Privacy Policy
Last updated
This Privacy Policy explains how Common Thread Advisors collects, uses, shares, and protects personal information when you visit our website, download our reports, register for an event, contact us, or sign up for our newsletter. It applies wherever you are in the world, including the European Union, the United Kingdom, and the United States.
We've written this in plain language. Where we use a legal term that matters (like “legal basis” or “personal information”), we explain what it means.
This Policy covers our website only. Where we deliver advisory work for a client, such as staff interviews, culture or trust diagnostics, or anonymizing individual input into aggregate findings, that processing is governed by our data processing agreement or other terms agreed with that client, not by this Policy. Your organization is typically the controller in that context, and Common Thread processes data on its instructions. If you've been invited to take part in this kind of work by an organization we're advising, please refer to the information that organization has given you, or contact us for details of the specific arrangement.
1. Who we are
Common Thread Advisors operates as two related legal entities:
- Common Thread Advisors, a Delaware corporation, with its business address at 548 Leonard Street, Brooklyn NY 11222. USA (“Common Thread US”).
- Common Thread Advisors Limited, a company registered in Ireland, with its registered office at 3 Rocklands, Quarry Road, Shankill, Dublin, Ireland (“Common Thread Ireland”).
Common Thread US and Common Thread Ireland (together, “Common Thread,” “we,” “us,” or “our”) act as joint controllers of personal information collected through our website and related activities. Which entity leads on a given engagement (for example, invoicing) depends on where you or your organization are based, but both entities share responsibility for how your personal information is handled under this Policy.
If you have a question about which entity is responsible for a specific processing activity, contact us using the details in Section 14 and we'll clarify.
Our Partner, Strategy & Innovation is our designated privacy contact and can be reached at the email in Section 14.
2. Personal information we collect
We collect personal information directly from you, and a limited amount automatically when you use our website.
2.1 Information you give us directly
| When | What we collect | Why |
|---|---|---|
| Contact form | Name, email address, and the content of your message | To respond to your enquiry |
| Downloading a report or gated content | Email address (and sometimes name, job title, or company, depending on the form) | To send you the requested content and related follow-up |
| Event registration | Name, job title, company, email address | To register, manage, and communicate with you about the event |
| Newsletter sign-up | Name, email address, and sometimes job title, company, or phone number | To send you the newsletter and related updates |
| Any correspondence with us | Whatever you choose to include (e.g. email, phone) | To manage the relationship and respond appropriately |
Information you submit through our forms is stored in our CRM system (Zoho CRM), which we also use to send you the emails described above and to manage our relationship with you as a prospective client.
2.2 Information we collect automatically
We use PostHog in cookieless mode for website analytics. This means we don't set tracking cookies or build a persistent profile tied to you across sessions. We still receive limited technical and behavioral data, including:
- Pages viewed, time on page, and general navigation paths on our site
- Device and browser type, operating system, and approximate location (derived from IP address, which we do not store in identifiable form)
- Referral source (e.g. the site or search engine that brought you to us)
Because PostHog doesn't set cookies or persist anything across sessions, this doesn't require cookie consent under GDPR or the ePrivacy rules and generally doesn't constitute personal information. We're including it here for transparency. Full detail on cookies and similar technologies is in our separate Cookie Policy.
Our website is hosted on Vercel. Standard web server logs (IP address, timestamp, requested URL, user agent) are generated as part of normal hosting operation and retained briefly for security and performance troubleshooting.
2.3 Information from third parties
If you attend an event we co-host with a partner, or if someone at your organization refers you to us, we may receive your name, email address, and company/job title from that third party. We treat it the same way as information you give us directly.
3. How we use your information, and on what basis
Under GDPR, we need a valid “legal basis” for each way we use personal information. Here's how that maps to what we actually do:
| What we do | Why (purpose) | Legal basis (GDPR) |
|---|---|---|
| Respond to contact form enquiries | To answer your question or request | Legitimate interest (running our business responsibly) |
| Send requested reports or gated content | To fulfil your request | Legitimate interest / consent (where required by local law) |
| Manage event registration | To organize and run the event, and follow up afterward | Legitimate interest / contract (where the event has a fee) |
| Send newsletter and marketing updates | To keep you informed about our thinking and services | Consent (EU/UK, and where else required) or legitimate interest for existing business contacts, consistent with local law |
| Website analytics via PostHog | To understand how our site is used and improve it | Legitimate interest |
| Maintain security and prevent abuse | To protect our website and systems | Legitimate interest / legal obligation |
| Comply with law | Tax, accounting, regulatory requirements | Legal obligation |
| Manage enquiries and prospective client relationships via our CRM | To follow up on enquiries and manage business development | Legitimate interest (running our business responsibly) |
| Measure how our emails perform | To understand which emails are useful and improve them | Consent (EU/UK, and where else required) or legitimate interest, consistent with local law |
You can withdraw consent at any time (for example, by unsubscribing from the newsletter). This doesn't affect the lawfulness of anything we did before you withdrew it.
