Privacy Policy

Last Updated: October 26, 2026

Threekit Inc. (“Threekit,” “we,” “our,” or “us”) respects your privacy and is committed to protecting personal information. This Privacy Policy describes how we collect, use, disclose, and otherwise process personal information in connection with our website located at www.threekit.com, including its subdomains (“our website”), and related interactions.

1. Scope of This Policy

Some data protection laws in various jurisdictions distinguish between “controllers” (or “businesses”) and “processors” (or “service providers”) of personal information. A controller is the party who decides why and how to process personal information. A processor only processes information on behalf of a controller based on the controller’s instructions.

This Privacy Policy applies to personal information that we collect and process in our capacity as a data controller and explains how we collect, use, and share such information for our own purposes. For example, this Privacy Policy covers when you:

Visit our website that links to this Privacy Policy;
Interact with us as a representative of a company that has (or is considering) a business relationship with us (for example, you are our customer or prospective customer, or our supplier or prospective supplier);
Register for or administer an account;
Register for or attend a Threekit marketing, learning, or training event or webinar;
Provide us with feedback about our products or services;
Receive a sales or marketing communication from us, including emails, texts, or telephone calls;
Apply for employment with us; or
Engage in any other contractual arrangement that references this Privacy Policy.

This Privacy Policy does not apply to information that we process on behalf of our customers within our software-as-a-service platforms, apps, or plug-ins. Such processing is governed exclusively by applicable customer agreements (including data processing agreements and addenda) and is outside the scope of this Privacy Policy. This Privacy Policy also does not apply to information that our suppliers process on our behalf or on behalf of our customers within our software-as-a-service platforms, apps, or plug-ins. Such processing is governed exclusively by applicable supplier agreements and also is outside the scope of this Privacy Policy.

2. Information We Collect

We collect personal information from various sources, including directly from you, automatically from your interactions with our website, and from third parties.

Some jurisdictions, including the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland, require a legal basis, or reason, why Threekit is legally allowed to collect and use your personal information.

Below, we describe (1) information that may be provided by you, (2) information that may be collected automatically, (3) the categories of information we collect in those instances, and (4) our purposes and legal bases for collection. If we need to collect other personal information from you, we will explain which information we need and why at the time we collect it.

2.1 Information from Your Interactions with Our Website

When you access or use our website, we collect information about your device and your interactions with our website. The information collected may include:

IP address
Device type and unique device identification numbers
Operating system and browser type and version
Broad geographic location (for example, country- or city-level location based on your public IP address)
Performance and technical data
Referring URL, pages visited, and features used
Email and content interactions, such as when you open a marketing email from us, click an embedded link on our website or in a marketing email from us, watch or download videos on our website, or interact with our chat function
Information collected when you register for or attend a webinar or event hosted by us
Information collected by cookies, pixels, tags, and similar tracking technologies, as described in Section 10 (Cookies and Tracking Technologies)

2.2 Information from Third Parties

We may receive personal information about you from third parties, including:

Your employer or organization (in the context of an existing or potential business relationship)
Third parties you have directed to share information with us
Data enrichment providers, who provide additional business contact information and buyer-intent data
Visitor-identification and identity-resolution providers, who match online identifiers (such as IP address and device signals) of marketing-site visitors to business contact information maintained in the vendor’s identity graph
Advertising platforms and analytics providers
Publicly available sources

2.3 Job Applicant Information

If you apply for employment with us, we may collect:

Full name
Address
Personal telephone number
Personal email address
Resume or curriculum vitae
Employment and education history
Professional certifications
References (including the personal information of referees you identify)
Work authorization status
Demographic information voluntarily provided for equal employment opportunity reporting purposes
The substance of any communications or interviews

See Section 9 (Job Applicants) of this Privacy Policy for additional disclosures specific to job applicants, including the California-required notice at collection.

3. Categories of Personal Information

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA/CPRA”), enumerates eleven categories of personal information at California Civil Code section 1798.140(v)(1)(A)–(K), and separately enumerates categories of “sensitive personal information” (“SPI”) at section 1798.140(ae)(1)–(2). The General Data Protection Regulation (“GDPR”) defines “personal data” broadly at Article 4(1), enumerates “special categories” of personal data at Article 9(1), and treats personal data relating to criminal convictions and offences separately under Article 10.

The following chart maps the types of personal information we collect to the relevant classification under the CCPA/CPRA and the GDPR. We have collected each category identified in the “Type of Data” column within the preceding twelve (12) months.

