Who we are and what this notice covers
SustainGRC Ltd (company number 14093132, registered office 128 City Road, London EC1V 2NX) is the controller of the personal data described in this notice. Our ICO registration number is ZC109201.
This notice covers personal data of:
- visitors to our website;
- customer and prospective customer personnel;
- attendees of our events and webinars, and participants in our Academy and podcast;
- personnel of our partners, introducers and suppliers; and
- candidates, contractors, advisers and trial engagees.
It does not cover data that customers load into the SustainGRC platform. For that data we act as processor (section 9).
Personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Contact and communications | Name, work email, telephone, employer, job title, and the content and metadata of our communications. | You or your employer; public professional sources; business contact data providers; referral partners. |
| Customer and prospect relationship | Records in our CRM: role, sector, interest in our products, demo requests, newsletter preferences and meeting notes. | You or your employer; public professional sources; business contact data providers. |
| Events, Academy and podcast | Registration details, attendance, Academy progress and certification results, access needs, and dietary requirements.Dietary information can reveal health or religious belief and is special category data. | You or your employer. |
| Website and usage | IP address, approximate location, device and browser type, pages viewed, referral source and cookie identifiers. | Your browser; cookies and similar technologies (section 10). |
| Partners and suppliers | Contact details, bank details needed to pay invoices, referral records and due diligence records. | You, your organisation and public sources. |
| Candidates, contractors and advisers | CV, identity and address details, signed agreements, payment and tax details, onboarding account data and correspondence. Identity documents are covered in section 4. | You; referrers; public professional sources. |
We do not seek special category data other than dietary information. Our services are not directed at children under 16.
How we use personal data, and why
| Purpose | Legal basis |
|---|---|
| Operating and securing our website; analytics and improving our services | Legitimate interests (running and protecting our business). Consent for non-essential cookies. |
| Entering into and administering contracts, invoicing and payment | Contract; legitimate interests. |
| Managing relationships, responding to enquiries and providing support | Legitimate interests. |
| Direct marketing and outreach to business contacts, including prioritising outreach by sector, size and role | Legitimate interests (promoting our business to relevant contacts), with a simple opt-out in every message. Consent where the law requires it, for example for individual subscribers and non-essential cookies. |
| Running events, webinars and the Academy | Legitimate interests. Explicit consent for dietary information. |
| Engaging candidates, contractors, advisers and partners, including identity checks, sanctions and anti-bribery diligence | Steps prior to a contract; legitimate interests; legal obligation. |
| Record keeping, security, fraud prevention, insurance and professional advice | Legitimate interests; legal obligation. |
| Establishing, exercising or defending legal claims | Legitimate interests. |
Where we rely on legitimate interests we document a balancing test, and you can ask us for a summary. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Identity documents
We ask for a passport or other identity document only where we need to verify who you are before we contract with you. We hold the copy separately from the signed agreement and delete it within 30 days of verification, unless a legal obligation or a dispute requires us to keep it longer.
If you ask us to delete it sooner, we will do so and confirm when it is done.
International transfers
Most of our processing takes place in the UK. Some of our providers, contractors and partners are based outside the UK, including in the European Economic Area and in countries that do not have UK adequacy regulations.
Where we transfer personal data to a country without UK adequacy regulations, we use the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and we assess the destination country's laws before we transfer. You can ask us for a copy of the safeguards that apply to you.
How long we keep personal data
| Category | Retention |
|---|---|
| Contact and communications | 24 months after our last meaningful contact |
| Customer and prospect relationship records | 6 years after the relationship ends |
| Event and Academy data | 12 months after the event; dietary information deleted within 14 days of the event |
| Website and usage data | 26 months from collection, or less where the analytics service sets a shorter period |
| Partner and supplier records | 6 years after the relationship ends |
| Contractor and adviser agreements and correspondence | 6 years after termination |
| Identity documents | 30 days after verification |
| Unsuccessful candidates | 6 months after the decision |
We keep data for longer where a legal obligation or a dispute requires it. When we delete, we remove data from active systems immediately and from backups on our normal cycle.
Your rights
You have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time. You can object to direct marketing at any point and we will stop.
Write to compliance@sustaingrc.com. We respond within one month and do not charge a fee unless a request is clearly unfounded or excessive. We may ask you to confirm your identity.
If we cannot delete everything you ask us to delete, we will tell you what we are keeping, why, on what legal basis and for how long.
If you are unhappy with our response, you can complain to us first. We will acknowledge your complaint within 10 days and tell you the outcome without undue delay. You can also complain at any time to the Information Commissioner's Office at ico.org.uk.
When we act as a processor
Customers who use the SustainGRC platform decide what personal data they load and why. For that data the customer is the controller and we are the processor, acting on their documented instructions under a data processing agreement.
Customers are responsible for their own privacy information to data subjects. If you contact us about data held in a customer's instance, we will pass your request to that customer and tell you we have done so.
Changes to this notice
We will update this notice when our practices or the law change. We show the date of the latest version at the top, and we will tell you about material changes by email where we hold your contact details.