Third Party Threat Hunting LLC
Privacy Notice
How this website handles personal data, and what happens to information you send us. Personal data we hold on behalf of a client under an engagement is governed by that engagement's contract, not by this notice.
Who we are
Third Party Threat Hunting LLC ("TPTH") is a United States limited liability company providing third-party risk advisory, managed risk services, training and certification, and AI governance advisory.
For anything in this notice, write to privacy@thirdpartythreathunting.com. The address is monitored each business day by the Chief Executive Officer.
What this notice covers — and what it does not
This notice covers personal data collected through thirdpartythreathunting.com: enquiries, newsletter sign-ups, resource and pack downloads, course bookings, and website analytics.
It does not cover client engagement data. Where we process personal data on behalf of a client, we act as a processor and the client is the controller. That processing is governed by the engagement contract and Data Processing Agreement, and by our Trust Center, which publishes our sub-processors, control profile and open control gaps.
What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Contact form — your name, email address, and whatever you put in the message | To reply to you | Legitimate interest in responding to an enquiry, or steps prior to entering a contract |
| Resource download — your name, work email and organization | To send you the material you asked for | Legitimate interest in delivering a document you requested. Being added to anything further is separate, optional, and by an unticked box you choose to tick |
| Course booking — participant contact and billing details | To enroll you and issue a certificate | Performance of a contract. Payment is handled by our processor; we do not receive or store card numbers |
| Newsletter subscription — your email address only, plus the date you signed up, the date you confirmed and which form you used | So we can send you Fourth Party, the weekly letter, and stop when you ask | Consent, which you give by clicking the confirmation link. We do not send you anything except that one confirmation until you click it. We do not record your name, your IP address, or whether you open an issue or click a link in it — there is no open or click tracking of any kind |
| Free BEACON class — your email address. On the same record we keep the date you first opened the class, the date you last opened it and how many times you have opened it. If you were already a Fourth Party subscriber, the same record is used and your original sign-up is not changed | To open the class for you through a short-lived viewing link, to send you Fourth Party, and to follow up with you about BEACON training | Consent for Fourth Party, given by clicking the confirmation link; we send nothing about the newsletter until you do. Legitimate interest in following up with someone who asked to watch our class. We do not record your name or your IP address on this record, and the viewing link, which lasts four hours, is not stored |
| Free VAULTS training — your email address. On the same record we keep the date you first opened the training, the date you last opened it and how many times you have opened it. If you were already a Fourth Party subscriber, the same record is used and your original sign-up is not changed | To open the training for you through a short-lived viewing link, to send you Fourth Party, and to follow up with you about training | Consent for Fourth Party, given by clicking the confirmation link; we send nothing about the newsletter until you do. Legitimate interest in following up with someone who asked to watch our training. We do not record your name or your IP address on this record, and the viewing link, which lasts four hours, is not stored |
| BEACON pack or Core Provider Toolkit — your email address, and the first name, company and role if you choose to give them. We also keep which page sent you, whether you ticked the newsletter box, whether you ticked the 30-minute call box, and the dates the pack or toolkit and its two follow-up emails were sent | To email you the pack or toolkit and the two follow-up emails over ten days, to follow up on a call you asked for, and, if you ticked the box, to send you Fourth Party | Legitimate interest in delivering what you asked for and in the three emails, each of which carries a one-click unsubscribe. Consent for the call box and for Fourth Party, both unticked by default; for the newsletter, given by clicking the confirmation link. If you tick the call box we contact you on the next business day or later, never the same day. We do not record your IP address, and there is no open or click tracking |
| On-demand course purchase — your email address (from Square at checkout), the Square payment and order IDs, the amount, the date, which course you bought and when your access ends. On the same record we keep the date you first opened the course, the date you last opened it, how many times you have opened it, and a count of viewing links issued each day | To email you your access link, to open the course and its toolkit files for you through short-lived viewing links, to send you a new link if you ask, to give you a refund, and to keep a record of the sale | Performance of a contract. Legitimate interest in stopping one link being shared beyond the buyer, which is why the number of viewing links per day is limited. Payment is handled by Square; we do not receive or store card numbers. We store only a one-way hash of your access key, not the key itself, and we do not record your IP address on this record. If you used a course's free preview, that sign-up follows the newsletter row above |
| Ethics attestation and course exams — your name, email address, the exam taken, your score, the date and your typed-name signature on the identity attestation, recorded only if you pass | So the attestation or exam can be tied to the certificate it supports, and confirmed later for you or an employer | Performance of a contract, and legitimate interest in being able to stand behind a credential we issued. We do not record your answers, which questions you missed, or anything about your device. A failed attempt is not recorded |
| Exam attempt counter — a one-way hash of the exam, your network address and the email you entered, with a count of attempts. It holds no readable address or email and is not linked to your result | To limit each exam to three attempts in 24 hours, so the pass mark cannot be reached by repeated guessing | Legitimate interest in the integrity of the certificates we issue. Deleted automatically 24 hours after the first attempt it counts |
| Website analytics — aggregate, cookieless traffic measurement | To understand which pages are useful | Legitimate interests — no cookie is set and no individual is identified |
| Trust Center gated artifacts — requester, artifact and date | A record of what security documentation was disclosed, to whom, and when | Legitimate interest in maintaining an auditable disclosure record |
We ask for the minimum that lets us do the thing you came for. If a form asks for something you would rather not give, email instead.
