Thanex Privacy Policy

1. Purpose and Scope

1.1 Thanex Ltd, referred to in the Privacy Policy as “Thanex,” “we,” “us,” or “our,” respects the privacy of every person whose personal data is processed through its website, mobile applications, web application, Personal Workspaces, Business Workspaces, Projects, Tasks, communications, and related services.

1.2 The Privacy Policy, referred to as the “Policy,” explains how personal data is collected, received, recorded, organised, stored, used, disclosed, transferred, retained, exported, and deleted. It also distinguishes the data for which Thanex acts as controller from the Project Content that Thanex processes on behalf of a Business Customer.

1.3 The Policy applies to the website at https://thanex.uk, the web application at https://app.thanex.uk, the Thanex mobile applications, Accounts on every plan including Free, Personal Workspaces and Business Workspaces, Projects, Tasks and the people who supply photographs through them, Reports and the photograph links in them, invitations and member search, subscription and support communications, and authorised third-party sign-in services.

1.4 Use of the Service is also governed by the Thanex Terms and Conditions. Where Thanex processes Project Content for a Business Customer, the Thanex Data Processing Addendum, published at https://thanex.uk/data-processing-addendum/, applies in addition to the Policy.

1.5 Artificial-intelligence analysis of Project Content and automated integration through the Model Context Protocol are not part of the Service as at the date at the head of the Policy. No provider of artificial-intelligence services receives Project Content, and no processing of that kind is described in the Policy because none is carried out. Should either be introduced, the Policy will be revised and notice will be given before the functionality becomes available.

2. Identity and Contact Details

2.1 Thanex Ltd is a private limited company incorporated in England and Wales under company number 16426957. It is registered with the Information Commission’s Office under registration number ZC007423.

2.2 The registered office is at Flat 11, Mill Pond Place, Mill Lane, Maidstone, England, ME14 1GL, United Kingdom.

2.3 Questions, rights requests, objections, and data-protection complaints may be sent to [email protected].

2.4 No statutory Data Protection Officer has been appointed, because the core activities of Thanex do not involve regular and systematic monitoring of data subjects on a large scale, nor large-scale processing of special-category data, within the meaning of Article 37 of the UK GDPR. Privacy matters are supervised by the responsible management of Thanex, and the position will be reviewed as the Service and its processing scale develop.

2.5 The representatives designated by Thanex for the European Union and for the Republic of Albania are identified, together with their contact details, in clause 3.4 and clause 26.3.

3. Applicable Data-Protection Legislation

3.1 Thanex is established in England and complies principally with the United Kingdom General Data Protection Regulation, referred to as the “UK GDPR,” the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, referred to as “PECR,” and the amendments made to each of them by the Data (Use and Access) Act 2025.

3.2 The data-protection provisions of the Data (Use and Access) Act 2025 have been commenced in stages. Section 112, which amends PECR and inserts the new Schedule A1 of consent exceptions, came into force on 5 February 2026. Section 103, which introduces the complaints duties described in clause 22, came into force on 19 June 2026.

3.3 Thanex is available internationally. Where the Service is offered to persons in the European Economic Area, Regulation (EU) 2016/679, referred to as the “EU GDPR,” also applies under Article 3(2). The official text is available at https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng. Clause 26 sets out the further information that applies to persons in the European Economic Area, Albania, the United States, and Australia.

3.4 Article 27 of the EU GDPR requires a controller or processor that is not established in the Union, and that offers services to persons within it, to designate in writing a representative in a Member State in which those persons are, unless the processing is occasional and meets the other conditions of Article 27(2). The Service is provided continuously, so that exception does not apply. Thanex has designated as its representative in the European Union Bajram Thana, Ellispontou 20, Evosmos, 56224 Thessaloniki, Greece. Supervisory authorities and data subjects may address the representative, in addition to or instead of Thanex, on any issue relating to the processing of personal data described in the Policy, and every communication received by the representative is passed to Thanex for a response.

3.5 Mandatory rights under applicable national law continue to apply even where they give greater protection than the Policy describes.

4. Controller and Processor Roles

4.1 Responsibility for personal data depends on the context in which it is processed, and on the Workspace in which the record sits.

4.2 Thanex acts as controller for Account registration, authentication administration, subscription status and entitlement records, support and complaints, Service security, marketing preferences, analytics configuration, legal compliance, and its own operational records. Thanex determines why and how that data is processed.

4.3 A company, employer, contractor, partnership, sole trader, or other organisation acts as controller for Project Content created or maintained within its Business Workspace. The Business Customer decides which Projects and Tasks are created, who may take part, what may be captured, which stamp fields are enabled, how long the records are needed, and how they may be used.

4.4 When Thanex stores, displays, organises, transmits, exports, or deletes Business Workspace Project Content according to the instructions of a Business Customer, Thanex acts as processor under Article 28 of the UK GDPR or of the EU GDPR, on the terms of the Thanex Data Processing Addendum.

4.5 The User holding the technical owner role over a Business Workspace is not, by virtue of that role, the controller. Where the owner role passes between authorised representatives of the same organisation under a workspace ownership transition, the controller does not change and the records remain those of the organisation.

4.6 Within a Personal Workspace, whether on Free or on Professional, Thanex acts as controller for Service administration. Where the User uses the Personal Workspace for a trade, business, or profession, the User is the controller of the Project Content held there and Thanex acts as processor on the terms of the Thanex Data Processing Addendum. The individual remains responsible for establishing lawful authority to capture information about other people.

4.7 A person seeking access to, correction of, or deletion of Business Workspace Project Content should approach the Business Customer that controls the relevant Workspace. Thanex will assist that Business Customer to the extent required by law and by the Data Processing Addendum.

