Privacy Policy

Who we are

GRC Ahead ("we", "us") provides governance, risk, compliance and AI governance consulting and is based in Ireland. We are the controller of the personal data described in this policy.

[To be confirmed: legal name of the business, registered or postal address, and company registration number if applicable.]

What personal data we collect

• Contact form: your name, email address, organisation (optional), the topic you choose, your message and your confirmation that we may use these details to reply.
• Emails you send us and our replies.
• Discovery Call bookings, once online booking opens: your name, email address, the answers you give on the booking form, the time and time zone of your appointment, your acceptance of the booking terms and the payment status. Card details are entered with our payment provider, Stripe, and are not seen or stored by us.
• Technical data: our hosting provider processes your IP address and basic browser information to deliver and secure the website.

We do not use analytics, advertising or tracking tools on this website.

How we use it and our lawful basis

• To reply to your enquiry: our legitimate interest in responding to people who contact us, or steps you ask us to take before entering into a contract.
• To provide a consultation you book and take payment for it: performance of a contract with you.
• To keep accounting and tax records: compliance with our legal obligations.
• To keep the website secure and working: our legitimate interest in operating a safe website.

We do not sell personal data, and we do not use it for automated decision-making or profiling.

How long we keep it

We keep personal data only for as long as we need it for the purposes above.

[To be confirmed: retention periods for enquiries, booking records and financial records (for example, the period required by Irish tax law).]

Who we share it with

We share personal data only with service providers that process it on our behalf, and with authorities where the law requires it:

• Netlify: website hosting and contact form submissions.
• Cal.com: appointment scheduling, once online booking opens.
• Stripe: payment processing, once online booking opens.
• [To be confirmed: the provider of our email service for hello@grcahead.com.]

Some of these providers are based outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA it is protected by safeguards recognised under data protection law, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. [To be confirmed by legal review for each provider.]

Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we use it;
• receive your data in a portable format;
• withdraw your consent at any time, where we rely on consent.

To exercise these rights, email hello@grcahead.com. You also have the right to lodge a complaint with the Data Protection Commission in Ireland (www.dataprotection.ie).

Contact

Questions about this page: email hello@grcahead.com.

[To be confirmed: postal address of GRC Ahead.]