Compliance Management
Risk Management
Third Party Risk Management
Data Privacy Management
Internal Auditing
Business Continuity Management
Continuous Control Monitoring (CCM)
Trust Center
AI Governance
Privacy statement
1. Introduction
1.1 We, SureCloud Ltd, are a UK-headquartered provider of cloud-based Governance, Risk and Compliance (GRC) applications and cyber security services, including an AI-powered GRC platform. This Privacy Statement details how we collect and process personal data in the course of this business. It covers the personal data of:
- visitors to our website;
- customer and prospective customer personnel; and
- supplier and business partner personnel.
1.2 We use cookies and similar technologies on our website and application services. For more details, see: www.surecloud.com/cookies
2. The personal data that we collect
2.1 In this table, we have set out the general categories of personal data that we process and, in the case of personal data that we did not obtain directly from you, information about the source and specific categories of that data.
| Data category | What this data may include | Source of data |
|---|---|---|
| Contact and communication data: data enabling us to get in touch with you and information contained in or relating to communications with you. | Your name, email address, telephone number, postal address, company or employer name, and job title or role, the content of communication, attachments, notes of calls or meetings, and metadata associated with communications. | You and/or your employer and/or publicly-available professional sources; our website may generate metadata associated with communications made using contact forms. |
| Customer relationship data: information relating to our customer, prospect, supplier and business partner relationships, all stored in our CRM system. | Your name, the name of your business or employer, your job title or role, your contact details, your classification or categorisation within our customer relationship management systems, event registration details, records of requests for demos, newsletter preferences, survey responses, and information contained in or relating to communications between us and you, or between us and your employer. | You and/or your employer and/or publicly-available professional sources; our website may generate metadata associated with communications made using contact forms. |
| Event data: information relevant to attendance at meetings, seminars and other events. | Identification and background information, attendance information, access requirements and dietary requirements. Dietary information may include special category data, which may reveal information about your health, religion or philosophical beliefs. | You and/or your employer. |
| Usage data: data about your use of our website and application services. | Your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your use of our website and application services. | Our analytics tracking systems, application logs and website logs. |
2.2 Please let us know if the personal data that we hold about you needs to be corrected or updated.
3. Purposes of processing and legal bases
3.1 In this table we have set out the purposes for which we may process personal data and the legal bases of the processing.
| Purpose | Details | Legal bases |
|---|---|---|
| Operations | We may process your personal data for the purposes of operating our website, providing our services, administering contracts and business arrangements, processing and fulfilling orders, generating invoices and other payment-related documentation, credit control, customer onboarding, and enabling integrations of the SureCloud platform with third-party applications and services. | The legal basis for this processing is our legitimate interests, namely the proper administration of our website, services and business. |
| Relationships and communications | We may process contact and communication data and customer relationship data for the purposes of managing our relationships with customers, prospective customers, suppliers and business partners, communicating with you (excluding communicating for the purposes of direct marketing) by email, SMS, post and/or telephone, responding to enquiries, providing support services, handling complaints, assisting with technical problems relating to the website, collecting reviews and feedback, and updating you with changes to our terms, conditions and policies. | The legal basis for this processing is our legitimate interests, namely communications with our website visitors, customers, prospective customers, suppliers and business partners, the maintenance of our relationships, enabling the use of our website and services, and the proper administration of our website, services and business. |
| Direct marketing | We may process contact and communication data and customer relationship data for the purposes of creating, targeting and sending direct marketing communications by email, post and/or telephone in relation to our products, services, publications, newsletters, events and related business updates. | The legal basis for this processing is either consent (where consent has been requested and given) or our legitimate interests, namely promoting our business and communicating relevant marketing messages and offers to website users and business contacts. |
| Events | We may process customer relationship data and event data for the purpose of administering and managing meetings, webinars, conferences, marketing events and other business events, including handling registrations, attendance, logistics, access requirements, dietary requirements, related communications and follow-up. | The legal basis for this processing is our legitimate interests, namely organising and administering our events and related business activities appropriately and efficiently, and consent where this is required or relied upon, including in relation to dietary information or related special category personal data. However, to the extent that the data is special category data, the legal basis for processing shall be consent (under Article 6 of the GDPR) and explicit consent (under Article 9 of the GDPR). |
| Publications | We may publish your name and job title, included in our customer relationship data, for the purposes of publishing of case studies on our website and elsewhere through our services in accordance with your express instructions. | The legal basis for this processing is our legitimate interests, namely the publication of content in the ordinary course of our operations, and/or taking steps, at your request, to enter into such a contract, as applicable. |
| Research and analysis | We may process customer relationship data and usage data for the purposes of researching and analysing the use of our website and services, and analysing interactions with our business, including through reports and statistical analyses concerning website use, content access and geographic patterns of visits. | The legal basis for this processing is our legitimate interests, namely monitoring, supporting, improving and securing our website, services and business generally. |
3.2 In addition to the specific purposes detailed above, we may process any of your personal data for the following general purposes.
- Record keeping – We may process your personal data for the purposes of creating and maintaining our databases, back-up copies of our databases, audit trails, and our business records generally. The legal basis for this processing is our legitimate interests, namely ensuring that we have access to the information needed to properly and efficiently run our business in accordance with this Privacy Statement.
- Security – We may process your personal data for the purposes of security, the prevention and detection of fraud and other criminal activity, safeguarding our systems and services, and maintaining the integrity and resilience of our website, platforms and business operations. The legal basis of this processing is our legitimate interests, namely the protection of our website, services and business, and the protection of others.
