Privacy Notice
Last updated: 12 October 2026 · Version: 3.1
This notice explains how 360 Synk Software Ltd ("360Synk", "we", "us") uses personal information where we decide how and why it is used (where we are the "controller"). It covers our website, the 360Synk web and mobile applications, the client portal, trials, support, sales and marketing.
It does not cover the business records your employer or another 360Synk customer keeps in 360Synk (jobs, timesheets, HR records, location history, certificates and so on). For those, that organisation is the controller and we process the data for them, under contract, as their "processor". If you have a question about those records, ask that organisation first; its own privacy notice should explain how it uses 360Synk. We will help it answer you. Section 8 explains this in more detail.
The ETT Connect app has its own privacy notice.
1. Who we are
360 Synk Software Ltd, a company registered in Northern Ireland, company number NI734698, registered office 3 Drumard Cottages, Ballymena, Co. Antrim BT42 2PX. ICO registration ZC262363.
Privacy contact: privacy@360synk.com. We have not appointed a formal Data Protection Officer; the privacy contact handles all requests.
2. Who this notice applies to
- people who visit our website or ask us for information;
- owners, directors, administrators and billing contacts of businesses that use or evaluate 360Synk;
- every person who signs in to 360Synk, for the limited things we do on our own account (security, sign-in, support, service emails);
- clients of our customers who are invited to the client portal, for the same limited things;
- people who agree to receive news about our products;
- suppliers, advisers and other business contacts who deal directly with us.
If your information was entered into 360Synk by one of our customers (for example your employer, or an electrical contractor you hired), that customer decides why it is used. Read their privacy notice too.
3. Our two roles
We are the controller when we decide the purpose: running accounts, billing, securing the Service, answering enquiries, operating our website and marketing where permitted.
We are the processor when a customer uses 360Synk to store and use information about its own staff, clients, sites, suppliers or other people. We then act only on that customer's documented instructions under our Data Processing Addendum.
The same person can be in both categories. We process an engineer's work records as processor for their employer, and separately process their login and security information as controller to keep the Service safe.
4. What we collect, why, and our lawful basis
| Who | What we collect | Why | Lawful basis (UK GDPR) |
|---|---|---|---|
| Website visitors | IP address, browser and device details, pages requested (server logs) | To run and secure the website | Legitimate interests (keeping the site working and safe) |
| People who sign up a business | Name, business email, phone, company name and details, Plan chosen, your acceptance of our terms | To set up and run the subscription | Contract; legitimate interests where you act for your company |
| Billing contacts | Name, email, invoices, payment status. Card payments are not live today; if we switch on card billing, card details go to our payment provider, never to us | To bill and keep accounts | Contract; legal obligation (tax records) |
| Everyone who signs in | Email, password (stored as a one-way hash), sign-in times, device identifier, IP address, two-step sign-in settings, security and audit logs | To sign you in, stop misuse, investigate problems | Legitimate interests (security); contract |
| Mobile app users | Crash reports and diagnostics (device model, operating system, app version, what the app was doing when it failed); push-notification token; support diagnostic bundles you choose to send | To fix faults and deliver notifications | Legitimate interests (reliability) |
| People who contact us | Your message and contact details | To answer you | Legitimate interests |
| Marketing and events | Name, email, company, your consent choice and its date; details you give us at an event or trade show, captured with our event lead tool (TAPi) | To follow up your enquiry and send you news about 360Synk | Consent, which you can withdraw at any time; for business contacts, legitimate interests where the law allows and you have not objected |
We do not sell personal information. We do not use it for advertising. We do not make decisions about people with legal or similarly significant effects by automated means alone.
5. Sensitive information and biometrics
360Synk is not a health-record system, but our customers may enter sensitive information (for example a worker's sickness record) into the records they control. They are responsible for the lawful basis for that, and our Data Processing Addendum restricts who can see staff medical details.
If you unlock the 360Synk or ETT Connect mobile app with Face ID or a fingerprint, the matching is done by your phone's operating system. We do not receive or store your biometric data.
6. How we collect information
Directly from you (sign-up, contact, trial, events, using the Service); from the organisation that creates your login; automatically from the Service, apps, servers and security systems; from a connected service when a customer enables an integration; and from public business sources for business-to-business sales where appropriate.
7. Marketing
We send marketing emails only to people who have agreed, or, for business contacts, where the law allows us to email about similar products and they have not objected. Every marketing email has an unsubscribe link, and you can change your email choices in your account settings. We keep a minimal suppression record so that we respect your choice. Opting out of marketing does not stop service, security or billing messages for an account you hold.
8. When we process information for our customers
Most of the information in 360Synk is about our customers' own people and contacts. The customer decides the purpose; we provide the Service. Our Data Processing Addendum sets out the processing, our security measures, our sub-processors, international transfers, how we help with rights requests, and deletion at the end of the contract.
To exercise a right over information your employer or another customer controls, contact that organisation first. We will refer any request we receive to them and help them answer.
