In short
- We collect only what our two forms ask for, and every field is listed below with its legal basis.
- There is no consent tick-box anywhere on this site, and no consent is relied on for handling enquiries — answering a business enquiry is a pre-contractual step under Art. 6(1)(b).
- Everything is stored on our own server, operated by Hostinger International Ltd in Vilnius, Lithuania — inside the European Economic Area. There is no transfer to a third country.
- No analytics, no advertising pixels, no CDN, no external fonts, no chat widget. The site makes no third-party requests at all.
- Nothing is sold, and nothing is shared with anyone for their own purposes.
1. Who is responsible
The controller is 360 Listings OÜ, Tööstuse tn 47b-52, 10416 Tallinn, Põhja-Tallinna linnaosa, Harju maakond, Estonia. Registry code 14286661, EU VAT EE101984928. Telephone +372 5705 1489. E-mail support@360listingsou.com.
No data protection officer has been appointed; the company does not meet the criteria in GDPR Art. 37(1). Write to the address above and the controller answers directly. The company’s full identity record and its register sources are on the legal identity page.
2. What we collect, field by field
These tables list every field stored by this website. They match the live forms and the database schema exactly — a build check compares them and fails if a column is added, renamed or removed without this page changing too.
2.1 Strategy audit request form (/strategy-audit)
| Stored as | What it is | Required? | Lawful basis | Why |
|---|---|---|---|---|
| company_name | Organisation name | Required | Art. 6(1)(b) | Identifies who is asking. Without it we cannot answer. |
| contact_person | Contact person | Required | Art. 6(1)(b) | The person we correspond with about the request. |
| Work e-mail address | Required | Art. 6(1)(b) | The route by which we reply. | |
| phone | Telephone number | Optional | Art. 6(1)(f) | A second route to reach you. Leaving it blank changes nothing; you may object under Art. 21. |
| business_size | Organisation size band | Required | Art. 6(1)(b) | Determines how a review would be scoped. |
| consultation_scope | Scope of the review | Required | Art. 6(1)(b) | Determines which practice area answers. |
| message | Description of the request | Required | Art. 6(1)(b) | The substance of what is being asked. |
| lawful_basis | Which Article 6 basis the row rests on | Automatic | — | Recorded so the basis for each stored row is auditable. |
| notice_version | Version of the notice shown at submission | Automatic | — | Records which wording you were shown. |
| ip_prefix | Truncated IP address | Automatic | Art. 6(1)(f) | Rate-limiting automated posting. The final octet is discarded before storage. |
| user_agent | Browser user-agent string | Automatic | Art. 6(1)(f) | Distinguishing automated posting from a person. Truncated to 255 characters. |
| created_at | Date and time of submission | Automatic | — | Ordering and retention. |
2.2 Contact form (/contact)
| Stored as | What it is | Required? | Lawful basis | Why |
|---|---|---|---|---|
| name | Your name | Required | Art. 6(1)(b) | Who is writing. |
| E-mail address | Required | Art. 6(1)(b) | The route by which we reply. | |
| organisation | Organisation | Optional | Art. 6(1)(f) | Context for the message. Leaving it blank changes nothing; you may object under Art. 21. |
| subject | Subject | Required | Art. 6(1)(b) | Routing, and identifying data protection requests so the Art. 12(3) deadline is met. |
| message | Message | Required | Art. 6(1)(b) | The substance of what is being asked. |
| notice_version | Version of the notice shown at submission | Automatic | — | Records which wording you were shown. |
| ip_prefix | Truncated IP address | Automatic | Art. 6(1)(f) | Rate-limiting automated posting. |
| user_agent | Browser user-agent string | Automatic | Art. 6(1)(f) | Distinguishing automated posting from a person. |
| created_at | Date and time of submission | Automatic | — | Ordering and retention. |
2.3 Server logs
The web server writes an access log containing the requested URL, the response status, the time, the user-agent string and the client IP address. This is necessary to operate and secure the service (Art. 6(1)(f)) and is rotated and deleted after 14 days.
3. Why the basis differs between required and optional fields
Article 6(1)(b) covers processing that is necessary for steps taken at your request before entering into a contract. A field that our own form calls optional cannot be necessary by definition, so it cannot rest on that basis. Optional fields are therefore processed under Art. 6(1)(f) — our legitimate interest in having a second way to reach you — and you may object to that processing at any time under Art. 21 by writing to support@360listingsou.com. Leaving an optional field blank has no effect on how your enquiry is handled.
