Legal
Privacy policy.
How ThinkShare collects, uses and protects personal data.
Last updated: 28 September 2026
This notice explains what personal information ThinkShare collects, why we collect it, who we share it with and how long we keep it. It covers people who use our website, contact us, work with us as clients or suppliers, or receive our marketing.
- Who we are
- What we collect, why, and our lawful basis
- Where we get personal information from
- Cookies
- Who we share information with
- Transfers outside the UK
- How long we keep information
- Your rights
- How to complain
Who we are
ThinkShare is the trading name of Think Share Limited, a company registered in Scotland under company number SC573384. We are the controller of the personal information described in this notice and we are registered with the Information Commissioner's Office (ICO) under reference ZA815375.
- Post: Think Share Limited, 8-10 Corn Exchange Road, Stirling, FK8 2HX
- Telephone: 01786 595 005
- Email: hello@thinkshare.co.uk
Please use these details for any question about this notice or to make a data protection request.
What we collect, why, and our lawful basis
Under UK data protection law we need a lawful basis for each thing we do with personal information. The table below sets out what we use, what for, and the basis we rely on. You can read more about lawful bases on the ICO's website.
| Purpose | Information | Lawful basis |
|---|---|---|
| Responding to enquiries made through our forms, chat, email or phone | Name, work email, phone number, company, job title and the content of your message | Legitimate interests, in that we need these details to answer you, or steps you have asked us to take before entering into a contract |
| Delivering projects and support to our clients | Names, work contact details and job titles of client staff, meeting notes and decisions, support tickets and project records | Contract, where you are our client. Legitimate interests, where we deal with you as a member of staff at a client organisation so that we can deliver the work your organisation has asked for |
| Invoicing, accounts and running our business | Names and contact details of client and supplier contacts, billing details, purchase and service history | Contract, and legal obligation for tax and accounting records |
| Sending news, events and insight by email | Name, work email, company, job title, marketing preferences, and whether our emails are opened and clicked | Legitimate interests for people at companies and other corporate bodies, with an unsubscribe link in every email. Consent for sole traders and partnerships, unless you are an existing client and the email is about similar services |
| Business development | Name, work email, company, job title and publicly available professional information about people in roles relevant to our services | Legitimate interests, in that we contact organisations who are likely to need Microsoft 365, SharePoint, intranet or Power Platform services. You can ask us to stop at any time |
| Website analytics, including session recordings | Pages visited, how you arrived at the site, device and browser details, approximate location from your IP address, and clicks and scrolls on the page | Consent, given through our cookie banner |
| Advertising and measuring our adverts on Google, Microsoft and LinkedIn | Cookie identifiers, pages visited and form submissions linked to an advert | Consent, given through our cookie banner |
| Keeping the website secure and working | IP address, browser details and your cookie choices | Legitimate interests, in that the site needs these to run and to remember what you have agreed to |
Where we rely on legitimate interests we have balanced our interest against yours, and you have the right to object at any time. Where we rely on consent you can withdraw it at any time, using the Cookie Settings button below for cookies or the unsubscribe link in any marketing email. We do not make decisions about you based solely on automated processing.
Where we get personal information from
- directly from you, when you fill in a form, use our chat, email or call us, or meet us at an event
- from your organisation, when it engages us and gives us the details of the people we will be working with
- from publicly available sources such as LinkedIn and company websites, and from business data providers, for business development
- from our website and advertising tools, when you have agreed to analytics or advertising cookies
Cookies
When you first visit the site a banner asks which types of cookie you are happy for us to use. Only necessary cookies are set until you make a choice, and if you decline we save one cookie to remember that. Google Analytics and Google Ads use Google Consent Mode, which means that until you accept they send limited information without setting cookies. Our banner also respects the Global Privacy Control signal if your browser sends one.
You can change your choice at any time:
The cookies below are the ones our site uses. Third parties can change the names and lifetimes of their cookies, so we check this list periodically.
