Data Sources & Compliance

Effective Date: 17 May 2026 Last Updated: 17 May 2026

Company Information

Company: Marathon 360 Ltd Company No: 16710005 Registered Office: Office 14505, 182-184 High Street North, East Ham, London, United Kingdom, E6 2JA Support: [email protected]

Scope of This Page

This page sets out (a) what personal data Marathon 360 Ltd holds about clients of the agent services platform (the agents and agencies who sign service agreements with us), and (b) the legal and regulatory frameworks our processing activities operate under.

Data hosted within a client's branded CRM portal — enquiries the agent receives through their own website, ads, and inbound channels — is controlled by the client agency, not Marathon 360 Ltd. Marathon 360 Ltd acts as the processor of that data on documented instructions from the agent. See the client's own privacy policy for the controller-side disclosures.

Personal Data We Hold About Clients

We collect and process the following categories of personal data about the agents and agencies that engage our services:

• Professional Identity: Name, job title, agency name, professional licence numbers where applicable
• Contact Information: Business email, phone number, WhatsApp number, postal address
• Service Configuration: Markets, postcodes, languages, ad budgets, AI Employee briefing, branded portal settings
• Communication History: Records of calls, emails, WhatsApp messages, support tickets, monthly review notes
• Billing & Payment: Invoice records, payment method metadata, billing address (full payment card data is handled by our payment processor, not Marathon 360)

Sources of this data: the agent's own submissions (contact form, onboarding intake, ongoing communication), publicly available company-register data used to verify the agency exists and is licensed to trade, and operational metadata generated by the agent's use of the platform.

How SMS Recipients Are Sourced

The Marathon 360 SMS programme is restricted to two recipient groups, and we maintain records of how each recipient was sourced:

1. Signed Clients: Agents and agencies who have signed a service agreement listing SMS as a delivery channel for service updates, billing reminders, and operational notifications. The consent timestamp is the signature date on the service agreement.
2. Website Form Submitters: Individuals who completed a form on marathon360.co.uk and ticked the SMS consent box. The consent timestamp, IP address, and the form URL are captured at submission and held in the platform's audit log.

We do not buy, rent, or otherwise acquire SMS recipient phone numbers from any third party. No phone number enters the SMS programme without one of the two consent events above.

Compliance Framework

Legal Compliance

• UK GDPR: UK General Data Protection Regulation and the Data Protection Act 2018
• EU GDPR: General Data Protection Regulation (EU)
• PDPL: Personal Data Protection Law (UAE, Kingdom of Saudi Arabia, others as applicable)
• CAN-SPAM: US Anti-spam legislation
• TCPA: US Telephone Consumer Protection Act
• CTIA Messaging Principles & Best Practices
• A2P 10DLC: Where applicable, the programme operates under registered A2P 10DLC use case "Customer Care & Account Notifications"

Sanctions Compliance

We exclude sanctioned persons and entities from our client base in compliance with:

• UK HM Treasury Office of Financial Sanctions Implementation (OFSI)
• EU Consolidated List of Persons, Groups and Entities
• US Office of Foreign Assets Control (OFAC) sanctions lists
• UN Security Council Consolidated List

Retention and Updates

Personal data about clients is retained for the duration of the service agreement plus three years, or longer where required by law (e.g. accounting and tax records). Operational logs are retained per the schedule in our Privacy Policy.

Third-Party Processors

Where third-party processors are engaged for platform operations, security, or compliance, we maintain Article 28 UK GDPR data processing agreements with each. See /sub-processors for the public list.

Contact Information

For questions about the data we hold about you as a client, our processing activities, or our compliance procedures:

Email: [email protected] Address: Office 14505, 182-184 High Street North, East Ham, London, United Kingdom, E6 2JA