We collect and process personal data relating to job applicants and prospective candidates to identify and assess potential talent, manage and administer our recruitment processes, communicate with candidates throughout the hiring process, inform them about current and future employment opportunities, comply with our legal obligations and, where permitted or based on your choice, support our diversity, equity and inclusion initiatives and improve our recruitment practices. Legal bases for processing Depending on the nature of the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data: Pre-contractual measures – to assess your application, evaluate your qualifications and suitability for a role, communicate with you throughout the recruitment process, and take steps at your request prior to entering into an employment relationship. Legitimate interests – to identify and engage prospective candidates, maintain talent pools, contact you about current and future employment opportunities, improve our recruitment processes, maintain records of recruitment activities, and protect our legal rights and interests. Compliance with legal obligations – to comply with applicable employment, immigration, tax, anti-discrimination, recordkeeping, and other legal or regulatory requirements. Consent – where required by applicable law or where we ask for your permission, such as for processing certain categories of personal data, including diversity, equity, and inclusion information. Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law. Duration We retain your recruitment information to contact you about future employment opportunities that may be a better fit for your skills and experience. We use your data for this purpose for up to two years after our last contact with you, or sooner if you ask us to stop. We then retain your recruitment data for a total of seven years after the recruitment decision to comply with applicable diversity and inclusion and immigration or visa legislation.

Current and prospective clients and business contacts

We collect and process personal data relating to current and prospective clients and business contacts to manage and develop our business relationships, provide and improve our services, respond to inquiries and requests, administer commercial and contractual relationships, communicate throughout the sales and service lifecycle, maintain records of our interactions, deliver marketing communications where permitted by applicable law, and comply with our legal and regulatory obligations. Legal bases for processing Depending on the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data: Performance of a contract and pre-contractual measures – to provide our services, manage our commercial relationships, respond to requests, negotiate contracts, and take steps prior to entering into a contract. Legitimate interests – to manage and develop our business relationships, identify prospective clients, maintain our CRM and prospect databases, communicate with business contacts, improve our services, conduct marketing activities where permitted by applicable law, and protect our legitimate business interests. Compliance with legal obligations – to comply with applicable legal and regulatory requirements. Consent – where required by applicable law or where we ask for your permission, such as for certain marketing communications. Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law. Duration We process your personal data for as long as necessary and relevant to maintain our business relationship and to pursue business. For marketing activities, we generally send marketing communications to prospective clients and business contacts for up to three (3) years following the last interaction, or for a shorter period where required by applicable local law, or sooner if you ask us to stop. After that, individuals are no longer treated as active prospects or marketing contacts. For sales and business relationship management activities, we generally maintain business relationship records relating to current, prospective, and former clients for up to ten (10) years following the end of our engagement. We may retain personal data for longer where necessary to comply with applicable laws, resolve disputes, enforce our agreements, maintain appropriate business records, or, where applicable, to pursue a legitimate business interest.

Website and digital channel visitors, newsletter subscribers, and event attendees

We collect and process personal data relating to visitors to our websites and digital channels, newsletter subscribers, and event attendees to operate and secure our digital services, improve user experience, understand how individuals engage with our content, manage event registrations and attendance, communicate with you, deliver newsletters and marketing communications where permitted by applicable law, and develop our business relationships. Legal bases for processing Depending on the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data: Performance of a contract and pre-contractual measures – to provide the information, services, newsletters, blog subscriptions, event registrations, and other communications you request from us, and to take steps at your request prior to entering into a commercial relationship. Legitimate interests – to operate and secure our websites and digital channels, manage events, respond to inquiries, maintain marketing and prospect databases, communicate with business contacts, and improve our services where permitted by applicable law. Consent – where required by applicable law, including for the use of non-essential cookies and similar technologies, website analytics, identifying organizations associated with business IP addresses, personalizing your experience, and delivering marketing communications. Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law. Duration We process your personal data for as long as necessary and relevant to provide our website and digital services, newsletters, events, and related communications, maintain our relationship with you, and support our marketing and engagement activities. For marketing and engagement activities, we generally send newsletters, event invitations, and other marketing communications for up to three (3) years following the last interaction, or for a shorter period where required by applicable local law, or sooner if you ask us to stop. After that, individuals are no longer treated as active marketing contacts. We may retain personal data for longer where necessary to maintain our relationship with you, support our marketing, engagement, and event activities, improve our websites and services, comply with applicable laws, or, where applicable, to pursue a legitimate business interest.

