Privacy Policy
Updated 25.08.26
This Privacy Notice for First Thursday LTD ("we", "us", or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
Visit our website at first-thursday.com, or any website of ours that links to this Privacy Notice
Use First Thursday for galleries — a software platform for art galleries and businesses to collect information about their customers
Engage with us in other related ways, including any sales, marketing, or events
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at hello@first-thursday.com.
Summary of key points
This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics using the table of contents below.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use — including, if you choose to connect your email account, the content of email messages exchanged with senders you have approved. Learn more.
Do we process any sensitive personal information? Some information may be considered "special" or "sensitive" in certain jurisdictions — for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.
Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources. Learn more.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more.
In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties, each named in our sub-processor register. Learn more.
How do we keep your information safe? We have organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission or storage technology can be guaranteed 100% secure. Learn more.
What are your rights? Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information. Learn more.
How do you exercise your rights? The easiest way is by emailing hello@first-thursday.com. We will consider and act upon any request in accordance with applicable data protection laws.
Table of contents
What information do we collect?
How do we process your information?
What legal bases do we rely on to process your personal information?
When and with whom do we share your personal information?
Do we use cookies and other tracking technologies?
Do we offer artificial intelligence-based products?
How long do we keep your information?
How do we keep your information safe?
Do we collect information from minors?
What are your privacy rights?
Controls for Do-Not-Track features
Do United States residents have specific privacy rights?
Do we make updates to this notice?
How can you contact us about this notice?
How can you review, update, or delete the data we collect from you?
1. What information do we collect?
Personal information you disclose to us
In short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services, or otherwise contact us.
Personal information provided by you. The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. It may include:
Names
Phone numbers
Email addresses
Mailing addresses
Contact preferences
Art purchase preferences
Contact or authentication data
Sensitive information. We do not process sensitive information.
Email account information (if connected). If you choose to connect an email account (for example, Gmail) to First Thursday, we access messages exchanged with senders you have approved within the product. Mail from a sender you have not approved is held in a pending state and is not read or analysed until you admit them. We use this content to build contact timelines and surface enquiries automatically, as described further in Section 6 below. You can disconnect this access at any time in Settings, which ends our access to your mailbox immediately.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.
Information automatically collected
In short: Some information — such as your IP address and browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This does not reveal your specific identity but may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and other technical information. This is used primarily to maintain the security and operation of our Services and for internal analytics and reporting.
We also collect information through cookies and similar technologies — see our Cookie Notice.
This includes:
Log and usage data — service-related, diagnostic, usage, and performance information recorded in server log files, including IP address, device information, browser type, activity within the Services, and error reports.
Device data — information about the computer, phone, tablet, or other device used to access the Services, such as device and application identification numbers, hardware model, ISP/mobile carrier, operating system, and system configuration.
Location data — imprecise or precise information about your device's location, based on IP address or device settings. You can opt out via your device's Location setting, though this may limit certain features.
Information collected from other sources
In short: We may collect limited data from public databases, marketing partners, and other outside sources.
To enhance our ability to provide relevant marketing, offers, and services and to update our records, we may obtain information from public databases, joint marketing partners, affiliate programs, data providers, and other third parties — including mailing addresses, job titles, email addresses, phone numbers, intent data, IP addresses, and social media profiles, for targeted advertising and event promotion.
2. How do we process your information?
In short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.
We process your personal information to:
Facilitate account creation and authentication, and manage user accounts
Deliver and facilitate delivery of requested Services
Respond to inquiries and offer support
Send administrative information, including changes to our terms and policies
Fulfil and manage orders, payments, returns, and exchanges
Enable user-to-user communications where you choose to use features that allow this
Request feedback about your use of our Services
Send marketing and promotional communications, in accordance with your preferences (you can opt out at any time — see Section 10)
Identify usage trends to better understand and improve our Services
Save or protect an individual's vital interest, such as to prevent harm
3. What legal bases do we rely on to process your information?
In short: We only process your personal information when we have a valid legal reason to do so — such as your consent, to comply with laws, to fulfil a contract, to protect your rights, or to pursue our legitimate business interests.
