Grofar is a company registered in England and Wales under company number 09505988, whose registered address is at Walden House, Foxcombe Road, Boars Hill, Oxford, OX1 5DL.
Grofar Ltd is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, store, and share personal data in our role as a Data Controller, particularly for visitors to our website, sales and marketing communications, analytics, support services, financial operations, and other business-related activities. It reflects our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
For details about how we process data on behalf of our customers (schools or colleges) as a data processor, please see our Data Protection and Sharing Policy.
We adhere to the following principles in accordance with UK GDPR:
In line with our commitment to data protection by design and default, Grofar conducts Data Protection Impact Assessments (DPIAs) when implementing new technologies or where processing is likely to result in a high risk to the rights and freedoms of individuals. We also review our data protection risks on an ongoing basis. These assessments help us identify and minimise data protection risks at an early stage.
This Policy applies to the following individuals when we act as a Data Controller:
When you visit our website, we collect the following types of information in accordance with UK GDPR.
For more detailed information on how we use cookies and other tracking technologies on our website, please refer to our Cookies Policy.
| Data | Why | Legal Basis |
|---|---|---|
|
To fulfil or answer enquiries or requests from you regarding a demo and provide you with accurate and appropriate information about Grofar. |
Legitimate interests: responding to sales enquiries and promoting Grofar's services to prospective customers. |
|
Any information you include in any message to Grofar, either directly or via our contact form on our website |
Allows us to respond to any enquiries, feedback, concerns, or complaints from you and to improve the functionality and user experience of the website. |
Legitimate interests: responding to enquiries and improving our website and services. |
|
Cookies |
To enhance user experience, analyse site usage, and provide personalised content. Where cookies are non-essential, we obtain your consent before placing them, as required by the Privacy and Electronic Communications Regulations 2003 (PECR). You can manage your preferences via the Cookie Widget on our website. |
Consent (PECR): for non-essential cookies, including analytics. Strictly necessary cookies are exempt from consent requirements under PECR Regulation 6. |
We collect personal information from individuals who express interest in receiving updates of our product and marketing communications, typically including but not limited to:
| Data | Why | Legal Basis |
|---|---|---|
|
To communicate with you about our products and services that may be of interest to you. |
Legitimate interests to provide information about our services to individuals who have expressed interest. Consent, when you opt in to receive marketing communications. |
|
To tailor our marketing communications to your interests and preferences. |
Legitimate interests to provide relevant information. Consent for email marketing activities. |
|
To understand your interests and provide relevant content. |
Legitimate interests to improve our marketing effectiveness and provide valuable content. |
|
To improve our products, services, and marketing activities. |
Legitimate interests in business improvement. |
Our marketing communications are also subject to the Privacy and Electronic Communications Regulations 2003 (PECR). We only send marketing communications to business email addresses where we have a legitimate interest in doing so, and we always include an unsubscribe link in our communications. You can opt out of receiving these communications at any time by:
We respect your choice and will process your opt-out request promptly.
We collect personal information from individuals who contact us for support, attend training, and webinars, including:
The following applies where your organisation holds a licence with Grofar.
| Data | Why | Legal Basis |
|---|---|---|
|
To enable us to provide technical and user support. |
Contractual necessity: processing is required to perform our agreement with you and provide the support services you are entitled to. |
|
To provide technical and user support. |
Contractual necessity: processing is required to perform our agreement with you. |
|
Obtain views on education and how to improve our platform/service. |
Legitimate interests: improving our platform and services based on customer feedback. |
|
For training and professional development. |
Legitimate interests: supporting customers in making effective use of the platform and improving our training offering. |
We collect personal information from our customers, including:
The following applies where your organisation holds a licence with Grofar.
As the Data Controller, we store your data within our Customer Relationship Management (CRM) system. We may create and manage custom fields to record additional information relevant to our business relationship with you. This helps us provide more tailored and effective services to meet your specific needs. Any personal data added to these custom fields will be processed based on our legitimate business interests or contractual necessity, in accordance with this Privacy Policy and applicable data protection laws.
| Data | Why | Legal Basis |
|---|---|---|
|
Organisation name, website, staff job titles and roles of key contacts, contact email addresses, telephone numbers, and business addresses |
To identify and maintain records of educational establishments using our services. |
Contractual necessity: processing is required to manage and perform our agreement with your institution. |
|
Financial History |
We retain financial records to comply with the requirements of HMRC, accounting regulations, and any other applicable UK laws and regulations. |
Legal obligation: we are required to retain financial records to comply with HMRC requirements and applicable UK accounting regulations. |
For information about data processed within the Grofar platform on behalf of your institution, please refer to our Data Protection and Sharing Policy.
We collect personal data through various channels when acting as a Data Controller:
When you visit our website, we may collect certain personal data automatically using Google Analytics, cookies and other tracking technologies.
