Last updated: April 2026
SecureGRC Ltd ("SecureGRC", "we", "us", "our") is committed to protecting the privacy of visitors to our website (securegrc.io) and users of our platform (app.securegrc.io). This policy explains what personal data we collect, why we collect it, how we use it, and your rights under UK data protection law.
SecureGRC Ltd is the data controller. We are registered in England and Wales and operate from Eagle Labs Barclays, London.
| Data type | What we collect | How we collect it |
|---|---|---|
| Contact information | Name, email address, company name, job title | When you email us, request a demo, or submit a contact form |
| Website analytics | Pages visited, time on site, referral source, device type, approximate location (country/city level) | Google Analytics (with your cookie consent) |
| Cookie preferences | Your consent choices | Cookiebot consent management |
| Platform usage data | Actions taken within app.securegrc.io, models assessed, reports generated | When you use the SecureGRC platform |
We do not collect sensitive personal data (health, ethnicity, political opinions, biometric data). We do not collect payment card information directly — any future payment processing will be handled by a PCI-compliant third-party processor.
SecureGRC's metadata-only architecture means we never access, collect, or store:
Our platform assesses AI compliance using publicly available metadata only. This is a core architectural principle, not a feature — it is protected by our filed UK patent.
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Responding to your enquiry or demo request | Legitimate interest (Article 6(1)(f)) — you contacted us |
| Providing the SecureGRC platform service | Contract performance (Article 6(1)(b)) — delivering the service you signed up for |
| Website analytics (understanding how visitors use our site) | Consent (Article 6(1)(a)) — via Cookiebot cookie banner |
| Sending you relevant product updates or compliance insights | Legitimate interest (Article 6(1)(f)) — you can opt out at any time |
We use your data to respond to your enquiries, deliver the SecureGRC platform, improve our website and product, and send you relevant information about AI compliance and our services. We will never sell your data to third parties. We will never share your data with third parties for their marketing purposes.
We share data only with service providers who process data on our behalf:
For transfers to the USA, we rely on EU Standard Contractual Clauses and the UK International Data Transfer Agreement (IDTA) where applicable. We do not transfer data to any country without adequate safeguards.
| Data type | Retention period |
|---|---|
| Contact enquiries | 24 months from last contact, then deleted |
| Platform account data | Duration of service agreement plus 12 months |
| Website analytics | 26 months (Google Analytics default) |
| Cookie consent records | 12 months (then re-consent required) |
We use cookies on securegrc.io. When you first visit, our cookie banner (powered by Cookiebot) asks for your consent before setting any non-essential cookies.
Required for the website to function. These do not require consent. They include Cookiebot's consent cookie which remembers your preference.
Google Analytics cookies help us understand how visitors use our site. These are only set if you consent. You can withdraw consent at any time by clicking the cookie icon in the bottom corner of any page.
We do not use advertising, tracking, or social media cookies.
Under UK GDPR, you have the right to:
To exercise any of these rights, email privacy@securegrc.io. We will respond within 30 days.
We take the security of your data seriously. Our platform uses encryption in transit (TLS 1.3), encrypted database storage, and access controls. Compliance evidence generated by our platform is signed with post-quantum cryptography (CRYSTALS-Dilithium, NIST FIPS 204) to ensure long-term integrity.
Our services are not directed at individuals under 18. We do not knowingly collect personal data from children.
We may update this policy from time to time. We will post the updated version on this page with a revised "last updated" date. Material changes will be communicated via email to registered platform users.
If you have questions about this privacy policy or how we handle your data:
SecureGRC Ltd
Eagle Labs Barclays, London
Email: privacy@securegrc.io
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.