Necessary
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| __hs_cookie_cat_pref | HubSpot | Records which cookie categories you have agreed to | 6 months |
| __hs_opt_out, __hs_do_not_track, __hs_initial_opt_in | HubSpot | Remember a decision not to be tracked and stop the banner reappearing | 7 days to 6 months |
| __hs_gpc_banner_dismiss, __hs_notify_banner_dismiss | HubSpot | Remember that you have dismissed a privacy notice | 180 days |
| __cf_bm, __cfruid, __cfuvid | HubSpot (Cloudflare) | Bot protection and rate limiting | Session to 30 minutes |
| hs-messages-is-open, hs-messages-hide-welcome-message | HubSpot | Remember whether the chat window is open and whether you have seen the welcome message | 30 minutes to 1 day |
Functionality
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| messagesUtk | HubSpot | Recognises you in our chat so that previous conversations load | 6 months |
Analytics
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| __hstc, hubspotutk | HubSpot | Recognise returning visitors and link website visits to a form submission | 6 months |
| __hssc, __hssrc | HubSpot | Count page views in a session and detect a new session | Session to 30 minutes |
| _ga, _ga_VG2J92VS8R | Google Analytics | Distinguish visitors and sessions for site statistics | 2 years |
| _clck, _clsk, CLID | Microsoft Clarity | Heatmaps and session recordings that show how people use our pages. Form fields are masked | 1 day to 1 year |
Advertising
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| _gcl_au | Google Ads | Measures whether a visit or enquiry came from one of our Google adverts | 90 days |
| IDE, test_cookie | Google (doubleclick.net) | Remarketing and advert measurement | 15 minutes to 13 months |
| _uetsid, _uetvid, MUID | Microsoft Advertising (Bing) | Measures visits and enquiries from our Microsoft adverts and builds remarketing audiences | 1 day to 13 months |
| li_sugr, bcookie, bscookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_fat_id | LinkedIn Insight Tag, used to measure our LinkedIn adverts and build audiences | 1 day to 1 year |
Who we share information with
We do not sell personal information. We share it with the following, who process it on our behalf under contract or, where they act as a separate controller, under their own privacy terms:
- HubSpot, for our website, forms, chat, CRM and marketing email. Our HubSpot account is hosted in HubSpot's EU data centre
- Microsoft, for email, documents and Teams (Microsoft 365), Microsoft Clarity and Microsoft Advertising
- Google, for Google Analytics and Google Ads
- LinkedIn, for LinkedIn advertising
- providers of email outreach, business data, project management and accounting software that we use to run the business
- our professional advisers, such as our accountants, lawyers and insurers
- Microsoft and intranet product partners, where you are a client and the project needs their involvement
- law enforcement, regulators or courts, where the law requires it
Transfers outside the UK
Some of the providers above, in particular Google, Microsoft and LinkedIn, and some of HubSpot's sub-processors, process information in the United States or elsewhere outside the UK. Where they do, the transfer is covered by the UK Extension to the EU-US Data Privacy Framework, the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more detail using the contact details above.
How long we keep information
We keep personal information only for as long as we need it for the purpose it was collected for.
| Information | Purpose | How long we keep it |
|---|---|---|
| Contact form and chat enquiries | Responding to enquiries | 12 months from our last contact, unless you become a client |
| Marketing email subscriptions | Marketing communications | Until you unsubscribe, plus 6 months. We keep your email address on a suppression list after that so that we do not contact you again |
| Client account and project data | Service provision | For the duration of the account, plus 6 months |
| Invoices and financial records | Tax and accounting | 6 years, as HMRC requires |
| Website analytics data | Site performance and user experience | Up to 18 months in our reporting tools. Cookie lifetimes are listed in the cookie tables above |
Your rights
You have the following rights. Some only apply to certain lawful bases, and there are exemptions, which the ICO's website explains.
- Access, to ask for a copy of your personal information and details of where we got it and who we share it with
- Rectification, to ask us to correct information that is inaccurate or incomplete
- Erasure, to ask us to delete your information
- Restriction, to ask us to limit how we use your information
- Objection, to object to us using your information on the basis of legitimate interests, and to stop direct marketing at any time
- Portability, to ask us to pass information you gave us to you or another organisation. This applies where we rely on consent or contract
- Withdrawing consent, at any time where consent is our basis. This does not affect anything we did before you withdrew it
To make a request, contact us using the details at the top of this notice. We will respond without undue delay and within one month.
How to complain
If you have a concern about how we use your personal information, please contact us first using the details at the top of this notice and we will try to put it right.
Changes to this notice
We update this notice when we change what we collect or the tools we use. The date at the top shows when it was last changed.