4. Who we share your information with
We don't sell your personal information. We share it only with the service providers who help us run Common Thread, and only for the purposes described in this Policy:
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| PostHog | Website analytics (cookieless) | Non-identifying usage and device data | United States |
| Sanity | Content management for our website | Content you submit through forms, where applicable | United States |
| Vercel | Website hosting and infrastructure | Server logs, technical data | United States |
| Google reCAPTCHA | Spam/bot prevention on forms | IP address, device and browser signals | United States |
| Zoho CRM | Collecting and managing form submissions and enquiries, and sending our emails to you | Name, email, job title, company, phone (where provided), and any message you submit | European Union (EU data center) |
We may also share personal information with: professional advisors (lawyers, accountants) under confidentiality obligations; a buyer or successor in the event of a merger, acquisition, or sale of assets; and law enforcement or regulators where we're legally required to.
5. International data transfers
Common Thread operates across the US and Europe, and our service providers may process data outside your home country, including in the United States. Where we transfer personal information from the EEA or UK to a country without an adequacy decision, we rely on one or more recognized safeguards:
- EU Standard Contractual Clauses (SCCs), and the UK International Data Transfer Addendum, where relevant, with our service providers; and/or
- Our providers' certification under the EU-U.S. Data Privacy Framework (DPF) and the UK Extension to it, where a provider holds that certification, as an alternative or additional safeguard.
You can request details of the specific safeguard that applies to a given provider by contacting us (Section 14).
6. How long we keep your information
We keep personal information only for as long as it's needed for the purpose we collected it, or as required by law (for example, tax and accounting records). When we no longer need it, we delete it or anonymize it. If you ask us to delete your information sooner and we have no legal or legitimate business reason to keep it, we will.
7. Your rights (EU, UK, and other jurisdictions with similar laws)
If GDPR or an equivalent law applies to you, you have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Request deletion (“right to be forgotten”), subject to legal exceptions
- Restrict or object to certain processing, including direct marketing
- Request a portable copy of information you gave us
- Withdraw consent at any time, where we rely on consent
- Lodge a complaint with a supervisory authority
To exercise any of these rights, contact us using the details in Section 14. For individuals in the EU, our lead supervisory authority is the Irish Data Protection Commission (dataprotection.ie), given our Dublin office, though you may also complain to the authority in your own country.
8. Your rights (California and other US states)
If you're a California resident, the CCPA/CPRA gives you the right to know what personal information we've collected about you, request deletion, correct inaccurate information, and opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information for cross-context behavioral advertising as those terms are defined under California law.
If you're a resident of another US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, or others as they take effect), we extend the same core rights to you: access, correction, deletion, and opt-out of targeted advertising or sale, to the extent applicable. We won't discriminate against you for exercising any of these rights.
To exercise a US state privacy right, contact us using the details in Section 14. We may need to verify your identity before acting on the request.
9. Cookies and similar technologies
Our use of cookies and comparable technologies (including PostHog's cookieless analytics) is covered in full in our separate Cookie Policy. In short: we've deliberately kept this to a minimum, and PostHog does not use tracking cookies.
10. Security and breach notification
We use reasonable technical and organizational measures to protect personal information, including access controls, encryption in transit, and vendor due diligence on the providers listed in Section 4. No system is completely secure, and we can't guarantee absolute security, but we take this seriously and review it regularly.
If a personal data breach occurs that's likely to pose a risk to your rights and freedoms, we'll notify the relevant supervisory authority (in most cases, the Irish Data Protection Commission) within 72 hours as required by GDPR, and we'll notify you directly where the breach poses a high risk.
11. Automated decision-making
We don't use your personal information for automated decision-making or profiling that produces legal or similarly significant effects on you.
12. Third-party links
Our website may link to third-party sites we don't control, including our clients' or partners' websites. We're not responsible for the privacy practices of those sites. Review their privacy policies before providing personal information.
13. Children's privacy
Our website and services are directed at business professionals and are not intended for children. We don't knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we'll delete it.
14. How to contact us
For any question about this Policy, or to exercise a right described above, contact us at:
- Email: julie.odonnell@commonthreadadvisors.com
- Post (Common Thread US): 548 Leonard Street, Brooklyn NY 11222
- Post (Common Thread Ireland): 3 Rocklands, Quarry Road, Shankill, Dublin, Ireland
We aim to respond to any rights request within one month. If your request is complex, we may need up to two further months, and we'll tell you why if so.
15. Changes to this Policy
We may update this Policy from time to time, for example as our services, tools, or the law change. We'll update the “last updated” date at the top when we do. If a change is material, we'll take reasonable steps to let you know, such as a notice on our site or, where appropriate, an email.