Digital Innovation & AI

Privacy Policy

Last updated: 11 August 2026

1. Introduction

This Privacy Policy explains how Thunk Ltd. (“we”, “us”, “our”) collects and processes personal data when you use our website https://www.thunk.co (the “Website”) and any services we provide (the “Services”).
Our Website may include links to third-party websites. We are not responsible for their privacy practices and recommend you review their privacy notices.
If you have any questions about this Privacy Policy or how we use your personal data, contact hello@thunk.co.
You have the right to complain at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the opportunity to address your concerns first, so please contact us in the first instance.

2. Who we are

Data controller: Thunk Ltd.
Registered address: Eastside Building, Kings Cross, LONDON, N1C 4AX, UK
Privacy contact: Nicola McLundie — nicola@thunk.co
General enquiries: hello@thunk.co
We process personal data in accordance with applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018.

3. Personal data we collect

We may collect, use, store and transfer different kinds of personal data about you, including:
  • Identity Data: first name, last name, job title, company name.
  • Contact Data: email address, telephone number, business address.
  • Financial Data: bank account and payment card details (where required for Services).
  • Transaction Data: details of Services purchased and payments.
  • Technical Data: IP address, browser type and version, time zone setting, device and operating system information, and other technology on the devices you use to access the Website.
  • Usage Data: information about how you use the Website and Services.
  • Application Data: information you provide when applying for a role with us (see section 14).
  • Application Behaviour Data: measurements of how our application form is used (see section 14).
  • Marketing and Communications Data: your preferences in receiving marketing from us and your communication preferences.
  • Correspondence Data: information you provide when you contact us (for example by email or via a form).
We may also collect and use Aggregated Data (such as statistical or demographic data) for any purpose. Aggregated Data is not personal data where it does not identify you.
We do not intentionally collect special category data (such as information about health, race, ethnicity, religious beliefs, sexual orientation, or political opinions) or data about criminal convictions.

4. How we collect your personal data

We collect personal data from and about you through:
  • Direct interactions: when you contact us, submit forms, request information, subscribe to updates, apply for a role, or use or purchase Services.
  • Automated technologies: when you use the Website, we may collect Technical Data and Usage Data through cookies and similar technologies (see our Cookie Notice).
  • Third parties: we may receive personal data from third parties where relevant to Services or Website operations (for example, analytics or technical service providers).

5. How we use your personal data

We use personal data to:
  • provide and administer the Website;
  • respond to enquiries and communicate with you;
  • provide, manage and deliver Services (including project delivery, billing and payments);
  • manage our relationship with you, including customer support;
  • assess and respond to job applications (see section 14);
  • send marketing communications where permitted by law and in accordance with your preferences; and
  • maintain Website security, prevent fraud, and protect our legal rights.

6. Lawful bases for processing

We will only process your personal data where we have a lawful basis to do so, including:
  • Performance of a contract (where processing is necessary to provide Services, or to take steps at your request prior to entering into a contract — such as a job application);
  • Legitimate interests (where processing is necessary for our business interests, such as operating and improving the Website, responding to enquiries, running a fair and efficient recruitment process, and protecting our business);
  • Legal obligation (where we must comply with a legal or regulatory requirement); and
  • Consent (where required, for example for certain marketing communications or non-essential cookies).
Where we rely on consent, you can withdraw it at any time.

7. Marketing

If you receive marketing communications from us, you can opt out at any time by using the unsubscribe link (where provided) or by contacting hello@thunk.co.

8. Cookies

We use cookies and similar technologies. For information about what we use and how you can manage your preferences, please see our Cookie Notice.

9. Sharing your personal data

We may share personal data with:
  • service providers that help us operate the Website and provide Services (such as hosting, IT, email and analytics providers);
  • professional advisers (such as lawyers, insurers, and accountants);
  • authorities or regulators where we are required to do so; and
  • third parties in connection with a merger, acquisition, or sale of assets, where permitted by law.
We do not sell personal data.

10. International transfers

Where personal data is transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with applicable law.

11. Data security

We use appropriate technical and organisational measures to protect personal data. Access to personal data is limited to those who need it for business purposes and who are subject to confidentiality obligations.

12. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including for legal, accounting, or reporting requirements. In many cases, we retain customer and transaction records for up to 7 years after our relationship ends.
Job application data is kept for twelve months from submission and then deleted automatically (see section 14).

13. Your rights

You have rights under UK data protection law, which may include the right to:
  • request access to your personal data;
  • request correction of inaccurate or incomplete personal data;
  • request deletion of your personal data;
  • object to processing or request restriction of processing;
  • request transfer of your personal data (data portability); and
  • withdraw consent (where processing is based on consent).
To exercise your rights, contact hello@thunk.co.

14. Job applications

When you apply for a role with us through our Website, we collect and process the following personal data:
  • Application Data: your first name, last name, email address and telephone number; the links you choose to share and any notes you add about them; and your answers to the application questions.
  • Application Behaviour Data: measurements of how the application form is used, collected while you complete it. This includes the time spent on the form and on each question; how text arrives in each field (typed, pasted, or dropped, as counts and timings — never what you type or copy anywhere else); copy and paste events on the application pages and the time between them; typing rhythm (timings only, never which keys); switches away from the page and their duration; time spent reading our application guide; and the pages of our Website you visited in the thirty days before applying (recorded in your own browser, and only sent to us if you submit an application).
We explain this measurement in plain language on the application form itself and in our “how to apply well” guide before you start.
Why we process it. We use Application Data to assess your application and contact you about it. We use Application Behaviour Data to help us review applications fairly and to identify applications that were generated by automated tools rather than written by the applicant — this lets us give genuine applications the attention they deserve.
Automated scoring assists; people decide. Our systems give each application a score based on how the form was used. The score determines how our review is prioritised — it never determines the outcome. A human reads every application, and a human makes every decision, including any decision not to take an application forward. We also use AI tools to summarise application behaviour for our reviewers; these tools see measurements only, never your answers. If you believe the way you completed the form doesn’t reflect the effort behind your application — for example, because you use assistive technology or prefer to draft your answers elsewhere — you can tell us in the application form and a person will take it into account.
Lawful bases. We process this data to take steps at your request prior to entering into a contract (your application), and for our legitimate interests in running a fair, efficient recruitment process and protecting it from automated abuse.
Your browser, your draft. While you complete the form, a draft of your answers is saved in your own browser (never on our servers) so your work isn’t lost. A record of your submission time may also be kept in your browser to remind you that you applied. Both stay on your device, and both expire after thirty days.
Retention. Application Data and Application Behaviour Data are kept for twelve months from submission and then deleted automatically. To ask about your data or request its deletion sooner, contact hello@thunk.co.

15. Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects for individuals without human involvement. In our recruitment process, automated scoring is used to assist and prioritise human review, but every decision about an application is made by a person (see section 14). If this changes, we will provide additional information in an updated Privacy Policy.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page and the “Last updated” date will reflect the most recent changes.
We love Oceans