EYESPY360
Website • Platform • Applications • Virtual Tours • AI & Digital Services
Effective date: 3 January 2025
This Privacy Policy explains how EyeSpy360 Limited (“EyeSpy360”, “we”, “us” or “our”) collects, uses, shares and protects personal data in connection with our websites, software platform, applications, virtual tours, viewers, APIs, SDKs, integrations, hosting, photography, CGI, AI/avatar features, conversational services and other products and services (together, the “Services”).
It applies to visitors to our websites, customers and prospective customers, account users, business contacts, suppliers, people who interact with virtual tours or other experiences powered by EyeSpy360, and other individuals whose personal data we process in connection with the Services.
This Privacy Policy should be read alongside our Terms of Use and Service and, where applicable, any Master Services Agreement, Order Form, Statement of Work, Data Processing Agreement, cookie settings or other specific privacy notice provided to you.
EyeSpy360 Limited is a company registered in England and Wales under company number 09934184, with its registered office at Athene House, 86 The Broadway, Mill Hill, London, NW7 3TD, United Kingdom.
For personal data that we process for our own purposes, EyeSpy360 Limited is generally the controller. You can contact us about privacy matters at support@eyespy360.com or at the postal address above.
Our role depends on the context in which personal data is processed.
We generally act as a controller when we decide why and how personal data is used, including for website administration, account management, sales, billing, customer support, security, service analytics, product development, direct marketing, legal compliance and our own business operations.
Where a business customer uploads or supplies personal data to the Platform and instructs us to process it solely to provide the Services on that customer’s behalf, EyeSpy360 may act as a processor and the customer is normally the controller. This may include personal data contained in Customer Content, client knowledge bases, lead-capture forms, tour interactions, live-viewing sessions or client-configured conversational experiences.
Where we act as a processor, our processing is governed by the customer’s instructions and any applicable Data Processing Agreement. The relevant customer is responsible for providing appropriate privacy information to the individuals concerned and identifying the lawful basis for that processing.
In some circumstances we may process limited personal data associated with customer-managed Services as an independent controller for our own purposes, such as platform security, fraud prevention, service administration, legal compliance, billing, enforcement of our rights and appropriately aggregated or de-identified analytics.
The personal data we collect depends on how you interact with EyeSpy360 and which Services are used.
Identity and business contact data, such as name, job title, company, postal address, email address and telephone number.
Account data, such as username, login identifiers, account permissions, organisation details, branding profiles, settings and account activity.
Commercial and transaction data, such as quotations, orders, subscriptions, hosting arrangements, invoices, payment status, service usage, credits and transaction history. Payment card details may be handled directly by our payment providers rather than stored by EyeSpy360.
Customer Content and project data, including images, 360-degree photographs, video, audio, text, logos, floor-plan information, property information, metadata, scripts, prompts, documents, links and other materials supplied for use with the Services.
Communications and support data, including emails, support requests, chat messages, call notes, feedback, complaints and other correspondence.
Technical and usage data, including IP address, device and browser information, operating system, identifiers, log data, timestamps, referring pages, tour or feature interactions, page views, session information, error reports and diagnostic data.
Tour and viewer interaction data, which may include the tours viewed, navigation events, interactions with information labels, calls-to-action, forms, live-viewing features and other engagement information.
Lead and enquiry data, where enabled by a customer, such as name, contact details, preferred contact time and information voluntarily provided about a property, booking, budget, timing, preferences or requirements.
Audio, voice, transcript and conversational data where you use live, voice, avatar or conversational features, including prompts, messages, recordings or transcripts where the relevant feature is configured to collect or retain them.
Location information where you choose to provide it or where an approximate location can be derived from an IP address for security, localisation, analytics or service delivery.
Marketing and preference data, including communication preferences, campaign engagement and cookie or tracking choices.
We may collect personal data directly from you, automatically when you use the Services, from the organisation you work for, from an EyeSpy360 customer that has asked us to provide a Service, from resellers or business partners, from service providers, or from publicly available business sources where lawful.
If a customer provides personal data about another person, including within images, recordings, scripts, knowledge bases or tour content, that customer is responsible for ensuring it has the necessary rights, notices, permissions and lawful basis to provide that information to us.
We use personal data only where we have a lawful basis to do so. Depending on the circumstances, that basis may be performance of a contract, our legitimate interests or those of a third party, compliance with a legal obligation, consent, or another basis available under applicable law.