Electrical certification records
360Synk stores names, roles, signatures, site details, inspection and test records, declarations and document history for electrical certification. The customer determines why those records exist and how long they are kept; we process them as processor. We do not use certification records to make our own judgements about anyone's competence, employment or legal status.Location information
Where a customer has location sharing on, the mobile app records its engineers' location during working hours or while a job timer or "On my way" is running, for the customer's dispatch map and, if enabled, an arrival estimate in its client portal. The live location trail is deleted after 90 days. Your employer is the controller of this information and should tell you how and why it is used.AI-assisted features
Some features use artificial intelligence to extract or suggest information (reading bills, importing forms, a read-only office assistant). Output is reviewed by a person. These run on Microsoft Azure services in the UK and are not used to train AI models on customer data.Support access
If your employer asks 360Synk for help, 360Synk support staff may view your employer's records, read-only and only with your employer's approval.9. Who we share information with
We use trusted providers to run the Service (our "sub-processors"). The current list, with where each one processes data, is published with our Data Processing Addendum. In summary:
- Microsoft Azure: hosting, database, file storage, email sending, logs and AI services;
- Google Firebase: push notifications and mobile crash reports;
- Google Maps Platform: maps, address look-up and route times in the office web application;
- Ideal Postcodes (postcodes.io): postcode and address lookup;
- TAPi: capturing enquiries and leads at events and trade shows (our own marketing, not customer data).
We also share data with an accounting or other service a customer chooses to connect (for example Xero), as it directs; with professional advisers, insurers and banks as needed to run our business; with the police, courts or regulators where the law requires; and with a buyer if our business is sold, under the same protections.
10. International transfers
Our main hosting is in Microsoft's North Europe region (Ireland, EU), with some services in UK South (London) and West Europe (Netherlands). The UK recognises the EU as providing adequate protection. Google may process push and crash data in the United States. For any transfer outside the UK and EU we rely on the UK's approved safeguards: the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum, with a transfer risk assessment where required.
11. How long we keep information
| Data | How long |
|---|---|
| Subscription and billing records | Life of the account, then 6 years for tax and accounting law |
| Trial account data | The trial, then 90 days unless you subscribe |
| Sign-in, security and application logs | 90 days |
| Mobile support diagnostic bundles | 90 days (deleted automatically) |
| Crash reports | As set by Google Firebase Crashlytics, our crash-reporting supplier |
| Enquiries, event and trade-show leads, and support correspondence | 12 months after the last contact, unless you become a customer |
| Marketing consent | Until you withdraw it, then a suppression record so that we do not email you again |
| Customer Data after a subscription ends | Read-only for 12 months, then deleted (see our Terms of Service and Data Processing Addendum) |
| Database backups | Rolling 30 days; deleted data leaves backups within 30 days |
12. How we protect information
Data is encrypted in transit (HTTPS) and at rest by Microsoft Azure's storage encryption. Each business's data is kept separate from every other business's, with that separation enforced on every database read and covered by automated tests. Access is by role; staff personal and medical details are visible only to a customer's owner, administrators and HR team. Passwords are stored as one-way hashes, accounts lock after repeated failed attempts, and office users can be required to use two-step sign-in. Secrets are held in Azure Key Vault. We keep audit logs of sign-ins and sensitive changes. No system is perfectly secure. If a breach affects your data and is likely to put you at risk, we will tell you and the Information Commissioner as the law requires.
13. Cookies
See our Cookie Policy. We use only strictly necessary cookies and storage; we run no analytics or advertising cookies.
14. Children and young people
360Synk is a business service and is not aimed at children. We do not knowingly offer accounts directly to anyone under 16. A person under 16 can use the Service only where an employer or training body that uses 360Synk has authorised them under its own young-person policy and supervision; that organisation is responsible for them and for telling us if extra protection is needed.
Because some users (for example apprentices) will be under 18, we apply the principles of the ICO's Age Appropriate Design Code to them: designing and running the Service with their best interests in mind; high-privacy defaults, with settings that share information more widely off unless there is a clear work reason; collecting the minimum; using location only for the work purposes described above and never to profile a young person; no nudge techniques or profiling that could harm them; and plain language.
15. Your rights
Depending on the circumstances, you have the right: to be informed; to access your personal information; to have inaccurate information corrected; to erasure in certain circumstances; to restrict processing; to receive your information in a portable format where the legal conditions apply; to object to processing based on legitimate interests; to object to direct marketing at any time (an absolute right); not to be subject to certain solely automated decisions; and to withdraw consent where we rely on it.
Email privacy@360synk.com. We may need to verify your identity. We reply within one month. You can delete your own mobile app login in the app (Settings → Delete account); this closes your login and anonymises your personal details, subject to the records your employer is entitled to keep.
Where we process information only on behalf of a customer, we will refer your request to that customer and help them respond.
16. Complaints
If you are unhappy, please tell us first at privacy@360synk.com. We acknowledge complaints within 30 days. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
17. Changes to this notice
We post changes here with a new date and tell account owners by email of any significant change.
360 Synk Software Ltd · 3 Drumard Cottages, Ballymena, Co. Antrim BT42 2PX · company number NI734698 · ICO registration ZC262363