Privacy Policy

This Privacy Policy explains how Throughline LLP ("Throughline", "we", "us", or "our") collects, uses, shares, and protects personal data when you visit our website, use our app, contact us, or engage us as a client. It applies globally to everyone who interacts with us, regardless of where you are located.

We've written this policy to give you transparency about our practices and to set out your rights under privacy laws that may apply to you, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs), the New Zealand Privacy Act 2020 and Information Privacy Principles (IPPs), the Singapore Personal Data Protection Act 2012 (PDPA), and applicable US federal and state privacy laws.

If you have any questions about this policy or how we handle your data, contact us at privacy@throughlineaudit.com.

1. Who we are

Throughline LLP is a certified public accounting (CPA) firm and certification body (CB) that provides compliance audit services.

For the purposes of data protection law, Throughline acts as:

• A data controller (or, in equivalent terms under other laws, the entity that determines the purposes and means of processing) for personal data we collect about website visitors, app users, prospects, and the individual representatives of our clients (e.g. contact information, analytics, business correspondence).
• A data processor (or service provider) for personal data contained within client systems and documentation that we audit on behalf of our clients. In that role, we process such data only on documented instructions from the client, under our agreed terms of service.

This Privacy Policy covers our controller activities. Our processing activities on behalf of clients are governed by the Data Processing Agreement we enter into with each client.

We have appointed a Data Protection Officer, who can be reached at privacy@throughlineaudit.com.

2. The personal data we collect

2.1 Contact information

When you fill out a form, request a demo, sign up for our app, email us, or otherwise interact with us, we collect information such as your name, business email, phone number, job title, employer, and the content of your communications with us.

2.2 Website and app analytics

When you use our website or app, we automatically collect technical and usage information such as IP address, device and browser type, operating system, referring URL, pages viewed, features used, session duration, and approximate location derived from your IP. This is collected through cookies and similar technologies.

2.3 Company and engagement information

We collect information about your company and your role within it (industry, size, stage, systems in use, business needs, and context) so we can align our services to your situation and provide relevant support. We may supplement this with information from third-party data providers (see Section 4).

2.4 Client audit data

When you become an active client, we receive documentation, configuration information, logs, and other data about the systems we are engaged to audit. This may include personal data relating to your employees, customers, or end users. We process this data as your processor, in accordance with our Terms of Service.

2.5 Information from third parties

We may receive information about you or your organisation from publicly available sources (e.g. company websites, LinkedIn), from data enrichment providers such as Clay, and from platforms or consultancies that you work with on your security compliance. Where we obtain your contact details from a third party, we will tell you the source the first time we contact you, in line with Article 14 of the GDPR.

We do not knowingly collect special category personal data under the GDPR or sensitive information under the Australian Privacy Act (e.g. health, ethnicity, political opinions, biometric or genetic data, criminal record). Please do not send us such data unless we have specifically agreed how to handle it under a written agreement.

3. How we use personal data

We use personal data for the purposes set out below. Where the EU or UK GDPR applies, we also identify the lawful basis we rely on for each purpose, as required by those laws. For individuals in Australia, New Zealand, Singapore, and other regions, the table sets out the purposes for which we collect, hold, use, and disclose your personal information.

Where we rely on legitimate interests under the GDPR, we have completed a balancing assessment and concluded that our interests are not overridden by your rights and freedoms. You can request more information about this assessment by contacting us.

We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects.

4. Who we share personal data with

We share personal data with the following categories of recipients:

• Service providers (subprocessors) who help us operate our business. Our current key subprocessors are:
  • Google, workspace, cloud infrastructure, and analytics
  • HubSpot, customer relationship management and marketing
  • Clay, data enrichment and sales intelligence
  • Anthropic, AI-assisted analysis and tooling
• Government authorities, regulators, and law enforcement, if we are legally required to disclose information.
• Acquirers or successors in connection with a merger, acquisition, financing, or sale of all or part of our business.

We require all subprocessors to provide appropriate safeguards and to process personal data only on our instructions and in line with applicable law. We do not sell personal data, and we do not share personal data for cross-context behavioural advertising.

5. International transfers and data hosting

Throughline is a globally operating firm, and personal data we collect may be processed in countries other than the one in which you are located.

Default hosting. By default, personal data we hold as a controller is hosted in the United States, where most of our subprocessors operate.

Regional accommodations. For clients in the European Economic Area, we will accommodate hosting within the EU on request, where commercially feasible. For clients in Australia, New Zealand, Singapore, and other jurisdictions with data localisation expectations, we accommodate local hosting on a case-by-case basis where expressly required by law or by the engagement.

