Version: v3.0

Effective date: 27 April 2026.

1. Who We Are

Third Mind Kft. ("we", "us", "our") is the data controller for personal data collected through the Accord Blueprint interview process. We are a Hungarian private limited company.

We do not act as a data processor for our Customers. Customers receiving the Blueprint Report are separate controllers for their use of it. For UK data subjects, UK GDPR applies in addition to EU GDPR; the UK Information Commissioner's Office (ICO) is your local supervisory authority.

2. What Data We Collect

During your Accord Blueprint interview, we collect the following categories of personal data:

• Your name, email address, job title and department.
• Your responses to interview questions about your organisation's processes, team structures, technology use and AI readiness.
• Your opinions and views on organisational culture, team attitudes and ways of working.
• Financial data you choose to share (staff costs, budget information, revenue figures). You may decline to answer financial questions at any time.
• Technical metadata: session timestamps, message counts, session duration.

3. Why We Process Your Data

We process your personal data for the following purposes:

• To conduct an AI readiness assessment commissioned by your employer.
• To generate an Accord Blueprint report containing aggregated and anonymised findings across all participants from your organisation.
• To identify data gaps and request clarification where needed.
• To send you information about AI services, resources and knowledge from Third Mind that may be relevant to your role — only where you have given consent. You can opt out at any time.

4. Lawful Basis for Processing

We process your data on the basis of legitimate interest (GDPR Article 6(1)(f)). Our legitimate interest is providing an AI readiness assessment service that your employer has commissioned. We have conducted a Legitimate Interest Assessment (available on request) confirming that your rights and interests are protected through anonymisation, voluntary participation, and the business context of the data collected.

Marketing Communications

Where we send marketing communications, we rely on consent under GDPR Article 6(1)(a). As a Hungarian-operated business, Hungarian Act XLVIII/2008 §6 requires prior opt-in consent for direct electronic marketing. This is stricter than the UK PECR "soft opt-in" rule, so we apply the stricter standard everywhere:

• Primary contacts: opt-in checkbox at checkout, unticked by default.
• Nominees: separate opt-in checkbox on the welcome screen, unticked by default.

We record the consent (timestamp, IP address, version of the form) for evidence. You can withdraw consent at any time by emailing privacy@3rdmind.co.uk or using the unsubscribe link in any message.

5. Who We Share Your Data With

Your personal data is shared with the following recipients:

A current, versioned sub-processor list is published at 3rdmind.co.uk/sub-processors. Material changes to the list will be notified at least 30 days in advance.

6. International Data Transfers

Processing of your interview content takes place inside the EU/EEA (AWS Bedrock EU, Frankfurt). Storage is inside the EU/EEA. We do not transfer interview content outside the EU/EEA.

A limited amount of website analytics metadata may be processed by Wix.com Ltd in Israel. Israel has an EU adequacy decision (Commission Decision 2011/61/EU), so no additional transfer mechanism is required. For UK data subjects, the UK has its own adequacy regulations recognising EU/EEA and Israel as adequate jurisdictions, so the same conclusion applies under UK GDPR.

7. How Long We Keep Your Data

After the retention period, your data is permanently deleted from all systems, including backups. Your employer may request earlier deletion of all engagement data.

8. AI-Powered Processing

Your interview is conducted by Accord, an AI system built by Third Mind Kft. The underlying language model is Anthropic's Claude, accessed through AWS Bedrock in the EU region (Frankfurt). This means:

• You are interacting with an AI agent, not a human interviewer.
• Your responses are processed by AI to extract structured, aggregated data about your organisation.
• The Blueprint Report includes AI-generated readiness scores across five dimensions (Strategy, Organisation, Technology, Capability, Governance). Scores describe the organisation, not any individual.
• A Third Mind consultant reviews the final Blueprint before delivery.
• Individual-level decisions about you (recruitment, promotion, discipline, restructuring) are not within the scope of this assessment and are contractually prohibited in our Terms & Conditions §11A.

The readiness scores are automated processing about your organisation. They do not produce legal or similarly significant effects on you personally. If you believe an assessment affects you and you want a human to review it, email privacy@3rdmind.co.uk and we will arrange a review within 14 days.

9. Your Rights

Under EU GDPR (and UK GDPR, where applicable), you have the following rights:

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your data (subject to any overriding legal obligations).
• Right to restriction: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing), you can withdraw at any time.

To exercise any of these rights, email privacy@3rdmind.co.uk. We will respond without undue delay and in any event within one month of receiving your request. If the request is complex, we may extend this by a further two months; we will tell you within the first month if we need to do so.

10. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint. Our lead supervisory authority is:

If you are resident in another country, you may also complain to your local supervisory authority. Examples:

• United Kingdom — Information Commissioner's Office (ICO), ico.org.uk
• Germany — the data protection authority of the Land where you live (e.g. BayLDA in Bavaria, HmbBfDI in Hamburg)
• France — Commission Nationale de l'Informatique et des Libertés (CNIL), cnil.fr
• Ireland — Data Protection Commission, dataprotection.ie
• Austria — Datenschutzbehörde, dsb.gv.at
• Italy — Garante per la protezione dei dati personali, garanteprivacy.it
• Spain — Agencia Española de Protección de Datos (AEPD), aepd.es

A full list of EU data protection authorities is available at edpb.europa.eu.

11. Changes to This Notice

We may update this Privacy Notice from time to time. The current version and its effective date are always published at 3rdmind.co.uk/privacy and linked from the Accord welcome screen.

Material changes will be highlighted at the top of the notice for 30 days. Minor changes (typo fixes, clarifications) may be made without notice. The version history is maintained internally and available on request.

12. Marketing Communications

With your consent, Third Mind may contact you with information about AI automation, practical knowledge resources, and services that may be relevant to your work. We will only ever send communications that are relevant to your role and the context in which you participated in the Blueprint.

Consent is collected via a separate, unticked opt-in checkbox at the point of data collection (checkout for primary contacts; welcome screen for nominees). The marketing checkbox is independent of the interview acknowledgement and entirely voluntary. You can withdraw consent at any time by contacting privacy@3rdmind.co.uk or using the unsubscribe link in any message.

We will never use the specific content of your interview responses to personalise marketing messages. Any targeting is based on your role and company context only.

End of Privacy Notice v3.0