GRC ONE Limited
Last updated: 27 October 2026
1. Introduction
GRC ONE Limited ("GRC ONE", "we", "us" or "our") is committed to protecting your personal information and respecting your privacy.
This Privacy Notice explains how we collect, use, store, share and protect personal information when you visit our website, communicate with us, enquire about our products or services, or engage with us in a business capacity.
It also explains your rights under applicable data protection legislation and how you can exercise those rights.
We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.
This Privacy Notice applies to our corporate website at www.grc1.com and related business communications.
Where GRC ONE processes personal information on behalf of customers using our iGRCs software platform, that processing may be governed by separate contractual data protection arrangements, including applicable Data Processing Agreements.
2. Who We Are
GRC ONE Limited is a company registered in the United Kingdom.
For the personal information covered by this Privacy Notice, GRC ONE Limited generally acts as the data controller, meaning that we determine why and how the information is processed.
Our contact details are:
GRC ONE Limited
Fergusson House
124–128 City Road
London
EC1V 2NX
United Kingdom
Website: https://www.grc1.com
Email: dpo@grc1.com
Information Commissioner's Office Registration Number: ZA315796
For questions about this Privacy Notice, our handling of personal information or your data protection rights, please contact us using the details above.
3. Personal Information We Collect
The personal information we collect depends on how you interact with GRC ONE.
3.1 Information you provide directly
When you contact us, submit an enquiry, request a product demonstration or otherwise communicate with us, we may collect:
- Your name.
- Your business email address.
- Your telephone number.
- Your job title or professional role.
- Your organisation's name.
- Your business contact details.
- Information about your interest in our products or services.
- Information contained in correspondence, enquiries, feedback or other communications you send to us.
We collect this information to respond to enquiries, provide requested information, manage business relationships and deliver relevant services.
3.2 Information collected automatically
When you access our website, certain technical information may be collected automatically.
This may include:
- Your Internet Protocol (IP) address.
- Browser type and version.
- Device type and operating system.
- Pages visited and website navigation information.
- Date, time and duration of visits.
- Referring website addresses.
- Technical diagnostic information.
- Cookie identifiers and similar information, where applicable.
This information may be used to operate and secure our website, understand website performance, identify technical problems and improve the visitor experience.
3.3 Business contact information
We may collect professional contact information about individuals acting on behalf of existing or prospective customers, suppliers, consultants, business partners and other organisations.
This may include information obtained through:
- Business enquiries and communications.
- Meetings, conferences and professional events.
- Introductions or referrals from business contacts.
- Authorised channel partners.
- Publicly available professional sources, including company websites and professional networking platforms, where relevant and lawful.
Where information is obtained from third-party sources, we process it in accordance with applicable data protection requirements and provide relevant privacy information where required.
3.4 Special category personal information
Our website and business enquiry processes are not intended to collect special category personal information, such as health information, biometric information, religious beliefs or political opinions.
We ask that you do not provide such information through general website enquiry forms unless specifically requested through an appropriate and secure process.
Where we do receive such information, we will assess whether its processing is necessary and lawful.
4. How and Why We Use Personal Information
We only process personal information where we have an appropriate lawful basis under applicable data protection legislation.
The following table summarises the principal purposes for which we may use personal information.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and providing information about our products and services | Legitimate interests in responding to business enquiries, or taking steps before entering into a contract where applicable |
| Managing relationships with customers, prospective customers, suppliers and business partners | Legitimate interests in conducting and managing our business |
| Providing services and fulfilling contractual obligations | Performance of a contract with an individual, where applicable, or legitimate interests in fulfilling business-to-business contracts |
| Operating, maintaining and securing our website | Legitimate interests in maintaining a secure and reliable website |
| Analysing website performance and improving functionality | Legitimate interests or consent, depending on the technology and processing involved |
| Sending relevant business-to-business marketing communications | Legitimate interests or consent, as applicable |
| Managing marketing preferences and unsubscribe requests | Legal obligation and legitimate interests |
| Maintaining business records and meeting regulatory requirements | Legal obligation or legitimate interests, as applicable |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against your rights, freedoms and reasonable expectations.
Where consent is required, we will request it appropriately. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
We do not rely on your general use of our website as consent to all forms of personal information processing.
5. Business Communications and Marketing
As a provider of governance, risk and compliance technology solutions, GRC ONE may contact business professionals to provide information about our products, services, events and relevant industry developments.
These communications may include:
- Information about GRC ONE, the iGRCs, Execeye and other partner products.
- Product updates and service announcements.
- Invitations to demonstrations, webinars and business events.
- Relevant professional insights and industry information.
- Follow-up communications relating to previous business enquiries.
We send direct marketing communications in accordance with applicable data protection and electronic marketing legislation.
Depending on the recipient, communication channel and circumstances, we may rely on legitimate interests or consent.
You have the right to object to the processing of your personal information for direct marketing purposes at any time.