Vendors and contractors

We collect and process personal data relating to vendors, supplier representatives, independent contractors, and other individuals providing goods or services to Thoughtworks to evaluate and onboard suppliers and contractors, manage our commercial and contractual relationships, administer payments, perform due diligence, communicate throughout the engagement, comply with legal and regulatory requirements, and protect our business interests. Legal bases for processing Depending on the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data: Performance of a contract and pre-contractual measures – to evaluate, onboard, engage, and manage vendors and contractors, administer contracts, and process payments. Legitimate interests – to manage supplier and contractor relationships, conduct due diligence, protect our business and information assets, maintain records, and improve our procurement and vendor management processes. Compliance with legal obligations – to comply with applicable legal and regulatory requirements, including tax, accounting, anti-corruption, sanctions, and other compliance obligations. Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law. Duration We retain personal data relating to vendors and contractors for as long as necessary to manage our business relationship, maintain a record of our commercial interactions for future business engagements, and comply with applicable legal, regulatory, tax, and accounting obligations. Certain personal data may also be retained within our business systems, including historical records and system logs, in accordance with the applicable retention periods for those systems.

We collect and process personal data relating to individuals who visit our offices to manage visitor access, maintain the security of our premises, protect our people and assets, comply with legal obligations, and respond to health and safety requirements where applicable. Legal bases for processing Depending on the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data: Legitimate interests – to manage visitor access and maintain the security of our offices, personnel, and assets. Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law. Duration We process your personal data for as long as necessary to manage access to our offices, maintain a safe and secure environment, and facilitate your visit.

Data we process

To provide our services, operate our business, manage our recruitment processes, communicate with you, deliver marketing communications, organize events, respond to your requests, maintain our digital channels and physical offices and develop our business relationships, we collect and process personal data from individuals who interact with Thoughtworks.

The categories of personal data we collect depend on the nature of your relationship with us and how you interact with Thoughtworks. The table below describes the categories of personal data we may collect in different contexts and from different types of individuals, together with the purposes for which we process such data, the legal bases that support their processing and the applicable retention periods or the criteria used to determine that period.

We collect and process personal data relating to job applicants and prospective candidates to identify and assess potential talent, manage and administer our recruitment processes, communicate with candidates throughout the hiring process, inform them about current and future employment opportunities, comply with our legal obligations and, where permitted or based on your choice, support our diversity, equity and inclusion initiatives and improve our recruitment practices.

Legal bases for processing

Depending on the nature of the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data:
- Pre-contractual measures – to assess your application, evaluate your qualifications and suitability for a role, communicate with you throughout the recruitment process, and take steps at your request prior to entering into an employment relationship.
- Legitimate interests – to identify and engage prospective candidates, maintain talent pools, contact you about current and future employment opportunities, improve our recruitment processes, maintain records of recruitment activities, and protect our legal rights and interests.
- Compliance with legal obligations – to comply with applicable employment, immigration, tax, anti-discrimination, recordkeeping, and other legal or regulatory requirements.
- Consent – where required by applicable law or where we ask for your permission, such as for processing certain categories of personal data, including diversity, equity, and inclusion information.
Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law.

Duration

We retain your recruitment information to contact you about future employment opportunities that may be a better fit for your skills and experience. We use your data for this purpose for up to two years after our last contact with you, or sooner if you ask us to stop.

We then retain your recruitment data for a total of seven years after the recruitment decision to comply with applicable diversity and inclusion and immigration or visa legislation.