Type of Data	CCPA/CPRA Classification	GDPR Classification
A. Contact and Account Information
Full name	(A) Identifiers (Cal. Civ. Code § 1798.140(v)(1)(A)) (B) Customer Records (Cal. Civ. Code § 1798.80(e))	Personal data (Art. 4(1)) Functional: identification data
Business email address	(A) Identifiers	Personal data (Art. 4(1)) Functional: contact data
Business telephone number	(A) Identifiers (B) Customer Records	Personal data (Art. 4(1)) Functional: contact data
Company name; job level; functional role	(I) Professional or employment-related information (§ 1798.140(v)(1)(I))	Personal data (Art. 4(1)) Functional: employment data
Work / business address	(A) Identifiers (B) Customer Records	Personal data (Art. 4(1)) Functional: contact data
LinkedIn profile URL	(A) Identifiers (B) Customer Records	Personal data (Art. 4(1)) Functional: contact data
Account log-in credentials (OAuth tokens received from your single sign-on provider)	Sensitive Personal Information (§ 1798.140(ae)(1)(B))	Personal data (Art. 4(1)); not an Art. 9 special category; subject to Art. 32 security obligations
B. Online and Technical Information
IP address	(A) Identifiers (§ 1798.140(v)(1)(A)) (F) Internet or other electronic network activity information	Personal data (Art. 4(1)); “online identifier” (Recital 30); confirmed by CJEU in Breyer v. Bundesrepublik Deutschland, C-582/14 (Oct. 19, 2016)
Device type; unique device identifiers	(A) Identifiers (F) Internet activity	Personal data (Art. 4(1)); online identifier
Browser type, version, operating system	(F) Internet activity	Personal data (Art. 4(1)); technical / online data
Broad (city- or country-level) geolocation derived from IP	(G) Geolocation data (§ 1798.140(v)(1)(G))	Personal data (Art. 4(1)); location data
Cookie identifiers; pixel data; advertising identifiers	(A) Identifiers and (F) Internet activity Sale/share triggering when used for cross-context behavioral advertising (§ 1798.140(ad), (ah))	Personal data (Art. 4(1)); online identifier; consent required under ePrivacy Directive Art. 5(3)
Referring page; pages visited; features used; usage detail; email/content interactions	(F) Internet or other electronic network activity information	Personal data (Art. 4(1)); behavioral / usage data
C. Communications and Content
Content of inquiries, support tickets, and other communications	(D) Commercial information (§ 1798.140(v)(1)(D))	Personal data (Art. 4(1)); communications data; may become Art. 9 data if it reveals special-category data
Audio recordings of sales calls and online meetings	(H) Audio, electronic, visual, thermal, olfactory, or similar information (§ 1798.140(v)(1)(H)) Sensitive Personal Information under (ae)(1)(E) if the business is not the intended recipient of the communications captured	Personal data (Art. 4(1)); may become Art. 9 data if content reveals health, religion, or other special categories
Video and image data from online meetings and demos	(H) Audio, electronic, visual, thermal, olfactory, or similar information	Personal data (Art. 4(1)); not Art. 9 biometric data unless used for unique identification (Art. 4(14))
Call transcripts and AI-generated summaries	(H) Audio, electronic, visual, thermal, olfactory, or similar information (K) Inferences (§ 1798.140(v)(1)(K))	Personal data (Art. 4(1)); classification follows underlying content; may implicate Art. 22 (automated processing)
D. Payment and Billing Information
Billing name and billing address	(A) Identifiers (B) Customer Records	Personal data (Art. 4(1)); financial / contact data
Credit or debit card number alone	(B) Customer Records (§ 1798.80(e))	Personal data (Art. 4(1)); financial data; PCI DSS overlay applies
Credit or debit card number in combination with a required security or access code, password, or credentials allowing account access	Sensitive Personal Information (§ 1798.140(ae)(1)(B))	Personal data (Art. 4(1)); subject to Art. 32 and PCI DSS overlay
E. Health and Safety Information (Event Registrants)
Emergency contact information	(A) Identifiers (of the emergency contact) (C) Characteristics of protected classifications, if they reveal family/marital status (§ 1798.140(v)(1)(C))	Personal data (Art. 4(1)); third-party personal data subject to Art. 14 disclosure obligations
Dietary preferences and restrictions	Potentially Sensitive Personal Information — (ae)(1)(D) (revealing religious or philosophical beliefs) or (ae)(2)(B) (concerning health), depending on content; (C) Characteristics of protected classifications	Special category personal data (Art. 9(1)) where it reveals religious or philosophical beliefs or health conditions; otherwise personal data (Art. 4(1)) Also governed by the Washington MHMDA (RCW Ch. 19.373) and Nevada NRS 603A.500–525 — see Section 12.2
F. Job Applicant Information
Full name; personal address; personal telephone; personal email	(A) Identifiers (B) Customer Records	Personal data (Art. 4(1)); identification / contact data
Resume / CV; employment history; education history	(I) Professional or employment-related information (J) Education information (§ 1798.140(v)(1)(J)) (as defined in FERPA, 20 U.S.C. § 1232g)	Personal data (Art. 4(1)); employment / education data
Professional certifications and references	(I) Professional or employment-related information	Personal data (Art. 4(1)) for the applicant; separate Art. 13/14 disclosure obligations for referees as third parties
Work authorization status	(C) Characteristics of protected classifications (national origin)	Special category personal data (Art. 9(1)) — “racial or ethnic origin” (broadly construed for national-origin information)
Demographic information voluntarily provided for equal employment opportunity reporting (race, ethnicity, gender, veteran status, disability status)	(C) Characteristics of protected classifications Sensitive Personal Information — (ae)(1)(D) (racial or ethnic origin) and, where applicable, (ae)(2)(B) (health)	Special category personal data (Art. 9(1)) — racial/ethnic origin; health data; processed only on the basis of Art. 9(2)(b) (employment obligations) or Art. 9(2)(a) (explicit consent)
G. Inferences
Inferences drawn from any of the above categories to create a profile reflecting preferences, characteristics, predispositions, or behavior	(K) Inferences (§ 1798.140(v)(1)(K))	Personal data (Art. 4(1)); may implicate Art. 22 if used in automated decision-making producing legal or similarly significant effects; if inferences reveal special-category data, they are themselves Art. 9 data (CJEU, OT v. Vyriausioji tarnybinės etikos komisija, C-184/20 (Aug. 1, 2022))