If you are located in the EU or UK
The GDPR and UK GDPR require us to explain our legal bases:
Consent — where you have given us permission for a specific purpose, for example when you choose to connect your email account. You can withdraw consent at any time.
Performance of a contract — where necessary to fulfil our contractual obligations to you, including providing our Services.
Legitimate interests — where reasonably necessary to achieve our legitimate business interests without outweighing your rights and freedoms, for example to send offers, analyse Service usage, and improve user experience.
Legal obligations — where necessary to comply with law, cooperate with regulators, or defend our legal rights.
Vital interests — where necessary to protect your vital interests or those of a third party.
We are generally the "data controller" of the personal information described in this Notice. This Notice does not apply to personal information we process as a "data processor" on behalf of our gallery customers — in those cases, the customer is the data controller, and we process data on their behalf under a data processing agreement. Contact the relevant gallery customer directly with questions about their own privacy practices.
If you are located in Canada
We may process your information with your express or implied consent, which you may withdraw at any time. In limited exceptional cases permitted by law, we may process information without consent — for example, for fraud investigation and prevention, business transactions, insurance claims, identifying deceased persons, suspected financial abuse, legal compliance (subpoenas, court orders), or where information is publicly available.
4. When and with whom do we share your personal information?
In short: We may share information in specific situations described in this section, and with the categories of third parties below. Where we act as a processor for a gallery customer, we appoint sub-processors under the terms of our Data Processing Agreement with that customer.
Vendors, consultants, and other third-party service providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties", also referred to as "sub-processors") who perform services for us or on our behalf. We have contracts in place with our third parties designed to safeguard your personal information: they cannot use it beyond our instructions, cannot share it with anyone other than us, and must protect and retain it only for the period we instruct.
Sub-processor register. The current, named list of our sub-processors is maintained at subprocessors.first-thursday.com rather than in this Notice, so that it always reflects who we actually use. Where we act as a data processor for a gallery customer under our Data Processing Agreement, we give at least 30 days' prior notice of any new or removed sub-processor by posting the change at that URL, and the customer may object on reasonable grounds relating to the protection of the Data. If you're not sure which category a specific vendor falls under, the register groups sub-processors by the same categories used below.
The categories of third parties we may share personal information with are:
Communication & Collaboration Tools — including email, calendar, and messaging providers, where you choose to connect an account
Email Delivery Services — providers who send transactional and marketing email on our behalf
Data Analytics Services — providers who help us understand product usage
AI Platforms — providers of the underlying AI models and related infrastructure used in our AI Products
Data Storage & Cloud Computing Services — providers who host our infrastructure and data
Account Registration, Authentication & Security Services — providers who support login, account security, and bot/fraud prevention
Payment Processing Services — providers who process payments on our behalf
Sales, CRM & Document Automation Tools — providers who support our own sales and contracting processes
Art gallery customers — where you are a contact of a gallery using First Thursday, that gallery
We may also share your personal information:
In business transfers — in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business.
With affiliates — who will be required to honour this Privacy Notice, including our parent company and any subsidiaries, joint venture partners, or commonly controlled companies.
5. Do we use cookies and other tracking technologies?
In short: We may use cookies and other tracking technologies to collect and store your information.
We use cookies and similar technologies (such as web beacons and pixels) to maintain security, prevent crashes, fix bugs, save preferences, and support basic site functions. We also permit third parties and service providers to use tracking technologies for analytics and advertising on our Services.
Where these technologies constitute a "sale"/"sharing" under applicable US state laws, you can opt out as described in Section 12.
See our Cookie Notice for full detail and opt-out instructions.
Google Analytics. We may share information with Google Analytics, including Demographics and Interests Reporting features. Opt out via Google's opt-out page or Ads Settings.