In cases where required, we obtain your consent for the collection of personal data, such as when you fill out forms, subscribe to newsletters, or interact with certain features of our website. You also have the option to manage your cookie preferences through your browser settings. For more detailed information on how we use cookies and other tracking technologies on our website, please refer to our Cookies Policy.
We collect personal data when you:
In some instances, we may receive your personal information from third parties, such as:
Personal data we hold as Data Controller is stored with trusted third-party service providers. Where providers process data outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with UK GDPR. For information about data storage in our role as Data Processor, please refer to our Data Protection and Sharing Policy.
Some of our third-party service providers may process personal data outside the United Kingdom. We are committed to ensuring that all international transfers of personal data comply with UK GDPR requirements and that appropriate safeguards are implemented to protect your data.
In the event of a personal data breach, Grofar has established comprehensive procedures for responding promptly and effectively. We will notify the relevant supervisory authority, such as the ICO, without undue delay and, where feasible, within 72 hours of becoming aware of a reportable breach. Where a breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay.
Our data breach notification will include:
We retain financial records to comply with the requirements of HMRC, accounting regulations, and any other applicable UK laws and regulations.
Once the retention period has expired, the data is no longer needed for the specified purposes, or a deletion request is submitted, we will securely delete the data.
Grofar engages trusted third-party service providers who may process personal data on our behalf. All service providers are bound by data processing agreements that ensure UK GDPR compliance. These providers fall into the following categories:
We ensure all third-party providers maintain appropriate technical and organisational measures to protect personal data in accordance with UK GDPR requirements and ICO guidance.
Grofar Ltd uses cookies to enhance user experience and ensure proper functioning of our website. For more detailed information on the specific cookies we use, their purpose, and how to manage them, please refer to our full Cookies Policy.
As a Data Controller, we are responsible for responding directly to requests from individuals (data subjects) regarding their personal data. The following are the rights that individuals have regarding their personal data under UK GDPR:
You have the right to:
You have the right to request correction of any inaccurate or incomplete personal data we hold about you. We will update your data promptly upon receiving a verifiable request.
Under certain circumstances, you may request the erasure of your personal data. We will comply with erasure requests unless we have a legal basis for retaining the data, such as a legal obligation or the need to establish, exercise, or defend legal claims.
Circumstances in which this right may apply include:
You have the right to request the restriction of the processing of your personal data under certain conditions. If you believe that your data is being processed incorrectly, you can request that we temporarily restrict processing.
Restrictions may apply if:
Where processing is based on your consent or on a contract with you, you have the right to request a copy of personal data you have provided to us in a structured, commonly used, and machine-readable format. You may also request that we transfer this data directly to another Data Controller, where technically feasible.
You have the right to object to the processing of your personal data, especially if the processing is based on legitimate interests or for direct marketing purposes. If you object to marketing, we will cease processing your data for marketing purposes immediately.
You have rights in relation to solely automated decision-making that produces legal or similarly significant effects. Where this applies, you have the right to receive information about the decision, to request human intervention, to make representations, and to contest the decision.
If we are processing your personal data based on consent, you have the right to withdraw that consent at any time. This will not affect the legality of the processing before you withdrew your consent. To withdraw consent, please use the unsubscribe links in our communications or contact us directly.
To exercise any of these rights, please contact us at dataprotection@grofar.com. We will respond to your request without undue delay and at the latest within one month. Under the Data (Use and Access) Act 2025, where a request is complex, or we receive multiple requests from you, we may extend this period by up to two additional months, and we will notify you if this applies. In responding to any subject access request, we will conduct a reasonable and proportionate search of the information we hold.
To protect your privacy and security, we may require verification of your identity before processing your request, typically through proof of identity documentation or account information. In most cases, requests are processed free of charge. However, we may charge a reasonable fee if your request is manifestly unfounded, excessive, or repetitive.
Grofar is committed to demonstrating compliance with UK GDPR and takes responsibility for protecting your personal data. We maintain comprehensive records of our data processing activities and regularly review our data protection practices to ensure ongoing compliance.
For data protection matters, please contact us at dataprotection@grofar.com.
If you believe that your rights have been violated or that we are not processing your personal data in compliance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
The Office of the Information Commissioner,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk
Under the Data (Use and Access) Act 2025, you have the right to make a data protection complaint directly to us. Please contact us in the first instance at dataprotection@grofar.com and we will acknowledge your complaint promptly, investigate it, and inform you of the outcome without undue delay. If you remain dissatisfied, you retain the right to lodge a complaint with the Information Commissioner's Office (ICO).
Version: 3.0
This Policy has been approved and authorised by:
This policy is reviewed annually to ensure continued compliance with data protection regulations and to reflect any changes in our data processing practices.