Legal

Privacy Policy

Last updated 30 September 2026 · Applies to thirdactconsulting.ai and to business contacts we reach out to

Who we are

Third Act Consultancy ("Third Act", "we", "us") is the data controller for personal data collected through this website and for the business contact details we use when we reach out to firms ourselves. We're based at Dún Laoghaire, Co. Dublin, Ireland. You can reach us at peter@thirdact.ie or +353 87 056 3226.

This policy covers the website and that outreach. If you're a client, the separate AI & Data Usage Policy covers how we handle your business information during an engagement, and it's provided with every proposal.

What we collect, and why

What	When	Why
Name, email address, company name	You complete the AI Maturity Assessment or the contact form	To send you your result and to follow up if there's a reason to
Your assessment answers and the resulting scores	You complete the assessment	To produce your scorecard, and so any later conversation starts from what you told us rather than from scratch
Page views, referrer, country, device type	Any visit	To understand which pages are useful. Aggregated, cookieless, never tied to you as an individual

We don't collect special category data and we don't ask for payment details on this site.

Our lawful basis

Legitimate interest for responding to an assessment or enquiry you started, and for aggregated analytics. You asked us a question; answering it is the expected outcome.
Consent for any marketing email to people who used this site, beyond a direct reply. We won't add you to a mailing list because you took the assessment.
Legitimate interest for a small number of business emails to people we contact first, described in the next section.
Contract once an engagement begins, at which point the AI & Data Usage Policy also applies.

If we contacted you first

We sometimes write to founders and senior people at professional services firms in Ireland and the UK whose work we think we can help with. If that's how you heard from us:

What we hold: your name, job title, work email address, company, company website and LinkedIn profile, plus basic facts about the firm (sector, size, location) and whether you replied.
Where it came from: business data providers (currently Instantly), public trade association directories, your company's website and LinkedIn.
Why, and on what basis: to tell you about Third Act's services, on the basis of our legitimate interest in finding clients we can help. We only use work email addresses, we send no more than three emails, and we don't track opens or clicks.
Your right to object: reply "no" to any email, or write to peter@thirdact.ie, and we'll stop straight away. We keep only your email address on a do-not-contact list, so it stays stopped.
How long we keep it: if you don't reply, six months from our last email. If we start talking, the retention period below applies.

Who else processes it

We keep the list of processors short on purpose.

Netlify — website hosting. Standard server logs, including IP address, retained briefly for security and abuse prevention.
Plausible Analytics — cookieless, aggregated site statistics. No cross-site tracking, no advertising profile, no individual identification.
Google Workspace — our email, and the spreadsheet where assessment submissions and enquiries are recorded. If you write to us, the email lives there.
Resend — sends the scorecard email when you complete the assessment.
Instantly — our email outreach platform, used only for the first contact described in “If we contacted you first”.
Attio — our CRM. It holds the details of people we're in conversation with, including anyone who replies to one of our outreach emails.
Anthropic — Claude, the AI assistant we use to help prepare outreach and to sort and draft replies. It processes the content of those emails.

Some of these providers process data outside the EEA. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We don't sell personal data, and we don't share it with advertisers.

Cookies and what's stored in your browser

We don't use advertising or tracking cookies, which is why you haven't been shown a consent banner. Our analytics are cookieless by design.

The AI Maturity Assessment does save your answers in your browser's local storage as you go, so that refreshing the page doesn't lose your progress. That data stays on your device, we can't read it remotely, and clearing your browser data removes it.

How long we keep it

Enquiry and assessment records, and the details of anyone we're in conversation with, are kept for two years from your last contact with us, matching the retention period in our AI & Data Usage Policy. Outreach contacts who don't reply are deleted six months after our last email. Aggregated analytics contain no personal data and are kept indefinitely. Ask us to delete your record sooner and we will.

Your rights

Under the GDPR and the Irish Data Protection Act 2018 you can ask us to give you a copy of what we hold about you, correct it, delete it, restrict how we use it, or port it elsewhere. You can also object to processing based on legitimate interest. If it's business outreach, we'll always stop.

Email peter@thirdact.ie and we'll respond within one month. If you're unhappy with how we've handled it, you can complain to the Data Protection Commission at dataprotection.ie.

Changes

If this policy changes materially, the date at the top changes with it. Anyone with an active engagement gets told directly.