4.8 Limited Project Content may be processed by Thanex as an independent controller where that is necessary to investigate fraud, to answer a binding legal demand, to protect the Service, to establish or defend legal claims, or to comply with a statutory duty. Processing of that kind is confined to the applicable purpose.

5. Categories of Personal Data Collected

5.1 Account and identity data comprises the full name, the email address, the Account identifier, profile information, the job title, the authentication method, password credentials held in protected form where email registration is used, and confirmation of Account status.

5.2 Social sign-in data comprises the provider identifier, name, email address, authentication token, and other information authorised by the User or supplied by Apple, Google, or Microsoft.

5.3 Workspace and employment data comprises the company or organisation name, job title, workplace role, Business Workspace membership, invitation status, administrative permissions, Project assignments, and the relationship between a User and a Business Workspace.

5.4 Project and Task data comprises the Project name and identifier, the record type, the project tags chosen by a User, the assigned Users, the creation date, the live or completed state, the description, photographs, due date, and recipients of a Task, the replies sent to it and the decision to accept a reply or send it back, and the associated activity.

5.5 Photographs comprise the images captured or uploaded through the Service. Photographs may show people, workplaces, construction sites, property, equipment, vehicles, identification marks, defects, incidents, safety matters, or anything else the person capturing them selects.

5.6 Stamped and structured photograph data comprises the record type, the Project, the company, the member name, the member job title, the date and time, the project tags, the note, the GPS coordinates where available, the Photo ID, and the Thanex watermark. The enabled fields are applied to the image, and the corresponding structured values are retained separately in the Thanex data model, as clause 9 explains.

5.7 Location data comprises GPS coordinates supplied by a device when location permission has been enabled, together with locations selected or entered manually. Capture remains available without GPS where the device and application configuration permit.

5.8 Activity and audit data comprises Account access, invitations, Project and Task activity, captures, uploads, downloads, exports, deletions, role changes, ownership transitions, plan changes, administrative actions, notification events, and security-related records.

5.9 Device and technical data comprises the device type, operating system, application version, browser type, IP address, approximate network-derived location, language, time zone, diagnostic data, error reports, request times, session identifiers, and security logs.

5.10 Subscription and entitlement data comprises the plan and size held by the Account, the billing period, the subscription status, the renewal and expiry dates, the Store used, the transaction identifier, and the entitlement history. Thanex does not receive or store payment-card credentials, because paid subscriptions are sold through the Apple App Store and Google Play.

5.11 Support and communications data comprises emails, support requests, complaint details, correspondence, attachments, survey responses, and information supplied when a person contacts Thanex.

5.12 Marketing and preference data comprises newsletter registration, marketing consent, communication preferences, campaign engagement, unsubscribe status, and the records needed to respect an objection or a withdrawal.

5.13 Website and analytics data comprises pages viewed, referral source, browser and device type, approximate country, and page-load performance collected through Cloudflare Web Analytics.

5.14 Special-category data and criminal-offence data are not intentionally requested. A photograph may nevertheless contain information of that kind because of what a User chooses to capture, and a Business Customer must therefore determine whether such information may appear in its Projects and, if so, identify an appropriate condition under Article 9 of the UK GDPR, Schedule 1 to the Data Protection Act 2018, or other applicable legislation.

5.15 Report data comprises the name of each Report, the photographs selected for it, the actions and comments written in it, the copy of each photograph’s details taken when the Report was made, the identity of the User who made it, and the date on which it was made.

5.16 The details that the registration form marks as required, which include the full name and the email address, are needed to create an Account, and an Account cannot be created without them. Location data, notes, and the other optional details are a choice, and declining them does not stop the Service from working, although the record then lacks those details. No law requires a person to provide personal data to Thanex.

6. Free, Professional, and Business Workspace Processing

6.1 Every Account receives one Personal Workspace, whose features follow the plan held by the Account. Personal data is processed in the same way on every plan, and the plan governs what the User may do rather than what Thanex collects. A Personal Workspace has no members, so no other User is given access to it.

6.2 On Free, one Project may be live, the standard Thanex stamp is applied without a User-selectable configuration, and Tasks are unavailable. Completed Projects, their photographs, and their Reports remain available through the web application, where the User may download the photographs.

6.3 On Professional, the User selects the stamp fields and creates Tasks, including Tasks sent by link to people without an Account. Selecting an additional stamp field causes more personal data to be written into each image, and clause 9 describes the consequence.

6.4 Within a Business Workspace, the personal data of members is processed so that the organisation can operate the Workspace: the name and job title are shown to other members, activity is attributed to the member who performed it, and administrative records show who invited whom and when. The Dashboard and Activity pages of the web application show how many photographs were taken in each Project and by each member on each day. Thanex does not rank members or set targets. The Business Customer decides how that information is used within the organisation and is responsible for telling its workers about it.

6.5 A User who belongs to a Business Workspace and also holds a Personal Workspace has the two kept separate. Project Content captured in a Business Workspace is not visible in the Personal Workspace, and the reverse is equally true. Joining a Business Workspace gives the organisation no access to the individual’s personal Projects.

6.6 Where a Business Workspace enters View-Only Mode, the personal data within it continues to be held under clause 18 until the Owner holds a Business plan again or deletes the Workspace.

6.7 A person who accepts an invitation without already holding an Account receives one on completing registration, and the Personal Workspace described in clause 6.1 is created at the same moment on the Free plan. Creation of that Workspace gives the inviting organisation nothing. The organisation obtains no access to it, no Project created within it is visible to the organisation, and no payment is asked of the individual in order to take up the invitation.

6.8 Photographs and records created while a device has no connection are held in the storage of the mobile application on that device until they are uploaded. The application may keep a cached copy afterwards so that the gallery can be shown without downloading it again.

7. People Who Supply Photographs Through a Task

7.1 A Task allows an authorised User to ask for work to be done on a Project and to receive photographs of the result, whether from a member of the Workspace or from a person who holds no Account, referred to in the Policy as a Contributor. Thanex issues a link, and the recipient uses it to see the Task and to capture or upload photographs into the Project identified in it.

7.2 Personal data processed in connection with a Contributor comprises the photographs supplied, the date and time of the upload, technical information about the device and the connection used, any name, note, or description that the Contributor chooses to enter, and location data where the Contributor’s device supplies it and the Contributor permits it. Where the request is sent by email, the recipient address is also processed.

7.3 A short privacy notice is displayed on the upload page before any photograph is supplied. It identifies Thanex, names the organisation that created the request, explains what will be collected, and links to the Policy.

7.4 The organisation that created the Task, or the individual User where it was created in a Personal Workspace, is the controller of the resulting Project Content, and Thanex acts as its processor. A Contributor who wishes to exercise a right of access, rectification, erasure, restriction, or objection should therefore approach that organisation, whose identity is shown on the upload page.

7.5 A Contributor may also write to [email protected], and Thanex will pass the request to the controlling organisation, confirm to the Contributor that it has done so, and assist the organisation as required by law.

7.6 A Contributor acquires no access to the Project, to the Workspace, or to material supplied by anyone else, and receives no marketing from Thanex as a result of the upload.

7.7 A Task link expires thirty days after issue, or when the request is closed or revoked, whichever occurs first. Once the link has expired, no further upload can be made through it.

8. Invitations and the Find Thanex User Lookup

8.1 An administrator of a Business Workspace may invite a person by searching within the application, by email address, by shareable link, or by QR code.

8.2 The Find Thanex User function finds a registered User only when that User’s full email address is typed exactly, and then shows that User’s full name and job title. It does not search by name, it does not suggest or complete partial addresses, nothing further is displayed, no list of users can be browsed, and the function is reached only from the member-invitation flow of a Business Workspace.

8.3 The purpose is narrow: an administrator confirms that the correct person is about to be invited, which prevents an invitation and, with it, access to workplace photographs from being sent to the wrong recipient. The lawful basis is the legitimate interest of Thanex and of the inviting organisation in accurate and secure access administration, under Article 6(1)(f). A balancing assessment has been carried out, and the safeguards described in clause 8.4 form part of it.

8.4 The safeguards are as follows. A User can be found only by someone who already knows that User’s full email address, so the function cannot be used to discover addresses or to browse users. Access is restricted to Users holding invitation permissions within a Business Workspace. Using the function to check addresses other than those of people being invited is treated as misuse and may lead to withdrawal of access to it.

8.5 The function is not a public directory. A person who registers with Thanex is not published, is not made searchable to the general public, and is not made searchable to Users without invitation permissions.

8.6 A registered User who objects to appearing in the lookup may write to [email protected] under Article 21, and the objection will be assessed on its merits against the interests described in clause 8.3.

8.7 An invitation shows the recipient the organisation issuing it, the identity of the inviter, and the Projects to which access is offered. Access begins only on acceptance, a recipient may decline, and a pending invitation is preserved through registration where the recipient has no Account yet. An invitation may be revoked by an administrator and expires automatically. Notice that an invitation is waiting reaches the recipient as an in-application message and, where notification permission has been given, as a push notification.

9. Photographs, the Thanex Stamp, and Location Data

9.1 A photograph may carry a stamp composed of the fields enabled for the Workspace, listed in clause 5.6. The enabled fields are applied to the exported image and, once applied, cannot ordinarily be edited or removed from it.

9.2 Thanex separately retains the corresponding structured field values in its data model, so that records can be searched, filtered, displayed, permissioned, and exported without reading them from the image.

9.3 Stamping carries a privacy consequence that a database field does not. A member name, a job title, a company, a precise timestamp, a workplace location, and a set of GPS coordinates written into the image travel with every copy of the file afterwards sent, printed, or published. A photograph forwarded to a client, an insurer, a subcontractor, or a public authority therefore discloses who took it, where, when, and for whom, whether or not the recipient needed to know. Combining a person’s name with a precise place and time also permits a record of that person’s movements to be reconstructed from a set of images.

9.4 Business Customers decide which stamp fields are enabled and are responsible for giving the workplace notices that their own obligations require, for informing workers, visitors, contractors, and clients where photography and location recording are carried out, and for limiting the enabled fields to what the documentation of the work genuinely requires. On Free, the standard stamp is applied and the selection cannot be changed by the User.

9.5 Camera access is required for capture. Location permission is optional unless the controlling organisation makes location recording part of its own work procedure, and it may be changed at any time in device settings.

9.6 The personal photograph library held on a device is neither read nor imported. A User may choose particular photographs from the device to upload to a Task, and only the photographs chosen are read. Photographs can be added to a Project only by taking them in the Service or by uploading them to a Task, in the application or through a Task link. An uploaded photograph is not stamped. It is labelled as uploaded and carries the Project, the project tags, the Task, the date of upload, and the person who uploaded it. Where a save-to-device function is offered, access is limited to writing the selected file to the device gallery.

9.7 Because an applied stamp cannot be edited, correcting an inaccurate record may require an explanatory entry or a replacement capture rather than alteration of the original file. The structured values held under clause 9.2 can be corrected, so a request for rectification is answered in substance even where the image file itself cannot be changed.

9.8 Each photograph in a Report carries a link that opens that photograph, with its details, for anyone who has the link, without a Thanex Account. The link cannot be found by typing a Photo ID and opens only the photograph concerned. Anyone to whom a Report is sent or forwarded can therefore open the photographs in it, so a User should send a Report only to people entitled to see them.

9.9 A Report that has been made does not change afterwards. It keeps a copy of the details of each photograph as they stood when it was made, and writing an action in a Report does not change the note held on the photograph. A Report is deleted with the Project, the Workspace, or the Account that holds it.

10. Push Notifications and Service Messages

10.1 Push notifications are sent through Expo, operated by 650 Industries, Inc., which passes them to the notification services operated by Apple and by Google. Expo stores the device’s push token and handles the content of a notification only for as long as it takes to send it. Apple and Google receive a device token and the minimum information needed to route the message.

10.2 Notifications concern Task activity, invitations, Project activity, Account security, subscription and entitlement events, and material changes to the Service. Communications of that kind are service messages rather than marketing.

10.3 Notification permission is requested when the application is first used and may be withdrawn at any time within the application or in device settings. Withdrawal stops the delivery of push notifications and does not stop the service emails required to administer the Account.

11. Subscription Data, the Stores, and RevenueCat

11.1 Paid subscriptions are sold through the Apple App Store and Google Play. The merchant of record depends on the country of the Store account, and that entity acts as controller for the payment relationship under its own privacy notice.

11.2 Thanex receives from the relevant Store the information needed to grant and administer access, comprising the subscription status, the plan, the billing period, the renewal and expiry dates, and a transaction identifier. Payment-card numbers, expiry dates, and security codes are not received.

11.3 RevenueCat, Inc. is engaged by Thanex to administer subscription status and to map a Store purchase to the entitlements granted within the Service. It acts as processor on the instructions of Thanex under its Data Processing Addendum, and it is not the merchant of record.

11.4 The information processed by RevenueCat may comprise the Thanex application user identifier, device and technical information, Apple receipt information, Google purchase tokens, transaction identifiers, product information, subscription status, expiry and renewal information, and entitlement history. RevenueCat does not receive the complete payment-card details of a User, which remain with the Store and its payment providers.

11.5 RevenueCat stores the data on infrastructure operated by Amazon Web Services in the United States, and the transfer safeguards described in clause 16 apply to it.

11.6 On a workspace ownership transition, RevenueCat may move an entitlement between Thanex user identities. The operation moves a record of access. It does not move the Store purchase, the billing contract, or the payment method between people.

11.7 Aggregated payout and transaction reports supplied by each Store are retained as accounting records, as described in clause 18.7.

12. Sources of Personal Data

12.1 Personal data may be obtained directly from the person who registers, subscribes, contacts Thanex, or uses the Service; from an organisation that invites, registers, or administers a User; from another authorised User who captures or annotates Project Content; from a Contributor who uploads through a Task link; from Apple, Google, or Microsoft when social sign-in is used; from Apple, Google, or RevenueCat in connection with a subscription; automatically from a device, browser, application, server, or security system; from analytics, email, hosting, notification, and infrastructure providers; and from public authorities, professional advisers, or public records where that is required for legal, security, or dispute purposes.

12.2 An organisation may supply a User’s name, email address, job title, role, or Project assignment before that User has registered. The information is used to issue the invitation, to administer authorised access, and to maintain the records of the organisation.

13. Purposes and Lawful Bases

13.1 Article 6 of the UK GDPR and, where it applies, of the EU GDPR requires a lawful basis for every processing operation.

13.2 Account creation and authentication rest on Article 6(1)(b), because the processing is necessary to enter into and perform the contract for the Service. Security checks applied during authentication also rest on the legitimate interests of Thanex under Article 6(1)(f). The basis is the same on Free as on a paid plan, because a Free Account is supplied under the same contract.

13.3 Delivery of the Service, meaning the capture, storage, organisation, retrieval, display, sharing, and export of photographs, notes, locations, timestamps, roles, and activity records, rests on Article 6(1)(b) so far as concerns the direct relationship between Thanex and a User. Where Thanex acts as processor for a Business Workspace, the controlling Business Customer determines the applicable basis.

13.4 Administration of a Business Workspace, covering invitations, membership, permissions, role assignments, ownership records, and ownership transitions, rests on contractual necessity and on the legitimate interests of Thanex in operating secure business services.

13.5 The Find Thanex User lookup rests on legitimate interests, as clause 8.3 explains, and is confined by the safeguards in clause 8.4.

13.6 Processing of Task uploads rests on the lawful basis identified by the controlling organisation, which will ordinarily be its own legitimate interests in obtaining a record of work. Thanex processes the upload on that organisation’s instructions.

13.7 Location functions rest on the basis identified by the controlling organisation for workplace location processing. Device permission grants technical access to the coordinates and does not, by itself, establish a lawful basis under data-protection law.

13.8 Subscription and entitlement administration, including the processing carried out through RevenueCat, rests on Article 6(1)(b) for the performance of the contract, on Article 6(1)(c) for statutory accounting duties, and on Article 6(1)(f) for the prevention of payment fraud and the correct allocation of entitlements between Workspaces.

13.9 Service notifications, whether sent by email or delivered as push notifications, rest on contractual necessity or on legitimate interests, because they concern invitations, Task and Project activity, security events, entitlement events, and material changes to the Service.

13.10 Customer support rests on contractual necessity and on legitimate interests in answering enquiries, investigating faults, and resolving complaints.

13.11 Security and abuse prevention rest on legitimate interests and, where relevant, on legal obligations, and may involve examination of technical records, IP addresses, authentication events, and audit logs.

13.12 Legal and regulatory compliance rests on Article 6(1)(c), and the establishment, exercise, or defence of legal claims rests on Article 6(1)(f).

13.13 Website analytics are provided by Cloudflare Web Analytics, which stores nothing on a visitor’s device, and rest on the legitimate interest of Thanex in understanding how its website is used. Non-essential technologies that store or read information on a device are activated only where valid consent has been obtained or a statutory exception under Schedule A1 to PECR applies.

13.14 Marketing rests on consent or, where the law permits, on the existing-customer exception in regulation 22 of PECR. Every marketing email offers a means of unsubscribing, and withdrawal does not affect processing lawfully carried out beforehand.

13.15 The Data (Use and Access) Act 2025 introduced a further basis, the recognised legitimate interests set out in Article 6(1)(ea) and Annex 1 to the UK GDPR, which came into force on 5 February 2026. Thanex does not presently rely on it, and any future reliance will be recorded in the Policy before the processing begins.

13.16 Legitimate interests are used only after the purpose, the necessity, and the effect on individuals have been considered. A person may object to processing based on Article 6(1)(f), as explained in clause 21.

14. Automated Decision-Making

14.1 Thanex does not make decisions producing legal effects, or similarly significant effects, solely by automated processing within the meaning of Article 22 of the UK GDPR or of the EU GDPR.

14.2 Analytics, security signals, search tools, classification by record type, and automated technical checks assist human decisions and the operation of the Service. They are not used to determine employment rights, creditworthiness, legal status, or comparable matters without meaningful human involvement.

14.3 The automatic consequences that follow the end of paid access, namely the move of a Personal Workspace to Free and the entry of a Business Workspace into View-Only Mode, follow the terms of the contract and the User’s own cancellation. They involve no evaluation of the person concerned.

14.4 Monitoring of aggregate consumption on a Business Workspace measures storage volume, upload volume, request rates, and, on Business Unlimited, the number of Live Projects. The number of members is not a monitored measure, no content is inspected, and any consequence follows a written notice and a human decision, as clause 14 of the Terms and Conditions describes.

15. Sharing and Recipients

15.1 Owners, administrators, and authorised members of a Business Workspace may access Project Content according to the permissions assigned to them. Anyone who receives a Report can open the photographs linked from it, as clause 9.8 explains.

15.2 Amazon Web Services hosts the application, its database, and its logs, and stores photographs in Amazon S3, in each case in its London region in the United Kingdom. It also processes photographs with AWS Lambda to apply the stamp and to prepare downloads, and delivers them through Amazon CloudFront, which may hold copies briefly at edge locations outside the United Kingdom.

15.3 Apple, Google, and Microsoft support sign-in where a User selects it.

15.4 Apple and Google process subscription payments, refunds, and the associated fraud checks, and operate the push-notification services described in clause 10.

15.5 RevenueCat, Inc. processes the subscription and entitlement information listed in clause 11.4 on the instructions of Thanex.

15.6 Cloudflare, Inc. processes website usage information through Cloudflare Web Analytics in order to measure visits to https://thanex.uk.

15.7 No marketing platform receives personal data from Thanex at present.

15.8 Plus Five Five, Inc. (Resend) sends the emails that the Service generates, including sign-in, invitation, Task, and Account emails. It receives the recipient’s email address, the content of the message, and delivery information, and acts as processor on the instructions of Thanex. Google LLC provides the Google Workspace email service through which Thanex sends and receives support correspondence at [email protected], and processes those messages as processor under the Google Workspace data processing terms.

15.9 Lawyers, accountants, auditors, insurers, and consultants may receive information where that is necessary and subject to professional or contractual confidentiality.

15.10 Personal data may be disclosed where required by law, by a court order, by a regulatory demand, or by a valid law-enforcement request.

15.11 Prospective purchasers, investors, lenders, and their advisers may receive limited information during a financing, restructuring, merger, or sale, subject to confidentiality and lawful safeguards.

15.12 Thanex does not sell personal data and does not disclose it to unrelated third parties for their own advertising in exchange for payment.

15.13 Service providers are appointed under contracts requiring confidentiality, security, purpose limitation, and compliance with Article 28 where that Article applies.

16. International Transfers

16.1 Thanex is established in the United Kingdom, and certain suppliers process data in the United States, in the European Economic Area, or elsewhere. RevenueCat, Inc., Plus Five Five, Inc. (Resend), 650 Industries, Inc. (Expo), and Google LLC are the providers whose processing most commonly involves a transfer outside the United Kingdom. The database and the photographs are stored in the United Kingdom.

16.2 A restricted transfer is made only where a lawful transfer mechanism is available. Depending on the destination and the provider, Thanex relies on United Kingdom adequacy regulations, on an adequacy decision adopted under Article 45 of the EU GDPR, on the United Kingdom International Data Transfer Agreement, on the United Kingdom Addendum to the Standard Contractual Clauses of the European Commission, on those Standard Contractual Clauses, on the UK Extension to the EU-US Data Privacy Framework or, for data subject to the EU GDPR, on the EU-US Data Privacy Framework itself, where the United States recipient holds a valid certification covering the relevant data, or on a limited statutory derogation where the law permits.

16.3 The transfer of subscription and entitlement data to RevenueCat, Inc. in the United States is made under the Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum contained in the RevenueCat data processing addendum.

16.4 Transfers of personal data from the European Economic Area to the United Kingdom are covered by the adequacy decisions adopted by the European Commission in respect of the United Kingdom, which were renewed on 19 December 2025 and which run until 27 December 2031 subject to review.

16.5 Transfer-risk assessments and supplementary contractual, organisational, or technical measures are applied where they are required. Information about a particular transfer safeguard may be requested through [email protected], subject to the protection of confidential and security-sensitive terms.

16.6 Plus Five Five, Inc. (Resend) stores data in the United States, and the transfer is made under the UK Extension to the EU-US Data Privacy Framework, under which Plus Five Five, Inc. (Resend) is certified, and under the Resend data processing addendum. 650 Industries, Inc. (Expo) processes push tokens in the United States under the UK Extension to the EU-US Data Privacy Framework. Google LLC may process support correspondence in the United States and elsewhere, and the transfer is made under the UK Extension to the EU-US Data Privacy Framework, under which Google LLC is certified, and under the Google Cloud Data Processing Addendum. Processing by Amazon Web Services outside the United Kingdom, including AWS Lambda and copies held briefly by Amazon CloudFront, is covered by the transfer safeguards in the Amazon Web Services data processing addendum.

17. Security Measures

17.1 Technical and organisational measures are applied with the object of protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

17.2 The measures include encrypted network transmission, cloud-access controls, role-based permissions, protected credentials, logging, provider due diligence, backup controls, software maintenance, access reviews, and incident-response procedures.

17.3 No internet-based service can offer an absolute guarantee of security. Users must keep credentials secure, protect their devices, install relevant updates, use the available access controls, and report a suspected compromise promptly.

17.4 A personal-data breach is assessed under Articles 33 and 34 of the UK GDPR or of the EU GDPR. Where notification is legally required, the competent supervisory authority will be notified without undue delay and, where feasible, within seventy-two hours of Thanex becoming aware of the breach. Affected individuals will be informed where the breach is likely to create a high risk to their rights and freedoms.

18. Retention Periods

18.1 Personal data is retained only for as long as it is reasonably required for the applicable purpose, contractual obligation, legal duty, security requirement, or legal claim.

18.2 Account information is retained while the Account remains active. Where a User deletes the Account, the treatment described in clause 19 applies and no general retention period is added.

18.3 Personal Workspace Project Content is retained while the Account exists. A move from Professional to Free completes Projects and deletes nothing, so the retention period is unchanged by the move.

18.4 Business Workspace Project Content is retained while the Workspace remains active and until an authorised deletion instruction is carried out. Retention beyond that point is determined by the controlling Business Customer.

18.5 Where paid Business access ends, the Business Workspace enters View-Only Mode and its Project Content is retained, without a fixed end, until the Owner holds a Business plan again or deletes the Workspace.

18.6 A deleted User’s name, role, timestamp, or activity may remain attached to the records of a Business Workspace where that is necessary to preserve the integrity of workplace documentation and the Business Customer has a lawful basis for retaining it.

18.7 Accounting records, comprising subscription status, plan history, Store transaction identifiers, entitlement history, and payout reports, are retained for six years after the end of the relevant accounting period, or longer where tax law, an audit, or an active dispute requires it.

18.8 Authentication, device, and security-event logs are retained for a limited period proportionate to fraud prevention, incident investigation, and system security, and in the ordinary course for no more than twelve months.

18.9 Support correspondence is retained for the period needed to resolve the matter and to establish the history of the request, after which it is deleted or anonymised unless it is required for a claim.

18.10 Marketing contact data is retained until consent is withdrawn, an objection is made, or the data is no longer required. A minimal suppression record is retained so that an unsubscribed address is not added again by mistake.

18.11 Cloudflare states that it keeps unsampled Web Analytics data for seven days and that aggregated data remains available for six months. The data contains no cookie or device identifier.

18.12 A legal hold, litigation, regulatory investigation, fraud enquiry, or binding preservation duty may extend a retention period that would otherwise apply.

18.13 A photograph deleted by a member of a Business Workspace is moved to the bin of that Workspace and kept there until an administrator or the Owner restores it or deletes it permanently. Permanent deletion takes effect on the basis described in clause 19.3, subject to clause 19.4.

19. Account Deletion and Business Workspace Deletion

19.1 An Account may be deleted at any time from Profile › Settings in the mobile application and from the equivalent control in the web application at https://app.thanex.uk. A person who can no longer sign in may request deletion by writing to [email protected] from any address, giving the email address registered to the Account, and identity is verified before the request is carried out.

19.2 No separate Personal Workspace deletion exists, because deleting the Account deletes the Personal Workspace attached to it.

19.3 Deletion takes effect immediately and cannot be reversed. No recovery period applies and no deletion queue is available to the User. Photographs, stamped image files, notes, Tasks, and other Project Content controlled by the deleted Account are removed from the active systems of the Service at that moment. The sign-in and contact details of the Account are removed at the same moment. A record of the Account is kept without them, so that the name of the person stays attached to work done for a Business Workspace, as clause 19.7 describes.

19.4 Removal from active systems is not the same as the disappearance of every trace. Four categories fall outside clause 19.3. First, copies may persist for a limited period in encrypted routine backups, which are not reachable through the Service, are not used to reinstate a deleted Account, and are purged as those backups are overwritten or expire, and in any event no later than thirty days after deletion. Second, accounting records within clause 18.7 are retained for the statutory period. Third, fraud-prevention and security records within clause 18.8 are retained for their proportionate period. Fourth, information subject to a legal hold, and information that Thanex must retain in order to comply with the law or to establish, exercise, or defend a legal claim, is retained until that requirement ends.

19.5 A Business Workspace may be permanently deleted by its Owner. Deletion removes its Projects, memberships, Tasks, and Project Content from active systems immediately, on the basis described in clause 19.3 and subject to clause 19.4, and it cannot be reversed.

19.6 An Owner cannot delete a personal Account while continuing to own a Business Workspace. The Owner must first complete a workspace ownership transition or delete the Business Workspace.

19.7 Where an ordinary member of a Business Workspace deletes an Account, the Project Content that the member created for that Workspace remains under the control of the Business Customer, together with the member’s name, role, and historical attribution, to the extent lawfully required for the integrity of the work records. A member seeking removal of that material must approach the Business Customer, which decides the request as controller.

19.8 A Business Workspace in View-Only Mode is not deleted automatically. It is deleted only when its Owner deletes it, on the terms of clause 19.5.

19.9 Deleting an Account or a Business Workspace does not cancel a subscription held in an Apple or Google account. A warning and a link to the subscription-management settings of the relevant Store are displayed before deletion is confirmed.

19.10 Every User should export the photographs and records required for business, regulatory, insurance, evidential, contractual, or tax purposes before requesting deletion, because recovery afterwards is impossible.

20. Export and Portability in Practice

20.1 Thanex does not currently offer a complete bulk export of an Account, of a Workspace, or of the structured data held in its model.

20.2 What is available is the selection of multiple photographs and their download or export through the application and the web application, the download of Reports, and the export of Tasks, subject to the active Workspace and the role and permissions of the User. Photographs in Completed Projects can be downloaded through the web application on every plan, including Free.

20.3 A right of data portability under Article 20, where it applies, is answered by Thanex through a structured export prepared on request to [email protected], and the absence of a self-service bulk export does not remove that right.

21. Individual Rights

21.1 Subject to legal conditions and exemptions, an individual may request confirmation of processing and a copy of the personal data held, may have inaccurate data corrected and incomplete data completed, may request erasure where the data is no longer necessary or another statutory ground applies, may ask for processing to be restricted while an issue is examined, may request data portability where processing is automated and based on consent or contract, may object to processing based on legitimate interests, may withdraw consent at any time without affecting earlier lawful processing, and may seek safeguards in respect of a qualifying solely automated decision.

21.2 An objection to direct marketing is honoured without the person needing to give reasons.

21.3 Requests may be sent to [email protected]. Identity and authority may be verified before information is disclosed or changed.

21.4 A valid request is answered without undue delay and within one month of receipt. A lawful extension may be applied to a complex or numerous request, with notice explaining the reason.

21.5 Requests are free of charge. A reasonable fee may be charged, or action refused, where a request is manifestly unfounded or excessive, as the law permits.

21.6 A right concerning Business Workspace Project Content should be directed first to the controlling Business Customer. When acting as processor, Thanex will not independently alter that organisation’s records unless instructed to do so or required by law.

21.7 Where a request concerns material already deleted under clause 19, the answer will explain that the record no longer exists rather than treating the request as refused.

22. Complaints and Supervisory Authorities

22.1 A data-protection complaint may be made to Thanex under section 164A of the Data Protection Act 2018, which was inserted by section 103 of the Data (Use and Access) Act 2025 and came into force on 19 June 2026. A complaint should be sent to [email protected] and should identify the Account, Workspace, Project, or Task concerned, the conduct complained of, the date, and the outcome sought.

22.2 In accordance with that section, Thanex will facilitate the making of a complaint, will acknowledge receipt within thirty days of receiving it, will take appropriate steps to respond, including making enquiries into the subject matter and reporting on progress, and will inform the complainant of the outcome.

22.3 A complaint may also be made to the Information Commission under section 165 of the Data Protection Act 2018. Section 103 of the Data (Use and Access) Act 2025 omitted Article 77 of the UK GDPR, so section 165 is now the route by which a complaint reaches the regulator. Since 30 September 2026, the functions previously exercised by the Information Commissioner have been exercised by the Information Commission.

22.4 The Information Commission’s Office may be contacted at 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL, United Kingdom, by telephone on 0303 123 1113, or through https://ico.org.uk/make-a-complaint/.

22.5 A person in the European Economic Area may complain to the supervisory authority of the Member State of habitual residence, of place of work, or of the alleged infringement.

23. Cookies and Similar Technologies

23.1 Cookies, local storage, software development kits, and comparable technologies are used for authentication, security, preference storage, and subscription entitlement, and visits to the website are measured by an analytics service that stores nothing on a visitor’s device. The extent of their use differs between the website, the web application, and the mobile applications.

23.2 Strictly necessary technologies operate without consent where a statutory exception in Schedule A1 to PECR applies, in particular where they are required to provide a service that the User has requested, to protect an Account, to maintain a session, to remember a privacy choice, or to complete a transaction.

23.3 Cloudflare Web Analytics, which stores nothing on a visitor’s device, measures visits to the website at https://thanex.uk without a consent request. No marketing or campaign-measurement technology is used there, and any non-essential technology introduced in future will be activated for a United Kingdom or European visitor only once the required consent has been obtained.

23.4 The web application at https://app.thanex.uk uses only technologies that operate without consent, the mobile applications use device permissions, application storage, and the RevenueCat software development kit rather than browser cookies, and the upload page reached through a Task link uses a session identifier and a security control and nothing else. The page that opens a photograph from a Report link uses strictly necessary technologies only.

23.5 No consent tool is presented on the website, because no technology used there requires consent. Browser settings can block or delete cookies, although doing so may affect functionality.

23.6 Names, providers, purposes, and durations are set out in the Thanex Cookie Policy.

24. Marketing

24.1 Thanex does not currently use a third-party platform to send newsletters or other marketing communications. Should one be introduced, the Policy will be revised to name it.