Category of personal data	Purpose of processing
Identification and contact information (e.g., name, email address, phone number, postal address, country of residence)	To identify and contact you regarding current and future employment opportunities, communicate with you throughout the recruitment process, and schedule interviews.
Professional and employment information (e.g., CV/résumé, work history, education, qualifications, certifications, skills, languages, references, portfolio, publicly available professional profiles such as LinkedIn)	To identify prospective candidates through professional networking platforms and other lawful sources, assess your qualifications and experience, and determine your suitability for current and future employment opportunities.
Recruitment process information (e.g., interview notes, assessments, recruiter feedback, communications, application status, hiring decisions)	To manage and administer the recruitment process, evaluate candidates, document recruitment decisions, maintain records of completed recruitment processes to demonstrate compliance with applicable employment and non-discrimination laws, and improve our recruitment practices.
Diversity, equity and inclusion information (where voluntarily provided and permitted by applicable law)	To monitor and improve the fairness, diversity, and inclusiveness of our recruitment processes and produce aggregated statistical reports. Providing this information is voluntary and, where required by law, based on your consent.
Background verification information (where applicable)	To verify your identity, qualifications, employment history, professional credentials, references, and eligibility to work where permitted by applicable law and relevant to the role.
Communications (e.g., emails, messages, call recordings where permitted, and correspondence with recruiters)	To communicate with you throughout the recruitment process, respond to your inquiries, notify you of current and future employment opportunities, and maintain records of our interactions.
Technical and usage information (e.g., IP address, browser type, device information, cookies, website usage data)	To operate and secure our recruitment platforms and websites, troubleshoot technical issues, improve user experience, and measure the effectiveness of our recruitment activities.
Information required to comply with legal obligations and record retention of closed recruitment processes	To comply with applicable employment, immigration, anti-discrimination, tax, regulatory, and other legal obligations.

Expandir tabla

Colapsar tabla

We collect and process personal data relating to current and prospective clients and business contacts to manage and develop our business relationships, provide and improve our services, respond to inquiries and requests, administer commercial and contractual relationships, communicate throughout the sales and service lifecycle, maintain records of our interactions, deliver marketing communications where permitted by applicable law, and comply with our legal and regulatory obligations.

Legal bases for processing

Depending on the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data:
- Performance of a contract and pre-contractual measures – to provide our services, manage our commercial relationships, respond to requests, negotiate contracts, and take steps prior to entering into a contract.
- Legitimate interests – to manage and develop our business relationships, identify prospective clients, maintain our CRM and prospect databases, communicate with business contacts, improve our services, conduct marketing activities where permitted by applicable law, and protect our legitimate business interests.
- Compliance with legal obligations – to comply with applicable legal and regulatory requirements.
- Consent – where required by applicable law or where we ask for your permission, such as for certain marketing communications.
Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law.

Duration

We process your personal data for as long as necessary and relevant to maintain our business relationship and to pursue business.

For marketing activities, we generally send marketing communications to prospective clients and business contacts for up to three (3) years following the last interaction, or for a shorter period where required by applicable local law, or sooner if you ask us to stop. After that, individuals are no longer treated as active prospects or marketing contacts.

For sales and business relationship management activities, we generally maintain business relationship records relating to current, prospective, and former clients for up to ten (10) years following the end of our engagement.

We may retain personal data for longer where necessary to comply with applicable laws, resolve disputes, enforce our agreements, maintain appropriate business records, or, where applicable, to pursue a legitimate business interest.