4. Purposes of Processing and Legal Bases

We process personal information for the purposes summarized in the chart below. Where we process personal information of individuals in the European Economic Area, the United Kingdom, or Switzerland, we rely on the legal bases under Article 6 of the GDPR (and Article 9 for special category data) identified for each purpose. Where we process personal information of California residents, the purposes below align with the categories of “business purpose” and “commercial purpose” set forth at California Civil Code section 1798.140(e), (f), and (l).

Information Type	Purpose of Processing	GDPR Legal Basis (where applicable)
Service Delivery and Account Administration
Contact and account information; account credentials; integration data; service and support details	To create and manage user accounts; to authenticate users; to provision and operate our products and services; to provide customer support and respond to inquiries; to enable third-party integrations authorized by the customer	Art. 6(1)(b) — performance of a contract Art. 6(1)(f) — legitimate interests (administrative operations)
Billing and payment information	To process payments; to bill customers; to maintain financial records	Art. 6(1)(b) — performance of a contract Art. 6(1)(c) — compliance with legal obligations (tax, accounting)
Sales, Marketing, and Communications
Contact information; company / job role; usage data; inferences	To send sales and marketing communications about our products and services; to invite you to events and webinars; to follow up on demo requests; to deliver targeted advertising on third-party platforms	Art. 6(1)(f) — legitimate interests in marketing our products to business contacts Art. 6(1)(a) — consent, where required (e.g., direct marketing in jurisdictions that require opt-in)
Marketing-site analytics and behavioral data	To measure marketing performance; to optimize our marketing campaigns; to understand visitor behavior	Art. 6(1)(a) — consent (in the EEA, the UK, and Switzerland), captured through the consent management platform described in Section 10 and in our Cookie Notice Art. 6(1)(f) — legitimate interests (in jurisdictions where consent is not required)
Events and Webinars
Registrant contact information; company; job role	To register attendees; to confirm attendance; to communicate logistics; to share attendee lists with co-sponsors (subject to consent where required)	Art. 6(1)(b) — performance of a contract (event registration is a contractual relationship) Art. 6(1)(a) — consent for co-sponsor sharing
Health and safety information (emergency contact; dietary preferences)	To provide dietary accommodations; to respond to emergencies at in-person events	Art. 6(1)(b) — performance of a contract Art. 9(2)(a) — explicit consent for processing of any special-category data (health or religious belief implications)
Sales Calls, Meetings, and Demos
Audio and video recordings; transcripts; AI-generated summaries	To record calls and meetings for training, quality assurance, and administration; to analyze content using AI for sales insights; to generate post-call summaries; to support sales coaching	Art. 6(1)(b) — performance of a contract (where the call is part of a business relationship) Art. 6(1)(f) — legitimate interests (sales operations, training) Art. 6(1)(a) — consent, where required by local two-party-consent laws or where Art. 9 data may be incidentally captured
Job Applicant Processing
Job applicant information	To evaluate candidacy; to conduct interviews and reference checks; to communicate about applications; to comply with employment law obligations	Art. 6(1)(b) — pre-contractual steps at the applicant’s request Art. 6(1)(c) — legal obligations under employment law Art. 6(1)(f) — legitimate interests in hiring
Demographic information voluntarily provided for EEO reporting	To comply with federal and state equal employment opportunity reporting obligations	Art. 9(2)(b) — necessary for carrying out the obligations of the controller in the field of employment law Art. 6(1)(c) — compliance with legal obligations
Security, Fraud Prevention, and Operations
All categories of personal information	To monitor for suspicious or unauthorized activity; to investigate and respond to security incidents; to detect and prevent fraud; to protect the security and integrity of our systems and services	Art. 6(1)(c) — compliance with legal obligations Art. 6(1)(f) — legitimate interests (information security)
Product Improvement
Aggregated, de-identified product-usage and behavioral telemetry	To analyze usage patterns; to develop, test, and improve our products and services; to fix bugs and improve performance	Art. 6(1)(f) — legitimate interests in improving our products
Legal and Compliance
Any category of personal information	To comply with applicable laws, regulations, court orders, and legal processes; to establish, exercise, or defend legal claims; to enforce our agreements; to protect our rights, property, and the safety of users and others	Art. 6(1)(c) — compliance with legal obligations Art. 6(1)(f) — legitimate interests in defending claims and enforcing agreements
Business Transitions
Any category of personal information	To facilitate a corporate transaction, such as a merger, acquisition, financing, or sale of all or a portion of our assets	Art. 6(1)(f) — legitimate interests in conducting corporate transactions

We may also process personal information for purposes that are compatible with the purposes identified above, where permitted by applicable law. If we propose to process your personal information for a materially incompatible purpose, we will provide you with prior notice and, where required, obtain your consent.

