Privacy Notice

1. Who we are

360iSR Ltd ("360iSR", "we", "us") is a defence consultancy providing Intelligence, Surveillance and Reconnaissance training, targeting support, and decision-architecture frameworks to NATO and allied military organisations.

• Registered office: United Kingdom
• Companies House number: 08481362
• ICO registration number: [pending — application submitted May 2026]
• Data Protection Lead: Ewen Stockbridge Sime — ewen@360isr.com

We are the data controller for any personal data described in this notice.

2. What personal data we collect

We only collect personal data that you provide to us directly, or that is generated automatically when you visit our website or use our client portal.

Information you give us

• Contact form submissions: name, organisation, role, email address, telephone number, and the message you send us.
• Client portal access: the email address you use to authenticate via Cloudflare Access.
• Course participation: if you are enrolled on a 360iSR programme, we may hold your name, rank, unit, contact email, and course assessment records, supplied to us by your sponsoring organisation.
• Correspondence: emails, calls and meeting notes you exchange with us.

Information collected automatically

• Web server logs: IP address, browser type, pages requested, timestamps. Held by our hosting provider (Cloudflare).
• Access authentication logs: sign-in attempts, session duration, source IP. Held by Cloudflare Access for the gated portal.
• Cookies: only those strictly necessary to operate the site and to maintain your authenticated session. We do not use analytics or advertising cookies.

3. Why we use your data (lawful basis)

Purpose	Lawful basis
Responding to contact-form enquiries	Legitimate interests (responding to a business enquiry you initiated)
Delivering training and consultancy services	Performance of a contract (with you or your sponsoring organisation)
Authenticating portal users	Legitimate interests (information security)
Sending you operational updates about a programme you are on	Performance of a contract
Keeping accounting and tax records	Legal obligation

We do not use your data for direct marketing without your separate, opt-in consent. We do not sell personal data to anyone.

4. Who we share data with

We only share your personal data with carefully selected processors that help us operate the business. Each is bound by a data processing agreement.

• Formspree — receives contact-form submissions and forwards them to us by email.
• Google Workspace (Google LLC) — provides our business email, document storage (Drive), and calendar.
• Cloudflare, Inc. — provides web hosting (Pages), file storage (R2), authentication (Access), and DNS.

We may also disclose personal data where we are legally required to do so (for example, in response to a lawful request from UK authorities), or to protect our rights, property, or safety.

5. International transfers

Some of our processors (Formspree, Google Workspace, Cloudflare) are based in or transfer data to the United States. We rely on the UK Extension to the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses where applicable, to provide an adequate level of protection for transferred personal data.

6. How long we keep data

• Contact-form submissions: retained for up to 24 months after our last meaningful contact with you, then deleted.
• Course participation records: retained for the duration of the relevant client contract plus seven years (in line with UK accounting and contractual record-keeping norms).
• Portal access logs: retained by Cloudflare for up to 30 days.
• Email correspondence: retained for up to 7 years, in line with our accounting record-keeping obligations.

7. Your rights

Under UK GDPR you have the right to:

• Be informed about how we use your personal data (this notice).
• Access the personal data we hold about you.
• Have inaccurate personal data corrected.
• Have your personal data erased, in defined circumstances.
• Restrict or object to certain processing.
• Receive your personal data in a portable format.
• Withdraw consent at any time, where consent is the basis for processing.

To exercise any of these rights, email ewen@360isr.com. We will respond within one calendar month.

8. Complaints

If you are unhappy with how we have handled your personal data, you can complain to the UK Information Commissioner's Office:

• Website: ico.org.uk
• Phone: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns first — please contact us directly at ewen@360isr.com.

9. Updates to this notice

We will update this notice from time to time to reflect changes in how we process data or in applicable law. The "Last updated" date at the top of this page indicates when the current version came into effect.