Category of personal data	Purpose of processing
Identification and contact information (e.g., name, job title, employer, business email address, business telephone number, business physical address)	To identify you, communicate with you, manage our business relationship, respond to inquiries, and administer commercial and contractual engagements.
Professional information (e.g., job role, department, areas of responsibility, employer, publicly available professional profiles such as LinkedIn, and information obtained from trusted third-party business data providers)	To identify prospective clients and business contacts, build and maintain a database of prospective customers, understand your role and responsibilities, develop business opportunities, and tailor our communications and services.
Commercial relationship information (e.g., account ownership, customer relationship history, sales opportunities, quotations, proposals, contracts, purchasing preferences, CRM records)	To manage customer and prospect relationships, maintain our CRM and prospect databases, administer our sales pipeline, negotiate and perform contracts, support account management and business development activities, and maintain records of our commercial interactions.
Project and service delivery information (e.g., project communications, meeting notes, project milestones, support requests, service interactions, project management records)	To deliver and manage our services, coordinate projects, communicate throughout project delivery, monitor project progress, and maintain records of our business interactions.
Communications (e.g., emails, meeting invitations, call notes, chat messages, correspondence, feedback)	To communicate with you throughout our commercial relationship, respond to your requests, manage projects, document business decisions, and maintain records of our interactions.
Marketing and engagement information (e.g., newsletter subscriptions, event registrations, marketing preferences, campaign interactions, webinar attendance)	To send marketing communications where permitted by applicable law, invite you to events, personalize your experience, measure the effectiveness of our marketing activities, and better understand your interests.
Technical and usage information (e.g., IP address, browser type, device information, cookies, website usage data)	To operate and secure our websites and online services, improve user experience, analyze website performance, and understand how visitors engage with our digital channels.
Information required to comply with legal obligations	To comply with applicable legal, regulatory, tax, accounting, anti-corruption, sanctions, and other compliance obligations.

Expandir tabla

Colapsar tabla

We collect and process personal data relating to visitors to our websites and digital channels, newsletter subscribers, and event attendees to operate and secure our digital services, improve user experience, understand how individuals engage with our content, manage event registrations and attendance, communicate with you, deliver newsletters and marketing communications where permitted by applicable law, and develop our business relationships.

Legal bases for processing

Depending on the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data:
- Performance of a contract and pre-contractual measures – to provide the information, services, newsletters, blog subscriptions, event registrations, and other communications you request from us, and to take steps at your request prior to entering into a commercial relationship.
- Legitimate interests – to operate and secure our websites and digital channels, manage events, respond to inquiries, maintain marketing and prospect databases, communicate with business contacts, and improve our services where permitted by applicable law.
- Consent – where required by applicable law, including for the use of non-essential cookies and similar technologies, website analytics, identifying organizations associated with business IP addresses, personalizing your experience, and delivering marketing communications.
Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law.

Duration

We process your personal data for as long as necessary and relevant to provide our website and digital services, newsletters, events, and related communications, maintain our relationship with you, and support our marketing and engagement activities.

For marketing and engagement activities, we generally send newsletters, event invitations, and other marketing communications for up to three (3) years following the last interaction, or for a shorter period where required by applicable local law, or sooner if you ask us to stop. After that, individuals are no longer treated as active marketing contacts.

We may retain personal data for longer where necessary to maintain our relationship with you, support our marketing, engagement, and event activities, improve our websites and services, comply with applicable laws, or, where applicable, to pursue a legitimate business interest.

Category of personal data	Purpose of processing
Identification and contact information (e.g., name, business email address, company, job title, telephone number)	To communicate with you, respond to your inquiries, manage event registrations, provide newsletters, and deliver requested information or services.
Marketing and engagement information (e.g., newsletter subscriptions, event registrations, webinar attendance, marketing preferences, campaign interactions, downloaded content)	To send newsletters and marketing communications where permitted by applicable law, invite you to events, and measure the effectiveness of our marketing activities.
Website and digital activity information (e.g., pages visited, clicks, downloads, referring website, session information, browser and device information, cookies and similar technologies)	To operate and secure our websites and digital services, analyze website usage, improve user experience, measure the effectiveness of our digital channels, and personalize content where permitted by applicable law.
Online identifiers and network information (e.g., IP address, approximate location derived from IP address, device identifiers)	To secure our websites, detect and prevent fraud or misuse, perform analytics, and, where permitted by applicable law, identify the organization associated with your business IP address to better understand interest in our services and support our business development activities.
Event information (e.g., event registration details, attendance records, dietary or accessibility requirements where voluntarily provided, feedback, photographs or recordings where applicable)	To organize and administer events, communicate with attendees, accommodate accessibility or dietary requirements, improve future events, and, where applicable, document and promote our events.
Communications (e.g., emails, contact forms, chat messages, feedback, survey responses)	To respond to your inquiries, provide support, maintain records of our interactions, and improve our services.

