Privacy Policy
Last updated: 30 July 2026
This policy explains how Critical Media Ltd collects and uses personal data through the Critical 360 website and platform, and your rights under UK data protection law.
Who we are
Critical 360 is operated by Critical Media Ltd (“we”, “us”, “our”), a company registered in England and Wales (company no. 6582022), registered in Bournemouth, Dorset. We are the “controller” of personal data described in this policy unless stated otherwise below.
For any privacy question, or to exercise your rights, contact us at [email protected].
Controller and processor roles
Our role depends on the data:
- Website and enquiries. When you visit our website or contact us, we are the controller of your personal data.
- The Critical 360 platform. When a client organisation runs 360° feedback on Critical 360, that organisation is the controller of the personal data of its users and reviewers, and we act as its processor, handling data on its documented instructions. This processing is governed by our Data Processing Agreement.
What we collect
Website and enquiries
- Information you send via our contact form: your name, email address, organisation, optional phone number and your message.
- Basic technical data needed to serve and secure the site (for example, your IP address, handled by our hosting and security providers).
The platform (on behalf of our clients)
- Account data — names and email addresses of administrators, reviewees and reviewers.
- Feedback data — questionnaire responses and free-text comments provided during a review.
- Optional demographic fields — such as age or gender, only where a client chooses to collect them and a respondent chooses to provide them. These are never mandatory.
How and why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Responding to your enquiry | Legitimate interests (to answer questions about our service) |
| Providing and supporting the platform to client organisations | Performance of a contract / legitimate interests |
| Processing user and feedback data within the platform | On behalf of the client controller, under our Data Processing Agreement |
| Securing our services and preventing abuse | Legitimate interests |
| Meeting legal and accounting obligations | Legal obligation |
We do not sell your personal data, and we do not use it for advertising or third-party marketing.
Where your data is stored
The platform and its data are hosted on Microsoft Azure in the UK South region, encrypted in transit and at rest. Each client organisation’s data is logically isolated from every other. We keep personal data within the UK wherever possible; where a service provider processes limited data outside the UK, we rely on the UK’s adequacy regulations or Standard Contractual Clauses / the UK International Data Transfer Addendum.
Service providers (sub-processors)
We use a small number of trusted providers to run our service. Each is bound by data-protection terms and may only process data on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Azure | Application hosting and data storage | UK |
| Cloudflare | DNS, content delivery and security | Global edge (UK-served) |
| Resend | Transactional email delivery | EU / US (SCCs) |
| Stripe | Subscription billing and payments | EU / US (SCCs) |
An up-to-date list of platform sub-processors is maintained in our Data Processing Agreement.
How long we keep it
We keep enquiry data only as long as needed to deal with your enquiry and for a reasonable period afterwards. Platform data is retained for as long as the client organisation’s account is active, and is deleted or returned after termination in line with our Data Processing Agreement. We keep records required for legal, tax or accounting purposes for as long as the law requires.
Your rights
Under UK GDPR you have the right to access, correct, delete or restrict the use of your personal data, to object to certain processing, and to data portability. Where we process data on behalf of a client organisation, please direct requests to that organisation; we will assist them in responding. To exercise any right in respect of data we control, email [email protected].
You also have the right to complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to resolve any concern first.
Cookies
We use only strictly necessary cookies. See our Cookie Policy for details.
Changes to this policy
We may update this policy from time to time. We’ll change the “last updated” date above and, where changes are significant, take reasonable steps to let affected clients know.