Grofar is a company registered in England and Wales under company number 09505988, whose registered address is at Walden House, Foxcombe Road, Boars Hill Oxford OX1 5DL.
Grofar Ltd is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, store, and share personal data in our role as a Data Controller, particularly for visitors to our website, sales and marketing communications, analytics, support services, financial operations, and other business-related activities. By using our services and visiting our website (www.grofar.com), you agree to the collection and use of information in accordance with this policy.
For details about how we process data on behalf of our customers (schools or colleges) as a data processor, please see our Data Protection and Sharing Policy.
We adhere to the following principles in accordance with the GDPR:
In line with our commitment to data protection by design and default, Grofar conducts Data Protection Impact Assessments (DPIAs) periodically and when implementing new technologies or where processing is likely to result in a high risk to the rights and freedoms of individuals. These assessments help us identify and minimise data protection risks at an early stage.
This Policy applies to the following individuals when we act as a Data Controller:
When you visit our website, we collect the following types of information in compliance with the General Data Protection Regulation (GDPR).
For more detailed information on how we use cookies and other tracking technologies on our website, please refer to our Cookies Policy.
| Data | Why | Legal Basis |
|---|---|---|
|
To fulfil or answer enquiries or requests from you regarding a demo and provide you with accurate and appropriate information about Grofar. |
Enable us to determine the suitability of potential opportunities and promote Grofar. |
|
Any information you include in any message to Grofar, either directly or via our contact form on our website |
Allows us to respond to any enquiries, feedback, concerns, or complaints from you and to improve the functionality and user experience of the website |
We use the information you provide to respond to your request and process your enquiries. |
|
Cookies |
To enhance user experience, analyse site usage, and provide personalised content. By using our website, you consent to the use of cookies as outlined in our cookie policy. |
We may use cookies for analytics and performance purposes, based on our legitimate interest in improving the functionality and content of the Grofar website. |
We collect personal information from individuals who express interest in receiving updates of our product and marketing communication, typically including but not limited to:
| Data | Why | Legal Basis |
|---|---|---|
|
To communicate with you about our products and services that may be of interest to you. |
Legitimate interest to provide information about our services to individuals who have expressed interest Consent, when you opt in to receive marketing communications. |
|
To tailor our marketing communications to your interests and preferences |
Legitimate interest to provide relevant information Consent for email marketing activities |
|
To understand your interests and provide relevant content |
Legitimate interest to improve our marketing effectiveness and provide valuable content |
|
To improve our products, services, and marketing activities |
Legitimate interest in business improvement |
Our marketing communications are also subject to the Privacy and Electronic Communications Regulations 2003 (PECR). We only send marketing communications to business email addresses where we have a legitimate interest in doing so, and we always include an unsubscribe link in our communications. You can opt out of receiving these communications at any time by:
We respect your choice and will process your opt-out request promptly.
We collect personal information from individuals who contact us for support, attend training, and webinars, including:
| Data | Why | Legal Basis |
|---|---|---|
|
To enable us to provide technical and user support |
Allows us to fulfil the terms set in the License Terms to support customers in using the Grofar platform. Contractual necessity to provide support services. |
|
To provide technical and user support |
Contractual necessity to provide support services |
|
Obtain views on education and how to improve our platform/service |
Allows us to fulfil the terms set in the service agreement and improve Grofar |
|
For training and professional development |
Legitimate interest in improving staff capabilities with the platform |
We collect personal information from our customers, including:
As the Data Controller, we store your data within our Customer Relationship Management (CRM) system. We may create and manage custom fields to record additional information relevant to our business relationship with you. This helps us provide more tailored and effective services to meet your specific needs. Any personal data added to these custom fields will be processed based on our legitimate business interests or contractual necessity, in accordance with this Privacy Policy and applicable data protection laws.
| Data | Why | Legal Basis | |
|---|---|---|---|
| School | College | ||
|
|
To identify and maintain records of educational establishments using our services |
Contractual necessity to provide services to the educational establishment |
| Financial History |
We retain financial records to comply with the requirements of HMRC, accounting regulations, and any other applicable UK laws and regulations. |
Legal interest to comply with HMRC, accounting regulations, and any other applicable UK laws and regulations. |
|
We collect personal data through various channels when acting as a Data Controller:
When you visit our website, we may collect certain personal data automatically using Google Analytics, cookies and other tracking technologies.
