How we collect, use and protect your information.
On this page
Vigilant Risk Manager Ltd takes your privacy seriously. This Privacy Policy explains how we collect, use, share, and protect your personal data when you visit our website at vigilantgrc.com, use our cloud-based risk management platform (the "Platform"), or interact with us in any other way. Please read this policy carefully before using our services.
This policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). If you are located in the European Economic Area, please note that our services are currently directed at UK-based organisations; we will notify you of any specific EU adequacy or transfer arrangements relevant to your jurisdiction.
Vigilant Risk Manager Ltd ("VigilantGRC", "we", "us", or "our") is a private limited company registered in England and Wales. We are the data controller responsible for personal data collected through our website and Platform, meaning we determine the purposes and means of processing your personal data.
| Company name | Vigilant Risk Manager Ltd |
| Registered address | United Kingdom |
| ICO registration | Registered with the Information Commissioner's Office |
| Data protection contact | privacy@vigilantgrc.com |
Where we process personal data on behalf of our business customers (for example, data uploaded to the Platform by your organisation), we act as a data processor. In those cases, our processing is governed by a separate Data Processing Agreement (DPA) with your organisation as the data controller.
We collect personal data in the following ways: directly from you when you fill in forms, request a demo, or contact us; automatically through your use of our website and Platform; and from third parties such as business intelligence providers or referral partners. The categories of data we process include:
| Category | Examples | How collected |
|---|---|---|
| Identity data | First and last name, job title, professional role | You (registration, forms) |
| Contact data | Work email address, telephone number, company name, postal address | You (forms, contracts) |
| Account credentials | Username, encrypted password, multi-factor authentication settings | You (account creation) |
| Usage data | Pages visited, features used, session duration, click paths, error logs | Automatically (analytics) |
| Technical data | IP address, browser type and version, operating system, device type, time zone | Automatically (server logs) |
| Communications data | Content of emails, support tickets, and live chat messages you send us | You (correspondence) |
| Marketing preferences | Email opt-in/out status, communication preferences, campaign interaction records | You (opt-in) and inferred |
| Financial data | Invoice details, VAT number, payment method type (not card numbers — those are held by our payment processor) | You (billing) |
| Risk register content | Data uploaded to the Platform by users in connection with risk, audit, or compliance workflows | You (Platform use) |
We do not intentionally collect special category data (such as health, biometric, or religious data) through our website or Platform. If you believe any such data has been submitted inadvertently, please contact us immediately so we can delete it.
We do not knowingly collect or process personal data from individuals under the age of 18. Our Platform and website are directed at business professionals. If you believe a minor has provided us with personal data, please contact us.
We use your personal data only for the purposes described below. We will not use your data for any purpose that is incompatible with these stated purposes without notifying you first.
We always identify a lawful basis before processing your personal data. The applicable basis depends on the specific purpose:
Performance of a contract
UK GDPR Art. 6(1)(b) — processing necessary to fulfil our subscription agreement with you, including providing Platform access, managing billing, and delivering support.
Legitimate interests
UK GDPR Art. 6(1)(f) — improving our services, preventing fraud and abuse, direct marketing to existing customers, and internal administration. We balance these interests against your rights.
Consent
UK GDPR Art. 6(1)(a) — where you have given clear, freely given consent, such as subscribing to our newsletter or agreeing to non-essential cookies. You may withdraw consent at any time.
Legal obligation
UK GDPR Art. 6(1)(c) — where processing is necessary to comply with UK law, including tax record-keeping under HMRC requirements, or responding to lawful regulatory requests.
We do not sell, rent, or trade your personal data to any third party. We may share your data with carefully selected third parties only where necessary for the purposes described in this policy:
| Recipient category | Purpose | Location |
|---|---|---|
| Cloud hosting providers | Secure infrastructure for Platform hosting and data storage | UK / EEA (e.g. Microsoft Azure) |
| CRM and marketing platforms | Managing customer relationships, sending email communications | UK / EEA or adequate countries |
| Analytics providers | Understanding website usage patterns (anonymised and aggregated) | UK / EEA |
| Payment processors | Securely processing subscription payments | UK (PCI-DSS compliant) |
| Customer support tools | Managing and resolving support tickets | UK / EEA or adequate countries |
| Professional advisers | Legal, accounting, and audit services under strict confidentiality | UK |
| Regulators and authorities | Compliance with legal obligations, court orders, or regulatory requests | UK |
| Business acquirers | In the event of a merger, acquisition, or sale of assets, subject to equivalent protections | As applicable |
All third-party processors we engage are bound by written data processing agreements requiring them to process data only on our instructions, maintain appropriate security measures, and comply with UK GDPR. We carry out due diligence on all significant sub-processors before appointment and review these relationships annually.
We primarily store and process personal data within the United Kingdom and the European Economic Area. Where we transfer data to countries outside the UK that do not benefit from a UK adequacy decision, we ensure adequate protections are in place by using one or more of the following mechanisms:
You may request a copy of the relevant transfer mechanism by contacting us at privacy@vigilantgrc.com.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as required by UK GDPR Article 34. We will also report qualifying breaches to the ICO within 72 hours.
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are:
| Data type | Retention period | Basis |
|---|---|---|
| Customer account and contract records | Duration of contract + 7 years | Legal obligation (Companies Act / HMRC) |
| Platform user data | For the duration of active subscription; 30 days post-termination for export, then deleted | Contract |
| Prospect and lead contact data | Up to 2 years from last engagement or until opt-out | Legitimate interests / Consent |
| Marketing consent records | Until consent is withdrawn, then archived for 3 years as evidence | Legal obligation (PECR) |
| Support correspondence | 2 years from case closure | Legitimate interests |
| Website analytics data | Up to 26 months in aggregated form | Legitimate interests |
| Server and access logs | 90 days | Security / Legitimate interests |
| Financial and invoice records | 7 years | Legal obligation (HMRC) |
At the end of each retention period, personal data is securely deleted or anonymised. Where we anonymise data, the resulting data is no longer personal data and may be retained indefinitely for statistical purposes.
We do not use your personal data to make decisions about you using solely automated means that produce legal or similarly significant effects. Any automated processing we carry out (for example, lead scoring for sales prioritisation) involves human review before any significant action is taken and does not produce legally binding outcomes for you.
If this position changes, we will update this policy and, where required, seek your explicit consent in advance.
Under UK GDPR, you have the following rights in relation to your personal data. We will respond to all valid requests within one calendar month (which may be extended by a further two months for complex requests, with notification):
To exercise any of these rights, submit a written request to privacy@vigilantgrc.com. We may ask you to verify your identity before processing your request. Your request is free of charge. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority, at 0303 123 1113 or online at ico.org.uk.
We use cookies and similar tracking technologies on our website and Platform. For full details of the cookies we use and how to control them, please read our Cookie Policy.
If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your data, please contact our Data Protection team:
Vigilant Risk Manager Ltd, United Kingdom
We aim to respond within 30 days. For complex requests we will notify you within one month of any extension.
We review and update this Privacy Policy periodically to reflect changes in law, technology, or our business practices. When we make material changes, we will notify you by email or prominent notice on our website at least 14 days before the changes take effect. The version date at the top of this page indicates when it was last revised. We encourage you to review this policy regularly.