Privacy notice

This notice covers T3A Adviser at t3aadviser.uk: the Briefing, Perspectives, your Workspace and CPD log, teams and licences, and ASK Tony. The 3rd Act's own website, t3a.uk, has a notice of its own. Test copies of the platform, at addresses ending t3aadviser.uk, keep what you enter in their own database, which is deleted within two days of the copy's last change.

The short version

• We are The 3rd Act Ltd. Write to press@t3a.uk about anything in this notice.
• You accept this notice before you use T3A Adviser. Before anything beyond the public pages opens to you, we ask you to read and accept it, and we ask again whenever we publish a new version.
• You sign in with your email address. We send you a link. There is no password.
• We log what you read while you are signed in. It shows which pages you opened and for how long. That log builds your CPD log, which is part of the service. T3A's super administrators also see it, with your email address beside it, to improve the service and to find readers and teams who are not getting value from it.
• If you belong to a team, your colleagues see your email address and role, and your team's administrators see the team's licence.
• We keep a record of what the platform decided, such as an invitation sent or a seat changed, which the platform cannot edit or delete. It holds your account's identifier, never your name, email address or words you wrote. Deleting your account leaves the identifier in it.
• Authorised T3A staff can read your ASK Tony questions and answers, including the recorded workings and sources, for support and quality review. We record which member of staff opens a run.
• Please do not identify your clients when you ask ASK Tony a question. Describe the situation, not the person.
• Your email address, payment details and our request logs are handled outside the UK by the companies that send our email, take payments and store our logs, and our database company's support staff can reach the database from the United States and Singapore. Each transfer is protected by UK adequacy regulations or by contract terms approved under UK law. See Information that leaves the UK.
• You can see, correct, export or delete your information, object to some uses of it, and complain to us or to the Information Commission (ICO) at any time.

Who we are

The 3rd Act Ltd is responsible for your information on T3A Adviser (the "controller", in data protection law).

• The 3rd Act Ltd, a company registered in England and Wales, number 16475980
• Registered office: 128 City Road, London EC1V 2NX
• Email: press@t3a.uk

We have not appointed a data protection officer. Questions about this notice, requests about your information and complaints go to press@t3a.uk, and The 3rd Act answers them.

Accepting this notice

Using T3A Adviser beyond its public pages means accepting this notice. The first time you sign in, and again whenever we publish a new version, we show you a page that links to it and asks you to accept. Until you do, nothing you read is logged against you, and only the public pages, this notice, the download of your CPD log, your account's deletion and signing out are open to you. We record which version you accepted and when.

If you do not want to accept it, sign out, or delete your account from that page.

What we collect, why, and on what basis

The law asks us to give a legal reason for each use of your information. We rely on three:

• Contract: we need the information to give you the service you signed up for.
• Legitimate interests: we have a good reason of our own, which we name below, and it does not override your interests. You can ask us for the assessment we made, and you can object (see Your right to object).
• Legal obligation: the law requires us to keep or disclose it.

Signing in and your account

What: your email address; the date your account was opened; each time you sign in, from the first, which is recorded before you accept this notice; which version of this notice you accepted and when; if you came to us from a campaign link, the campaign details in the link (its source, medium, name, term and content) and the page where you signed up. If a T3A colleague sets it, your display name.

Why: to create your account, sign you in, and tell you apart from other readers.

Basis: contract. An email address is the only thing we need, and without one you cannot sign in. You can still read the Briefing's front pages and the other public pages without an account.

How long: until you delete your account, or ask us to. If you ask for a sign-in link and never follow it, the address stays in our sign-in service until you ask us to remove it.

Teams, licences and invitations

What: the name of your team; who belongs to it; each member's role (member or administrator) and whether they hold a seat; invitations, with the address invited, who sent it and when it was answered.

Why: a team buys seats on a licence, and its administrators decide who holds them.

Basis: contract, for the team's members. For someone invited who is not yet a member, legitimate interests: the team's interest in inviting a colleague, and ours in delivering the invitation.

How long: a membership lasts until a team administrator removes you or you delete your account. An invitation lapses after 14 days; the address invited is kept with it until you ask us to remove it.

Paying for seats

What: the team's name, the buying administrator's email address, the number of seats, and the state of the subscription. Stripe collects your card, billing address and any tax ID on its own page, and may update the team's name and address from what you enter there. We never see or store your card details; we record only whether a card is on file.

Why: to sell and manage a team's licence.

Basis: contract; and legal obligation, for the financial records the law requires us to keep.

How long: we keep the team's licence record, and the customer record in our Stripe account (the team's name and the buyer's email address), while the team has a licence and afterwards. Deleting your account does not remove the customer record from Stripe; ask us and we will, unless the law requires us to keep it as a financial record. Stripe also keeps its own records, for fraud prevention and its legal duties, under its own privacy notice.

