Privacy Statement

1. Introduction

This Privacy Statement explains how Airetris GRC ("we", "us", "our") collects, uses, discloses and protects personal data when you visit www.airetrisgrc.com, engage our governance, risk and compliance (GRC) advisory services, or otherwise interact with us.

As a GRC consultancy, we advise clients on their own regulatory and data protection obligations. We hold ourselves to the standards we advise on, and this statement is written to reflect that.

2. Scope — who this applies to

This statement applies to everyone who interacts with us, wherever you are located.

Rather than apply different standards in different countries, we have chosen to adopt the GDPR as our global baseline. This means we extend the protections and rights described below to all individuals as a matter of policy, regardless of where you live — even where your local law would require less of us.

3. Who is responsible for your data

Airetris GRC is the data controller in respect of the personal data described here.

• All privacy enquiries and requests: privacy@airetrisgrc.com

When we act as a processor instead

The above applies to data we control — for example, data about our own website visitors, enquiries, business contacts and candidates.

During a client engagement, the position is often different. Where we handle personal data contained in a client's systems, records or investigations in order to deliver GRC services on that client's instructions, our client remains the controller and Airetris GRC acts as a processor. In those cases, the client's own privacy notice governs that data, and we process it only under a written agreement with that client. If you are an employee, customer or third party of one of our clients and want to exercise your rights over that data, please contact that organization directly, or contact us at privacy@airetrisgrc.com and we will refer you.

4. The personal data we collect

Depending on how you interact with us, we may collect:

• Identity and contact data — name, job title, employer, business email, phone number, postal address.
• Client and engagement data — information you provide in the course of a GRC engagement, including correspondence, policies, registers, audit and assessment records, and any personal data contained within materials you share with us.
• Enquiry and marketing data — details submitted through contact forms, event registrations, newsletter sign-ups and your communication preferences.
• Technical and usage data — IP address, browser type, device information, pages viewed and other data collected via cookies and similar technologies (see Section 9).

In our own capacity as controller, we generally collect personal data about business contacts rather than special categories of data.

Sensitive data in engagements. GRC work can involve material that goes further — for example internal investigations, whistleblowing reports, conduct and disciplinary matters, sanctions or anti-money-laundering screening, and audit findings naming individuals. This may include sensitive personal data, or data relating to alleged misconduct or offences, to which the GDPR affords additional protection. Where an engagement involves such data, we handle it under the client's instructions as processor (see Section 3), on the basis of a written agreement, with access restricted to the personnel delivering that engagement.

5. How we collect personal data

We collect data: directly from you; from your organization in the context of an engagement; from publicly available sources and business directories; from referrals; and automatically through our website (see cookies).

6. Why we use your data and our legal basis

Where we rely on legitimate interests, our interest is in operating and growing a professional GRC advisory practice; we balance this against your rights. You may object at any time (Section 11).

7. Marketing

We will only send marketing communications where permitted. Where required, we obtain your consent, and you can opt out at any time using the unsubscribe link in any email or by contacting privacy@airetrisgrc.com.

8. Disclosure and sharing

We may share personal data with:

• service providers (IT hosting, CRM, email, analytics, professional advisers) acting on our instructions;
• our group companies and sub-contractors supporting an engagement;
• authorities, regulators or courts where required by law; and
• parties to a corporate transaction (e.g. merger or acquisition).

We require our service providers to protect personal data under written agreements, and to act only on our instructions. We do not sell your personal data.

9. Cookies and consent

Our website uses strictly necessary cookies to function. We use analytics and other non-essential cookies only with your consent, which we request through a consent banner when you first visit. Non-essential cookies are switched off by default and are not set until you opt in.

You can withdraw or change your consent at any time by clicking "Cookie settings" at the bottom of any page. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

10. International transfers

Because we operate globally, your personal data may be transferred to, or accessed from, countries other than your own.

Where personal data is transferred to a country not formally recognized as providing equivalent protection, we put appropriate safeguards in place — typically approved standard contractual terms, together with additional measures where needed. We apply the same safeguards to all users' data, regardless of where you are located. You may request details of these safeguards by contacting privacy@airetrisgrc.com.

11. Your rights

We extend the following GDPR rights to users. You have the right to:

• access the personal data we hold about you;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances;
• restriction of our processing;
• data portability — receive your data in a portable format;
• object to processing, including profiling and direct marketing; and
• withdraw consent at any time, without affecting processing carried out beforehand.

To exercise any right, contact privacy@airetrisgrc.com. We may need to verify your identity. These rights are not absolute and may be subject to legal exemptions.

12. Complaints

If you have concerns, please contact us first at privacy@airetrisgrc.com.

You also have the right to lodge a complaint with a data protection authority — in the EEA, the authority where you live or work; elsewhere, your local regulator where one exists.

13. How long we keep data

We retain personal data only as long as necessary for the purposes above and to meet legal, tax and professional-record requirements, after which it is securely deleted or anonymized.

14. Data security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss or misuse. No transmission over the internet is completely secure, so we cannot guarantee absolute security.

15. Children

Our website and services are directed at businesses and professionals and are not intended for children. We do not knowingly collect data from children.

16. Changes to this statement

We may update this Privacy Statement from time to time. The current version, with its effective date, will always be available on our website.

17. Contact

Questions about this statement or your personal data: privacy@airetrisgrc.com