Profiling, automated decision-making, and model training. We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers. As described in Section 5, we do not use personal information collected through our website to train large language models. These disclosures are made pursuant to the Connecticut Data Privacy Act, as amended effective July 1, 2026, and analogous requirements of other state privacy laws.

We may share or disclose personal information in the following circumstances:

Threekit affiliates. We may disclose any of the categories of personal information described above to affiliates within the Threekit group where necessary to fulfill a request you have submitted or for customer support, marketing, technical operations, event registration, and account management purposes.
Service providers and processors. We may disclose the categories of personal information described above to third-party service providers or vendors contracted to provide services on our behalf — for example, IT and hosting, data analytics, event services, customer support, call recording, chatbot technology, data enrichment, email fulfillment, and payment services. These service providers may use personal information we provide to them only as instructed by Threekit. Our service providers and processors are bound by written contracts that limit their use of personal information to the purposes we specify.
AI and large language model providers. We engage third-party large language model (“LLM”) providers — currently including Anthropic, OpenAI, Grok, Google, Cloudflare, G2.com, and Perplexity — to process certain personal information for the purpose of generating AI outputs in connection with our website. Personal information is not used to train these providers’ models.
Visitor-identification and B2B identity-resolution services. We use visitor-identification and B2B identity-resolution services that match online identifiers (such as IP address and device signals) of marketing-site visitors to business contact information maintained in the vendor’s identity graph. The providers we currently use are RB2B and Apollo. As described in Section 6, the disclosures involved in these services constitute a “sale” or “share” of personal information under California law and analogous state privacy laws.
Advertising platforms. When you visit our website, we use cookies, pixels, tags, and similar tracking technologies that disclose your personal information (including online identifiers, IP address, device information, and browsing activity) to advertising platforms. The advertising platforms we currently use are Google Ads, Meta Ads, LinkedIn Ads, Reddit Ads, and Microsoft Ads. These disclosures are used for cross-context behavioral advertising, conversion measurement, and lead generation. Under the CCPA/CPRA and analogous state privacy laws, these disclosures constitute a “sale” or “share” of personal information. See Section 6, which also provides opt-out mechanisms. We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age, and in particular not of children under thirteen (13) years of age.
Event co-sponsors. When you participate in webinars, events, and other activities where we collaborate with third parties, we may disclose information you provide when registering for events and webinars, such as your contact information and interests in these offerings or services, to these approved third parties so they can communicate with you. Where required by law, we obtain your consent prior to such disclosure.
Threekit partners. We may share your personal information with certain partners that offer supplementary services to those provided by Threekit, such as partners that resell Threekit services, to the extent you consent to such sharing (where required by applicable law) or direct us to intentionally interact with such third parties.
Your organization. Where your organization is a customer or potential customer of ours, we may disclose your personal information to relevant people within your organization. For example, we may share a list of individuals attending a Threekit event, information about Threekit training courses you have completed, or inquiries from end users that should be addressed directly by the organization rather than by us.
Legal and protective disclosures. We may disclose personal information if we have a good-faith belief that disclosure is necessary to (a) conform to legal requirements or comply with legal process; (b) protect and defend our rights or property; (c) enforce our website terms of service; or (d) act to protect the interests of our customers, users, or others.
Business transitions. If Threekit goes through a corporate transaction — such as a merger, acquisition, financing, or sale of all or a portion of our assets — your personal information may be among the assets transferred, provided that we inform the actual or potential acquirer (or its agents and advisors) that it must use your personal information only for the purposes disclosed in this Privacy Policy.
With your consent. We may also ask for your consent to disclose your information to other unaffiliated third parties that are not described elsewhere in this Privacy Policy.

Under the CCPA/CPRA and certain other U.S. state privacy laws, the terms “sale” and “share” have specific statutory meanings. “Sale” generally means the exchange of personal information for monetary or other valuable consideration. “Share” generally refers to the disclosure of personal information to a third party for cross-context behavioral advertising, whether or not for consideration. See California Civil Code section 1798.140(ad) and (ah).

We do not sell personal information for monetary consideration. However, our use of advertising and analytics cookies, pixels, tags, and similar tracking technologies on our website, and our use of visitor-identification services, constitutes a “sale” or “share” of personal information under the CCPA/CPRA and analogous state privacy laws, by transferring online identifiers, IP address, device information, and browsing activity to third parties for cross-context behavioral advertising and lead-generation purposes.