| Purpose | Typical data | Typical lawful basis |
|---|---|---|
| Provide, configure and support the Services | Identity, account, Customer Content, project, technical and communications data | Contract; legitimate interests; processor instructions where applicable |
| Create, host and deliver tours and Outputs | Customer Content, project data, account data and technical data | Contract; legitimate interests; processor instructions where applicable |
| Manage accounts, orders, billing and hosting | Identity, business contact, account, transaction and communications data | Contract; legal obligation; legitimate interests |
| Provide support and respond to enquiries | Identity, contact, account, project and communications data | Contract; legitimate interests |
| Secure the Platform, prevent fraud and investigate misuse | Account, technical, usage and communications data | Legitimate interests; legal obligation |
| Monitor performance, diagnose errors and improve the Services | Technical, usage, interaction and appropriately limited Customer Content or support data | Legitimate interests; consent where required for non-essential tracking |
| Develop new products, features, automation and AI-enabled functionality | Usage, interaction, feedback, technical data and lawfully usable content or derived data | Legitimate interests; contract; consent where required |
| Measure engagement and produce analytics, aggregated or anonymised insights | Usage, interaction and technical data | Legitimate interests; consent where required for cookies or similar technologies |
| Market EyeSpy360 and communicate with business contacts | Identity, business contact, preference and engagement data | Legitimate interests where permitted; consent where required |
| Comply with law, defend legal claims and enforce agreements | Relevant account, transaction, content and communications data | Legal obligation; legitimate interests |
Where we rely on legitimate interests, those interests may include operating and improving the Services, protecting our systems and users, understanding how our products are used, developing our business, communicating with customers and prospective business customers, preventing fraud, and exercising or defending legal rights. We consider the impact on individuals and do not rely on legitimate interests where our interests are overridden by applicable data-protection rights.
Our Terms of Use and Service provide that customers retain ownership of Customer Content while granting EyeSpy360 a licence to use that content for the purposes stated in the Terms. That contractual licence does not remove or reduce any obligations that apply to personal data contained within Customer Content.
Where Customer Content contains personal data, any use of that personal data must have an appropriate lawful basis and remain subject to applicable data-protection law, confidentiality obligations and any separate written agreement with the customer.
We may use Customer Content for demonstrations, websites, social media, advertising or other promotional purposes where permitted by our Terms, but identifiable personal data within that content will only be used in that way where the use is lawful in the circumstances. The general Customer Content licence is not, by itself, a substitute for any consent or other lawful basis required by data-protection law.
Customers should avoid uploading unnecessary personal data and should use available privacy tools, such as blurring, access controls, passwords or expiry links, where appropriate.
Some Services use artificial intelligence, speech recognition, language models, translation, voice synthesis, avatars, automated navigation or other automated technologies. Depending on the feature, information you provide may be transmitted to technology providers acting for us or for our customer.
We may process prompts, messages, audio, transcripts, knowledge-base information, interaction data and associated metadata to provide these features, maintain safety and security, investigate errors, measure performance and improve the Services where lawful.
Where a customer configures an AI or conversational experience to collect information from its own users, that customer is generally responsible for determining what information should be collected and why, and for providing the required privacy information. EyeSpy360 may process that data as a processor on the customer’s behalf.
We do not use solely automated processing to make decisions about individuals that produce legal effects or similarly significant effects unless this is specifically disclosed and permitted by applicable law.
Our websites and Platform may use cookies, local storage, pixels and similar technologies to provide essential functionality, maintain security, remember settings, measure performance and understand usage.
Strictly necessary technologies may be used without consent where permitted by law. We seek consent before using non-essential cookies or similar technologies where consent is required, including certain analytics, advertising or tracking technologies.
You can manage non-essential cookies through the cookie banner or cookie settings made available on our website. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.
Our cookie settings or separate cookie information may provide further details about the specific technologies in use, their providers, purposes and duration.
We may send service-related and operational communications where necessary to administer an Account, provide a Service, manage hosting, address security issues or perform a contract.
We may also send information about EyeSpy360 products, services, events or offers to business contacts where permitted by law. Where consent is required, we will ask for it. You can opt out of marketing at any time by using the unsubscribe mechanism in the communication or contacting us.
Opting out of marketing does not prevent us from sending necessary service, contractual, security or billing communications.
We may share personal data with the following categories of recipients where reasonably necessary and lawful:
cloud hosting, storage, content-delivery and infrastructure providers;
communications providers supporting email, SMS, telephone, messaging, live-viewing or similar functionality;
AI, speech, translation, avatar and software-technology providers used to deliver relevant features;
payment processors, banks, accountants and financial-service providers;
analytics, security, fraud-prevention, monitoring and support providers;
photographers, CGI artists, production partners and other contractors involved in delivering an ordered Service;
resellers, integration partners or agencies where necessary to deliver a customer arrangement;
professional advisers, insurers, auditors and debt-recovery providers;
regulators, law-enforcement bodies, courts and other authorities where disclosure is required or permitted by law;
a purchaser, investor, lender or successor organisation in connection with a merger, restructuring, financing, sale of assets or other corporate transaction, subject to appropriate safeguards.
Service providers that process personal data on our behalf are required to handle it in accordance with applicable contractual and legal requirements. Where a third party independently determines how and why it uses personal data, that third party may act as its own controller and its privacy policy may also apply.
EyeSpy360 operates internationally and uses service providers in multiple countries. Personal data may therefore be accessed from, stored in or transferred to countries outside the United Kingdom or the country in which you are located.
