This Privacy Policy explains how GRC Ready Limited ("we", "us", "our"), trading as GRC Ready, collects, uses, and protects your personal data when you use our website and compliance assessment platform (the "Service"). We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
GRC Ready is a service operated by GRC Ready Limited, a company registered in England and Wales under company number 17302357, with its registered office at 2 Waterbeach Road, Slough, Berkshire, SL1 3LB.
For the purposes of data protection law, we are the data controller of the personal data you provide when registering and using the Service. Where we process compliance data on behalf of your organisation, we may act as a data processor — see our Data Processing Agreement.
Our Data Protection contact is: info@grcready.co.uk.
| Category | Examples | Why we collect it |
|---|---|---|
| Account data | Full name, email address, password (encrypted) | To create and secure your account |
| Company data | Company name, address | To associate audits with your organisation |
| Assessment data | Questionnaire answers, scores, ratings | To generate and store your compliance reports |
| Technical data | IP address, browser type, session tokens | Security, authentication, and service operation |
| Usage data | Pages visited, actions taken | To improve and maintain the Service |
We process your personal data under the following lawful bases:
Your data is stored on secure cloud infrastructure with encryption in transit (TLS) and at rest. We apply access controls so that your data is only accessible to authorised users within your organisation and to authorised personnel who need it to operate the Service. We take appropriate technical and organisational measures to protect against unauthorised access, loss, or misuse.
We retain your personal data for as long as your account is active and as needed to provide the Service. If you close your account, we will delete or anonymise your personal data within [RETENTION PERIOD, e.g. 90 days], except where we are required to retain it for legal, accounting, or regulatory purposes.
We do not sell your personal data. We may share it with:
A current list of sub-processors is available on request from info@grcready.co.uk.
Where your data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or Standard Contractual Clauses.
Under UK GDPR you have the right to:
To exercise any of these rights, contact us at info@grcready.co.uk. You can also contact the ICO at ico.org.uk.
We use cookies and similar technologies as described in our Cookie Policy.
We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email. The "Last updated" date at the top indicates the latest version.
For any questions about this Privacy Policy or how we handle your data, contact us at:
GRC Ready Limited
Email: info@grcready.co.uk