In cases where required, we obtain your consent for the collection of personal data, such as when you fill out forms, subscribe to newsletters, or interact with certain features of our website. You also have the option to manage your cookie preferences through your browser settings. For more detailed information on how we use cookies and other tracking technologies on our website, please refer to our Cookies Policy.
We collect personal data when you:
In some instances, we may receive your personal information from third parties, such as:
Grofar use third-party service providers for customer relationship management, support services, and customer communications.
Some of our third-party service providers may process personal data outside the United Kingdom. We are committed to ensuring that all international transfers of personal data comply with UK GDPR requirements and that appropriate safeguards are implemented to protect your data.
In the event of a personal data breach, Grofar has established comprehensive procedures for responding promptly and effectively. We will notify affected individuals and the relevant supervisory authority (such as the ICO) without undue delay when legally required to do so, and where feasible, within 72 hours of becoming aware of the breach.
Our data breach notification will include:
We retain financial records to comply with the requirements of HMRC, accounting regulations, and any other applicable UK laws and regulations.
Once the retention period has expired, the data is no longer needed for the specified purposes, or a deletion request is submitted, we will securely delete the data.
Grofar engages trusted third-party service providers who may process personal data on our behalf. All service providers are bound by data processing agreements that ensure GDPR compliance. These providers fall into the following categories:
We ensure all third-party providers maintain appropriate technical and organisational measures to protect personal data in accordance with GDPR requirements and ICO guidance.
Grofar Ltd uses cookies to enhance user experience and ensure proper functioning of our platform. For more detailed information on the specific cookies we use, their purpose, and how to manage them, please refer to our full Cookies Policy.
As a Data Controller, we are responsible for responding directly to requests from individuals (data subjects) regarding their personal data. The following are the rights that individuals have regarding their personal data under the GDPR:
You have the right to:
You have the right to request correction of any inaccurate or incomplete personal data we hold about you. We will update your data promptly upon receiving a verifiable request.
Under certain circumstances, you may request the erasure of your personal data. We will comply with erasure requests unless we have a legal basis for retaining the data, such as a legal obligation or the need to establish, exercise, or defend legal claims.
Circumstances in which this right may apply include:
You have the right to request the restriction of the processing of your personal data under certain conditions. If you believe that your data is being processed incorrectly, you can request that we temporarily restrict processing.
Restrictions may apply if:
You have the right to request a copy of your personal data in a structured, commonly used, and machine-readable format. You can also request that we transfer this data to another Data Controller, if technically feasible.
You have the right to object to the processing of your personal data, especially if the processing is based on legitimate interests or for direct marketing purposes. If you object to marketing, we will cease processing your data for marketing purposes immediately.
You have the right not to be subject to automated decision-making, including profiling, that has legal effects or similarly significantly affects you. If this is the case, you can request human intervention in the decision-making process.
If we are processing your personal data based on consent, you have the right to withdraw that consent at any time. This will not affect the legality of the processing before you withdrew your consent. To withdraw consent, please use the unsubscribe links in our communications or contact us directly.
To exercise any of these rights, please contact us using the details provided in the "How to contact us" section below. We will respond to your request without undue delay and at the latest within one month. This period may be extended by up to two additional months for complex requests. To protect your privacy and security, we may require verification of your identity before processing your request, typically through proof of identity documentation or account information. In most cases, requests are processed free of charge. However, we may charge a reasonable fee if your request is manifestly unfounded, excessive, or repetitive.
Grofar is committed to demonstrating compliance with UK GDPR and takes responsibility for protecting your personal data. We maintain comprehensive records of our data processing activities and regularly review our data protection practices to ensure ongoing compliance.
Our Data Protection Officer is Lucy Coombs, who oversees our data protection compliance and can be contacted at dataprotection@grofar.com for any data protection matters.
To exercise your rights under the GDPR or for any questions about this Privacy Policy, please contact us using the following details:
For data protection matters specifically, you can contact our Data Protection Officer on the email above.
If you believe that your rights have been violated or that we are not processing your personal data in compliance with the GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
The Office of the Information Commissioner,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
Tel: +44 (0) 01625 545 745
Website: www.ico.org.uk
We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.
Version: 2.0
This Policy has been approved and authorised by:
This policy is reviewed annually to ensure continued compliance with data protection regulations and to reflect any changes in our data processing practices.