Privacy Policy

Who we are

360 Web Solutions is a digital marketing and SEO agency incorporated and operating under the laws of England and Wales. We provide a range of services including search engine optimisation, content marketing, email marketing, and AI-driven marketing consultancy.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, 360 Web Solutions is the Data Controller in respect of personal data collected through this website and our associated services.

What this policy covers

This Privacy Policy explains how 360 Web Solutions collects, uses, stores, and protects your personal data when you:

• Visit and interact with our website at 360websolutions.co.uk
• Submit an enquiry through our contact form or any other on-site form
• Subscribe to or receive communications from us via email
• Engage with us as a prospective or existing client
• Otherwise provide your personal data to us in the course of our business relationship

This Policy does not cover third-party websites linked from our site. We encourage you to review the privacy policies of any external sites you visit.

What personal data we collect

We collect and process the following categories of personal data, depending on how you interact with us:

3.1 Data you provide directly

• Full name
• Business name and job title
• Email address
• Telephone number (where provided)
• The content of any messages or enquiries you submit to us

3.2 Data collected automatically

• IP address (anonymised where applicable)
• Browser type and version
• Device type and operating system
• Pages visited, session duration, and navigation behaviour
• Referring URL
• Geographic location data (country/city level only)

3.3 Data received from third parties

We may receive limited data about how you found our website through platforms such as Google Search Console. This data is aggregated and anonymised and does not identify you personally.

Lawful bases for processing

Under UK GDPR, we are required to have a lawful basis for each type of processing activity. The lawful bases we rely upon are as follows:

4.1 Legitimate interests (Article 6(1)(f) UK GDPR)

We process personal data submitted through our contact and enquiry forms on the basis of our legitimate interests in responding to business enquiries and developing client relationships. We have conducted a Legitimate Interests Assessment (LIA) and are satisfied that our interests do not override your fundamental rights and freedoms, given that:

• You have voluntarily initiated contact with us
• The data processed is limited to what is necessary to respond to your enquiry
• You retain the right to object to this processing at any time

4.2 Consent (Article 6(1)(a) UK GDPR)

Where you have opted in to receive marketing communications from us — including email newsletters or promotional content — we process your data on the basis of your freely given, specific, and informed consent. You may withdraw your consent at any time by clicking the unsubscribe link in any marketing email or by contacting us directly.

4.3 Contractual necessity (Article 6(1)(b) UK GDPR)

Where you engage us as a client, we process personal data to the extent necessary to perform our contractual obligations to you and to administer the client relationship.

4.4 Legal obligation (Article 6(1)(c) UK GDPR)

We may process personal data where we are required to do so by applicable law, including tax, accounting, or regulatory obligations.

How we use your personal data

We use the personal data we collect for the following specific purposes:

• To respond to your enquiries and provide the information or services you have requested
• To onboard you as a client and manage the delivery of contracted services
• To send marketing communications where you have consented to receive them
• To analyse website usage and improve the performance and content of our site
• To monitor search performance and organic visibility through Google Search Console
• To maintain accurate client and prospect records within our CRM
• To comply with our legal, financial, and regulatory obligations
• To protect the security and integrity of our website and business systems

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

Third-party data processors

We engage the following third-party services that may process your personal data on our behalf. Each processor has been selected for its compliance with applicable data protection standards, including UK GDPR. All personal data shared with processors is governed by appropriate Data Processing Agreements (DPAs).

All of the above processors are either based in the United Kingdom, the European Economic Area (EEA), or in countries recognised by the UK as providing adequate levels of data protection, or operate under appropriate transfer safeguards such as Standard Contractual Clauses (SCCs).

We do not sell, rent, or otherwise commercially transfer your personal data to any third party.

Cookies and tracking technologies

Our website uses cookies and similar technologies to improve functionality, analyse traffic, and enhance your browsing experience. A full breakdown of the cookies we use — including their names, purposes, and durations — is available in our separate Cookie Policy, accessible at:

360websolutions.co.uk/cookie-policy

By continuing to use our website without adjusting your browser settings, you consent to our use of non-essential cookies in accordance with our Cookie Policy. You may withdraw or manage your cookie preferences at any time.

Data retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, and in compliance with our legal obligations. Our standard retention periods are as follows:

• Enquiry and contact form data: Retained for a period of up to 12 months from the date of last contact, unless a client relationship is established
• Client data: Retained for the duration of the client relationship and for a period of up to six years thereafter, in accordance with our statutory obligations under the Limitation Act 1980 and HMRC record-keeping requirements
• Email marketing data: Retained until you withdraw your consent or unsubscribe, following which your data will be suppressed within 30 days
• Website analytics data: Retained in anonymised form as configured within Google Analytics 4; raw session data is not retained by us directly

At the end of the applicable retention period, your personal data will be securely deleted or anonymised such that it can no longer be attributed to you.

Your rights under UK GDPR

As a data subject, you are entitled to exercise the following rights in respect of your personal data. We will respond to all valid requests within one calendar month, free of charge, unless your request is manifestly unfounded or excessive.

9.1 Right of access

You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data together with information about how it is processed (a Subject Access Request).

9.2 Right to rectification

You have the right to require us to correct any inaccurate or incomplete personal data we hold about you without undue delay.

9.3 Right to erasure (‘Right to be Forgotten’)

You have the right to request the deletion of your personal data where: it is no longer necessary for the purposes for which it was collected; you withdraw your consent and no other lawful basis applies; or the data has been unlawfully processed. This right is subject to certain exemptions, including where we are required to retain data by law.

9.4 Right to restriction of processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.

9.5 Right to data portability

Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that it be transferred to another controller where technically feasible.

9.6 Right to object

You have the right to object at any time to the processing of your personal data where we rely on legitimate interests as our lawful basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

9.7 Rights in relation to automated decision-making

You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal or similarly significant effects. As noted above, we do not currently engage in such processing.

To exercise any of the above rights, please contact us using the details under How to contact us below. We may be required to verify your identity before processing your request.

Data security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• Encrypted data transmission via HTTPS/TLS across our website
• Access controls limiting the processing of personal data to authorised personnel only
• Password-protected and access-controlled systems for all tools processing personal data
• Regular review of third-party data processors and their security credentials

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware, and will notify affected individuals without undue delay where required by law.

How to contact us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us using the following details:

If you are not satisfied with our response, or if you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or regulatory requirements. Any material changes will be communicated by updating the ‘Last Updated’ date at the top of this Policy. Where changes are significant, we may also notify you by email or by means of a prominent notice on our website.

We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Your continued use of our website or services following the publication of any changes constitutes your acknowledgement of the updated Policy.