Privacy Policy

Last updated: 1/20/2026

1. Introduction

3AM Thoughts ("we", "our", or "us") is committed to protecting and respecting your privacy. This policy explains how we collect, use, and protect your personal information when you use our services, website (3amthoughts.co.uk), and the Positioned to Win program. We operate in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Personal Information

• Identity Data: name, title, company name
• Contact Information: email address, phone number, postal address
• Financial Data: payment card details (processed securely through our payment providers)
• Professional Information: business type, role, company size
• Technical Data: IP address, browser type, device information
• Usage Data: how you use our website and services
• Marketing Preferences: your preferences in receiving marketing from us

2.2 Automatically Collected Information

When you visit our website, we automatically collect:

• Technical information about your device and browser
• Your IP address and approximate location (country level)
• Pages you visit and features you use
• Referral sources and time spent on our website

3. How We Use Your Information

3.1 Primary Uses

• To provide and manage our services
• To process your payments and prevent fraud
• To communicate with you about your program
• To provide customer support and handle inquiries
• To send you important updates about our services

3.2 Marketing Communications

With your consent, we may use your information to:

• Send newsletters and educational content
• Inform you about new programs and services
• Share relevant business insights and updates
• Invite you to events and webinars

4. Legal Basis for Processing

We process your data under the following legal bases:

• Contract Performance: Processing necessary for the performance of our contract with you
• Legal Obligation: Processing necessary for compliance with legal obligations
• Legitimate Interests: Processing necessary for our legitimate business interests
• Consent: Processing based on your specific consent

5. Data Sharing and Transfers

We may share your data with:

• Payment processors (e.g., Stripe)
• Email service providers (e.g., SendGrid)
• Customer support platforms
• Analytics providers (e.g., Google Analytics)
• Professional advisers (e.g., lawyers, accountants)

6. International Transfers

We primarily process data within the UK and European Economic Area (EEA). When we transfer data outside these regions, we ensure appropriate safeguards are in place through:

• Standard Contractual Clauses
• Adequacy decisions by the UK Government
• Binding Corporate Rules

7. Data Security

We implement appropriate technical and organizational measures including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication
• Staff training on data protection
• Incident response procedures

8. Your Rights

Under the UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure of your data
• Restrict or object to processing
• Data portability
• Withdraw consent

9. Data Retention

We retain personal data for:

• Active customers: Duration of service plus 6 years (for tax purposes)
• Marketing data: Until consent withdrawal
• Prospective customers: 2 years from last interaction
• Financial records: 7 years (legal requirement)

10. Cookies and Tracking

We use cookies and similar technologies for:

• Essential website functionality
• Performance and analytics
• User preferences
• Marketing (with consent)

11. Changes to This Policy

We may update this policy periodically. Significant changes will be notified via email or website notice. Continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact Information

For any questions about this Privacy Policy or our data practices, please contact our Data Protection Officer:

13. Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO):