Privacy Policy
Last updated 13 October 2026 · Replaces the version of 2 October 2026
1. Who we are and what this policy covers
Third Vector Advisory B.V. is the controller of the personal data this policy describes. We are registered in the Netherlands under KvK 99226774, at Heemraadssingel 123A, 3022 CC Rotterdam. For anything about this policy or your data, email legal@thirdvector.io.
We sell only to businesses (Third Vector Terms, section 1.2). This policy covers the people we deal with at and around those businesses:
- visitors to thirdvector.io;
- people who contact us, or whom we contact about working together;
- the people at our clients we work with; and
- Academy participants, including those whose place a Sponsor pays for.
It does not cover personal data we process on a client’s behalf. When a client shares materials that contain personal data, for example in Applied AI Services or on the Third Vector Platform, the client is the controller and we act as its processor under our data processing agreement (Terms, sections 10.2 and 10.3). The sub-processors we use for that work are listed at thirdvector.io/subprocessors (section 4).
Skills we build for you run in your own environment, on the AI provider you choose, unless you run them on the Platform. That provider processes your data under your contract with it, and we do not receive your source data (Terms, section 10.1).
2. What we collect, why and for how long
We collect only what each situation below needs.
| When | What we collect | Why | Legal basis | How long we keep it |
|---|---|---|---|---|
| You visit thirdvector.io | Page viewed, referrer, country, device and browser type, recorded anonymously by Vercel Web Analytics; our host’s technical logs, which include your IP address | To keep the site running and secure, and to see which pages are read | Legitimate interest | Analytics only as aggregate statistics, and the daily visitor hash is discarded after 24 hours; logs for the short period our host keeps them |
| You contact us, by the form or by email | Name, email address, company, your message and our replies | To answer you and follow up | Legitimate interest | 3 years after our last contact, unless you become a client |
| You work with us, or we discuss working together | Name, role, work contact details, correspondence, meeting notes, and what your business bought | To prepare, deliver and invoice what your business bought, and to manage the relationship | Contract, where you contract with us yourself; otherwise legitimate interest | While the relationship runs, then 3 years after our last contact |
| We contact you first | Name, role, company, work email address and public professional profile, from company websites and professional networks such as LinkedIn | To introduce the Platform, Applied AI or Academy to businesses we think they could help | Legitimate interest; you can object at any time, and we stop | Until you object, or 2 years after our last contact if you do not reply |
| We invoice your business | Name and billing details of the person who buys or signs, invoices and payment records | To invoice, and to keep the records Dutch tax law requires | Legal obligation | 7 years |
| You take part in Academy | See section 3 | |||
| You subscribe to The Blueishprint | Email address, through Substack | To send the newsletter we co-write | Consent; unsubscribe from any issue | Until you unsubscribe |
The legal bases are those in Article 6(1) GDPR: consent (a), contract (b), legal obligation (c) and legitimate interest (f). Where we rely on legitimate interest, our interest is running and growing a business that sells to businesses, weighed against yours, and you can object at any time (section 6). We do not sell personal data, and we make no decisions about you by automated means alone. You do not have to give us personal data, but without it we may not be able to answer you, take a booking or tailor a programme.
3. Academy
Academy Programmes are live training on your own stack, so they involve more personal data than the rest of what we do. We handle it as controller (Terms, section 5.8), step by step as below.
3.1 Booking and checkout
When you book a programme online, you give us your email address for the receipt and confirm that you buy for a business. Payment runs on Stripe’s hosted checkout, where you enter your name, billing address, payment details and, where you have one, your business’s VAT number. Stripe processes the payment for us, and acts under its own privacy policy for its fraud prevention and legal obligations. We receive the payment status and billing details, never your full card number. For a private programme, your business gives us the names and work email addresses of its participants in the Order Form or booking confirmation.
3.2 The intake form
Before the first session, each participant completes a short intake form on thirdvector.io: what you want to achieve, how you work today, your role, and the tools and accounts you use. We use the answers to prepare a tailored agenda and setup checklist, so the first session is spent building. To draft that agenda we may run your answers through Claude, under Anthropic’s commercial terms, which exclude training on them. Answer about your own work, and leave out personal data about colleagues or customers.
3.3 Live sessions and screen-share
Sessions run on Google Meet or Microsoft Teams, as agreed with you. The tools you build with, such as Claude, GitHub, Vercel or Notion, run on your own accounts under their providers’ terms (Terms, section 5.8). While you share your screen, the instructor sees what you show, and in a group programme so do the other participants. Apart from a recording under 3.4, we take no copies of it. The instructor keeps only the notes needed to deliver the programme, such as where your setup stands and what to cover next. Before you share, close anything you would not show the group, such as client data, email or messages. What another participant shows is theirs, so do not record, copy or pass it on.
3.4 Recordings
We record a session only with the consent of everyone present, asked at its start. Anyone can decline, or ask us to stop, and the session then runs unrecorded. The same applies to any transcript or AI summary the platform can make. A recording is stored in the account of the platform the session ran on, shared only with the people who took part, and deleted after 90 days. If you withdraw your consent, we delete it.
3.5 Sponsored places
Where a Sponsor, such as a fund or accelerator, pays for your place (Terms, section 5.6), the Sponsor gives us your name and work email address so we can invite you. We tell the Sponsor only whether you took up and completed your place. Your intake answers, your work and any recording are not shared with the Sponsor.
3.6 Certificates
A certificate of completion carries your name, the programme and what you built (Terms, section 5.9). We keep a record of the certificates we issue, so we can confirm one if asked.
3.7 Legal basis and how long we keep it
| Academy data | Legal basis | How long we keep it |
|---|---|---|
| Booking and contact details | Contract, where you book yourself; otherwise legitimate interest | 3 years after the programme ends |
| Payment and invoice records | Legal obligation | 7 years |
| Intake answers and instructor notes | Contract, where you book yourself; otherwise legitimate interest | 12 months after the programme ends, so you can join a later group without starting over (Terms, section 5.4) |
| Recordings, transcripts and AI summaries | Consent | 90 days |
| Certificate records | Legitimate interest | 5 years |
4. Who we share it with
We do not sell personal data. The providers below process it for us, on our instructions and under a data processing agreement with each.
| Provider | What it does for us | Where it processes data |
|---|---|---|
| Google Workspace: email, calendar, file storage, and Meet calls and recordings | EEA and worldwide | |
| Microsoft | Microsoft 365: Teams calls and recordings | EEA, within Microsoft’s EU Data Boundary |
| Slack | Private channels for conversations with client teams | Slack’s global infrastructure |
| Notion | Client project pages, meeting notes and task tracking | United States |
| Linear | Tracking development work on Custom Skills | European Union |
| Stripe | Academy checkout and payments | EEA and United States |
| Vercel | Hosting thirdvector.io, its contact and intake forms, and its analytics | United States and worldwide |
| Neon | The database behind thirdvector.io: Academy orders and intake form answers | EEA (Frankfurt), with support from the United States |
| Resend | Email sent from thirdvector.io: order confirmations, intake links and contact form messages | United States, with email sent from Ireland |
| Attio | Our CRM, for client and prospect relationships | United Kingdom, and elsewhere under Attio’s safeguards |
| Anthropic | Claude, which we use in our own work, including drafting Academy agendas from intake answers | United States |
Where needed, we also share personal data with:
- the people who deliver our work, including contractors and subcontractors bound by confidentiality (Terms, section 14.1);
- our professional advisers, such as lawyers, accountants and auditors;
- authorities, where Dutch or EU law requires it; and
- a successor to our business in a merger or sale (Terms, section 14.4).
Sub-processors for client work. When we process personal data on a client’s behalf, we act as its processor under our data processing agreement. We then use only the AI providers named in the SOW and the sub-processors on our published list at thirdvector.io/subprocessors, on terms that exclude training on the data (Terms, section 10.2). Before we add or replace a sub-processor, we update that list and tell our clients.
5. Transfers outside the EEA
Some of these providers process data outside the European Economic Area, mainly in the United States. We use them only with a transfer mechanism the GDPR recognises: an adequacy decision of the European Commission, such as the one for the United Kingdom or the EU-US Data Privacy Framework for certified US providers, or the European Commission’s standard contractual clauses. For a copy of the safeguard that applies, email legal@thirdvector.io.
6. Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data (access);
- correct it (rectification);
- delete it (erasure);
- limit how we use it (restriction);
- stop using it where we rely on legitimate interest (objection), and always stop using it to contact you about our work; and
- send it to you or another party in a common format (portability).
Where we rely on your consent, such as for a recording or the newsletter, you can withdraw it at any time. That does not affect what we did before.
Email legal@thirdvector.io. We answer within one month, and may first ask you to confirm who you are. Where we hold your data as a client’s processor, we pass your request to that client. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
7. Cookies and analytics
thirdvector.io sets no cookies. We measure visits with Vercel Web Analytics, which works without cookies and gives us aggregate figures such as page views, referrers and countries. It does not follow you across sites or build a profile of you, and the hash it uses to count a visit is discarded after 24 hours (Vercel).
Stripe’s checkout and Substack are separate sites, and set their own cookies under their own policies. If we add cookies that are not strictly necessary, we will ask for your consent first and update this section.
8. Security, changes and contact
Security. We protect personal data with measures that fit the risk. We keep it in our company accounts, limit access to the people who need it, and use providers that encrypt it in transit and at rest.
Age. We sell only to businesses, and do not knowingly collect personal data from anyone under 16.
Changes. We update this policy when what we do changes, and show the date at the top. If a change materially affects how we use the data of clients or Academy participants, we tell them by email.
Contact. Third Vector Advisory B.V., Heemraadssingel 123A, 3022 CC Rotterdam, The Netherlands · legal@thirdvector.io