Privacy policy

This policy explains how 360review (operated by Dunbar App Inc.) handles personal data.

Who is the data controller?

For data we collect about you directly (account, billing, support correspondence): we are the controller.

For data submitted into the service by a customer organization (a leader’s team feedback program): the customer organization is the controller and we are the processor under GDPR Article 28.

What data we collect

We collect only what’s needed to operate the service:

• Account information required to set up and bill your account
• The content you and your team submit through the service (self-assessment ratings, anonymous team responses, generated reports)
• Support correspondence you initiate
• Standard operational logs

We run no third-party analytics or advertising trackers, inside the product or on our public website, and the feedback your team submits is never used to train AI models or shared with ad networks.

When you email us, your message is kept in our support inbox (Google Workspace). An AI service (Microsoft Azure OpenAI) may prepare a draft reply, which a person reads before anything is sent. Your email is never used to train AI models.

Where data is stored

All primary customer data is stored and processed within the European Economic Area (EEA). A current sub-processor list is published at /legal/sub-processors.

Your rights

If you are an EEA, UK, or Swiss data subject, you have the right to access, correct, delete, port, restrict, and object to the processing of your personal data. To exercise any of these, contact us. We respond within 30 days.

For data submitted by a customer organization, please contact that organization directly.

Retention

We retain personal data for as long as needed to deliver the service, plus any period required by law (e.g., billing records). On request, we delete or return your data within 30 days.

International transfers

Where personal data flows outside the EEA, we rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified under it, the EU-US Data Privacy Framework. Our transactional email provider (Resend) sends from its EU region and is certified under that framework. Our support inbox (Google Workspace) may store emails outside the EEA.

Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls on production systems, and breach-notification procedures aligned with GDPR Article 33.

Contact

Dunbar App Inc.
8 The Green Suite 7013, Dover, DE 19901, USA

For data-protection enquiries, please use our contact form and put “GDPR” in the message.

Changes

We may update this policy. Material changes that affect your rights will be communicated by email to active customers at least 14 days before they take effect.