You can opt out by following the unsubscribe instructions included in our marketing emails or by contacting dpo@grc1.com.
If you opt out, we may retain limited information to ensure that your preferences are respected and that we do not send you further unwanted marketing communications.
We do not sell personal contact information to third parties for their independent marketing purposes.
6. Cookies and Website Analytics
Our website may use cookies and similar technologies to support website functionality, maintain security, understand website usage and improve performance.
Cookies are small files placed on your device when you visit a website. Similar technologies may include tracking pixels, scripts and browser storage.
Depending on the functionality deployed, these technologies may include:
Strictly necessary technologies: These support essential website functions, security and services that you have requested.
Analytics technologies: These help us understand how visitors use our website, identify areas for improvement and assess website performance.
Functional technologies: These support additional website features and visitor preferences.
Marketing technologies: Where used, these may help measure the effectiveness of marketing activities or support relevant advertising.
We obtain consent before using technologies that require consent under PECR.
Certain technologies may qualify for statutory exceptions, including specific statistical analytics purposes, where all applicable requirements are met. Where an exception requires us to provide a means of objecting, we will make that available.
You can manage applicable cookie preferences through our website's cookie controls.
For further information about the technologies used, their purposes, providers, retention periods and your choices, please refer to our:
Cookie Policy: https://www.grc1.com/cookie-policy/
7. Sharing Personal Information
We may share personal information with trusted organisations where reasonably necessary for legitimate business purposes, the provision of services or compliance with legal obligations.
Recipients may include:
7.1 Technology and service providers
Third-party organisations that support our operations, such as providers of:
- Website hosting and infrastructure.
- Email and business communications.
- Customer relationship management systems.
- Website maintenance and technical support.
- Website analytics and performance monitoring.
- Information security and IT services.
Where these providers process personal information on our behalf, we require appropriate contractual arrangements and data protection safeguards.
7.2 Business and channel partners
Where relevant to a business enquiry, product demonstration or service arrangement, we may share appropriate business contact information with authorised business or channel partners.
We will only do so where an appropriate lawful basis exists and the sharing is consistent with applicable data protection requirements.
Where a partner independently determines how it uses personal information, it may act as a separate data controller with its own data protection obligations.
7.3 Professional advisers and legal authorities
We may disclose personal information to professional advisers, including legal, accounting and auditing advisers, where reasonably necessary.
We may also disclose information where required by law, court order, regulatory obligation or a lawful request from an authorised public body.
7.4 Business restructuring
In the event of a merger, acquisition, restructuring or transfer of business assets, relevant personal information may be disclosed where necessary and lawful.
Any such disclosure will be subject to appropriate confidentiality, security and data protection arrangements.
We do not disclose personal information to third parties without an appropriate legal basis.
8. International Transfers of Personal Information
GRC ONE is based in the United Kingdom. However, some of our personnel, business operations or third-party service providers may be located outside the United Kingdom.
As a result, personal information may be accessed but not processed or stored in other countries.
Where international transfers are subject to UK GDPR restrictions, we ensure that an appropriate legal transfer mechanism is in place.
Where required, we assess the data protection risks associated with international transfers and implement appropriate additional safeguards.
You may contact us at dpo@grc1.com for further information about relevant international transfers and how to obtain a copy of applicable safeguards.
9. How Long We Keep Personal Information
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including satisfying applicable legal, regulatory, contractual and business requirements.
Our retention arrangements take account of:
- The type and sensitivity of the information.
- The purposes for which it is processed.
- The duration of relevant business relationships.
- Applicable legal and regulatory obligations.
- The need to maintain appropriate business records.
- The establishment, exercise or defence of legal claims.
The following retention arrangements apply to relevant categories of information:
| Category | Retention period or criteria |
|---|---|
| Website enquiries | 12 months from the date of the enquiry or last meaningful interaction, unless the enquiry develops into a customer relationship or on-going business opportunity |
| Prospective customer and business contact records | 24 months from the last meaningful business interaction. Records will be reviewed periodically and deleted or anonymised when no longer relevant. |
| Customer and supplier business contact records | Retained throughout the business relationship and for 6 years following termination, where necessary for contractual, financial, legal or legitimate business purposes. Contact details no longer needed will be deleted sooner. |
| Marketing records | Retained while there is a valid lawful basis for marketing and the contact remains relevant, subject to marketing preferences and objections. Contacts are reviewed after 24 months of inactivity. Minimal suppression records may be retained for as long as necessary to honour opt-outs. |
| Website analytics information | 14 months for identifiable or pseudonymous analytics data, subject to the configuration of the analytics platform. Aggregated, genuinely anonymised statistics may be retained indefinitely. |
| Website security and technical logs | 90 days for routine security, access and technical logs. Relevant logs may be retained for up to 12 months, or longer where necessary for an identified security investigation, incident or legal obligation. |
| Legal and compliance records | Generally, 6 years following the end of the relevant contractual relationship or matter, unless a longer or shorter period is required by applicable legislation, regulatory obligations or ongoing legal proceedings. |
When personal information is no longer required, we securely delete, anonymise or otherwise dispose of it in accordance with our retention procedures.