6.1 Categories of Personal Information Sold or Shared

The categories of personal information involved in such sale or sharing are: identifiers (including online identifiers, IP address, and device identifiers); internet or other electronic network activity information; commercial information; and inferences drawn from the foregoing.

6.2 Categories of Third Parties to Whom We Sell or Share

The categories of third parties to whom we sell or share are: digital advertising platforms (currently including Google Ads, LinkedIn Ads, Meta Ads, Reddit Ads, and Microsoft Ads); analytics providers; and visitor-identification / identity-resolution providers.

6.3 Sensitive Personal Information

We do not sell or share sensitive personal information.

6.4 Children

We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age, and in particular not of children under thirteen (13) years of age. Where we obtain actual knowledge that a consumer is between thirteen (13) and sixteen (16) years of age, we will not sell or share that consumer’s personal information without their affirmative opt-in consent. For consumers under thirteen (13) years of age, we will not sell or share without the affirmative opt-in consent of a parent or guardian. In addition, we do not knowingly sell the personal information of, share the personal information of, or process for targeted advertising the personal information of, any consumer under eighteen (18) years of age, consistent with the heightened protections for minors under the Connecticut Data Privacy Act (as amended by Public Act 25-113, effective July 1, 2026), the Maryland Online Data Privacy Act, and analogous state laws.

6.5 How to Opt Out

You have the right to opt out of the sale or sharing of your personal information. To exercise this right, you may:

Click the “Do Not Sell or Share My Personal Information” link in the footer of our website, which opens our “Do Not Sell or Share My Personal Information” page. That page effectuates the opt-out directly through our consent management platform’s preference controls; you are not required to create an account, and we request no more information than is necessary to effectuate your request.
Enable a recognized opt-out preference signal, such as the Global Privacy Control (GPC), in your browser.
Submit a request via the methods described in Section 14 (How to Exercise Your Privacy Rights), including by emailing privacy@threekit.com or, for California residents, calling 312-549-8882.

Consistent with California Civil Code section 1798.135(b)(1) and 11 California Code of Regulations section 7025, we process Global Privacy Control signals and other recognized opt-out preference signals as a valid request to opt out of sale and sharing.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, subject to legal and contractual requirements. Our general retention practices are as follows:

Account data: account profile and identifier information, integration data, call recordings and transcripts, and other content stored as part of a customer account (where we act as the controller or business with regard to such content) are retained for the duration of the customer’s active relationship with us plus seven (7) years (for tax and legal reasons).
Operational logs, system logs, and backups: not more than twelve (12) months from the date of creation, unless a longer retention period is required for security investigation, legal hold, or regulatory compliance.
Website analytics, prospect data, and lead records: retained for as long as is reasonably necessary for sales and marketing follow-up, and in any event not more than thirty-six (36) months from the last point of engagement, after which time records are anonymized or deleted.
Job applicant data: retained for twenty-four (24) months from the date of application, unless a longer period is required by law or the applicant requests earlier deletion.
Cookie data: retained typically for thirteen (13) months or less, though consent records are retained as required by applicable law or regulations. Session cookies expire on session close, and persistent cookies expire as described in our cookie preferences tool.
Website and services: as necessary to provide our website and related services.
Legal obligations: as required to comply with legal obligations, resolve disputes, and enforce agreements, personal information is retained for the period required by applicable law or until the matter is resolved.

When personal information is no longer required, we will delete, anonymize, or otherwise securely dispose of it, except as required or permitted by applicable law. To request deletion of personal information, please email privacy@threekit.com or call 312-549-8882.

8. Security

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures may include:

Encryption of data at rest and in transit where appropriate
Access controls and authentication mechanisms
Monitoring and logging of system activity
Security testing and vulnerability management processes

We maintain policies and procedures designed to ensure appropriate access controls and data protection practices. However, the security of information transmitted through the internet can never be guaranteed. You are responsible for maintaining the security of your password or other forms of authentication involved in accessing password-protected or secured resources.

9. Job Applicants

If you apply for employment with us, the following provisions apply in addition to the rest of this Privacy Policy.

9.1 Categories Collected and Purposes

The categories of personal information we collect from job applicants are listed in Section 2.3 above. We use this information to evaluate your candidacy, conduct interviews and reference checks, communicate with you about your application, and comply with employment-related legal obligations.

9.2 California Notice at Collection

For California residents, this section serves as our notice at collection under 11 California Code of Regulations section 7012. The categories of personal information we collect and the purposes for which we collect them are as described in this Section 9 and in the chart in Section 3. The personal information of applicants is retained for twenty-four (24) months from the date of application, except as otherwise required by law. We do not sell or share applicant personal information.

9.3 Sharing of Applicant Personal Information

We may share applicant personal information with our applicant tracking system provider, background-check vendors (where we engage them and where the applicant has consented), and other service providers that support the hiring process under written contracts that restrict their use of the information.