What we do not do
- We do not sell or rent personal data, to anyone, for any purpose.
- We do not use enquiry, participant or website data to train AI models.
- We do not build advertising profiles or run cross-site tracking pixels.
- We do not accept categories of data we have no need for — Protected Health Information, cardholder data, government classified information, or production credentials. Declining a category of data is the strongest available control over it.
Cookies and analytics
This site sets no cookies of its own. We use none for analytics, preferences or advertising — which is why you have not been shown a cookie banner. We store nothing in your browser ourselves. The one exception to know about is the human check on our forms, described below, which Cloudflare runs in its own frame.
We do measure aggregate traffic, using Cloudflare Web Analytics. It records page views and referring sites so we can tell which material is worth writing more of. It is cookieless: it sets no cookie, writes nothing to your browser, does not fingerprint your device and does not follow you to other sites. It does not record query strings. There is no advertising network involved and no profile is built.
Human check on our forms. The newsletter sign-up, the contact form and the vendor-AI pack form use Cloudflare Turnstile to tell people from bots, because bots flooded our sign-up form in October 2026 and sent unwanted confirmation emails to people who never asked for them. Cloudflare's script loads only when you first click or tap into one of these forms, not when you view a page. To make its decision it looks at signals such as your IP address, your browser's user-agent and TLS fingerprint, and how the page behaves; Cloudflare states it does not read what you type into the form. We have not turned on pre-clearance, so Turnstile does not leave Cloudflare's clearance cookie on this site. The check runs in a frame served by Cloudflare, and anything the browser keeps for it is governed by Cloudflare's Turnstile Privacy Addendum. For this purpose we are the controller, our lawful basis is legitimate interests (keeping our forms and your inbox free of abuse), and Cloudflare acts as our processor; Cloudflare also uses the signals, as its own controller, to improve its bot detection, and says it does not use them to identify, profile or target anyone. Cloudflare already hosts this site and is listed in the Trust Center; no new sub-processor is added. If your browser blocks the check, the form will not send, and you can email us directly.
Cloudflare also hosts this site, so it is already processing the request that delivers this page to you. Adding the measurement introduced no new company to the chain.
Who else sees it
Our material sub-processors are published — named, dated, with the categories of data each may access and where they process it — in the Trust Center. That list is the authoritative one and it is reconciled quarterly.
Forms on this site. The contact form and the resource-download form are handled by our own code running on Cloudflare Workers — there is no third-party form service. A contact message is not stored in a database; the sign-up, pack and training forms keep their records in Cloudflare D1 databases for the purposes and periods set out in this notice. The sign-up, contact and pack forms are protected by Cloudflare Turnstile (see section 05). The resulting email is sent by Resend (Resend Labs, Inc., United States), which processes the message in transit; the address then rests only in our mailbox, hosted on Microsoft 365. We run no tracking pixels and no advertising scripts on this site. Aggregate, cookieless analytics are described in §05; a form submission is still the only thing that tells us who you are.
