Privacy notice

This notice covers personal information we collect through the Common Thread website, the growth diagnostic, email, phone, video calls, booked working sessions and in person. Sparring Ventures is the same team's practice for founders who are still building their product. Both sites use the same diagnostic and the responses are held in one place, so this notice covers the Sparring Ventures website and diagnostic too.

We handle personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. In this notice, "we", "us" and "our" mean Common Thread Partners.

1. Who we are

Common Thread Partners is a trading name of [LEGAL ENTITY NAME], a company registered in England and Wales under number [COMPANY NUMBER], with its registered office at [REGISTERED OFFICE ADDRESS]. We are the controller of the personal information described in this notice. Our ICO registration number is [ICO REGISTRATION NUMBER].

For any question about your information, or to use any of your rights, email sophie.adams@commonthreadpartners.co.uk.

2. What we collect

When you take the growth diagnostic

• Your name, role, email address and phone number, if you give it.
• Your company's name and website, its stage, size and team.
• Your answers about your customers, proposition, sales, delivery and where growth feels stuck.
• Where you found us, and your consent for us to review your answers.

Most of what the diagnostic asks is about your business rather than about you. Please don't include health information or other sensitive personal details, or personal details about your customers or staff that we don't need.

When you contact us, book a session or work with us

• Your name, email address and any other contact details you share.
• The details of a session you book through our calendar.
• What you tell us in emails, calls and meetings, and our notes of them.
• If you become a client, the business contact and billing details we need to deliver and invoice the work.

From public sources

When we review a diagnostic, we read what is publicly available about your business, such as its website, Companies House records and public professional profiles, so that our review reflects more than the answers alone.

When you visit the website

Our hosting provider records basic technical information, such as IP addresses, browser type and the pages requested, to keep the site running and secure. The site's fonts are served by Google, so your browser shares your IP address with Google when a page loads. We do not use analytics, advertising or tracking tools on this site.

3. How we use it, and why we're allowed to

We only use personal information where the law gives us a reason to. The reasons we rely on are:

• To review your diagnostic and send you a Growth Constraint Review. Your consent, given in the form, and our legitimate interest in responding to people who ask for our view.
• To reply to you, arrange working sessions and talk about possible work. Our legitimate interest in running our business, and taking steps at your request before entering a contract.
• To deliver work we've agreed with you or your company. Performing our contract.
• To send occasional updates we think are relevant to you as a business contact. Our legitimate interest in telling people about our work. Every message lets you opt out, and you can opt out at any time by emailing us.
• To keep accounts and meet our legal obligations. Legal obligation.
• To improve our method. Our legitimate interest in getting better at what we do. We use responses with names and contact details removed, and never identify you or your business outside the team.

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details, and you can object at any time (see section 10).

4. AI and how decisions are made

We use AI tools to help us analyse diagnostic responses and draft the Growth Constraint Review. A member of our team reads and reviews every review before it is sent, and decides what it says. We do not make any decision about you that has legal or similarly significant effects using automated means alone.

The AI provider processes responses on our behalf under contract, and under terms that do not allow it to use your information to train its models.

5. Who we share it with

We don't sell personal information, and we don't share it for advertising. We share it only with:

• Service providers who process it for us, under contract and only on our instructions: Google (Workspace, Forms, Sheets, email and calendar), Cloudflare (website hosting) and [AI PROVIDER] (AI-assisted analysis).
• Professional advisers, such as our accountants and lawyers, where needed.
• Authorities or other parties where the law requires it, or to establish, exercise or defend legal claims.
• A buyer or successor, if our business is sold or restructured. They would have to use your information in line with this notice.

6. International transfers

Some of our service providers process information outside the UK, including in the United States. Where they do, we make sure the transfer is protected: either the destination is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), or the transfer is covered by the ICO's International Data Transfer Agreement or Addendum.

7. How long we keep it

• Diagnostic responses and enquiries that don't lead to work: [24 months] from our last contact with you, then deleted.
• Client records: six years after the end of the engagement, to meet tax and legal requirements.
• Marketing opt-outs: we keep a short record that you've opted out, so that we don't contact you again.

If we no longer need information sooner, we delete or anonymise it sooner.

8. How we protect it

Access to personal information is limited to the people in our team who need it. Our accounts use two-factor authentication, and the site and our tools encrypt information in transit. No system is completely secure, but if a breach affected you, we would tell you and the ICO where the law requires it.

9. Your rights

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use it;
• object to how we use it, including an absolute right to stop marketing;
• receive information you gave us in a portable format;
• withdraw your consent at any time, where we rely on it. This doesn't affect anything we did before you withdrew.

Email sophie.adams@commonthreadpartners.co.uk to use any of these rights. It's free, and we'll respond within one month. We may need to confirm your identity first.

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

10. Cookies

This website does not set cookies and does not use analytics or advertising trackers, so there's nothing to accept or decline. The diagnostic opens in Google Forms and the booking page in Google Calendar. Those are Google's services, and Google's own cookies and privacy policy apply there. If we ever add analytics to this site, we'll update this notice and ask for your consent where the law requires it.

11. Other websites

This site links to other websites, including Sparring Ventures, Google Forms and Google Calendar. They have their own privacy policies, and we're not responsible for how they handle your information.

12. Children

Our services are for businesses and the people who run them. This site and the diagnostic are not intended for anyone under 18.

13. Changes to this notice

We'll update this notice when our practices change. The date below shows when it was last revised.

Last updated 14 October 2026.