10. Cookies and Tracking Technologies

We and our service providers and advertising partners use cookies, pixels, tags, web beacons, local storage, and similar tracking technologies on our website to operate and improve our services, to support analytics and functionality, to enable targeted advertising, and to identify visitors for sales follow-up.

As described in Section 6 (Sale and Sharing of Personal Information), certain of these technologies result in a “sale” or “share” of personal information under the CCPA/CPRA and analogous state privacy laws.

Consent management platform. Our website uses a consent management platform with region-based configurations. Visitors located in the European Economic Area, the United Kingdom, or Switzerland are shown a cookie consent banner, and non-strictly-necessary cookies and tracking technologies are not deployed for those visitors unless and until they affirmatively consent. Visitors located elsewhere, including in the United States, may opt out at any time as described in Section 6 and in our Cookie Notice. Consent choices are logged and may be changed or withdrawn at any time through the preference center available in the website footer.

Do Not Track and Global Privacy Control. Our website treats an enabled Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale and sharing of personal information, effectuated automatically through our consent management platform, as described in Section 6. Our website does not currently respond to “Do Not Track” (DNT) signals. This disclosure is made pursuant to California Business and Professions Code section 22575(b)(5).

11. International Data Transfers

11.1 Recipient Jurisdictions

Personal information that we collect, including personal information of data subjects located in the European Economic Area (“EEA”), the United Kingdom, and Switzerland, is processed and stored in the United States. The processing and storage of personal information in the United States may involve transfers to vendors and service providers identified in this Privacy Policy.

Our use of identity-resolution services (RB2B and Apollo, as identified in Section 5 of this Privacy Policy) involves transfers to U.S. recipients.

11.2 Adequacy Status of Recipient Jurisdictions

The United States is not the subject of a current European Commission adequacy decision under Article 45 of the GDPR covering all categories of U.S. data importers, although the EU–U.S. Data Privacy Framework provides a partial adequacy mechanism for U.S. organizations that have self-certified and remain in good standing, as confirmed by European Commission Implementing Decision (EU) 2023/1795 of July 10, 2023. The United Kingdom extension to the EU–U.S. Data Privacy Framework provides analogous adequacy under the UK GDPR for participating U.S. recipients, as confirmed by the UK Secretary of State’s Data Protection (Adequacy) (United States of America) Regulations 2023 (SI 2023/1028), effective October 12, 2023. Switzerland has issued an analogous adequacy decision recognizing the Swiss–U.S. Data Privacy Framework for participating U.S. recipients, effective September 15, 2024.

Brazil is the subject of an ongoing adequacy assessment by the European Commission but is not, as of the Last Updated date of this Privacy Policy, the subject of a current adequacy decision. Russia is not the subject of, and has not been recommended for, any current adequacy decision by the European Commission, the United Kingdom Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner.

11.3 Safeguards

Where required by applicable law, we implement appropriate safeguards under Article 46 of the GDPR (and analogous provisions of the UK GDPR and the Swiss Federal Act on Data Protection) to protect the personal information of EEA, UK, and Swiss data subjects when it is transferred to recipients in jurisdictions not covered by an adequacy decision. These safeguards include:

The European Commission’s Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of June 4, 2021, executed in the appropriate module (controller-to-controller, controller-to-processor, processor-to-processor, or processor-to-controller) with each non-adequate data importer;
The United Kingdom International Data Transfer Agreement and the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, issued by the Information Commissioner’s Office under section 119A of the Data Protection Act 2018 and effective March 21, 2022, for transfers from the United Kingdom;
Where applicable and where the U.S. recipient has self-certified and remains in good standing, reliance on the EU–U.S. Data Privacy Framework, its UK extension, and its Swiss extension, as listed at www.dataprivacyframework.gov;
Transfer impact assessments (TIAs) conducted in accordance with the Court of Justice of the European Union’s decision in Data Protection Commissioner v. Facebook Ireland Ltd. and Maximillian Schrems (Case C-311/18, judgment of July 16, 2020) (“Schrems II”);
Supplementary technical and organizational measures consistent with the European Data Protection Board’s Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (adopted in final form June 18, 2021), including encryption in transit and at rest, role-based access controls, access logging, and contractual restrictions on government-access disclosures; and
Identifying any reliance on the EU–U.S. Data Privacy Framework or its UK or Swiss extensions in our Data Processing Agreement with the relevant customer.

11.4 Particular Notes Regarding Identity-Resolution Vendors

Our use of RB2B and Apollo for EEA, UK, and Swiss visitors is conditional on consent (as described in our Cookie Notice) and on the transfer safeguards described in Section 11.3. EEA, UK, and Swiss visitors who wish to limit cookie-related transfers may use the controls described in our Cookie Notice, pending deployment of our consent management platform.