Where UK data-protection law restricts an international transfer, we use an available lawful transfer mechanism. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism permitted by law. Where appropriate, we also assess whether supplementary safeguards are needed.
If you are located in the European Economic Area, equivalent safeguards may include an applicable adequacy decision or the European Commission’s Standard Contractual Clauses.
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide the Services, maintain security, meet legal and accounting requirements, resolve disputes and enforce agreements.
Retention periods vary according to the type of information and the context. In deciding how long to retain information we consider the duration of the customer relationship, hosting or project term, whether an Account remains active, contractual commitments, legal limitation periods, tax and accounting requirements, security needs, backup cycles, the sensitivity of the information and whether the data can be deleted, aggregated or anonymised.
Customer Content and hosted tour material may be retained for the applicable hosting or service period and for a limited period afterwards where reasonably necessary for backup, restoration, legal or operational purposes. The Terms of Use and Service and any applicable Order may contain additional provisions about content retention, expiry, suspension, export and deletion.
Where we act as a processor, we retain or delete personal data in accordance with the customer’s instructions, the applicable Data Processing Agreement and legal requirements.
We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, encryption in transit or at rest where appropriate, logging, backups, vulnerability management, supplier controls and staff access restrictions.
No online system can be guaranteed completely secure. You are responsible for protecting Account credentials and for notifying us promptly if you suspect unauthorised access or a security incident affecting your Account.
Depending on where you live and the circumstances of the processing, you may have rights in relation to your personal data. Under UK data-protection law these can include:
the right to be informed about how your personal data is used;
the right to request access to your personal data;
the right to ask us to correct inaccurate or incomplete personal data;
the right to request erasure in certain circumstances;
the right to request restriction of processing in certain circumstances;
the right to data portability where the legal conditions apply;
the right to object to processing based on legitimate interests and to object to direct marketing at any time;
the right to withdraw consent where processing is based on consent, without affecting earlier lawful processing;
rights relating to certain solely automated decisions and profiling.
These rights are not absolute and exemptions may apply. If we process personal data solely on behalf of an EyeSpy360 customer, we may refer your request to that customer or assist the customer in responding.
To exercise a privacy right, contact support@eyespy360.com. We may need to verify your identity before acting on a request. We do not ordinarily charge a fee for exercising statutory privacy rights, although applicable law may permit a reasonable fee or refusal in limited circumstances.
If you have a concern about how we use personal data, please contact us first so that we can try to resolve it.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Information about making a complaint is available at ico.org.uk. If you are located outside the United Kingdom, you may also have the right to complain to the data-protection authority in your country.
If a United States state privacy law applies to EyeSpy360 and to our processing of your personal information, you may have additional rights such as rights to know or access information, correct inaccuracies, request deletion, obtain a portable copy, and opt out of certain uses such as sale, sharing for cross-context behavioural advertising or targeted advertising, depending on the law that applies.
EyeSpy360 does not sell personal data as a standalone commercial product for monetary consideration. Certain analytics or advertising disclosures may be treated as “sharing”, “sale” or targeted advertising under some state privacy laws even where no money changes hands. Where such a law applies and an opt-out is required, we will provide an appropriate mechanism, which may include cookie settings or another privacy control.
We will not discriminate against you for exercising a privacy right where applicable law prohibits discrimination. You or an authorised agent may contact us at support@eyespy360.com to submit a request. We may need to verify the request and the agent’s authority.
EyeSpy360 business Accounts and paid Services are not directed to children under 16. We do not knowingly invite children under 16 to create business Accounts.
A customer may use the Services in contexts where children or young people can view content, such as education, tourism or public venues. In those circumstances, the customer is responsible for ensuring that its use of the Services and any collection of personal data is appropriate and lawful, including obtaining parental or guardian consent where required.
The Services are not designed for customers to provide unnecessary special category or highly sensitive personal data. You should not upload health information, biometric information used for identification, information about racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, sex life or sexual orientation, or similarly sensitive information unless it is genuinely necessary, lawful and appropriate for the relevant Service.
Where such information is processed, additional legal conditions and safeguards may apply.
Tours, websites or applications may contain links to or embed third-party websites, maps, booking tools, videos, payment systems or other services. Those third parties may collect personal data independently and their own privacy policies apply to their processing. EyeSpy360 is not responsible for the privacy practices of independent third parties.
If EyeSpy360 is involved in a merger, acquisition, restructuring, financing, insolvency process or sale of some or all of its business or assets, personal data may be disclosed or transferred as part of that transaction, subject to applicable law and appropriate confidentiality or data-protection safeguards.
We may update this Privacy Policy from time to time to reflect changes to the Services, our processing activities, technology, legal requirements or business practices.
The current version will be published on our website with an updated effective date. Where a change materially affects how we use personal data, we will take reasonable steps to bring the change to the attention of affected individuals where required by law.
Questions, requests or concerns about this Privacy Policy or our use of personal data can be sent to:
EyeSpy360 Limited
Athene House, 86 The Broadway
Mill Hill, London, NW7 3TD
United Kingdom
Email: support@eyespy360.com