Safeguards for international transfers. Where we transfer personal data across borders, we rely on appropriate safeguards under the law that applies to the data:

• For data subject to the EU or UK GDPR: transfers to countries the European Commission or UK government has determined offer an adequate level of protection; Standard Contractual Clauses (supplemented, where applicable, by the UK International Data Transfer Addendum); and the EU to US Data Privacy Framework and the UK Extension, where the recipient is certified.
• For personal information subject to the Australian Privacy Act: before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles your information in a way consistent with the Australian Privacy Principles, as required by APP 8.
• For personal information subject to the New Zealand Privacy Act 2020: we disclose personal information to overseas recipients only where the conditions of IPP 12 are satisfied, for example, where the recipient is subject to comparable safeguards or has agreed contractually to protect the information to a comparable standard.
• For personal data subject to the Singapore PDPA: we transfer personal data overseas only where the recipient is bound by legally enforceable obligations to provide a standard of protection at least comparable to that under the PDPA, in line with Section 26 and the Personal Data Protection Regulations.
• For other regions: we apply equivalent protections through contractual commitments with our subprocessors, vendor due diligence, and adherence to the principles set out in this policy.

You can request a copy of the safeguards in place for a specific transfer by contacting us.

6. How long we keep personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Indicative retention periods:

• Prospect and marketing contact data: until deletion is requested.
• Client records and engagement correspondence: for the duration of the engagement and 7 years thereafter, to support our contractual and compliance obligations as a CPA firm and certification body.
• Website and app analytics: 12 months in identifiable form, unless deletion is requested sooner.
• Records relating to legal claims: for the duration of any applicable limitation period.

7. Your rights

Subject to certain conditions and exceptions in applicable privacy law, you have the right to:

• Access the personal data we hold about you and receive a copy
• Correct or rectify inaccurate or incomplete personal data
• Delete or erase your personal data
• Restrict how we process your personal data
• Object to processing based on legitimate interests, including direct marketing (you can object to marketing at any time, with no need to give a reason)
• Data portability, receive certain personal data in a structured, commonly used, machine-readable format
• Withdraw consent at any time where we rely on consent (this does not affect the lawfulness of processing carried out beforehand)
• Deal with us anonymously or under a pseudonym where this is lawful and practicable (relevant to individuals in Australia under APP 2 and New Zealand under IPP 1)
• Lodge a complaint with a privacy regulator (see below)

Not all of these rights apply in every jurisdiction, and some are subject to exceptions. We will tell you if an exception applies to your specific request.

To exercise any of these rights, email privacy@throughlineaudit.com. We aim to respond within 30 days. Under the GDPR, this period may be extended by up to two further months for complex requests, in which case we will tell you within the first month. We may need to verify your identity before acting on a request.

If your personal data sits within data we process on behalf of a client (for example, because you are a customer or employee of one of our clients), we will direct you to the client and assist them in responding.

Privacy regulators. You can complain to a privacy regulator with jurisdiction over your circumstances. Depending on where you are located, this may include:

• United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk
• European Economic Area: your local Data Protection Authority. A list is available at edpb.europa.eu
• Australia: the Office of the Australian Information Commissioner (OAIC), oaic.gov.au
• New Zealand: the Office of the Privacy Commissioner (OPC), privacy.org.nz
• Singapore: the Personal Data Protection Commission (PDPC), pdpc.gov.sg
• United States: the Federal Trade Commission (ftc.gov), your state Attorney General, or other regulator with jurisdiction over your circumstances
• Elsewhere: the regulator with jurisdiction in your country or region

We'd appreciate the chance to address your concerns directly first, please do contact us before escalating, if you're comfortable doing so.

8. Security

We maintain appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, and destruction. These include access controls, encryption in transit and at rest where appropriate, logging and monitoring, vendor due diligence, and staff training. No system is completely secure, and we cannot guarantee absolute security; if we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (such as the ICO, the OAIC under the Australian Notifiable Data Breaches scheme, the OPC under the New Zealand notifiable privacy breach regime, the PDPC under the Singapore PDPA, or the relevant US state authority) and, where required, affected individuals in line with our legal obligations.

9. Cookies and similar technologies

We use cookies and similar technologies on our website and app for essential functionality, analytics, and (where you have consented) marketing. You can manage your preferences through our cookie banner or your browser settings. For more information, see our Cookie Policy.

10. Children

Our services are directed at businesses, not children. We do not knowingly collect personal data from anyone under 16 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, services, or legal obligations. When we do, we will update the "Last updated" date at the top and, for material changes, take reasonable steps to notify you (for example, by email or a prominent notice on our website).

12. Contact us

For privacy questions, requests, or complaints, contact:

Throughline LLP
Email: privacy@throughlineaudit.com