GRC Portal Privacy Policy

GRC Portal respects the privacy of individuals and organisations that interact with our website and services.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable data protection requirements.

For purposes of POPIA, the entity operating GRC Portal will act as the responsible party where it determines the purpose and means of processing. The operating legal entity details will be published below once formally configured.

Service

GRC Portal

Operated by

Not yet published

Registration number

Not yet published

Business address

Not yet published

Privacy contact

Not yet published

Information Officer

Not yet published

Information Officer email

Not yet published

Contact GRC Portal

Website and enquiry information

Name, surname, organisation, job title, work email, telephone number, organisation size, industry, country, preferred contact method, package interest, enquiry content and the page from which an enquiry was made.

Account information

Name, business email, organisation membership, assigned roles, account status and authentication-related information. Passwords are handled by the authentication service and are not stored in plain text by GRC Portal.

Platform activity information

Login and activity records, timestamps, administrative actions, assignments, comments, report activity and audit history where generated through normal platform use.

Technical information

Authentication/session data, browser or device information and security or error logs may be processed by the platform and its infrastructure providers during normal operation. The application records an IP address and user-agent for certain privileged administrative actions.

Client-provided content

Authorised users may provide policies, procedures, evidence, assessment responses, findings, risks, reports, operator or vendor information, governance contact details and supporting documents. Clients are responsible for ensuring that uploaded information is lawful, relevant and appropriate.

Information may be collected directly from you; when you submit an enquiry; when an account is created or invited; when you use the platform; when documents or evidence are uploaded; through normal security and technical logging; and through essential cookies or browser storage.

An organisation may also provide your details to create or administer an authorised business account. In that case, the organisation should ensure it is permitted to provide the information and has given any notice required by law.

We may process personal information to respond to enquiries; prepare quotations; provision client workspaces; create and manage accounts; authenticate users; manage roles and access; deliver and support the service; administer customer relationships; maintain audit trails; protect the platform; investigate incidents; improve reliability and performance; fulfil contracts; meet legal duties; and send service-related communications.

We process personal information lawfully and reasonably, and only where there is an appropriate basis under applicable law. Depending on the circumstances, this may include consent where appropriate, concluding or performing a contract, complying with a legal obligation, protecting a data subject's legitimate interests, or pursuing the legitimate interests of GRC Portal or a third party where permitted.

We aim to collect only personal information that is adequate, relevant and reasonably necessary for the purpose for which it is processed. Optional enquiry fields are not required to submit a request.

Personal information is used for the stated purpose, compatible related purposes, or other purposes permitted by law. Enquiry details are not silently repurposed as consent to unrelated electronic marketing.

Information may be shared with authorised hosting, infrastructure, authentication, storage, email, communications, security, support, AI technology and professional service providers where necessary to operate the service. Providers are expected to process information subject to appropriate confidentiality, security and contractual obligations.

Specific providers may change as the service evolves. GRC Portal does not sell personal information.

GRC Portal is the responsible party for personal information used for its own website, enquiries, account administration and business operations.

Where a client uses GRC Portal to process information for its own governance, risk or compliance purposes, the client generally determines why that information is processed. The client may then act as the responsible party and GRC Portal may process information as an operator on the client's instructions, subject to applicable contractual and security arrangements.

GRC Portal maintains reasonable technical and organisational safeguards intended to protect personal information against loss, damage, unauthorised destruction, unlawful access, unauthorised processing, disclosure and alteration.

Implemented safeguards include authenticated access, role-based permissions, organisation-level separation enforced in the data layer, private storage controls for client evidence and logos, and audit trails for material administrative and platform actions. No internet service can guarantee absolute security.

Access to client information is restricted according to organisation membership, roles and permissions. Authorised client administrators control access within their organisation, subject to platform rules.

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, or where retention is required or permitted by law, contract or legitimate business requirements. Fixed public retention periods have not yet been adopted.

After the applicable period, information may be securely deleted, destroyed or de-identified. Client content may also be governed by contractual instructions and legal hold requirements.

We take reasonable steps to keep personal information complete, accurate, not misleading and updated where necessary. Authorised users can update appropriate information in the platform, or request a correction through the Contact page.

Subject to applicable law, you may request confirmation of whether we hold your personal information, access to it, correction of inaccurate information, deletion or destruction where permitted, objection to certain processing, or withdrawal of consent where processing relies on consent.

Submit a request through Contact Us or email Not yet published. We may need to verify your identity and authority before responding. For client-controlled information, we may direct the request to the relevant client.

If you have concerns about how we process personal information, please contact us first through our Contact page.

You may also lodge a complaint with Information Regulator (South Africa). Complaint email: Not yet published. Telephone: Not yet published.

The platform uses service providers whose infrastructure or support operations may involve access to or processing of information outside South Africa. The exact hosting and support locations depend on current provider configuration and are not represented as South Africa-only.

Where personal information is transferred across borders, GRC Portal will manage the transfer in accordance with applicable legal requirements and relevant contractual safeguards.

The current public website does not use advertising or analytics cookies. Essential authentication/session storage supports sign-in, and an interface-preference cookie remembers whether the signed-in navigation panel is open. These are used to provide requested functionality.

If non-essential analytics or marketing technology is introduced, this notice and the consent controls will be updated. See the Cookie Policy.

A general enquiry is not treated as unlimited consent to electronic direct marketing. Service and enquiry communications are kept distinct from marketing. If optional marketing is introduced, individuals will be given a separate choice and a practical way to opt out.

Our public website and account services are intended for business users and are not directed at children. Client-uploaded content may concern children where relevant to a client's lawful compliance activities; in those circumstances the client remains responsible for the purpose and lawfulness of that processing.

Certain subscribed features may use AI or large-language-model technology to analyse assessment, risk or governance information. AI output supports human decision-making and is not an automatic legal determination, compliance certification or substitute for professional advice.

Access is controlled through organisation settings, permissions and subscribed features. Users should not include unnecessary personal information in material submitted for analysis. Information required for an analysis may be processed by an external AI technology provider subject to applicable privacy and contractual safeguards. AI-generated reporting content is subject to human review and approval before formal use.

Suspected compromises of personal information will be investigated and handled in accordance with applicable legal and contractual requirements, including notification where required.

Our website may link to third-party websites. Their handling of personal information is governed by their own privacy policies, not this policy.

We may update this policy periodically to reflect changes in the service, law or processing practices. Material updates will be published on this page and the “Last updated” date will be revised.

If you have questions about this Privacy Policy, wish to exercise a privacy right, or have a concern about how your information is processed, please contact us.

Privacy email: Not yet published