What you read, and your CPD log

What, once you are signed in and have accepted this notice: each page you open; how long you spend reading it, counted in 15-second steps while the page is in view; the website (not the full address) of any link you follow off the platform; the page or site that sent you here, and the campaign details in the link; the type of device, browser and operating system (not the full description your browser sends); the region you are in, worked out by Google's load balancer (not your IP address); your language setting and window width; your team, whether your access is free or paid for by subscription or agreement, and which sign-in session it was; and the actions you take, such as asking ASK Tony a question or sending an invitation (never the words of a question).

Why, and on what basis:

1. To build your CPD log, which you see in your Workspace and can download. Basis: contract. The CPD log is part of the service, and it is built from this log.
2. To improve the service, and to look after the readers and teams who use it. T3A's super administrators see a report that lists readers by email address, with what they read and how much they use the platform, and can download it. Basis: legitimate interests. Our interests are learning what readers find useful, so we can improve the Briefing and ASK Tony for them; and seeing which readers and teams are not getting value from the platform, so we can contact them to ask why, or to offer a package that suits them better. You can object; see Your right to object.

Before you accept, and visitors who are not signed in: we count each page viewed, with the page or site that sent you, the campaign details in the link, the type of device, browser and operating system, the region, your language setting and window width. Nothing ties one visit to another or to you, and we do not identify you. A visitor who is not signed in holds only the form cookie described under Cookies, and only on pages that are not public, such as the sign-in page; once you sign in you also hold the cookies that keep you signed in, before you accept. Basis: legitimate interests, and the exception in the law for statistics about how a website is used: knowing how people find and use the platform. To stop even this, turn on Global Privacy Control in your browser, and we count none of your page views until you accept this notice. It does not stop the record of your sign-ins, described under Signing in and your account.

How long: the log of what you read until you delete your account. Counts of visits identify nobody, and we keep them without a time limit.

ASK Tony

What: the questions you ask, your replies to its clarifying questions, and its answers.

Why: to answer you, and to let you read your questions and answers again.

Basis: contract.

Who sees it: you and authorised T3A staff. Staff can read your questions, answers and recorded workings and sources to provide support, investigate mistakes and review the quality of the service. This access does not depend on you flagging an answer or granting access to an individual run. Staff review is read-only: it does not change your questions or answers or run another answer on your behalf. We record which member of staff opens a run. The usage report shows only how many questions you asked, without their words. The engineers who run the database can reach it, as described under Who can see your information.

How long: until you delete your account.

ASK Tony is still being built. It is being built to use a language model to read questions. Today it answers from a fixed set of worked examples. Your question is stored in our database (Supabase) and passes through Google Cloud, which host the platform for us. No other company receives it, and we do not use questions to train or improve any model. Before ASK Tony sends questions to a company that provides a language model, we will publish a new version of this notice naming that company, saying where it handles questions and whether it may keep or learn from them, and ask you to accept it.

About your clients. ASK Tony needs the facts of a situation (ages, figures, dates, the kind of plan), not who the person is. Please do not include a client's name, address, date of birth or anything else that identifies them. If you do, it is kept with your question until you delete your account. See also If your adviser asked ASK Tony about you.

The record of what the platform decided (the audit trail)

What: each decision the platform makes, with when it happened, what was decided, and the identifiers of the accounts, teams and records involved. For example: a version of this notice accepted, an invitation sent or refused, a member removed, seats changed, a question answered or declined. It never holds a name, an email address or the words of a question.

Why: so that every decision can be traced and explained afterwards, to you, to your firm, or to anyone entitled to ask.

Basis: legitimate interests. Our interest is being able to show what the platform did and why, which is what advisers rely on it for.

How long: for as long as we run the platform. The platform cannot change or delete an entry: the database refuses it to every account the platform runs as. When you delete your account, entries keep your account's identifier. On their own they do not say who that was once your account is gone, though an invitation sent to you, while it is kept, and our Stripe customer record of a licence you bought can still be linked to them.

Keeping the platform secure and working

What: each request your browser makes, recorded by Google's load balancer, which receives every request before it reaches us: your IP address, the description of your browser and device that it sends with each request, and the full address requested, which includes the one-time code in a sign-in link and anything typed into a search box; records of how the platform handled each request, with the same details; and records of sign-in requests kept by our sign-in service.

Why: to keep the platform running, find faults, and stop abuse. The load balancer blocks an address for ten minutes when it sends a flood of requests.

Basis: legitimate interests: keeping the platform and your information secure.

How long: request logs and records of requests 30 days. Sign-in records 7 days.

Emails we send you

The platform sends two kinds of email, both through Postmark: a link to confirm your address and sign in, and a sign-in link each later time you ask. An invitation to a team arrives as one of these. We do not track whether you open them or click their links. If your team's licence is invoiced, Stripe emails the invoices.

Basis: contract, to sign you in; for an invitation to someone who is not yet a member, legitimate interests, as under Teams, licences and invitations.

The platform sends no marketing email. T3A's people may write to you or your team's administrator about how you use the platform or a package that suits you better, as described under What you read, and your CPD log. Tell us to stop and we will.

If you reply to one of our emails, the reply is kept by Postmark and not read. If an email to you bounces or you mark it as spam, Postmark keeps your address on a block list so it does not write to you again.