10. Information Security
We take the security and confidentiality of personal information seriously.
We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction.
These measures may include, as appropriate:
- Access controls and authentication mechanisms.
- Encryption and secure communications.
- Role-based access to business systems.
- Security monitoring and technical safeguards.
- Information security policies and procedures.
- Personnel confidentiality requirements.
- Procedures for managing information security incidents.
- Appropriate oversight of service providers.
We review our security arrangements in light of the nature of the information we process and the risks associated with our activities.
Although no information system can guarantee absolute security, we take proportionate measures to protect the personal information entrusted to us.
11. Your Data Protection Rights
Under applicable UK data protection legislation, you have a number of rights concerning your personal information.
These rights may include:
Right to be informed: You have the right to receive clear information about how your personal information is collected and used.
Right of access: You may request confirmation of whether we process your personal information and obtain access to relevant information.
Right to rectification: You may request that inaccurate personal information is corrected or incomplete information is completed.
Right to erasure: In certain circumstances, you may request that we delete your personal information.
Right to restrict processing: You may request that we limit how your information is processed in certain circumstances.
Right to data portability: Where applicable, you may request to receive certain personal information in a structured, commonly used and machine-readable format, or have it transmitted to another organisation.
Right to object: You may object to processing based on legitimate interests in certain circumstances.
Right to object to direct marketing: You have an unconditional right to object to the processing of your personal information for direct marketing.
Rights relating to automated decision-making: You may have rights and protections where decisions producing legal or similarly significant effects are made using solely automated processing.
Right to withdraw consent: Where we rely on consent, you may withdraw that consent at any time.
These rights are subject to the conditions and exemptions provided by applicable law.
Exercising your rights
To exercise your rights, please contact: dpo@grc1.com
We may request reasonable information to verify your identity before responding to a request.
We will normally respond within one month of receiving your request, subject to applicable statutory rules concerning extensions and response periods.
We do not ordinarily charge a fee for responding to data protection rights requests. However, fees or other measures may apply in circumstances permitted by law.
12. Automated Decision-Making and Profiling
We may use website analytics and business information to understand engagement with our website and services, subject to applicable data protection requirements.
If our use of automated decision-making changes in a way that requires additional privacy information, we will update this Privacy Notice accordingly.
13. Children's Privacy
Our corporate website and services are intended for business and professional audiences and are not directed towards children.
We do not knowingly collect personal information from children through our general website enquiry and business contact processes.
If you believe that a child has provided personal information to us, please contact dpo@grc1.com.
We will review the circumstances and take appropriate action in accordance with applicable data protection legislation.
14. Third-Party Websites
Our website may contain links to websites, applications or services operated by third parties.
These third parties operate independently of GRC ONE and may have their own privacy notices and data protection practices.
We encourage you to review the privacy information provided by any third-party website before submitting personal information.
GRC ONE is not responsible for the privacy practices of independent third-party websites.
15. Data Protection Complaints
We aim to handle personal information responsibly and transparently.
If you have concerns about how we have collected, used, disclosed or protected your personal information, you may submit a data protection complaint to us.
Please contact:
Email: dpo@grc1.com
Postal address:
GRC ONE Limited
Fergusson House
124–128 City Road
London
EC1V 2NX
United Kingdom
We will acknowledge receipt of a data protection complaint within 30 days.
We will take appropriate steps to investigate the complaint without undue delay, keep you informed where appropriate and communicate the outcome without undue delay.
We may request additional information where reasonably necessary to investigate your concerns.
Complaints to the Information Commissioner's Office
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection matters.
Information Commissioner's Office
Website: https://ico.org.uk
Telephone: 0303 123 1113
We encourage you to contact us directly so that we have an opportunity to address your concerns, although this does not affect your right to contact the ICO.
16. Changes to This Privacy Notice
We may update this Privacy Notice periodically to reflect changes in our business activities, technology, data processing practices or applicable legal requirements.
When we make changes, we will publish the revised Privacy Notice on our website and update the date shown at the beginning of the document.
Where changes materially affect how personal information is processed, we will take additional steps to inform affected individuals where required by law.
We encourage you to review this Privacy Notice periodically.
17. Contact Us
If you have questions about this Privacy Notice, how GRC ONE handles personal information or your data protection rights, please contact us.
GRC ONE Limited
Fergusson House
124–128 City Road
London
EC1V 2NX
United Kingdom
Privacy enquiries: dpo@grc1.com
Website: https://www.grc1.com
Contact page: https://www.grc1.com/contact/
ICO Registration Number: ZA315796
© GRC ONE Limited. All rights reserved.