The free BEACON class video. The video is hosted by Cloudflare Stream, a service of Cloudflare, Inc., which already hosts this site and is listed in the Trust Center. The video is private: it plays only through a viewing link that our code issues after you enter your email address, and the link stops working after four hours.
The free VAULTS training video. The video is hosted by Cloudflare Stream, a service of Cloudflare, Inc., which already hosts this site and is listed in the Trust Center. The full video is private: it plays only through a viewing link that our code issues after you enter your email address, and the link stops working after four hours. The short trailer on the same page is public and does not ask for an email address.
We give not less than 30 days' notice before a new sub-processor with access to client data begins processing. To subscribe to those notices, email trust@thirdpartythreathunting.com with the subject line Sub-processor notifications.
International transfers
Where personal data originating in the EEA or the United Kingdom is transferred to the United States, we make that transfer under the European Commission's Standard Contractual Clauses together with a transfer risk assessment, or under an adequacy decision where one applies.
How long we keep it
| Record | Retention |
|---|---|
| Enquiry correspondence | Duration of the discussion plus 12 months |
| Resource download — address only, no list opt-in | 30 days, then deleted. The address is held in one mailbox and nowhere else, so this is a deletion we can actually perform |
| Training participant records (certificate register) | 5 years from the latest certificate, attestation or renewal date, then deleted, so certifications can be verified and reissued |
| Newsletter subscription | Until you unsubscribe. If you unsubscribe we keep the address on a suppression list rather than deleting it — that record is what guarantees you are not added back by mistake. Ask us to delete it outright and we will. Sign-ups never confirmed are deleted after 30 days |
| BEACON class viewing record (first view, last view, number of views) | 12 months after your last view, then the dates and count are cleared. The email address itself follows the newsletter rules above: it stays while you are subscribed, a sign-up never confirmed is deleted after 30 days, and if you unsubscribe it goes on the suppression list |
| VAULTS training viewing record (first view, last view, number of views) | Kept on your subscriber record and deleted with it. The email address itself follows the newsletter rules above: it stays while you are subscribed, a sign-up never confirmed is deleted after 30 days, and if you unsubscribe it goes on the suppression list |
| BEACON pack or Core Provider Toolkit sign-up (address, optional name, company and role, source, box choices and email dates) | Follows the newsletter rules: kept until you unsubscribe from the pack or toolkit emails, then kept as a suppression record so you are not added back by mistake. Ask us to delete it outright and we will. If you ticked the newsletter box, that subscription is governed by the newsletter row above |
| On-demand course purchase record (email address, access key hash, viewing dates and counts) | 12 months of access from purchase, plus 90 days. Then the email address, the key hash and all viewing data are erased automatically, and we keep only the payment ID, order ID, amount, currency, status and the purchase, expiry and refund dates as our sales record for 7 years, then deleted. Ask us to erase your email address sooner and we will; the sales record stays for that period |
| Exam attempt counter | 24 hours from the first attempt it counts, then deleted automatically |
| Ethics attestation and course exam results (passes only) | 5 years from the date taken (or the latest renewal), then deleted. Long enough that a credential stays confirmable across a hiring cycle and any continuing-education audit; short enough that it does not become an indefinite file |
| Gated-artifact access log | 3 years |
| Contracts, NDAs and DPAs | 7 years from termination |
Where a contract sets a shorter period, the contract governs. Certified destruction is available on request.
Your rights
Subject to applicable law you may ask us for access to your personal data, or for correction, deletion, restriction or portability, and you may object to processing or withdraw consent at any time.
Write to privacy@thirdpartythreathunting.com. We acknowledge requests within five business days and fulfill them within the statutory period. You may also complain to your supervisory authority; exercising a right here does not affect that.
Security
Our security program is documented and published rather than described in general terms. The Trust Center carries the NIST CSF 2.0 control profile, the sub-processor register, the insurance position, and a register of every open control gap with its target date — including the ones we have not closed yet.
To report a vulnerability in a TPTH public property, write to security@thirdpartythreathunting.com. You will be acknowledged within two business days.
Changes to this notice
Material changes are recorded in the change log at §12 of the Trust Center and reflected in the effective date above. We do not make quiet edits.
Privacy: privacy@thirdpartythreathunting.com · Security: security@thirdpartythreathunting.com · Due diligence: trust@thirdpartythreathunting.com