11.5 Russia Contractor Access

Where contractors and personnel located in Russia have access to personal information of EEA, UK, or Swiss data subjects, that access is conditional on (i) the execution of the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Agreement with the relevant contractor entity; (ii) a documented transfer impact assessment conducted in accordance with Schrems II; and (iii) supplementary technical and organizational measures, including encryption, role-based access controls, and access logging. We continue to monitor the geopolitical environment and the enforcement positions of EEA, UK, and Swiss supervisory authorities regarding Russia transfers, and we reserve the right to suspend or restructure Russia contractor access where required by applicable law or supervisory guidance.

11.6 Obtaining a Copy of the Applicable Safeguards

You may request a copy of the safeguards applicable to a transfer of your personal information — redacted as necessary to protect commercial confidentiality — by contacting us at privacy@threekit.com.

12. Your Privacy Rights

Depending on where you are located and how you interact with us, you may have certain legal rights with respect to the personal information we hold about you. Many of these rights are subject to verification of your identity, statutory exceptions, and our ability to comply consistently with our legal obligations.

12.1 Rights Generally Available Across Applicable Jurisdictions

Right to know and to access the categories and specific pieces of personal information we have collected about you.
Right to correct inaccurate personal information.
Right to delete personal information we have collected, subject to statutory exceptions.
Right to obtain a copy of your personal information in a portable and (where technically feasible) machine-readable format.
Right to opt out of the sale or sharing of your personal information (see Section 6.5).
Right to opt out of targeted advertising.
Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, where applicable. We do not currently engage in such profiling.
Right to limit the use and disclosure of sensitive personal information, where applicable.
Right to non-discrimination for exercising your privacy rights. We will not discriminate against you for exercising any of these rights.
Right to appeal a denial of a privacy rights request.
Right to object to the processing of your personal information carried out based on our legitimate interests (EEA, UK, and Switzerland), and to ask us to restrict that processing.
Right to withdraw your consent at any time, if we have collected and processed your personal information with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing conducted in reliance on lawful processing grounds other than consent.
Right to opt out of marketing communications sent by Threekit.

12.2 United States State-Specific Rights and Provisions

In addition to the rights above, residents of certain U.S. states have rights specific to their state of residence, including:

California (CCPA/CPRA). California residents have the rights set forth in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (California Civil Code section 1798.100 et seq.). These include the right to limit the use and disclosure of sensitive personal information, the right to opt out of sale and sharing, and the right to receive metrics regarding consumer requests where applicable. We honor recognized opt-out preference signals such as the Global Privacy Control.
Virginia (VCDPA). Virginia residents have the rights set forth in the Virginia Consumer Data Protection Act (Va. Code section 59.1-575 et seq.), including the right to appeal a denied request within sixty (60) days.
Colorado (CPA). Colorado residents have the rights set forth in the Colorado Privacy Act (Colo. Rev. Stat. section 6-1-1301 et seq.). Colorado residents may also opt out of targeted advertising and profiling through a universal opt-out mechanism approved by the Colorado Attorney General.
Connecticut (CTDPA). Connecticut residents have the rights set forth in the Connecticut Data Privacy Act (Conn. Gen. Stat. section 42-515 et seq.). Effective July 1, 2026, amendments to the Connecticut Data Privacy Act (Public Act 25-113) additionally provide Connecticut residents the right to obtain a list of the specific third parties to which the controller has sold personal data and the right to contest certain profiling decisions, and extend that law to controllers that sell personal data regardless of processing volume.
Utah (UCPA). Utah residents have the rights set forth in the Utah Consumer Privacy Act (Utah Code section 13-61-101 et seq.).
Other U.S. states. Residents of Texas, Tennessee, Iowa, Indiana, Montana, Oregon, New Hampshire, New Jersey, Delaware, Minnesota, Maryland, Nebraska, Kentucky, and Rhode Island have analogous rights under their respective state privacy laws, including, where applicable: the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Chapter 541); the Tennessee Information Protection Act (Tenn. Code section 47-18-3201 et seq.); the Iowa Consumer Data Protection Act (Iowa Code Chapter 715D); the Indiana Consumer Data Protection Act (Ind. Code section 24-15-1 et seq.); the Montana Consumer Data Privacy Act (Mont. Code section 30-14-2801 et seq.); the Oregon Consumer Privacy Act (Or. Rev. Stat. section 646A.570 et seq.); the New Hampshire Privacy Act (RSA Chapter 507-H); the New Jersey Data Privacy Act (N.J.S.A. 56:8-166.4 et seq.); the Delaware Personal Data Privacy Act (Del. Code Tit. 6, Chapter 12D); the Minnesota Consumer Data Privacy Act (Minn. Stat. section 325O.01 et seq.); the Maryland Online Data Privacy Act (Md. Code Ann., Com. Law section 14-4601 et seq.); the Nebraska Data Privacy Act (Neb. Rev. Stat. section 87-1101 et seq.); the Kentucky Consumer Data Protection Act (KRS Chapter 367); and the Rhode Island Data Transparency and Privacy Protection Act (R.I. Gen. Laws section 6-48.1-1 et seq.). Oregon and Minnesota residents may additionally request a list of the specific third parties to which their personal data has been disclosed.
Washington (My Health My Data Act). Washington residents have rights under the My Health My Data Act (RCW Chapter 19.373) with respect to consumer health data. Although our products are oriented to business sales workflows and we do not design our products to process consumer health data, to the extent consumer health data of a Washington resident is inadvertently collected through our website, we will treat that data in accordance with the requirements of the My Health My Data Act.
Nevada (NRS Chapter 603A). Nevada residents have rights regarding consumer health data under Nevada Revised Statutes Chapter 603A (sections 603A.500–603A.525). The disclosures and processing standards in the preceding bullet apply equally to consumer health data inadvertently collected from Nevada residents.

