Privacy Policy – Thonk Ltd – DIY Synthesizer Kits & Components

Last updated: 12th Sept 2026

This policy explains what personal information Thonk Ltd collects, why we collect it, who we share it with and what rights you have over it. If anything here is unclear, please email us at [email protected] and we will explain it properly.

Our use of cookies is covered separately in our Cookie Policy.

1. Who we are

Thonk Ltd is the data controller for the personal information described in this policy. We are a company registered in England and Wales, company number 08711466.

Our registered office is C/O Ozkan Accountants Ltd, 2nd Floor, Suite 12, Vantage Point, New England Road, Brighton, England, BN1 4GW.

Our operating address is Thonk Ltd, Unit 14, Floor 6, Vantage Point, New England Road, Brighton, BN1 4GW.

We are registered with the Information Commissioner’s Office under registration number ZA863887.

For anything to do with your personal information, email [email protected]. We do not have a Data Protection Officer, as we are not required to appoint one.

2. The information we collect

When you place an order. Your name, billing address, delivery address, email address and telephone number. We also keep a record of what you ordered, when, and what you paid.

When you create an account. Your email address, password, saved addresses and order history.

When you pay. We do not see or store your card details. Payment is handled by PayPal or Stripe, who collect your payment information directly through a secure frame on our site. We receive confirmation that payment succeeded and a transaction reference, not your card number.

When you email us. Whatever you send us, including your email address and anything in the message. For build support this often includes photographs of your work. Support emails are handled through a helpdesk system, so a message to us becomes a ticket that our team can pick up and refer back to.

When you join our mailing list. Your email address, and a record of whether you opened or clicked our emails. Joining the mailing list is a separate decision from placing an order, and we never add a customer to it because they bought something.

When you use our website. Information about your device and how you use the site, collected through cookies and similar technologies. Our Cookie Policy sets out what is collected and by whom, and you control this through the cookie banner.

When you apply for a job with us. Your CV, contact details and anything else you send in support of your application.

We do not ask for special category data. Please do not send us health information, or anything else of that kind, in a support email.

3. Why we use it, and our lawful basis

Under UK data protection law we must have a lawful basis for everything we do with your information. Ours are set out below.

What we do	Why	Lawful basis
Take, pick, pack and send your order	To fulfil the contract between us	Performance of a contract
Give your name, address, email address and phone number to a carrier	So your parcel can be delivered and so the carrier can contact you about delivery or charges	Performance of a contract
Declare your details to customs authorities	Export and import law requires it	Legal obligation
Take payment	To fulfil the contract between us	Performance of a contract
Maintain your account	To provide the account you asked for	Performance of a contract
Answer your emails, whether or not you have bought anything, and provide build support	To fulfil the contract, to answer questions from people deciding whether to buy, and to run our business well	Performance of a contract where you are a customer, steps taken at your request before a contract, and our legitimate interests
Copy the designer or manufacturer of a product into a support email	So that a specialist can help with their own product, whether or not you have bought it yet	Performance of a contract where you are a customer, steps taken at your request before a contract, and our legitimate interests
Send you order confirmations, dispatch notices and service messages	To fulfil the contract between us	Performance of a contract
Send you marketing emails	Because you asked us to	Consent
Measure how our website is used	To understand what works and improve the site	Consent, for anything requiring cookies
Show and measure advertising	To reach people who might want our products	Consent
Keep accounting and tax records	Tax law requires it	Legal obligation
Deal with returns, refunds, complaints and disputes	To fulfil the contract, and to protect our position	Performance of a contract, and our legitimate interests
Consider a job application	To decide whether to employ you	Steps prior to entering a contract

Where we rely on legitimate interests, our interest is in running a functioning shop: answering customers, resolving problems, keeping records of what was agreed, and protecting the business against fraud or an unfounded claim. We have considered your rights in each case and do not believe any of this is intrusive or unexpected. You can object at any time, and section 7 explains how.

Giving us your details is not optional for an order. We need a name, address, email and telephone number to form and perform the contract. A carrier will not accept a parcel without a phone number, and a missing or incorrect one is a common cause of a parcel being returned. If you do not want to provide these, we cannot sell to you.

We do not make any decisions about you by automated means alone, and we do not profile you in any way that produces legal effects.

4. Who we share it with

We never sell your personal information, and we never share it with a third party for their own marketing.

We do share it with the following, and only so far as each of them needs it.

Carriers and postal services, including Royal Mail, FedEx and DHL, along with their partner services in your country. They receive your name, delivery address, email address and telephone number so that they can deliver your parcel and contact you about the delivery.

Customs authorities in the country your parcel is going to. They receive the information required on a customs declaration, which includes your name and address and the contents and value of the parcel. We are legally required to declare this accurately.

The designers and manufacturers of the products we sell. Where a question is best answered by the person who designed a module, we may copy them into the email so they can help you directly. This applies whether you have already bought the product or are asking about it beforehand. They will see your email address and the contents of the thread. This is usually the fastest way to a working module, and because we copy them in rather than forward your message, you can always see who is on the email and reply to us alone if you would rather.

PayPal and Stripe, who process payments for us.

Mailchimp, who send our mailing list emails on our behalf. Only the email addresses of people who have joined the mailing list are given to Mailchimp. Ordering from us does not put you on the list, and we do not add customers to it.

Google and Meta, in connection with website analytics and advertising, where you have consented through the cookie banner. Our Cookie Policy explains this in more detail.

Plausible Analytics, who provide privacy-focused website statistics.

Google, whose Workspace services we use to run the business. This includes our email accounts and the file storage where business records are kept.

Freshworks, whose Freshdesk software we use to handle customer support emails. Anything you send us about an order or a build is held there.

Our website host, and the providers of the software that runs our shop.

Our accountants and our VAT compliance consultant, who help us meet our tax and VAT obligations in the UK and in the countries we ship to.

Our professional advisers, if ever needed, including in connection with a legal claim.

We may also disclose information where the law requires it, or to establish, exercise or defend a legal claim.

5. Sending information outside the UK

We ship worldwide, and most of our orders go overseas. That means your delivery details will normally be sent outside the UK.

To deliver your order. Where you have asked us to send a parcel to a country outside the UK, we transfer your name, address and contact details to the carriers and customs authorities in that country. This is necessary to perform the contract you have entered into with us.

To our suppliers. Some of the companies we use are based outside the UK, or store information outside it. Our website is hosted in the European Union, which the UK recognises as providing an adequate level of protection. Some of our other providers, including Google, Meta, Mailchimp and Freshworks, are based in the United States. Where information goes to a country the UK has not deemed adequate, we rely on the safeguards available under UK law, which are the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it.

If you would like more detail on the safeguards that apply to a particular transfer, email us and we will tell you.

6. How long we keep it

Order and accounting records: seven years. We are required to keep records of transactions for tax purposes, and we keep them for seven years from the end of the relevant accounting period.

Your account: for as long as you have one. If you would like it closed, email us and we will do it, though we will still need to keep the underlying order records for the period above.

Support emails: for as long as they are useful in supporting you, and then in our helpdesk and email archives. Build support threads are worth keeping, because a problem someone had two years ago is frequently the same problem someone else has today.

Mailing list: until you unsubscribe. Unsubscribing removes you from the list immediately.

Job applications: for six months after a decision, unless you ask us to delete them sooner.

Cookies and analytics: as set out in our Cookie Policy.

7. Your rights

Under UK data protection law you have the following rights. All of them are free to exercise, and we will respond within one month.

Access. You can ask for a copy of the personal information we hold about you.

Correction. You can ask us to correct anything that is wrong. You can also update most of it yourself in your account.

Erasure. You can ask us to delete your information. We cannot delete records we are legally required to keep, such as those covered by the seven year period above, but we can delete an account, remove you from the mailing list, and delete correspondence that we do not need.

Restriction. You can ask us to stop using your information while a question about it is resolved.

Portability. You can ask for the information you gave us in a machine-readable format, or ask us to send it to someone else.

Objection. You can object to us using your information on the basis of legitimate interests. You can also object to direct marketing at any time, and we will stop.

Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. Unsubscribing from an email, or changing your cookie preferences, does this. Withdrawing consent does not affect anything we did before you withdrew it.

To exercise any of these, email [email protected]. We may ask you to confirm your identity, which normally means replying from the email address on your account.

If you are unhappy with how we have handled your information, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at any time.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Their website is ico.org.uk and their helpline is 0303 123 1113.

8. Marketing

We only send marketing emails to people who have asked for them, and joining the list is always a deliberate act on your part. Buying from us does not sign you up, and we do not add customers to the list on the basis of having their address. On average we send about one email a month.

Every email we send has an unsubscribe link, and you can also email us and ask to be removed. We do not pass your subscription email address to anyone else for their own marketing.

Order confirmations, dispatch notices, and replies to your support emails are not marketing, and you will receive those whether or not you are on the mailing list, because they are part of fulfilling your order.

9. Social media

We have accounts on Instagram, Facebook and YouTube. If you follow us, comment on a post or send us a message there, we can see your profile and whatever you have posted, and the platform processes your information under its own privacy policy rather than this one.

Where someone asks us a product question publicly, we may answer publicly, and we may tag the designer of the product so they can help too. We only do that with what you have already posted yourself.

We sometimes reshare photos that customers post of their builds and their parcels. Before we do, we check for anything personal, and we will not reshare an image showing your address or order details.

Please take the same care yourself. A photograph of a parcel often has a readable address label on it, and a public comment is a poor place for an order number. If we happen to spot something that shows more than you meant to, we will let you know, although only you can take your own post down. If you need to share private details to get help, email us instead.

10. Cookies

Our website uses cookies and similar technologies. When you first visit, you will be asked which categories you accept, and you can change that choice at any time.

Only strictly necessary cookies are set without your consent, because the site cannot function without them. Everything else, including analytics and advertising, is set only if you agree.

Full details, including a current list of the cookies in use and what each one does, are in our Cookie Policy.

11. Security

We take reasonable technical and organisational measures to keep your information safe. Our website uses encrypted connections throughout, we do not store card details at any point, and access to customer information is limited to the people who need it to do their jobs.

No system is completely secure. If a breach ever occurred that was likely to affect your rights, we would tell you and the Information Commissioner’s Office, as the law requires.

12. Children

Our website and products are not aimed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, please email us and we will delete it.

Building electronics involves hot and sharp tools, and our terms ask that anyone under 18 is supervised.

13. Changes to this policy

We update this policy when what we do changes, or when the law does. The version published here is the current one, and the date at the top tells you when it last changed. If we make a change that materially affects you, we will tell you.