6. Do we offer artificial intelligence-based products?
In short: We offer products and features powered by artificial intelligence, including features that connect to your email account with your permission.
We provide our AI Products through third-party AI Service Providers, including OpenAI and Anthropic. Your input, output, and personal information are shared with and processed by these providers to enable your use of our AI Products, as outlined in Section 3. You must not use the AI Products in a way that violates any AI Service Provider's terms.
Our AI Products cover:
General AI-assisted research features within the Services
Email-based contact and enquiry intelligence, where you have connected an email account
Email account integration
If you connect an email account (for example, Gmail):
We read email from senders you have approved. Messages from approved contacts are used to build their timeline and surface enquiries automatically. Mail from a sender you have not approved sits in a Pending senders list and is never analysed until you admit them.
Approved messages are analysed by AI. We send that content to our AI Service Providers to extract enquiries, artists, and artworks referenced. It is not used to train AI models. Newsletters and marketing emails are filtered out before this analysis happens.
We send from your mailbox, when you ask. Replies and mail merges you write in First Thursday are sent from your own address, so they reach people the way your email always has. Nothing is sent without you composing it.
We read your email signature, so messages sent from First Thursday look like the ones you send yourself.
You can stop this at any time. Disconnecting the integration in Settings ends our access to your mailbox immediately. Your contact history built from that access remains in the product; a separate Delete synced email action removes the synced email content itself.
How to opt out
Disconnect a connected email account at any time in Settings
Contact us using the details in Section 14
7. How long do we keep your information?
In short: We keep your information for as long as necessary to fulfil the purposes in this Notice, unless a longer period is required by law.
When we no longer have an ongoing legitimate business need to process your personal information, we delete or anonymise it, or — where that isn't possible (for example, information in backup archives) — securely isolate it from further processing until deletion is possible.
8. How do we keep your information safe?
In short: We aim to protect your personal information through organisational and technical security measures.
We have implemented reasonable technical and organisational security measures. However, no method of transmission or storage over the internet can be guaranteed 100% secure, and we cannot guarantee that unauthorised third parties will never defeat our security. Transmission of personal information to and from our Services is at your own risk.
9. Do we collect information from minors?
In short: We do not knowingly collect data from or market to children under 18.
By using the Services, you represent that you are at least 18, or are the parent or guardian of a minor and consent to their use of the Services. If we learn we've collected personal information from a user under 18, we will deactivate the account and delete the data. Contact us at callum@first-thursday.com if you become aware of any such data.
10. What are your privacy rights?
In short: Depending on where you live, you may have rights to access, correct, delete, or restrict processing of your personal information.
If you're in the EEA, UK, Switzerland, or Canada, you may have the right to:
Access and obtain a copy of your personal information
Request rectification or erasure
Restrict processing
Data portability (where applicable)
Object to processing, and not be subject to automated decision-making
Exercise these rights by contacting us — see Section 14. If you're in the EEA or UK, you also have the right to complain to your data protection authority. If you're in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing consent. Where you've connected an email account, disconnect it in Settings to withdraw consent immediately. For other processing, contact us to withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.
Marketing opt-out. Unsubscribe via the link in our emails, reply "STOP"/"UNSUBSCRIBE" to SMS, or contact us. Note we may still send non-marketing, service-related messages.
Account information. Contact us to review, change, or terminate your account. On termination, we deactivate or delete your information from active databases, subject to retention needed for fraud prevention, legal compliance, or dispute resolution.
Cookies. Configure your browser to reject or remove cookies — see our Cookie Notice.
11. Controls for Do-Not-Track features
Most browsers include a Do-Not-Track ("DNT") signal. As there is no finalised industry standard for recognising DNT signals, we do not currently respond to them. If a legal standard requiring this is adopted, we will update this Notice accordingly.
12. Do United States residents have specific privacy rights?
In short: Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia may have rights to access, correct, delete, or obtain a copy of their personal information, and to withdraw consent to processing. These rights may be limited by applicable law.
