GRCK

    GRCK LTD. Privacy Policy

    Effective Date: March 2, 2026 | Version: 1.0

    Contact: privacy@grckco.com | www.grckco.com

    1. Introduction and Scope

    GRCK LTD. ("GRCK", "we", "us", or "our") is a professional advisory firm specialising in Governance, Risk Management, and Compliance (GRC) services. We are committed to protecting the privacy, confidentiality, and security of all personal information we receive in the course of our advisory, consulting, and business development activities.

    This Policy applies to:

    • Visitors to our website and digital platforms
    • Prospective, current, and former clients and their authorised representatives
    • Business contacts, partners, and vendors
    • Individuals whose data we process in connection with our professional engagements
    • Employees, contractors, and job applicants (to the extent applicable)

    2. Applicable Regulatory Framework

    GRCK operates across multiple jurisdictions and is committed to compliance with the following data protection and privacy regulations, as applicable based on the location of the individuals whose data we process:

    • Nigeria Data Protection Act (NDPA) 2023: For personal data of Nigerian residents or data processed within Nigeria.
    • PIPEDA (Canada): For personal information of individuals located in Canada, complying with PIPEDA and applicable provincial privacy legislation (including Quebec's Law 25 / Bill 64).
    • CCPA/CPRA (United States): For personal information of California residents. We do not sell personal information as defined under the CCPA.
    • GDPR (EU/EEA): For personal data of individuals located in the EU/EEA.

    Note: Where there is a conflict between applicable privacy laws, we will apply the standard most protective of individuals' rights.

    3. Personal Information We Collect

    We collect personal information proportionate to the purposes for which it is required.

    3.1 Information You Provide Directly

    • Contact Information: Full name, job title, company name, business email address, telephone number, and postal address.
    • Professional Background: Work history, qualifications, certifications, and areas of expertise shared in the context of client engagements or recruitment.
    • Engagement Data: Information provided during consultations, workshops, risk assessments, compliance reviews, and advisory mandates.
    • Correspondence: Records of emails, phone calls, meeting notes, and other communications.
    • Billing Information: Invoicing details, payment information, and related financial records.

    3.2 Information Collected Automatically

    • Technical usage data: IP address, browser type and version, operating system, referring URLs, pages visited, time and duration of visits, and device identifiers.
    • Cookie and tracking data: As described in Section 8 (Cookie Policy) below.

    3.3 Information Obtained from Third Parties

    • Publicly available professional information (e.g., LinkedIn profiles, company registries) for business development and due diligence purposes.
    • Information provided by client organisations about their employees or stakeholders in the course of an engagement.
    • Referrals and introductions from existing clients or professional contacts.

    4. How We Use Personal Information

    We process personal information only for specified, explicit, and legitimate purposes. The primary purposes include:

    • Service Delivery: Delivering, managing, and improving our GRC advisory, consulting, and compliance services.
    • Client Relationship Management: Onboarding clients, maintaining client records, and managing ongoing advisory relationships.
    • Communication: Responding to enquiries, providing project updates, and conducting professional correspondence.
    • Business Development: Identifying and pursuing legitimate business opportunities with prospective clients and partners.
    • Thought Leadership and Marketing: Sending industry insights, regulatory updates, event invitations, and other relevant communications — subject to applicable consent requirements.
    • Legal and Regulatory Compliance: Meeting our obligations under applicable law, including anti-money laundering (AML), Know Your Client (KYC), and conflict-of-interest checks.
    • Risk and Security Management: Protecting our systems, data, and the interests of our clients and stakeholders.

    5. Legal Basis for Processing

    Depending on the applicable jurisdiction and the nature of the processing activity, we rely on one or more of the following legal bases:

    • Contract Performance: Processing is necessary for the performance of a contract with you or to take pre-contractual steps at your request.
    • Legal Obligation: Processing is required to comply with a legal or regulatory obligation applicable to GRCK.
    • Legitimate Interests: Processing is necessary for our legitimate business interests, provided these are not overridden by your rights and interests.
    • Consent: Where required by law, we will obtain your express, freely given, and informed consent before processing your data.

    6. Disclosure and Sharing of Personal Information

    GRCK does not sell, rent, or trade personal information. We may share personal information in the following limited circumstances:

    • Service Providers and Processors: We engage third-party service providers who process personal data on our behalf, strictly under our instruction and subject to appropriate data processing agreements.
    • Professional Advisors: We may share information with our legal counsel, auditors, insurers, and financial advisors as required for the proper administration of our professional practice, subject to confidentiality obligations.
    • Regulatory and Law Enforcement Authorities: We may disclose personal information where required by law, court order, regulatory mandate, or government authority.
    • Business Transfers: In the event of a merger, acquisition, or restructuring of GRCK, personal information may be transferred to the relevant successor entity.

    7. International Data Transfers

    As a global advisory firm, we may transfer personal information across international borders in the course of delivering our services. Where such transfers occur, we implement appropriate safeguards as required by applicable law, including Standard Contractual Clauses (SCCs), Adequacy decisions, and Data transfer agreements.

    8. Cookies and Similar Technologies

    Our website (www.grckco.com) uses cookies and similar tracking technologies to enhance your browsing experience and to analyse website performance. We use Strictly Necessary Cookies, Performance and Analytics Cookies, Functional Cookies, and Marketing Cookies.

    9. Data Retention

    We retain personal information only for as long as necessary to fulfil the purposes for which it was collected. As a general guide, client engagement records are retained for a minimum of seven (7) years following the conclusion of an engagement, in line with professional standards and applicable regulatory requirements.

    10. Your Privacy Rights

    Depending on your jurisdiction, you may have one or more of the following rights in respect of your personal information:

    • Right of access to personal data held about you.
    • Right to rectification/correction of inaccurate or outdated personal data.
    • Right to erasure ('Right to be Forgotten') or deletion, subject to applicable legal bases.
    • Right to restrict or object to processing.
    • Right to data portability.
    • Right to withdraw consent at any time.
    • Right to lodge a complaint with your relevant supervisory authority.

    11. Data Security

    GRCK implements robust organisational, administrative, and technical safeguards to protect personal information against unauthorised access, disclosure, alteration, loss, or destruction. Our security measures include encryption of data in transit and at rest, multi-factor authentication, and comprehensive information security policies aligned with ISO 27001 and NIST CSF principles.

    12. Children's Privacy

    Our services are directed exclusively to business professionals and organisations. We do not knowingly collect, use, or disclose personal information from individuals under the age of 18 (or the applicable age of majority in the relevant jurisdiction).

    13. Contact Information and Complaints

    If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Team:

    *This document is for informational purposes. For legal advice specific to your organisation, please consult qualified legal counsel.*

    Download Privacy Policy (PDF)