Privacy notice

Last updated 30 September 2026.

1. Who we are

1.1 This Privacy Notice explains how Theos X Ltd collects, uses, shares and protects your personal data, and what rights you have over it.

1.2 Theos X Ltd is a limited liability company registered in Malta under company number C 117139, with its registered office at ADD Malta, Level 2, Hardrocks Business Park, Triq Burmarrad, Naxxar NXR 6345, Malta. In this notice we refer to it as "Theos X", "we", "us" and "our".

1.3 Theos X Ltd is the data controller for the personal data described in this notice. That means we decide why and how it is used, and we are responsible for it.

1.4 Theos X trades under a number of brand names, including Founders Who Give A F*ck, Your Profile Scan and Founder Blueprint. Those brands are not separate companies. Whichever of our websites you use, your personal data is controlled by Theos X Ltd.

1.5 You can contact us about anything in this notice at [email protected].

2. What this notice covers

2.1 This notice applies to our websites at founderswhogiveaf.com, founderswhogiveafuck.com, yourprofilescan.com and founder-blueprint.com, and to any other website we operate with the same domain names and a different extension, together with all of the products and services we supply through them.

2.2 We are governed by the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Chapter 586 of the Laws of Malta), together with any subsidiary legislation made under it.

2.3 This notice should be read together with our Terms and Conditions and our Refund and Cancellation Policy.

3. The personal data we collect

3.1 Information you give us

3.1.1 Your name and, where you provide it, your company name.

3.1.2 Your email address.

3.1.3 The URL of the LinkedIn profile you ask us to review, where you purchase a profile scan.

3.1.4 Your answers to the Founder Blueprint assessment, where you purchase Founder Blueprint.

3.1.5 Billing and payment information, which is collected and processed by our payment provider rather than by us. We receive confirmation of payment, the amount, the date and a transaction reference. We do not receive or store your full card number.

3.1.6 Anything you choose to tell us when you contact us, including by email, through a form on our websites, or through a social media platform.

3.1.7 Where you enrol on a course or membership, the account details you provide to our learning platform, and records of your progress and attendance.

3.2 Information we obtain from a LinkedIn profile you ask us to review

3.2.1 Where you purchase a profile scan, we obtain information that is already publicly visible on the LinkedIn profile at the URL you give us, without logging in to LinkedIn. This may include your name, headline, photograph, location, work history, education, skills, recommendations, posts and other publicly displayed content.

3.2.2 Some of that publicly visible information relates to other LinkedIn members rather than to you. Where your report shows the names of other members, those names are already displayed publicly by LinkedIn to anyone who views your profile. We do not assess, collect, store or otherwise process the profiles of those members, we do not contact them, and we do not use their names for any other purpose.

3.3 Information we collect automatically

3.3.1 When you visit our websites we may collect technical information including your IP address, browser type and version, device type, the pages you viewed, the time and length of your visit, and the website you arrived from. This is described further in section 11.

3.4 What we do not collect

3.4.1 We do not ask for, and you must not give us, information about your health, information about children, information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning your sex life or sexual orientation. Our assessments are designed to measure working preferences and professional behaviour, and nothing else.

4. How we use your personal data, and our lawful basis

4.1 We only use your personal data where the law allows us to. The table below sets out what we use it for and why we are permitted to.

4.2 Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we have concluded that they are not. You can ask us for more detail about that assessment, and you can object to processing based on legitimate interests. See section 10.

4.3 We do not make any decision about you that produces a legal effect or similarly significantly affects you based solely on automated processing.

5. Your Profile Scan: how the profile information is handled

5.1 (Collection by people, not by machines) The information we assess is collected and verified manually, by people working under contract to us, from the publicly visible LinkedIn profile at the URL you give us, without logging in. Nothing is collected by scraping, automated extraction, crawling, bots or any other automated means.

5.2 (Assessment) That information is then assessed by our systems against our own framework, which draws on our proprietary methodology, published research, and automated analysis tools, including artificial intelligence tools.

5.3 (Your own profile) We only ever review the profile you tell us is your own. You confirm that when you place your order.

5.4 (What we never do) We do not sell the information collected from your profile. We do not share it other than with the people and service providers who are required in order to produce and deliver your report. We do not use it to train any artificial intelligence model. We do not use it for any other product, brand or purpose, and we do not use it to market to you unless you have separately consented to marketing.

5.5 (Keeping a copy) We keep the information collected from your profile, and a copy of your report, as our record of what you ordered and what we supplied. You can ask us to delete both at any time, and we will. See section 9.

5.6 (We do not keep it for your benefit) We recommend you save your own copy of your report. We are not obliged to keep it or to send it again.

6. Founder Blueprint: how your answers are handled

6.1 Your answers and your results are held temporarily in your own browser while you complete the assessment, and are used to generate and display your report.

6.2 We do not provide a login area for Founder Blueprint and we do not keep a copy of your answers or your report for you. You must download or print your report before you leave the results page.

6.3 Your results are not used to make any decision about your legal rights, employment, credit, insurance, health or access to essential services, and Founder Blueprint must not be used to assess, screen or select employees or job applicants.

7. Who we share your personal data with

7.1 We do not sell your personal data. We have never sold it and we will not sell it.

7.2 We share your personal data only with the following categories of recipient, and only to the extent they need it in order to do their job for us:

7.2.1 Data collection providers, being contracted personnel who manually collect the publicly visible information from the LinkedIn profile you ask us to review;

7.2.2 Hosting and infrastructure providers, who host our websites and store our data;

7.2.3 Payment processing providers, who take your payment and provide us with the transaction record;

7.2.4 Email delivery providers, who send your report, your order confirmation and, where you have consented, our marketing emails;

7.2.5 Learning platform providers, where you have enrolled on a course or membership;

7.2.6 Customer support and communication tools, which hold our correspondence with you;

7.2.7 Automated analysis tools, which are used to assess the information as described in section 5.2; and

7.2.8 Professional advisers, including accountants, auditors and lawyers, where we need advice or are required to provide records.

7.3 Every provider we use is bound by a written agreement requiring them to keep your data confidential, to use it only on our instructions, and to protect it appropriately.

7.4 We will also disclose your personal data where we are required to do so by law, to a law enforcement agency, court, regulator or government authority, or where disclosure is necessary to establish, exercise or defend legal claims.

7.5 If our business, or substantially all of our assets, is acquired by or transferred to a third party, your personal data may be transferred as part of that transaction. We will take reasonable steps to ensure the recipient handles it consistently with this notice.

7.6 We do not name our individual service providers in this notice, because the specific tools we use form part of our own methodology and change from time to time. If you want to know the categories of recipient that apply to your own data, contact us and we will tell you.

8. Transfers outside the European Economic Area

8.1 Some of the people and service providers we work with are established outside the European Economic Area, currently in the United Kingdom and the United States.

8.2 Where personal data is transferred outside the European Economic Area, we make sure an appropriate safeguard is in place, which will be one of the following:

8.2.1 the country has been found by the European Commission to provide an adequate level of protection, which is currently the case for the United Kingdom; or

8.2.2 the transfer is made under the European Commission's Standard Contractual Clauses, together with any additional measures required following our assessment of the transfer. We rely on this for transfers to the United States.

8.3 You may request a copy of the safeguards we rely on by contacting us at [email protected].

9. How long we keep your personal data

9.1 We keep your personal data for as long as we have a legitimate business need to do so, and for as long as we are required to keep it by law.

9.2 In practice this means:

9.2.1 Information collected from your LinkedIn profile, and your report: kept as our record of what you ordered and what we supplied, and deleted on request. See clause 9.4.

9.2.2 Order records, invoices and payment records: seven years, as required by Maltese tax and accounting law.

9.2.3 Your checkout acknowledgements, including the wording and the date and time you gave them: seven years, so that we can evidence the basis of the sale in the event of a payment dispute.

9.2.4 Marketing contact details and your consent record: until you withdraw your consent, and for a reasonable period afterwards so that we can evidence that you asked us to stop.

9.2.5 Correspondence with you: for as long as needed to deal with the matter, and afterwards for as long as a claim relating to it could reasonably be brought.

9.2.6 Founder Blueprint answers and results: not retained by us at all.

9.3 When we no longer have a reason to keep your personal data, we delete it or anonymise it so that it can no longer be linked to you.

9.4 (Deletion on request) You may ask us at any time to delete the information collected from your profile and our copy of your report, by emailing [email protected]. We will do so, except for records we are required by law to keep, such as invoices.

10. Your rights

10.1 Under the GDPR you have the following rights:

10.1.1 Access. You can ask for a copy of the personal data we hold about you, and for information about how we use it.

10.1.2 Rectification. You can ask us to correct personal data that is inaccurate, and to complete data that is incomplete.

10.1.3 Erasure. You can ask us to delete your personal data where there is no good reason for us to continue holding it.

10.1.4 Restriction. You can ask us to pause our use of your personal data in certain circumstances, for example while we check whether it is accurate.

10.1.5 Objection. You can object to our use of your personal data where we rely on legitimate interests, and we will stop unless we have compelling grounds to continue. You can object to direct marketing at any time, and we will always stop.

10.1.6 Portability. Where we process your personal data by automated means on the basis of your consent or a contract with you, you can ask us to provide it in a structured, commonly used, machine-readable format, or to transmit it to another controller.

10.1.7 Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

10.2 (How to exercise them) Email [email protected]. We may ask you to verify your identity before we act, so that we do not disclose your data to someone else.

10.3 (Our response) We will respond within one month. If your request is complex, or you have made several requests, we may extend that by a further two months, and we will tell you if we do.

10.4 (Cost) Exercising your rights is free. We may charge a reasonable fee, or refuse to act, only where a request is manifestly unfounded or excessive.

11. Cookies and similar technologies

11.1 (What they are) Cookies are small text files placed on your device when you visit a website. We also use similar technologies, including local storage, tracking pixels and tags. In this notice we refer to all of them as cookies.

11.2 (The categories we use) We use cookies in the following categories:

11.2.1 Strictly necessary cookies. These are required for our websites to work and to stay secure, for example to remember your display preferences, to keep your session active, to process your payment and to protect against fraud and abuse. Our websites cannot function properly without them, so they do not require your consent.

11.2.2 Analytics and performance cookies. These tell us how our websites are used, for example which pages are visited, how long people stay, where they arrived from and where they leave. We use this to understand what is working and to improve our websites and our products. These are set only with your consent.

11.2.3 Advertising and targeting cookies. These include tracking pixels and tags provided by advertising and social media platforms. They allow us to measure whether our advertising works, to understand which adverts led to a purchase, and to show you relevant adverts on other websites and platforms, including adverts shown to people who have visited our websites before. These are set only with your consent.

11.3 (Third party cookies) Analytics and advertising cookies are set by third party providers, including advertising and social media platforms. Those providers may receive information about your visit, and may combine it with other information they already hold about you. Their own privacy notices govern what they do with it, and we recommend you read them. We describe these providers by category rather than by name, for the reason given in clause 7.6.

11.4 (Your consent) When you first visit one of our websites, we will ask whether you accept analytics and advertising cookies. No analytics or advertising cookie is set before you give that consent. You can accept all, reject all, or choose by category.

11.5 (Changing your mind) You can change or withdraw your consent at any time through the cookie settings link on our websites. Withdrawing consent does not affect the lawfulness of anything done before you withdrew it, and it does not remove cookies already on your device, which you can delete through your browser.

11.6 (Browser controls) You can also block or delete cookies and clear local storage through your browser settings. If you block strictly necessary cookies, parts of our websites may not work properly.

11.7 (How long they last) Some cookies last only for your current visit and are deleted when you close your browser. Others remain on your device for a set period so that you are recognised when you return. The duration of each cookie is shown in our cookie settings.

11.8 (Server logs) Separately from cookies, our hosting provider keeps standard server logs, which may include your IP address, as described in clause 3.3.1. These are used for security and to keep our websites working, and for no other purpose.

12. How we protect your personal data

12.1 We limit access to personal data to the people who need it in order to supply our products or do their jobs.

12.2 We have appropriate technical and organisational measures in place to protect personal data against unauthorised or unlawful processing, and against accidental loss, damage or destruction.

12.3 No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information and Data Protection Commissioner, and will notify you where the law requires us to.

13. Marketing

13.1 We will only send you marketing emails where you have given us your consent to do so, by ticking a box that was not pre-ticked and that was separate from any other agreement.

13.2 Every marketing email we send contains a one-click unsubscribe link. You can also unsubscribe at any time by emailing [email protected].

13.3 Where you consent to marketing from Your Profile Scan, Founder Blueprint or Founders Who Give A F*ck, you are consenting to marketing from Theos X Ltd, which operates all of those brands.

14. Complaints

14.1 If you are unhappy with how we have handled your personal data, please tell us first at [email protected]. We will acknowledge your complaint within seven business days and try to resolve it.

14.2 You also have the right to lodge a complaint with the supervisory authority. In Malta this is the Information and Data Protection Commissioner:

Office of the Information and Data Protection Commissioner

Floor 2, Airways House, High Street, Sliema SLM 1549, Malta

[email protected]

idpc.org.mt

14.3 If you live or work in another country in the European Economic Area, you may also complain to the supervisory authority in that country.

15. Changes to this notice

15.1 We may update this notice from time to time. When we do, we will publish the updated version on our websites and change the date at the top.

15.2 Where a change materially affects how we use your personal data, we will tell you directly.

16. Contacting us

16.1 For anything relating to this notice, including exercising your rights, email [email protected].

16.2 Theos X Ltd, Company Number C 117139, VAT MT33204410. Registered office: ADD Malta, Level 2, Hardrocks Business Park, Triq Burmarrad, Naxxar NXR 6345, Malta.