If you write for T3A

If you write for the Briefing or Perspectives, your name and portrait are published with your pieces. Basis: our agreement with you as a writer. Kept while the piece is published.

Who can see your information

Inside the platform:

The engineers who run the platform can reach the database directly to keep it working. The platform itself cannot change the audit trail.

Outside the platform: the companies below provide parts of the service and act on our instructions, except where we say otherwise.

Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal duties. For those it is responsible itself, under Stripe's privacy notice.

We give information to the police, a regulator or a court only when the law requires it. If The 3rd Act's business is sold, the buyer becomes responsible for your information and must keep to this notice.

Information that leaves the UK

You can ask us for a copy of these safeguards.

Cookies

We set four cookies. All are ours and all are needed for the platform to work, so we do not ask for consent to them. No advertiser or other company sets or reads cookies on T3A Adviser, and we store nothing else on your device.

The Briefing's front pages and the other public pages set no cookie at all. The sign-in page sets only __Host-t3a_form. Signing out removes the first three.

How long we keep it

Deleting your account

You can delete your account yourself from your account menu, or ask us to. Deleting it removes at once, from the platform's database:

• your sign-in and your account;
• your acceptance of this notice;
• your place on a team, and any role you held;
• the invitations you sent;
• your questions and ASK Tony's answers;
• the log of what you read, and with it your CPD log. Download your CPD log first if you want to keep it.

Copies in our database backups go when those backups expire, after 7 days.

These stay:

• The audit trail keeps your account's identifier, as described above.
• An invitation that was sent to you keeps your email address with the team that sent it. Ask us and we will remove it.
• Our Stripe account keeps your email address on the customer record of a licence you bought, as described under Paying for seats. Ask us and we will remove it.
• Our sign-in service's own records of your sign-ins, until they expire after 7 days.
• Logs and records of requests keep your IP address until they expire, after 30 days.
• Postmark keeps the emails it sent you for 45 days.

Your rights

You can ask us to:

• see the information we hold about you, and get a copy (access);
• correct anything that is wrong (rectification);
• delete it (erasure). You can delete your account yourself; the audit trail and the records the law requires us to keep are the limits;
• stop using it while a question about it is settled (restriction);
• give it to you or another organisation in a common format (portability). Your CPD log already downloads as a spreadsheet.

Write to press@t3a.uk. It is free. We answer within one month, and tell you within that month if a complicated request needs up to two more. We may ask you to confirm it is you, usually by replying from the address on your account.

Your right to object

Where we rely on legitimate interests, you can object at any time to our using your information that way. That covers the usage report and our contacting you about how you use the platform, the audit trail, security, invitations, and details about a client in an adviser's question. Write to press@t3a.uk.

We will stop unless our reasons for continuing outweigh your interests, rights and freedoms, or we need the information to deal with a legal claim, and we will tell you which. If you ask us to stop contacting you about packages or offers, we always stop.

Automated decisions

The platform makes routine decisions by fixed rules: whether a sign-in link is valid, whether you have accepted the current version of this notice, whether you hold a seat and so may use ASK Tony, whether a team has free seats, whether an invitation can be sent, and whether a burst of requests from one address is blocked for ten minutes. None of these changes your legal rights or has a comparable effect on you, and a person at T3A will review any of them if you ask.

ASK Tony makes no decisions about you or your clients. It answers your question, and what you do with the answer is your professional judgement.

If you have been invited

If a team administrator invited you, we received your email address from them. If T3A staff invited you to a licence your firm agreed with T3A, your address came from the billing contact your firm gave us for that agreement. When the invitation is sent, our sign-in service creates an unconfirmed sign-in record for your address, and Postmark delivers the email. Your address is kept with the invitation, which the team's administrators and T3A staff can see, until you ask us to remove it. The email you receive is our standard sign-in email; it does not say which team invited you until you follow the link. If you do not want the invitation, ignore it. It lapses after 14 days. You have all the rights in this notice.

If your adviser asked ASK Tony about you

Advisers use ASK Tony to check technical questions about financial planning. An adviser may describe a client's circumstances, such as age, income, pension or family situation, and occasionally health. We ask advisers not to identify their clients, and ASK Tony does not need to know who you are.

If your adviser did include details about you, we received them from your adviser. We hold them only inside your adviser's question, which only your adviser can see on the platform, until your adviser deletes their account. We use them only to answer the question. The basis is legitimate interests: answering an adviser's technical question. Your adviser knows what they entered and can usually help fastest. You can also write to us directly at press@t3a.uk, and you have all the rights in this notice.

Complaints

If you are unhappy with how we have handled your information, tell us at press@t3a.uk. We will acknowledge your complaint within 30 days, look into it, and tell you what we found and what we are doing about it without undue delay.

You can also complain to the Information Commission (ICO) at any time, whether or not you have complained to us: ico.org.uk/make-a-complaint, or 0303 123 1113. If you live or work in the European Economic Area, you can also complain to the data protection authority there.

Changes to this notice

When this notice changes, we publish the new version at its own address and keep the earlier versions readable. A new version takes effect for you when you accept it: the next time you use T3A Adviser, we show you what changed and ask you to accept.