Privacy Policy

Effective Date: 5th June 2025
Last Updated: 8th August 2026

1. Introduction

GRANDPOINT LTD ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

2. Company Information & Data Controller

3. Information We Collect

Personal Information

We may collect the following personal information when you use our services:

• Name and contact details (email address, phone number)
• Project requirements and business information
• Communication preferences
• Technical information about your device and browsing behaviour

Automatically Collected Information

• IP address and location data
• Browser type and version
• Pages visited and time spent on our website
• Referring website addresses

4. How We Use Your Information

We use your information to:

• Provide and maintain our services
• Respond to your inquiries and project requests
• Send you relevant communications about our services
• Improve our website and user experience
• Comply with legal obligations

5. Legal Basis for Processing (GDPR)

Under UK GDPR, we process your data based on:

• Consent: When you provide explicit consent for marketing communications
• Contract: To fulfill our contractual obligations to you
• Legitimate Interest: To improve our services and business operations
• Legal Obligation: To comply with applicable laws and regulations

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information with:

• Service providers who assist in our business operations
• Legal authorities when required by law
• Business partners with your explicit consent

7. Your Rights Under UK GDPR

You have the right to:

• Access your personal data
• Rectify inaccurate personal data
• Erase your personal data
• Restrict processing of your personal data
• Data portability
• Object to processing
• Withdraw consent at any time

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

9. Data Retention

We keep personal data only for as long as we need it. In practice that means:

• Enquiries that do not become projects: 24 months from last contact, then deleted.
• Client and project records: for the life of the engagement and 7 years afterwards, to meet our obligations under the Companies Act 2006 and HMRC record-keeping rules.
• Accounting and invoicing records: 7 years from the end of the relevant accounting period.
• Website analytics: up to 26 months, and only where you have consented to performance cookies.
• Cookie consent records: 12 months, so we can evidence the choice you made.
• Client reviews published on this site: until the client withdraws permission, after which the review is removed.
• Marketing contacts: until you withdraw consent or after 24 months of no engagement, whichever is sooner.

Where we hold data as a processor on behalf of a client, retention is governed by that client's instructions and our contract with them, not by this policy.

10. International Transfers

Some of the providers we rely on to run our website and services operate outside the United Kingdom. Where personal data is transferred outside the UK, we rely on UK adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You can ask us for details of the safeguards in place for any specific transfer.

11. When We Act for Our Clients

When we build, host or maintain a system for a client, any personal data held in that system belongs to the client, who is the data controller for it. We act only as a processor, on their documented instructions, under the terms set out in section 12 of our Terms of Service. If you want to exercise your rights in relation to data held in one of those systems, please contact the organisation that operates it. We will pass on any request we receive and assist that organisation in responding.

12. Contact Information & ICO Complaints

For any questions about this Privacy Policy or to exercise your rights, please contact our data protection contact:

You have the right to lodge a complaint with the UK Information Commissioner's Office at any time:ico.org.uk/make-a-complaint · Telephone 0303 123 1113.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page with an updated effective date.