Privacy Policy

Last updated: 4th September 2026

Core GRC Solutions Ltd (“Core GRC”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website https://core-grc.co.uk or engage with our services.

1. Who we are

• Company name: Core GRC Solutions Ltd
• Registered office: Piccadilly Business Centre, Aldow Enterprise Park, Manchester, M12 6AE
• Company number: 16732250
• Contact for data protection matters: info@core-grc.co.uk 

2. What data we collect

We may collect and process the following personal data:

• Identity details (name, job title, organisation)
• Contact details (email address, phone number, postal address)
• Technical data (IP address, browser type, device, operating system)
• Usage data (how you use our website, pages visited, time spent)
• Any other data you provide via our contact forms or by corresponding with us

3. How we collect data

• Directly from you (e.g. when you complete a contact form, sign up for updates, email us or engage our services)
• Automatically, through cookies and analytics tools (see section 10)
• From third-party service providers (such as GoDaddy, Microsoft 365, or other business systems we  use to deliver our services)

4. How we use your data

We use your personal data to:

• Respond to enquiries and provide our services
• Manage our business relationship with you
• Improve our website and services
• Comply with legal and regulatory obligations
• Send you updates, insights, or marketing communications (where you have consented or where we have a legitimate business interest)

5. Legal basis for processing

We process your data under one or more of the following legal grounds:

• Your consent (e.g. when signing up for updates or accepting cookies)
• Performance of a contract (e.g. providing services to you)
• Legitimate interests (e.g. business development, improving our services)
• Legal obligation (e.g. record-keeping, regulatory compliance)

6. Who we share data with

We may share your data with trusted third parties such as:

• Hosting and IT service providers (e.g. GoDaddy, Microsoft 365, Monday.com)
• Professional advisers (accountants, auditors, legal consultants)
• Regulatory or government bodies where required by law

We do not sell your personal data to third parties.

7. International transfers

Where our service providers are based outside the UK or EEA, we ensure that appropriate safeguards are in place, such as UK adequacy regulations or standard contractual clauses.

8. Data retention

We keep your personal data only as long as necessary for the purposes we collected it for, including legal, accounting or reporting requirements. Typically, we retain business records for 6 years in line with UK regulations.

9. Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure (“right to be forgotten”)
• Object to or restrict processing
• Request data portability
• Withdraw consent at any time

To exercise your rights, contact us at info@core-grc.co.uk 

10. Cookies and tracking technologies

What are cookies?

Cookies are small text files placed on your device to help websites work more efficiently, as well as to provide information to the website owner.

Types of cookies we may use

• Strictly necessary cookies: Essential for the operation of the website  (e.g. security, load balancing).
• Performance/analytics cookies: To understand how visitors use our website  and improve functionality (e.g. Google Analytics).
• Functionality cookies: To remember choices you make, such as preferences.
• Marketing/advertising cookies: Used to deliver relevant ads (we do not currently use these, but this section applies if we do in future).

Managing cookies

When you first visit our site, you may be asked to accept or decline non-essential cookies. You can also control or delete cookies through your browser settings at any time. Please note that disabling cookies may affect website functionality.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or disclosure.

12. Complaints

If you are unhappy with how we use your data, please contact us first. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO): www.ico.org.uk.

13. Changes to this policy

We may update this policy from time to time. The latest version will always be published on this page with the “last updated” date.

Policy Owner: Managing Director
Effective Date: September 2026
Next Review: September 2027