Categories of personal information we collect
Category Examples Collected A. Identifiers Name, address, phone, IP address, email, account name Yes B. California Customer Records categories Name, contact info, education, employment, financial information Yes C. Protected classifications Gender, age, race, national origin, marital status No D. Commercial information Transaction and purchase history, financial details Yes E. Biometric information Fingerprints, voiceprints No F. Internet/network activity Browsing history, search history, interactions with our Services Yes G. Geolocation data Device location No H. Audio/visual information Images, audio/video/call recordings No I. Professional/employment information Business contact details, job title, work history No J. Education information Student records No K. Inferences Profiles or summaries drawn from the above Yes L. Sensitive personal information — No
We also collect personal information through customer support, surveys/contests, and delivery of the Services and responses to inquiries.
Retention: Categories A, B, D, and F — for as long as you have an account with us. Category K — up to 24 months of idle activity.
Sharing and disclosure
We disclose personal information to service providers under written contract — see Section 4. We may use your information for our own purposes, such as internal research for technological development; this is not "selling" your information.
In the preceding 12 months we disclosed the following categories for a business or commercial purpose: A (Identifiers), B (California Customer Records categories), D (Commercial information).
We have not sold any categories of personal information in the preceding 12 months.
The categories of third parties we shared personal information with are the categories in Section 4 — Communication & Collaboration Tools, Email Delivery Services, Data Analytics Services, AI Platforms, Data Storage & Cloud Computing Services, Account Registration/Authentication & Security Services, Payment Processing Services, Sales/CRM & Document Automation Tools, and Art gallery customers. The specific named third parties within each category are listed in our sub-processor register.
If you are a resident of Minnesota or Oregon, you have the right to request the specific third parties (not just categories) to which we've disclosed your data — our sub-processor register provides this directly.
Your rights
Know whether we're processing your personal data
Access your personal data
Correct inaccuracies
Request deletion
Obtain a copy of data you've shared with us
Non-discrimination for exercising your rights
Opt out of targeted advertising, sale, or profiling with legal effect
Depending on your state, you may also have the right to: access categories of data processed (MN); obtain a list of categories or specific third parties (CA, DE, MN, OR); review and correct profiling decisions (MN); limit use of sensitive personal data (CA); or opt out of voice/facial recognition data collection (FL).
How to exercise your rights
Contact hello@first-thursday.com. You can opt out of selling, targeted advertising, or profiling by disabling cookies in Cookie Preference Settings. You may designate an authorised agent, subject to proof of authorisation.
Verification. We will verify your identity using the information provided in your request, and may ask for additional information if needed for verification or fraud prevention.
Appeals. If we decline to act on your request, you may appeal by emailing hello@first-thursday.com. We'll respond in writing; if denied, you may complain to your state attorney general.
California "Shine the Light" law. California residents may request, once a year and free of charge, details of personal information disclosed to third parties for direct marketing purposes in the prior calendar year. Submit requests in writing — see Section 14.
13. Do we make updates to this notice?
In short: Yes — we update this Notice as necessary to stay compliant with relevant laws.
Updates are indicated by a revised "Last updated" date at the top. For material changes, we may notify you via a prominent notice or direct communication. We encourage you to review this Notice periodically.
14. How can you contact us about this notice?
Contact our Data Protection Officer (DPO):
Email: callum@first-thursday.com Phone: 07813180993 Post: First Thursday LTD Data Protection Officer 3rd Floor, 86-98 Paul Street London EC2A 4NE
If you are a UK resident, we are the "data controller" of your personal information. We have appointed Callum Hale-Thomson as our UK representative — contact them via the details above or at first-thursday.com.
15. How can you review, update, or delete the data we collect from you?
Depending on your country or US state of residence, you may have the right to access, correct, delete, or request details of how we've processed your personal information, and to withdraw consent to processing. To make a request, email hello@first-thursday.com.