24.2 Marketing records may include a name, an email address, the source and time of consent, campaign activity, and unsubscribe status.

24.3 Every recipient may unsubscribe by selecting the link contained in a marketing email or by writing to [email protected].

24.4 Transactional messages concerning security, entitlement, Account administration, or material changes to the Service are not marketing and may continue after a marketing opt-out where they are necessary to perform the contract or to comply with the law.

24.5 A Contributor who uploads through a Task link is not added to any marketing list as a result, and neither is a person located through the Find Thanex User lookup.

25. Children

25.1 The Service is intended for professional workplace use by persons aged 18 or over, and Thanex does not knowingly permit children to create Accounts.

25.2 A parent, guardian, or other person who believes that a child has supplied personal data should write to [email protected]. Investigation and deletion will follow, subject to any lawful need to preserve evidence or to protect the child.

26. Additional Information for Particular Countries

26.1 Clause 26 supplements the Policy for persons in particular countries. Where it gives a greater right than the rest of the Policy, the greater right applies.

26.2 A person in the European Economic Area has the rights described in clause 21 under Articles 15 to 22 of the EU GDPR and may complain to the supervisory authority described in clause 22.5. Personal data transferred from the European Economic Area to Thanex in the United Kingdom is covered by the adequacy decision described in clause 16.4, and an onward transfer to a provider in the United States relies on the EU-US Data Privacy Framework, where the provider is certified, or on the Standard Contractual Clauses adopted by the European Commission. The representative designated under Article 27 of the EU GDPR is identified in clause 3.4.

26.3 A person in the Republic of Albania is protected by Law No. 124/2024 on personal data protection, which applies to Thanex under its Article 4(1)(b) because the Service is offered to persons in Albania, and has rights corresponding to those described in clause 21. Transfers of personal data to the United Kingdom, and to recipients in the United States that participate in the EU-US Data Privacy Framework, rely on Decision No. 01 of 30 April 2025 of the Commissioner for the Right to Information and Personal Data Protection, which lists them among the destinations ensuring an adequate level of protection, and other transfers rely on the safeguards permitted by Chapter IV of that Law. Under Article 25 of that Law, Thanex has designated as its representative in Albania Anja Thana, Delisufaj village, Lushnje, Albania, who may be contacted at [email protected] and may be addressed by the Commissioner and by data subjects on all issues relating to the processing; the designation does not prevent a complaint from being made against Thanex itself. A complaint may be made to the Commissioner for the Right to Information and Personal Data Protection, Rr. “Abdi Toptani”, Nd. 5, 1001 Tirana, Albania, through https://idp.al or by email to [email protected].

26.4 For a person in the United States, Thanex does not sell personal information, does not share it for cross-context behavioural advertising, does not use it for targeted advertising or for profiling that produces legal or similarly significant effects, and does not use sensitive personal information to infer characteristics. The categories of personal information collected in the preceding twelve months are those listed in clause 5, obtained from the sources in clause 12, used for the purposes in clause 13, and disclosed for business purposes to the categories of recipients in clause 15. Where a comprehensive state privacy law, such as the California Consumer Privacy Act of 2018, applies to Thanex, a resident of that state may request access to, correction of, deletion of, and a portable copy of personal information, and will not be discriminated against for exercising a right. Requests may be sent to [email protected], are verified before they are carried out, may be made through an authorised agent where the law permits, and may be appealed by replying to the decision where the law provides for an appeal. Several of those laws apply only to businesses above thresholds of revenue or of the number of residents whose data is processed, and the rights described are honoured to the extent that the applicable law confers them.

26.5 The Service does not collect personally identifiable information about a person’s online activities over time and across third-party websites or online services, and no other party is permitted to collect such information through the Service. Thanex therefore does not respond differently to a browser Do Not Track signal, or to a comparable mechanism, because no cross-site tracking takes place for such a signal to stop. The Service is not directed at children under 13, and Thanex does not knowingly collect personal information from them within the meaning of the Children’s Online Privacy Protection Act.

26.6 For a person in Australia, and to the extent that the Privacy Act 1988 (Cth) applies to Thanex, the Policy sets out the matters required by Australian Privacy Principle 1: the kinds of personal information collected and held are described in clause 5, how they are collected and held in clauses 12 and 17, the purposes in clause 13, access and correction in clause 21, and complaints in clause 22 and in clause 26.6. Personal information is likely to be disclosed to overseas recipients located in the United Kingdom and the United States, and in the other countries in which Amazon CloudFront and Cloudflare operate edge locations. Thanex does not use computer programs to make decisions that could reasonably be expected to significantly affect the rights or interests of an individual. A complaint may be made to Thanex at [email protected] and, where the response is not satisfactory, to the Office of the Australian Information Commissioner, GPO Box 5288, Sydney NSW 2001, by telephone on 1300 363 992, or through https://www.oaic.gov.au.

27. Changes to the Policy

27.1 The Policy may be amended to reflect legal developments, provider changes, new features, revised data practices, or security requirements.

27.2 A material amendment will be notified through the Service, by email, or by another appropriate method before it takes effect, where notice is required. The date at the head of the Policy identifies the latest revision.

27.3 Earlier versions may be retained for compliance and dispute purposes.

28. Contact

Privacy enquiries, rights requests, withdrawal notices, and complaints should be directed to Thanex Ltd, Flat 11, Mill Pond Place, Mill Lane, Maidstone, England, ME14 1GL, United Kingdom.

Email: [email protected]

Telephone: +44 7479 039030

Website: https://thanex.uk

Web application: https://app.thanex.uk

Company number: 16426957.

VAT number: GB516584280.