We do not rely on consent (Art. 6(1)(a)) for any form on this site. Consent that must be given in order to submit a form is not freely given within the meaning of Art. 7(4), so a mandatory tick-box would be invalid consent and would contradict this policy. There is no such box.
4. How long we keep it
- Strategy audit requests: 24 months from the last correspondence about the request. If an engagement follows, the record is kept for the duration of the engagement and then for the statutory accounting retention period under Estonian law.
- Contact messages: 24 months from the last correspondence.
- Data protection requests and our answers: 3 years, as the record that we complied.
- Server access logs: 14 days.
- Consent record in your browser: until you clear it — see the cookie policy.
5. Who else sees it
Two categories of recipient, and no others:
- Hostinger International Ltd — hosting provider, acting as a processor under GDPR Art. 28. The server is in Vilnius, Lithuania.
- Our own accountants, auditors and advisers, and any authority we are legally required to answer — only where an engagement or a legal obligation makes it necessary.
Your data is not disclosed to third parties for those parties’ own purposes, is not sold, is not used for advertising or profiling, and is not fed to any advertising or analytics network. That wording is deliberate. Engaging a hosting processor is a transfer in the legal sense, so an absolute promise that nothing ever leaves us would be untrue — what we can promise, and do, is that no one receives your data to use for their own ends.
6. Where the processing happens
All personal data submitted through this website is stored on a single virtual server operated by Hostinger International Ltd in Vilnius, Lithuania, which is inside the European Economic Area. There is no transfer of personal data to a third country, and consequently no Chapter V transfer tool is required.
We did not take the hosting location from an IP-geolocation database, because those routinely disagree with one another. Measured from inside the server, not from an IP database. The RIPE allocation for 168.231.124.0/22 is HOSTINGER-HOSTING with country LT; the first upstream transit hop (77.241.206.33) is in the BALT-IX allocation — the Baltic Internet Exchange in Vilnius; the minimum round-trip time to a Lithuanian host was 0.377 ms, which cannot be crossed between cities. Cross-checks: Amsterdam 23.6 ms, Frankfurt 26.8 ms, London 29.4 ms, New York 96.0 ms. The measurement was taken on 2026-09-01 and is published in full on the legal identity page. If the hosting location ever changes, this section is updated on the same day and the change is described here.
7. What happens to a submission
A submission is written to our database on the server described above and read there by a member of the practice. Outbound e-mail from the website is switched off, so nothing is forwarded to a mailbox and no third-party mail service is involved. This is deliberate: it keeps the number of systems holding your data to one.
8. Cookies and browser storage
This site sets no HTTP cookies at all. It stores two items in your browser, both strictly necessary and both exempt from consent under Art. 5(3) of the ePrivacy Directive as transposed in Estonia:
| Name | Type | Purpose | Basis | Retention |
|---|---|---|---|---|
| l360-consent | localStorage entry (not an HTTP cookie) | Records the choice made in the consent banner so it is not asked again. | Strictly necessary — ePrivacy Directive Art. 5(3) exemption. Set without consent. | Until cleared in the browser or by the "Withdraw" control on the cookie page. |
| l360-form-token | sessionStorage entry (not an HTTP cookie) | Single-use token that lets the API distinguish a real form submission from automated posting. | Strictly necessary — ePrivacy Directive Art. 5(3) exemption. Set without consent. | Deleted when the browser tab is closed. |
No analytics, advertising or personalisation technology is loaded on this site. The consent banner records your preference anyway, so that it is already in force if one is ever added — see the cookie policy.
9. Security
- The site is served over HTTPS only; plain HTTP requests are redirected.
- The database listens on the server’s loopback interface only and is additionally blocked at the firewall, so it is not reachable from the internet. Both layers were checked from outside the machine, not merely configured.
- Database credentials live in a file readable only by the application account.
- Form submissions are rate-limited per IP prefix, and the final octet of the address is discarded before storage.
- Access to the server is by SSH key only.
10. Automated decision-making
None. Nothing on this site makes an automated decision producing legal or similarly significant effects within the meaning of Art. 22. The strategy grid on the home page is an interactive illustration: it runs entirely in your browser, sends nothing to us, and stores nothing.
11. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing rests on Art. 6(1)(f) — the optional fields and our security logging — you may object at any time and we will stop unless we can show compelling legitimate grounds.
Write to support@360listingsou.com or to the postal address in section 1. We answer within one month, as Art. 12(3) requires. There is no charge for a first request.
You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee/en, or to the supervisory authority of your own EU member state.
12. Changes to this policy
The version number and date at the top of this page change whenever the substance does. The version shown to you at the moment you submit a form is stored alongside your submission, so it is always possible to establish which wording applied.