Privacy notice
Think Commerce Ltd runs this website and decides how your personal data is used. We collect very little. We count visits with Vercel Web Analytics, which sets no cookies. Google Analytics and Microsoft Clarity run only if you accept analytics cookies in our cookie banner. We hold your details when you email us, send our contact form or work with us, and we use them to reply, to deliver our work and to keep our accounts. To ask about your data, email hello@thinkcommerce.com.
Last updated: 6 November 2026
Who we are and how to contact us
Think Commerce Ltd is a UK company and a Shopify agency. We are the controller of the personal data described in this notice. We run two versions of this website: thinkcommerce.com in English and thinkcommerce.no in Norwegian. This notice covers both.
- Company: Think Commerce Ltd, registered in England and Wales, company number 08374113
- Registered office: 5 Canon Court, Institute Street, Bolton, England, BL1 1PZ
- Email: hello@thinkcommerce.com
- Norwegian branch: Think Commerce Ltd NUF, organisation number 921 224 818, Biskop Gunnerus’ gate 14 A, 0185 Oslo, Norway
You can also reach us through our contact page.
Think Commerce Ltd NUF is the registered Norwegian branch of Think Commerce Ltd, not a separate company, so Think Commerce Ltd is the controller for both sites. The branch is our establishment in the European Economic Area, so we have not appointed a separate representative under Article 27 of the GDPR.
We pay the data protection fee to the Information Commissioner’s Office (ICO), the UK data protection regulator.
What we collect and why
When you visit the website
The website’s pages are static. A small server function, also on Vercel, handles the contact form. Vercel Inc. hosts both. When your browser requests a page, Vercel processes technical request data to deliver the page and protect the site from abuse. That data is your IP address, your browser’s user agent, the page address you requested and the time of the request.
Lawful basis: legitimate interests. We need to deliver the site to you and keep it secure.
Visit statistics
We use Vercel Web Analytics, from Vercel Inc., to count visits and see which pages people read. It sets no cookies. For each page view it records the page address, the site that sent you, your browser, operating system and device type, and your approximate location (country, region and city). Instead of a cookie, Vercel recognises a visit by a hash made from your request and discards it after 24 hours. The data is not linked to your IP address, and we see only totals, never a record of you as an individual.
We also use Vercel Speed Insights, provided by Vercel Inc. as our processor, to measure how quickly our pages load (Core Web Vitals); it sets no cookies and does not track you across other sites, and we rely on legitimate interests to keep the site fast.
Lawful basis: legitimate interests. We need to know which pages people read so we can improve the site.
Analytics cookies, only with your consent
If you accept analytics cookies in our cookie banner, we also use two tools that set cookies:
- Google Analytics 4, from Google, measures how people find and use the site: the pages you visit, how you arrived, how long you stay, and your browser, device and approximate location. When you send our contact form or click our email address, it also records that an enquiry was made and, for the form, the topic you chose; never what you wrote. We have switched off Google signals and ad personalisation in our set-up.
- Microsoft Clarity, from Microsoft, shows how people use our pages: clicks, scrolling and mouse movement, which it turns into heatmaps and session recordings. We use Clarity’s Strict masking mode, so Clarity masks all the text on our pages, including anything you type into a form, before it leaves your browser. Recordings show the layout of a page and how you move around it, not what you read or write.
Accepting turns on both tools. Rejecting turns on neither. Until you choose, neither tool loads.
Revenue calculator. Our revenue calculator puts the figures you enter in the page address, so you can share them with a link. We don’t store them. That address goes to our hosting provider and, if you have accepted analytics cookies, to Google Analytics and Microsoft Clarity, like any page you visit. The calculator also sends Google Analytics one event with rough ranges, never the figures you typed.
Lawful basis: consent. You can withdraw it at any time, as described under “Cookies”.
When you email us
If you email us, we receive your name, email address and anything you choose to include, such as your company, role and the project you want to discuss. We use it to reply, to talk about how we might work together and to keep a record of the conversation.
Lawful basis: legitimate interests. We need to answer the people who contact us and follow up on enquiries they start.
When you use our contact form
Our contact page and start a project page have an enquiry form. It asks for your name, your work email address, what you need help with and your message, and, if you choose, your company or website. When you send it, we email those details to our own inbox so we can reply to you. We do not add you to a mailing list, and the form does not send you an automatic email.