Expandir tabla

Colapsar tabla

We collect and process personal data relating to vendors, supplier representatives, independent contractors, and other individuals providing goods or services to Thoughtworks to evaluate and onboard suppliers and contractors, manage our commercial and contractual relationships, administer payments, perform due diligence, communicate throughout the engagement, comply with legal and regulatory requirements, and protect our business interests.

Legal bases for processing

Depending on the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data:
- Performance of a contract and pre-contractual measures – to evaluate, onboard, engage, and manage vendors and contractors, administer contracts, and process payments.
- Legitimate interests – to manage supplier and contractor relationships, conduct due diligence, protect our business and information assets, maintain records, and improve our procurement and vendor management processes.
- Compliance with legal obligations – to comply with applicable legal and regulatory requirements, including tax, accounting, anti-corruption, sanctions, and other compliance obligations.
Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law.

Duration

We retain personal data relating to vendors and contractors for as long as necessary to manage our business relationship, maintain a record of our commercial interactions for future business engagements, and comply with applicable legal, regulatory, tax, and accounting obligations. Certain personal data may also be retained within our business systems, including historical records and system logs, in accordance with the applicable retention periods for those systems.

Category of personal data	Purpose of processing
Identification and contact information (e.g., name, business or personal email address, telephone number, business or residential address, emergency contact details where applicable)	To identify you, communicate with you, manage our contractual relationship, and administer your engagement.
Professional information (Contractors only) (e.g., CV, qualifications, certifications, professional licenses, skills)	To assess your suitability for providing the contracted services, verify relevant qualifications or certifications where appropriate, and administer contractor onboarding and engagement.
Commercial and contractual information (e.g., contracts, purchase orders, statements of work, invoices, payment terms, supplier records, performance records)	To negotiate, execute, manage, and monitor contractual relationships, administer procurement activities, and maintain supplier records.
Financial information (e.g., bank account details, tax identification numbers, payment information)	To process payments, administer invoices, comply with tax and accounting obligations, and maintain financial records.
Due diligence and compliance information (e.g., sanctions screening, conflict of interest declarations, certifications, background verification where applicable)	To conduct supplier due diligence, manage risk, comply with legal and regulatory obligations, and protect Thoughtworks from fraud and other unlawful activities.
Communications (e.g., emails, meeting invitations, call notes, chat messages, correspondence)	To communicate throughout the commercial relationship, coordinate services, document business decisions, and maintain records of our interactions.
Technical and usage information (e.g., user account information, authentication logs, IP address, device information where applicable)	To provide access to Thoughtworks systems, secure our networks and systems, monitor access, and protect our information assets.
Information required to comply with legal obligations	To comply with applicable employment, tax, accounting, procurement, anti-corruption, sanctions, anti-money laundering, and other legal or regulatory requirements.

Expandir tabla

Colapsar tabla

We collect and process personal data relating to individuals who visit our offices to manage visitor access, maintain the security of our premises, protect our people and assets, comply with legal obligations, and respond to health and safety requirements where applicable.

Legal bases for processing

Depending on the processing activity and the applicable data protection laws in your jurisdiction, Thoughtworks may rely on one or more of the following legal bases to process your personal data:
- Legitimate interests – to manage visitor access and maintain the security of our offices, personnel, and assets.
Where local laws do not permit us to rely on a particular legal basis (such as legitimate interests or pre-contractual measures) or require consent for specific processing activities, we will rely on the appropriate legal basis in accordance with the applicable law.

Duration

We process your personal data for as long as necessary to manage access to our offices, maintain a safe and secure environment, and facilitate your visit.

Category of personal data	Purpose of processing
Identification and visitor information (e.g., name, company, host, contact details, date and time of visit, visitor logs, identification details where required)	To register and manage your visit, verify your identity where required, maintain visitor records, and ensure the security of our premises.
Security information (e.g., CCTV footage, access badge records, access logs where applicable)	To protect our people, premises, and assets, investigate security incidents, and maintain the security of our offices.