Privacy policy
What we collect, why, where it goes and how long we keep it, for visitors to this site and for clients whose infrastructure we operate.
1. Who is responsible
Innovations GRC operates innovationsgrc.com and is the controller of personal data collected through this site and in the course of selling and supporting its services. Contact for anything in this policy: contact@innovationsgrc.com.
2. What we collect
Forms. When you use the contact or order forms we collect what you type: name, email, company, domain, VAT number where given, your message, and the plan and options you choose. The forms also record the time of submission and a honeypot field used only to discard automated spam.
Email. When you email us we keep the correspondence, including your address and anything you include.
Clients. When you become a client we additionally hold billing details (invoicing name, address, tax number), payment status from our payment processor (we never see or store full card numbers), the technical details of your infrastructure, support history, and the delegated credentials you grant us, held in an encrypted vault.
Server logs. Our web server records the IP address, user agent, requested page, referrer and time of each request, for security and troubleshooting. Logs are kept for 30 days.
Partner networks. If you reached this site through an affiliate or partner link, or leave it through one, the network involved may receive click data as described in section 6.
3. Why, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Replying to an enquiry or audit request | Form and email data | Steps before a contract, and legitimate interest in responding |
| Providing and billing the services | Client data | Performance of the contract; legal obligation for tax records |
| Security, abuse prevention, troubleshooting | Server logs, form metadata | Legitimate interest in running a secure service |
| Analytics, where enabled | Usage data | Consent, via the banner |
| Service announcements to clients | Client contact details | Performance of the contract |
| Marketing email | Email address | Consent, which you can withdraw at any time. We do not add enquirers to a marketing list without asking. |
4. Cookies and analytics
This site works without cookies. The only item we store in your browser is a preference for the monthly or annual billing toggle on the plans page, kept in local storage, which contains no personal data and is never sent to us.
If we enable analytics on this site, it will load only after you accept it in a consent banner, will be configured to anonymise IP addresses, and will be described here with the provider named. Declining analytics will not affect anything else on the site.
5. Who we share data with
We share personal data only with providers who process it on our behalf under contract, and only what each needs:
- Hosting and infrastructure for this site and our systems (providers listed on the stack page; this site is hosted in the EU).
- Email for receiving and sending correspondence.
- Payment processor for checkout and invoicing; they receive your name, email, billing address and payment details and are independent controllers for the payment itself.
- Credential vault for client access credentials, encrypted end to end.
- Accounting for invoices and tax records.
We do not sell personal data and we do not share it with advertisers. We disclose data to authorities only where the law requires it, and we tell you when we are allowed to.
6. Affiliate links
Some outbound links on this site, mainly on the stack page and in guides, are affiliate links to providers whose partner programmes we take part in, including programmes run through affiliate networks. When you click one, the provider or network sets a cookie in your browser or records the click on their side so that they can attribute any purchase you make to us. We receive aggregate reports of clicks and commissions; we do not receive your identity from these reports. The provider's and network's own privacy policies govern what they do with the click data. Affiliate links are marked in the page code with a "sponsored" attribute, and every page that contains them carries a disclosure. Our affiliate disclosure has the full policy.
7. Client data we process for you
When we host and operate a client's infrastructure, we process the personal data of the client's own customers and users, for example in a database, a CRM, email or analytics. For that data the client is the controller and Innovations GRC is a processor acting on the client's documented instructions. We process it only to provide the services, keep it secure as described in section 10, use the sub-processors listed on the stack page and agreed with the client, assist with data subject requests and breach notifications, and delete or return it at offboarding as set out in the terms. A data processing agreement with the standard terms is available on request.
8. International transfers
Our own systems and this site are hosted in the European Union. Some providers in section 5 may process data outside the EU or the UK; where they do, we rely on adequacy decisions or standard contractual clauses and the provider's published safeguards. Client infrastructure is hosted in the region the client chooses at onboarding, and we do not move it without written agreement.
9. Retention
- Enquiries that do not become clients: 12 months from the last contact, then deleted.
- Client records: for the duration of the contract and 6 years after it ends, for tax and legal purposes, except access credentials which are deleted within 60 days of offboarding.
- Server logs: 30 days.
- Backups of client infrastructure: the retention period of the client's plan, after which they are overwritten.
10. Security
We apply to our own systems the same controls we sell: TLS everywhere, firewalled hosts, 2FA on every account, least-privilege access, encrypted backups, logging and monitoring, and the practices we publish. Access to client data is limited to the engineers who need it and is logged. If a breach affects your personal data we will tell you and, where required, the supervisory authority, without undue delay.
11. Your rights
Depending on where you live you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. To exercise any of these, email contact@innovationsgrc.com; we respond within one month. You also have the right to complain to the data protection authority where you live. We will not treat you differently for exercising your rights.
12. Changes and contact
We will update this policy when our practices change and notify clients by email of material changes. The current version is always the one published here. Questions, requests and complaints: contact@innovationsgrc.com.