Privacy policy Effective 2 November 2026 This notice explains how 360COMPLIANCE LTD uses personal information collected through this website. For privacy requests, email help@360compliance.co.uk. Who is responsible 360COMPLIANCE LTD is the controller for website enquiries, consultation administration, our customer records and our blog mailing list. Company number 10539118. Registered office: 154 Manor Park Road, London, England, NW10 4JR. Contact help@360compliance.co.uk. The separate policy portal may have additional privacy and data-processing arrangements; do not upload patient information through this website. Information you provide An enquiry may include your name, email, telephone, company, service type, preferred reply method and message. A consultation requires your name, email and mobile; service type and preparation notes are optional. We record the requested time, booking status, relevant consent wording and subscription preference. Orders include your name, email, provider type, selected services, prices, order and payment references, status and acceptance of terms. Please do not enter patient details, medical records or other sensitive information in free-text fields. For blog-library access we collect your name, email, subscription choice and verification attempts. Access codes are stored as keyed hashes, with expiry and attempt counts. We use a hashed network identifier to limit misuse. Why we use it and our lawful bases We use enquiry and consultation details to respond, arrange meetings, prepare requested support and take steps towards a contract at your request, or perform our contract with you. For staff acting for a business customer, we rely on our legitimate interests in managing business communications and providing the service. We use contract and legitimate interests for order administration and dispute handling, legal obligations for required accounting records, and legitimate interests for proportionate security and misuse prevention. Blog emails rely on your separate consent; booking or buying alone does not add you to the mailing list. Blog subscription and your choice Blog subscription is optional for consultations. Separately, our free blog library requires an active subscription to read full articles. Titles and summaries are public. New subscribers explicitly choose to receive blog articles and updates by email, then verify their email with a short-lived code. Existing subscribers verify their email to sign in; sign-in alone does not resubscribe an unsubscribed address. You can unsubscribe from the signed-in blog library, an email link, or by emailing us. This ends blog emails and subscriber-only access without affecting consultations or creating a charge. Blog email consent does not authorise marketing calls, texts or WhatsApp messages. Publishing an article does not automatically email subscribers. Who receives information Authorised business staff can access website records. The website is hosted through OpenAI Sites using Cloudflare services for delivery and database storage. Google Workspace receives consultation attendee details to manage Calendar invitations, Google Meet and confirmation emails. When Revolut checkout is enabled, payment details are entered on Revolut’s hosted checkout; our website receives order references and payment status, not full card details. Portal subscription payments use a separate GoCardless arrangement. Professional advisers and authorities may receive information where necessary for advice, legal obligations or disputes. We do not sell your contact information. External services and overseas processing Google, OpenAI, Cloudflare, Revolut, GoCardless and WhatsApp may process information in locations outside the UK under their own service arrangements and privacy notices. We must assess the applicable transfer arrangements and use the safeguards required for our transfers. Contact us for information about the providers and safeguards relevant to your request. Clicking a WhatsApp, Maps or external portal link takes you to that provider; its privacy notice applies to its own processing. How long information is kept We review unsuccessful enquiries and non-customer consultation records after 12 months and remove or minimise information no longer needed, unless a dispute or another documented reason requires retention. Customer contract and accounting records are generally kept for six years after the relevant contract ends or accounting period, with longer retention only where justified. Blog contact details are used until consent is withdrawn; we retain a minimal suppression record to honour an unsubscribe and proportionate consent evidence to demonstrate how permission was obtained. Dormant mailing-list consent is reviewed before campaigns resume. These are retention rules for manual review, not a claim that automated deletion is already installed. Blog access attempts are removed on subsequent access requests once they have been expired for 30 days. Article revision history is retained while needed to manage published guidance and evidence changes. Security and essential technical information We restrict owner pages to an authorised sign-in and keep connection credentials encrypted on the server. Hosting and service providers may process IP addresses, browser information and technical logs for delivery and security. We limit access to records and do not ask you to send payment-card details or API keys by email. No online service can promise absolute security. See our cookie policy for essential sign-in and security storage. Your rights Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal information, and object to processing based on legitimate interests. You can object to direct marketing or withdraw consent at any time. Rights have legal exceptions, including records we must retain. Email help@360compliance.co.uk; we may ask for proportionate identity checks. We normally respond within one month, subject to lawful extensions. You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. Required fields, decisions and changes Required fields let us contact you, arrange your chosen consultation or process an order; without them the relevant form cannot be completed. Optional fields can be left blank. The website does not make decisions with legal or similarly significant effects based solely on automated profiling. We update this notice when our use of information changes. This version applies from 2 November 2026.