Privacy Policy
Transparent disclosure of how 360GrowthLab OÜ processes, safeguards, and respects personal data in accordance with the European Union General Data Protection Regulation (Regulation EU 2016/679).
Key Privacy Commitment
360GrowthLab OÜ operates under strict data minimization principles. We do not sell, rent, or monetize your personal data. All processing activities adhere strictly to the European General Data Protection Regulation (GDPR) and the ePrivacy Directive.
1. Data Controller Identity
Under Article 4(7) of the General Data Protection Regulation (GDPR), the legal entity determining the purposes and means of the processing of personal data collected through this website and our operational platforms is:
Legal Name: 360GrowthLab OÜ
Corporate Form: Private Limited Company (Osaühing - OÜ)
Registered Office: Ahtri tn 12, 15551 Tallinn, Republic of Estonia
Commercial Register: Estonian Commercial Register (Äriregister)
Primary Contact & DPO Desk: hello@360growthlabs.com
2. Core Principles of Data Processing
In accordance with Article 5 of the GDPR, all personal data handled by 360GrowthLab OÜ is:
- Processed lawfully, fairly, and transparently in relation to the data subject.
- Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
- Adequate, relevant, and limited to what is strictly necessary in relation to the purposes for which it is processed (Data Minimization).
- Accurate and kept up to date where necessary.
- Kept in a form permitting identification for no longer than is strictly necessary.
- Processed with appropriate technical and organizational security to prevent unauthorized access, accidental loss, destruction, or damage.
3. Categories of Personal Data Collected
We may collect and process the following categories of data depending on your interaction with our website and communications desk:
A. Information You Voluntarily Provide
- Direct Inquiries & Contact Submissions: Name, professional email address, telephone number, company affiliation, job title, and any contextual information included within message payloads when you initiate contact or request collaboration.
- Commercial & Asset Collaboration Data: Information exchanged during discussions regarding asset co-development, platform licensing, or institutional partnerships.
B. Information Collected Automatically (Technical Telemetry)
- Connection Telemetry: Anonymized/truncated IP address, operating system, browser engine and version, language settings, screen resolution, referring URLs, request timestamps, and HTTP response headers.
- Diagnostic & Security Logs: Server access records, error logs, and firewall activity records maintained strictly for DDoS defense, system stability, and threat detection.
4. Purposes and Legal Bases for Processing
We process personal data strictly where an authorized legal basis exists under Article 6(1) of the GDPR:
| Processing Purpose | Categories of Data | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Responding to contact inquiries & partnership proposals | Name, email, company, message contents | Art. 6(1)(b): Performance of a contract or pre-contractual steps |
| Infrastructure security, server reliability & bot prevention | Server logs, truncated IP, device metadata | Art. 6(1)(f): Legitimate interest in securing digital infrastructure |
| Aggregated web audience measurement & analytics | Pseudonymized browsing telemetry, cookies | Art. 6(1)(a): Explicit Consent (where non-essential cookies are enabled) |
| Compliance with statutory legal, tax, or corporate obligations | Corporate transaction records, billing details | Art. 6(1)(c): Legal obligation under Estonian and EU law |
5. Data Retention Periods
Personal data is retained only for the duration strictly necessary to fulfill the purpose for which it was gathered:
- Contact & Inquiries: Maintained for the duration of the active exchange and up to three (3) years following the last documented contact, after which it is securely deleted or anonymized.
- Server & Security Logs: Retained for a maximum period of 30 to 90 days for forensic and operational security analysis, unless an ongoing security investigation mandates extended preservation.
- Cookie Identifiers: In compliance with European regulatory guidance, consent preferences and analytical tracking identifiers are retained for a maximum duration of thirteen (13) months.
6. Recipients and Data Processors
We do not sell, rent, or trade your personal data to data brokers or commercial third parties. Personal data is only accessible to authorized personnel within 360GrowthLab OÜ and contracted service providers acting as Data Processors (Art. 28 GDPR) under strict confidentiality and security agreements:
- Web Hosting & Cloud Infrastructure: Hostinger International Ltd. / Hostinger Operations, UAB (High-availability European server infrastructure located within the EEA).
- Email & Communication Gateways: Enterprise email infrastructure ensuring encrypted message transmission (TLS 1.3).
7. International Data Transfers
Our primary data storage and server infrastructure is located within the European Economic Area (EEA). If any service provider processes data outside the EEA, we ensure that adequate safeguards are enforced in accordance with Chapter V of the GDPR (e.g., standard contractual clauses approved by the European Commission, or recognized adequacy decisions).
8. Your Rights Under the GDPR
As a data subject located within the European Union / European Economic Area, you possess the following statutory rights under Articles 15 through 22 of the GDPR:
Right of Access (Art. 15)
Obtain confirmation as to whether your data is processed and receive a copy of your personal data.
Right to Rectification (Art. 16)
Request the prompt correction of inaccurate or incomplete personal data held about you.
Right to Erasure (Art. 17)
Request the deletion of your personal data ("right to be forgotten") when grounds under Art. 17 apply.
Right to Restriction (Art. 18)
Request the temporary suspension of processing under circumstances specified in Art. 18.
Right to Data Portability (Art. 20)
Receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object & Withdraw Consent
Object to processing based on legitimate interests (Art. 21) or withdraw consent at any time without penalty (Art. 7(3)).
How to exercise your rights: To submit a request, contact our Privacy Desk via email at hello@360growthlabs.com with the subject line "GDPR Data Request". We will respond to your verified request within one (1) month of receipt, in accordance with Article 12(3) GDPR.
9. Supervisory Authority and Right to Lodge Complaints
If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a formal complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
The lead supervisory authority for 360GrowthLab OÜ in Estonia is:
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee | Website: www.aki.ee
10. Security Measures
360GrowthLab OÜ enforces robust technical and organizational measures (TOMs) to safeguard personal data against unauthorized disclosure, alteration, loss, or unlawful processing. These include end-to-end SSL/TLS 1.3 encryption, network firewalls, strict role-based access restrictions, periodic vulnerability evaluations, and isolated operational environments.
11. Cookies and Tracking Technologies
For complete details regarding the cookies, local storage mechanisms, and telemetry scripts deployed across this website, please consult our dedicated Cookie Policy (EU).
12. Policy Modifications
We may update this Privacy Policy periodically to reflect technological evolutions, operational changes, or new regulatory requirements. Any material updates will be published directly on this page with an updated effective date.