Privacy Policy
This policy explains how 360GrowthLab OÜ collects, uses and protects personal data through Exoskeleton Index.
Last updated: 28 July 20261. Who controls your personal data
The controller responsible for personal data processed through Exoskeleton Index is:
Ahtri tn 12, 15551 Estonia
Email: hello@exoskeletonindex.com
Telephone: +33 6 59 23 27 45
In this policy, “we”, “us” and “our” refer to 360GrowthLab OÜ and the Exoskeleton Index platform.
2. Scope of this policy
This Privacy Policy explains how we collect and use personal data when you visit exoskeletonindex.com, contact us, subscribe to our newsletter, submit or update a listing, use available account features, or otherwise interact with the platform.
It also covers limited professional information that we may obtain from public sources when building company, product, expert or ecosystem records.
3. Personal data we may collect
Information you provide
- Name, business email address, telephone number, organisation, job title and country.
- Information included in contact, sourcing, partnership, event, listing or correction forms.
- Newsletter subscription details and communication preferences.
- Messages, attachments and other information you choose to send us.
- Account and authentication information where account features are available.
Information collected when you use the website
- IP-derived location, device, browser, operating system, page views, referring pages and interaction data.
- Cookie identifiers, consent choices and analytics information, subject to your consent where required.
- Security logs and technical information needed to protect and operate the website.
Professional information from public sources
To maintain the index, we may process business contact details, professional roles, company affiliations and other professional information available from official company websites, public registers, research publications, event pages, press releases and other credible public sources.
4. Why we use personal data and our legal bases
| Purpose | Typical data | Legal basis |
|---|---|---|
| Responding to enquiries, sourcing requests and partnership discussions | Contact and message data | Steps requested before a possible contract and our legitimate interest in responding to communications |
| Managing listing submissions, corrections and company relationships | Professional contact, organisation and submission data | Legitimate interests in maintaining an accurate directory and communicating with ecosystem participants |
| Building and maintaining public company and ecosystem records | Publicly available professional information | Legitimate interests in providing an informative industry index, subject to the rights and interests of affected individuals |
| Sending the Exoskeleton Index newsletter | Email address and subscription preferences | Your consent |
| Measuring and improving the website with GA4 and Microsoft Clarity | Cookie, device, usage and interaction data | Your consent where required |
| Securing, administering and troubleshooting the platform | Logs, device and technical data | Our legitimate interests in operating a secure and reliable service |
| Complying with legal obligations and protecting legal rights | Relevant records and correspondence | Legal obligation and legitimate interests in establishing, exercising or defending legal claims |
Where we rely on legitimate interests, we consider whether those interests are overridden by your rights and freedoms. You may object to processing based on legitimate interests as explained below.
5. Contact forms and listing submissions
Our forms are built with WPForms. Information submitted through a form may be stored in the website’s WordPress database and sent to authorised team members by email. WPForms states that form entries are handled on the website where the plugin is installed rather than being collected by WPForms for its own purposes.
Please do not submit medical records, health information, government identification documents or other sensitive personal data unless we specifically request it through a secure and appropriate process.
6. Analytics and session insights
Google Analytics 4
We use Google Analytics 4 (“GA4”) to understand website usage, such as page visits, session statistics, approximate location, browser and device information. Google states that GA4 uses IP addresses at collection time to derive general location information and, for users in the EU, Switzerland and the United Kingdom, discards IP addresses before logging the analytics data.
Microsoft Clarity
We use Microsoft Clarity to understand how visitors interact with the website through aggregated behaviour data, heatmaps and visual reconstructions of sessions. Clarity may collect clicks, scrolling, mouse movement, page and performance events, and information needed to reconstruct the layout and interaction sequence. Privacy-sensitive fields should be masked by the service and by our configuration.
GA4 and Clarity are treated as non-essential analytics services and should only receive the relevant consent signal where consent is required. More information is available in our Cookie Policy.
7. Newsletter
If you subscribe to the newsletter, we use your email address and related subscription information to send news, insights and updates about the exoskeleton ecosystem. Our newsletter is delivered using Brevo.
You can withdraw consent at any time by using the unsubscribe link included in each marketing email or by contacting us. Withdrawal does not affect processing that took place before consent was withdrawn. We may retain a minimal suppression record so that we continue to respect your opt-out request.
8. Service providers and recipients
We may share personal data only where necessary with:
- Website hosting, infrastructure, security, backup and technical-support providers.
- WordPress and website service providers, including WPForms.
- Google for GA4, where analytics consent has been provided.
- Microsoft for Clarity, where analytics consent has been provided.
- Brevo for newsletter delivery and subscriber management.
- Email, collaboration and professional advisers supporting our operations.
- Competent authorities where disclosure is required by law.
- A purchaser, investor or successor in connection with a genuine business reorganisation, subject to appropriate safeguards.
We do not sell personal data. We do not currently use affiliate tracking or accept online payments through the website.
9. International data transfers
Some service providers may process data in countries outside Estonia or the European Economic Area. Where personal data is transferred internationally, we rely on an applicable adequacy decision, the European Commission’s Standard Contractual Clauses, participation in a recognised transfer framework where applicable, or another lawful transfer mechanism.
You may contact us for further information about the safeguards relevant to a particular transfer.
10. How long we retain data
- Enquiries and submissions: normally for up to three years after the last meaningful interaction, unless a longer period is needed for an active relationship, legal obligation or legal claim.
- Newsletter data: until you unsubscribe or we discontinue the newsletter, with a limited suppression record retained where necessary to respect your opt-out.
- Account data: while the account remains active and for a reasonable period after closure for security, support and legal purposes.
- GA4 user and event-level analytics: according to the retention setting configured in our GA4 property, and no longer than reasonably necessary for analytics purposes.
- Microsoft Clarity: Microsoft currently states that playback data is retained for 30 days, while click, heatmap and certain labelled or favourited session data may be retained for up to nine months.
- Security and server logs: for a limited operational period, normally up to 90 days, unless needed longer to investigate an incident or protect legal rights.
- Public professional records: while relevant to the directory, subject to periodic review, correction requests and applicable legal rights.
We may anonymise information so that it can no longer be linked to an identifiable person. Anonymised information may be retained for research and statistical purposes.
11. Your data-protection rights
Subject to the conditions in applicable law, you may have the right to:
- Request access to your personal data.
- Ask us to correct inaccurate or incomplete data.
- Request deletion of personal data.
- Request restriction of processing.
- Receive certain data in a portable format.
- Object to processing based on legitimate interests.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with a competent supervisory authority.
To exercise a right, email hello@exoskeletonindex.com. We may request reasonable information to confirm your identity.
You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or to the supervisory authority in the EU or EEA country where you live or work.
12. Security, children and automated decisions
Security
We use reasonable technical and organisational measures designed to protect personal data. No internet service can guarantee absolute security, and you should avoid sending sensitive information through ordinary website forms or email.
Children
The platform is intended for professional and general informational use and is not directed to children under 16. We do not knowingly collect personal data from children through the website.
Automated decisions
The comparison tool and category or Fit Finder features may generate automated suggestions based on user selections. These features do not make decisions that produce legal or similarly significant effects.
13. Changes and contact
We may update this policy when our services, providers or legal obligations change. The latest version will be published on this page with an updated date.
Questions about this policy or our handling of personal data can be sent to hello@exoskeletonindex.com.