- Insurance and risk management – We may process your personal data where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, and administering governance, risk and compliance processes within our business. The legal basis for this processing is our legitimate interests, namely the proper protection of our business against risks.
- Legal claims – We may process your personal data where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this processing is our legitimate interests, namely the protection and assertion of our legal rights, your legal rights and the legal rights of others.
- Legal compliance and vital interests – We may also process your personal data where such processing is necessary for compliance with a legal obligation to which we are subject or in order to protect your vital interests or the vital interests of another natural person.
4. Providing your personal data to others
4.1 We may disclose your personal data to other companies that are under common ownership or control with SureCloud, insofar as reasonably necessary for the purposes, and on the legal bases, set out in this Privacy Statement.
4.2 We may disclose your personal data to our insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or establishing, exercising or defending legal claims.
4.3 We may share personal data with our hosting providers, infrastructure providers, payment service providers, and other suppliers and service providers as reasonably necessary to operate our website, application services and business. Further information about such recipients is set out on our dedicated third-party processor page at www.trust.surecloud.io.
4.4 In addition to the specific disclosures of personal data set out in this Section 4, we may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. We may also disclose your personal data where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.
5. International transfers of your personal data
5.1 In this Section 5, we provide information about the circumstances in which your personal data may be transferred to a third country under UK and/or EU data protection law.
5.2 We may transfer your personal data between the UK and the EEA and process that personal data in the UK and/or the EEA for the purposes set out in this Privacy Statement and may permit our suppliers and subcontractors to do so, to the extent permitted under applicable data protection law.
5.3 Personal data may be transferred to our hosting providers, infrastructure providers, suppliers and subcontractors in the UK, the EEA and United States and other jurisdictions, subject to appropriate safeguards where required under applicable law. Further information about specific recipients and locations is set out on our dedicated third-party processor page at www.trust.surecloud.io.
5.4 You may contact us using the details in Section 11 for a copy of, or further information about, the safeguards we use for international transfers of your personal data.
6. Retaining and deleting personal data
6.1 Personal data that we process for any purpose, or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6.2 Our standard data retention periods are set out in the table below.
| Data category | Duration |
|---|---|
| Contact and communications data | Minimum: 12 months following the date of the most recent contact between you and us. Maximum: 7 years following that date. |
| Customer relationship data | Minimum: 6 years following the date of termination of the relevant customer, prospect, supplier or business partner relationship. Maximum: 7 years following that date. If you grant to us a licence to publish any of your personal data, we may continue to retain and publish that personal data after the end of the relevant retention period specified in this table in accordance with the applicable licence terms, subject always to your data subject rights. |
| Event data | Minimum: 6 years following the end of the relevant event. Maximum: 7 years following that date. Special category data shall be deleted promptly after the event unless there is a specific reason to retain it for longer. |
| Usage data | 50 months following the date of collection, subject to any shorter retention period that applies to the relevant analytics service. |
6.3 Notwithstanding the other provisions of this Section 6, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person, or for the establishment, exercise or defence of legal claims.
7. Your rights
7.1 In this Section 7, we have listed the rights that you have under data protection law.
7.2 Your principal rights under data protection law are:
- the right to access – you can ask for copies of your personal data;
- the right to rectification – you can ask us to rectify inaccurate personal data and to complete incomplete personal data;
- the right to erasure – you can ask us to erase your personal data;
- the right to restrict processing – you can ask us to restrict the processing of your personal data;
- the right to object to processing – you can object to the processing of your personal data;
- the right to data portability – you can ask that we transfer your personal data to another organisation or to you;
- the right to complain to us or to a supervisory authority – you can complain about our processing of your personal data; and
- the right to withdraw consent – to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent.
7.3 These rights are subject to certain limitations and exceptions. You can learn more about the rights of data subjects by visiting the ICO's guide to individual rights.
7.4 You may lodge a complaint with us, by writing to the address below, or with the Information Commissioner's Office, following the procedures set out on the ICO's website.
7.5 You may exercise your other rights in relation to your personal data by written notice to us, using the contact details set out below.
8. Third-party websites
8.1 Our website includes hyperlinks to, and details of, third-party websites and services.
8.2 In general, we have no control over, and are not responsible for, the privacy policies and practices of third parties.
9. Acting as a processor
9.1 This Privacy Statement applies where we are acting as a data controller with respect to the personal data of such persons; in other words, where we determine the purposes and means of the processing of that personal data.
9.2 In relation to certain personal data processed through our cloud-based Governance, Risk and Compliance applications and related services, we act as a processor on behalf of our customers rather than as a controller.
9.3 Gracie AI is embedded within the SureCloud platform but does not process personal data in respect of which SureCloud acts as a controller under this Privacy Statement. Any Gracie-related processing of customer data is carried out by SureCloud solely as a processor and is addressed separately in customer contractual documentation and data processing arrangements. This Privacy Statement does not apply to such processor activities.
9.4 Where we act as a processor, the relevant customer or other client is responsible for providing appropriate privacy information to data subjects and for determining the lawful basis of processing.
10. Amendments
10.1 We may update this Privacy Statement from time to time in response to changing legal, technical or business developments.
10.2 The most current version will be made available on our website and, where appropriate, we may draw material changes to your attention by email or other suitable communication method.
11. Our details
11.1 This website is owned and operated by SureCloud Ltd. We are registered in England and Wales under company registration number 05703655. Our registered office and principal place of business is 1 Sherwood Street, London, England, W1F 7BL.
11.2 You can contact us by email at privacy@surecloud.com.
11.3 Our data protection registration is ZA100632.
11.4 Matthew Davies (Chief Product Officer, Data Protection Officer), matthew.davies@surecloud.com
