Privacy Policy
This Privacy Policy explains how Bestow360 (“Bestow360”, “we”, “us”, “our”) collects, uses, stores and protects your personal data when you visit our website, engage with us, or use our services, and explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our website or services, you acknowledge that your data will be handled as described in this Policy.
Bestow360 is operated by Bestow360 Ltd., a company registered in England and Wales under company number 17109324, with its registered office at 25 Pennyroyal Place, Harwell, Oxfordshire, OX11 6FY (“Bestow360”, “we”, “us”). We are the data controller responsible for your personal data under this Policy.
UK Representative: Heta Jigar Mandlani
We do not currently have a formal Data Protection Officer. For any privacy queries, requests, or complaints, please contact us at [email protected].
We collect the following categories of personal data, depending on which of our services you use:
Identity and contact data — name, email address, phone number, billing address.
Payment data — payment method details and transaction history, processed on our behalf by our payment provider (see Section 5).
Service and project data — briefs, correspondence, and content you share with us to deliver your project.
Branding and marketing service data — brand assets, marketing content, campaign and audience data, and any personal data embedded in materials you provide for branding or marketing work we carry out for you.
Creative output and portfolio data — designs, creative assets, and deliverables produced during your engagement with us.
Web, cyber and email security service data — where we provide web security, cyber security, or email security services, we may collect and process technical data such as IP addresses, domain and DNS records, network and system logs, access and authentication logs, email headers and metadata, threat and vulnerability scan results, and security incident data, to the extent necessary to deliver and maintain those services.
Marketing data — your email address, once provided, together with your marketing preferences and consent/unsubscribe history.
Technical and usage data — IP address, browser/device type, pages visited, and cookie identifiers, collected via Google Analytics.
For web, cyber and email security services, we only collect the technical and personal data reasonably necessary to detect, prevent, and respond to security risks, and to deliver the specific service you have engaged us for.
UK GDPR requires us to have a valid lawful basis for every use of your personal data. The table below sets out our main purposes and the basis we rely on for each.
| Purpose | Category of data | Lawful basis |
|---|---|---|
|
Setting up and delivering our services to you (creating designs, portfolios, creative work, project management) |
Name, contact details, project details, correspondence |
Performance of a contract with you |
|
Processing payments and keeping financial records |
Payment details, transaction history |
Performance of a contract; legal obligation (accounting/tax records) |
|
Providing web security, cyber security and email security services |
Technical, network and log data; email metadata; security incident data |
Performance of a contract with you; legitimate interests (protecting systems and detecting/preventing security threats) |
|
Delivering branding and marketing services to clients |
Brand assets, campaign and audience data, content you provide for the engagement |
Performance of a contract with you |
|
Responding to enquiries, feedback and support requests |
Name, contact details, content of your enquiry |
Legitimate interests (running our business responsively) / performance of a contract |
|
Sending marketing emails about our services |
Name, email address |
Consent — only once you have provided your email address to us for this purpose. You may withdraw consent at any time. |
|
Website analytics and improving our services |
Usage data, device/browser data, cookie identifiers |
Consent (for non-essential analytics cookies) / legitimate interests (aggregate, non-identifying analytics) |
|
Preventing fraud and keeping our systems secure |
Account and transaction data, technical/log data |
Legitimate interests (protecting our business and our customers) / legal obligation |
Bestow360 Ltd. engages Bestow India, a related service provider, to store and process personal data on our behalf as part of delivering our services. Bestow India acts as our data processor for this purpose.
Because your data is stored and processed in India, this involves an international transfer of personal data outside the UK. India does not currently have UK “adequacy” status, so we put in place appropriate safeguards for this transfer, namely the UK International Data Transfer Agreement (IDTA) / the UK Addendum to the EU Standard Contractual Clauses between Bestow360 Ltd. and Bestow India, together with organisational and technical measures to protect your data to a standard consistent with UK GDPR. You can request a copy of the relevant safeguard by contacting us using the details in Section 1.
We take payment either by direct bank transfer to our UK bank account, or via Razorpay, a third-party payment processor. Where you pay via Razorpay, your payment details are collected and processed directly by Razorpay in accordance with its own privacy policy; we do not store your full card or payment credentials ourselves. Razorpay is based in India, and payment data shared with it is subject to Razorpay's own security and transfer safeguards.
We use Google tools for email marketing and for website analytics (Google Analytics). Once you provide us with your email address by your own choice (for example, when enquiring about our services or opting in on our website), we may send you marketing communications about our services. We will not add you to marketing communications unless you have given us your email address for that purpose.
Every marketing email includes an unsubscribe link. You can withdraw your consent and stop receiving marketing emails at any time by clicking that link, or by contacting us directly. We will action unsubscribe requests promptly.
Google Analytics collects technical and usage data about how visitors use our website, to help us understand and improve our services. Data processed by Google in this way is subject to Google's own privacy and data transfer safeguards.
Our website uses cookies to operate correctly and, where you consent, for analytics and marketing purposes. When you first visit our website, a cookie consent banner asks you to accept or reject non-essential cookies (such as analytics and marketing cookies) before they are set. You can change your cookie preferences at any time by revisiting the cookie settings on our website.
Strictly necessary cookies (needed for the website to function) do not require consent and cannot be disabled without affecting site functionality. You can also control or delete cookies at any time through your browser settings.
Service and account data: retained for the duration of your engagement with us.
Personal and transaction-critical data: retained for up to 30 days after you end your service with us, after which it is deleted, save where we are required by law (e.g. tax/accounting rules) to retain certain records for longer.
Creative work and portfolio materials: may be retained by us indefinitely for our own portfolio, business, and reference purposes, and discarded at our discretion.
Marketing data: retained until you unsubscribe or withdraw consent, or until it is no longer needed for marketing purposes.
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.
We share personal data only with the following categories of recipients, and only as needed to operate our business:
Bestow India — our service provider for data storage and processing (see Section 4).
Razorpay — our payment processor, for customers paying by card/UPI/other Razorpay-supported methods.
Google — for email marketing tools and website analytics.
Regulators, law enforcement or other third parties — where we are required to do so by law.
We do not sell your personal data, and we do not share it with third parties for their own independent marketing purposes without your consent.
Under UK GDPR, you have the right to:
Access the personal data we hold about you.
Have inaccurate data corrected (rectification).
Request deletion of your data in certain circumstances (erasure).
Restrict how we use your data in certain circumstances.
Object to our use of your data, including for direct marketing.
Receive your data in a portable format, where technically feasible.
Withdraw consent at any time, where we rely on consent as our legal basis.
Lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not handled your data properly — see Section 13.
To exercise any of these rights, contact us using the details in Section 1. We will respond within one month, as required by law.
We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on you. If this changes, we will update this Policy accordingly.
If you have a concern about how we have handled your personal data, please contact us first at [email protected] so we can try to resolve it directly. If you remain unsatisfied, you have the right to lodge a complaint with the UK's data protection regulator:
Information Commissioner's Office (ICO) — ico.org.uk, or telephone 0303 123 1113.
This Policy applies to visitors, customers and users of Bestow360 based in the United Kingdom.
We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. Any changes will be posted on this page with an updated “last updated” date. We encourage you to review this Policy periodically.
If you have any questions about this Policy or how we handle your personal data, please contact us at [email protected].