You may exercise your rights by contacting us as described in Section 14. We will respond in accordance with applicable law. We will not discriminate against you for exercising your rights.

12.3 EEA, UK, and Swiss Specific Provisions

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following supplemental provisions apply.

Controller

Threekit Inc., having its principal place of business at 100 S Wacker Dr., Suite 450, Chicago, IL 60606, is the controller of personal information collected through our website and other direct-marketing channels. With respect to personal information submitted to our products by or on behalf of our business customers, the customer is the controller and we are the processor.

Legal bases

We process personal information on the legal bases set forth in Section 4, including: (a) performance of a contract with you or to take steps at your request prior to entering into a contract (Art. 6(1)(b)); (b) compliance with a legal obligation (Art. 6(1)(c)); (c) our legitimate interests in operating, securing, improving, and marketing our products, where those interests are not overridden by your rights and freedoms (Art. 6(1)(f)); and (d) your consent, where required (Art. 6(1)(a)).

International transfers

As described in Section 11, personal information collected in the EEA, UK, or Switzerland is transferred to the United States and may be accessed from other jurisdictions. We rely on standard contractual clauses, the UK International Data Transfer Addendum, and other appropriate safeguards as required.

GDPR rights

In addition to the rights listed in Section 12.1, you have the right under Articles 15–22 of the GDPR (and the corresponding provisions of UK and Swiss law) to access, rectify, erase, restrict the processing of, and port your personal information, and to object to processing carried out on the basis of our legitimate interests.

Right to lodge a complaint

You have the right under Article 77 of the GDPR to lodge a complaint with the data protection supervisory authority of your habitual residence, place of work, or place of the alleged infringement. We would, however, appreciate the opportunity to address your concerns first, and you may contact us at privacy@threekit.com.

13. Notice of Financial Incentive

We do not currently offer financial incentives or programs that provide a price or service difference in exchange for the retention or sale of personal information within the meaning of California Civil Code section 1798.125(b) or 11 California Code of Regulations section 7016. If we offer such a program in the future, we will provide a notice of financial incentive that describes the material terms of the program, including a good-faith estimate of the value of personal information to the business and the method we used to calculate that value, before any consumer opts in to the program.

14. How to Exercise Your Privacy Rights

14.1 Submitting a Request

To exercise your privacy rights, you may:

Email privacy@threekit.com
For California residents, call us at 312-549-8882
Send written correspondence to: Threekit Inc., 100 S Wacker Dr., Suite 450, Chicago, IL 60606

Please indicate the right you wish to exercise and provide sufficient information for us to verify your identity and respond.

14.2 Identity Verification

We will take reasonable steps to verify your identity before responding to a request. The steps we take will be proportionate to the sensitivity of the personal information at issue and the risk of harm posed by unauthorized access, consistent with the verification requirements at 11 California Code of Regulations section 7060 et seq. and analogous provisions under other applicable laws. We may decline to act on a request where we are unable to verify the identity of the requestor.

14.3 Response Timing

We will acknowledge receipt of your request and provide a substantive response within the period required by applicable law (generally forty-five (45) days under most U.S. state privacy laws and one (1) month under the GDPR). Where permitted, we may extend the response period and will notify you of any extension.

14.4 Authorized Agents

You may use an authorized agent to submit a request on your behalf. For California consumers, we will require the agent to provide a written, signed authorization from you (or a valid power of attorney), and we may require you to verify your identity directly with us before acting on the request. See 11 California Code of Regulations section 7063.

14.5 Appeals

If we deny your privacy rights request in whole or in part, you may appeal that decision by emailing privacy@threekit.com with the subject line “Privacy Rights Appeal.” We will review the appeal and respond to you within sixty (60) days of receipt, or within the time period required by applicable law. If we deny your appeal, we will provide a written explanation of the reasons and inform you of your right to lodge a complaint with the applicable regulator (for U.S. consumers, the state attorney general; for individuals in the EEA, UK, or Switzerland, the data protection supervisory authority in your country of residence).

14.6 Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights, including by denying goods or services, charging different prices, or providing a different level or quality of goods or services.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at privacy@threekit.com.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date above and provide notice as required by applicable law. If we make a material change to this Privacy Policy or to our data practices that applies retroactively to previously collected personal information, we will notify affected consumers electronically or through other reasonable means and, where required by applicable law (including in Connecticut and Minnesota), provide an opportunity to withdraw consent to any further materially different collection, use, or sharing of previously collected personal information.