Privacy Policy

Thema Ltd ("the Company," "we," "us," or "our") (20 Cannon Street, Floor 6, London EC4M 7LS, United Kingdom) is the data controller for personal data processed through themahq.com under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains what data we collect, how we use it, and what rights you have.

Thema operates a private market intelligence platform. Our core service processes sector-level signals derived from UK regulatory filings, Companies House records, and employment data to produce structured target lists for private equity deal teams and corporate development groups. This policy reflects how that specific service handles personal data about the people who use it.

1. Data Controller

Thema Ltd (20 Cannon Street, Floor 6, London EC4M 7LS, United Kingdom) is the data controller for personal data processed through themahq.com under the UK GDPR and the Data Protection Act 2018. You can contact us at [email protected].

2. Personal Data We Process

When you use the Thema platform or contact us about it, we may process the following categories of personal data:

• Identity and contact data (name, work email address, phone number, employer or firm name);
• Account credentials and access-request information submitted through our early access programme;
• Communications content, including messages sent via [email protected];
• Technical data (IP address, browser type and version, device identifiers, pages visited, session duration);
• Analytics data collected with your prior consent, such as navigation patterns and feature usage within the platform.

Thema's sector intelligence outputs are derived from publicly available UK regulatory filings and employment registries. The underlying company records and director information processed as part of service operation may constitute personal data under UK GDPR where they relate to identifiable individuals (for example, named directors of private companies). We process such data on the basis of legitimate interests in operating an analytical service using public-record information.

3. Lawful Bases (Article 6 UK GDPR)

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Pre-contractual steps and performance of a contract, for handling access requests and providing the Service to subscribers;
• Legitimate interests, for operating and improving the platform, ensuring security, and processing public-record company and director data in the course of sector mapping;
• Legal obligation, for compliance with applicable law;
• Consent, for non-essential cookies and analytics, and for any direct marketing communications.

4. Recipients and International Transfers

We share personal data with processors under Article 28 contracts (for example, infrastructure and communications providers). Transfers to processors outside the United Kingdom are protected by the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy regulation, as applicable. We do not sell personal data to third parties.

5. Retention

We retain personal data only as long as necessary for the purposes described here. Specifically:

• Inquiry and access-request data is retained for 24 months after last contact;
• Account data is retained for the duration of the subscription and for 24 months after account closure;
• Server and access logs are retained for 90 days.

Anonymised or aggregated analytical data derived from platform usage may be retained indefinitely as it no longer constitutes personal data.

6. Your UK GDPR Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to personal data we hold about you:

• Right of access: you may request a copy of your personal data;
• Right to rectification: you may ask us to correct inaccurate data;
• Right to erasure: you may request deletion of your data where no overriding legitimate ground applies;
• Right to restriction of processing: you may ask us to limit how we use your data while a dispute is resolved;
• Right to data portability: you may request your data in a structured, machine-readable format where processing is based on consent or contract;
• Right to object, including to direct marketing without further conditions;
• Rights related to automated decision-making: we do not engage in automated decisions with legal or similarly significant effects.

To exercise any of these rights, email [email protected]. We will respond within one calendar month, extendable by a further two months for complex or multiple requests.

7. Right to Complain to the ICO

You have the right to lodge a complaint with the UK Information Commissioner's Office (the "ICO") if you believe we have not handled your personal data in accordance with UK data-protection law. The ICO's website is ico.org.uk; their helpline is 0303 123 1113. We would, however, welcome the opportunity to address your concerns before you contact the ICO. Please contact us at [email protected] first.

8. Cookies

See our Cookie Policy for full details. Non-essential cookies (analytics, preferences) are not set without your prior consent under the Privacy and Electronic Communications Regulations (PECR). Our cookie banner gives you the option to accept or reject non-essential cookies when you first visit the site.

9. Security and Changes

We implement technical and organisational measures appropriate to the risk, including encrypted transmission, access controls, and regular security reviews. If we make material changes to this policy, we will update the "Last updated" date above. We encourage you to review this policy periodically.

10. Contact

Thema Ltd
20 Cannon Street, Floor 6
London EC4M 7LS
United Kingdom
Email: [email protected]
Phone: +44 20 3927 5140