To keep the form free of spam, our server counts how many messages come from your IP address in 10 minutes. It keeps only a scrambled (hashed) form of the address, in memory, for that count. It never writes it to disk and never keeps it with your message. Vercel, our host, also records the IP address of every request, including this one, as described under “When you visit the website”. The form also has a field that people never see; if it is filled in, we treat the message as spam and do not send it.
We use Resend to deliver the form to our inbox (see “Who we share data with” and “International transfers”). We keep form enquiries for the same time as emails (see “How long we keep data”).
Lawful basis: legitimate interests. We need to answer the enquiries people send us and keep the form free of spam. When you ask about working with us, we are also taking steps you asked for before entering into a contract.
When you are a client
If you work for one of our clients, we hold your business contact details: your name, job title, work email address and phone number, and our correspondence with you. We use them to deliver projects and retainers, to manage the work and to invoice.
Lawful basis: legitimate interests. We need to contact the people we work with to deliver and manage our contract with their organisation. If you contract with us yourself, as a sole trader for example, the basis is contract.
We also keep invoices and accounting records that may include your name and contact details.
Lawful basis: legal obligation. UK law requires us to keep accounting records.
ThemeLens browser extension
Our ThemeLens browser extension has its own ThemeLens privacy policy. It explains what the extension does and does not do with data.
Do you have to give us your data?
You do not have to give us personal data. If you do not, we cannot reply to your enquiry or work with you.
International transfers
Our hosting provider, Vercel Inc., may process request data outside the UK and the European Economic Area.
Resend sends our contact form emails from its Ireland (EU) region, but it stores its account data, including logs of the emails it sends for us, in the United States. Its data processing agreement covers transfers from the UK and the European Economic Area with the EU Standard Contractual Clauses and the UK Addendum to them. Resend also says it complies with the EU-US Data Privacy Framework and its UK Extension.
If you accept analytics cookies, Google and Microsoft may process analytics data in the United States.
How long we keep data
We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires.
- Website request data: kept for the period set by Vercel’s plan for this website, then deleted by Vercel.
- Visit statistics: Vercel discards the hash that recognises a visit after 24 hours. The aggregated statistics, which do not identify you, are kept for the period set by Vercel’s plan for this website.
- Google Analytics: 14 months. Our Google Analytics property keeps user-level and event-level data for 14 months.
- Microsoft Clarity: Microsoft keeps Clarity session recordings for 30 days from the time of recording. Recordings we mark as favourites, and a random sample that Microsoft keeps, are kept for up to 9 months.
- Emails and form enquiries: 2 years after our last contact with you, unless they lead to work.
- Client contract records: 6 years after the contract ends, as UK accounting rules require.
- Client contact details and correspondence: 6 years after the contract ends.
- Invoices and accounting records: 6 years after the contract ends, as UK accounting rules require.
- Contact form emails at Resend: Resend keeps data about the emails it sends for us for 30 days.
- Contact form spam check: the scrambled form of your IP address is kept only in memory, for the 10-minute count described under “When you use our contact form”.
Your rights
Under UK data protection law, and the GDPR for people in the European Economic Area, including Norway, you have the right to:
- access the personal data we hold about you and get a copy
- correction: have wrong or incomplete data fixed
- deletion: ask us to delete your data
- restriction: ask us to limit how we use your data
- object to our use of your data where we rely on legitimate interests
- portability: get data you gave us in a format a computer can read, or have it sent to another organisation
- withdraw consent at any time, where we rely on consent. For analytics cookies, use the “Cookie settings” link at the bottom of any page.
Some of these rights apply only in certain circumstances. To use any of them, email hello@thinkcommerce.com. We may need to confirm your identity before we act, and we will reply within the time the law allows.
Complaints
If you are unhappy with how we handle your data, please contact us first so we can try to put it right.
You can also complain to a data protection regulator:
- In the UK: the Information Commissioner’s Office, at ico.org.uk
- In Norway: Datatilsynet, at datatilsynet.no
Children
This website and our services are for businesses. They are not aimed at children.
Changes to this notice
We will update this notice when the way we handle personal data changes. When we do, we will change the “Last updated” date at the top of this page.