Privacy Notice

How we use personal data

This privacy notice explains how Data GRC Ltd (Registered in UK, number 10892418, 7 Castlefield Rd, Reigate RH2 0SA, UK) uses personal data.

We are Data Controllers (ICO registration number ZA284104) for the following processes:

Visitors to our websites
People we work with
Our newsletters
Our marketing
Our employees

More detail is provided about each process below.

If you visit our website

If you visit our website, we retain technical data relating to your IP address, device settings, use of our technologies and time stamps, as a legitimate interest to monitor system performance, and prevent and detect cybercrime.

If you contact us, we’ll use those details to respond, as a legitimate interest to maintain business relations.

If we work with you

If you engage us, for professional purposes, we’ll use relevant details (contact details, availability, interests, etc) with the legitimate interest of maintaining long term business relationships.

If you register for a course, we will process your contact details, payment, travel and and specific requirements, as necessary for contract. Payment details are shared with financial services organisations, such as Stripe and the global financial services system, to facilitate secure payments.

If you subscribe to our newsletters

If you subscribe to our newsletters, we will send you our newsletters, as a legitimate interest of responding to your request. You can opt out any time by contacting us.

If we engage you with marketing

We collect data for marketing from a number of legal sources. We inform people if we are using their data within one month. We perform marketing in accordance with PECR, using the legitimate interest of business development or consent when required by law. If you click on our marketing, we will record that information for the legitimate interest of performance management. You can opt out any time by contacting us.

If you work for Data GRC

If you apply to work at Data GRC, we will use the information that you provide to assess your application, with the intention to enter into a contract. This does not guarantee a contract. We will seek your agreement before reqesting references, right to work, or other background checks.

If you work for Data GRC, we maintain staff records for a variety of reasons including legal (e.g. Employment, AML and tax law), contract (e.g. bank details) and legitimate interest (e.g. performance reviews).

Your Data Protection GDPR Rights

We fully respect your legal right to request that we:

Allow you to opt-out of any process that you previously consented to, at any time.
Provide a copy of data we hold on you, or to pass it to a third party on your behalf.
Amend, delete or restrict processing of your data.
Explain and review any automated decision making or profiling.
Provide further information about our processing activities.

If you wish to raise a privacy request or contact us about any another matter, please contact our Data Protection Office using our contact forms.

When we receive a request, we will verify your identity, then normally complete our response within 1 month. We will retain details of your request as a legitimate interest, for quality assurance purposes and to ensure we continue to comply going forward.

We will not discriminate individuals who make data subject requests.

If you are unhappy with how we have used your data, you can also complain to the ICO or take independent legal action. For more details, visit www.ico.org.uk

More Information

We do not perform restricted international transfers.

We only retain data for long as we believe there to be an appropriate business purpose related to the reason you provided your data to us.

We only share personal data with third parties if they are processing that data on our behalf under written contract, or if required for legal or regulatory reasons. We do not sell or give away personal data.

If our website provides links to other websites, those websites are beyond our control. We encourage you to read the privacy notices on any other website you visit.

This privacy notice was drafted with brevity and clarity in mind. Please let us know if you would like more details.

We reserve the right to update our privacy notice and cookie notice at any time. We will notify affected Data Subjects of major amendments that affect their data.