Privacy Policy

Privacy contact

We have appointed an internal Data Protection Officer, our Chief Information Security Officer, to answer questions or concerns about how we handle personal information. You can contact them at privacy@grclens.net.

Personal information you give us

We collect personal information when you:

• Request a demonstration. You share contact details such as your name, email address and telephone number through the demo request form or by contacting us directly. We use them to respond to your request and for ongoing communication about it (legitimate interest). If you go on to acquire our products or services, we use your information to answer your questions about terms and to provide the product or service (contractual necessity).
• Correspond with us. If you contact us by email, post or another channel, we may keep that correspondence and use it to respond, to tell you about events, publications or services, or to keep a record of a complaint or request.
• Express interest in our products and services. We use your information to answer your questions about our products, services and website (legitimate interest).
• Subscribe to our publications or follow us on social media. By subscribing to news, articles, events or webinars you consent to receiving them by email. You can unsubscribe at any time using the link in any email or by writing to us. If you asked to receive information from us before the subscribe option existed on our website, we will continue to send it unless you tell us otherwise.
• Are a client. We use your information to tell you about changes to the products and services you use, and to support them (contractual necessity).
• Apply for a job. We use the contact details in your CV, whether you send it or a recruitment agency does, to progress your application, and the other information you provide to assess your suitability. You do not have to provide everything we ask for, but it may affect your application. We do not collect more than we need. If you are unsuccessful we keep your CV for a further six months. If you are successful we will explain what further information we need and why.
• Register for an event or web conference. We collect your name, email address and telephone number to send you information about the event you registered for or attended. At live events we may take general photographs and video of the audience for use on social media about the event.

If you do not give us personal information

Much of this website can be used without giving us any personal information. Some information is necessary for us to provide the services you request and to confirm who you are. If you choose not to provide it, we may not be able to respond to your enquiry or request.

Personal information from third parties

Where we obtain contact details from marketing third parties, we check that consent has been given before sending marketing material. Anyone can unsubscribe using the link in the first email we send.

Use of our website

Our website automatically records certain information in log files, such as your IP address, the general region you are connecting from, your browser type and operating system, and the pages you view. We use this to improve the website, diagnose problems, administer the site and understand in general terms how visitors use it (legitimate interest).

We use cookies and similar technologies, such as browser storage that remembers your language choice. You can block or delete cookies and stored site data in your browser settings, although some features may then not work as intended.

Our website links to third-party websites. We have no control over, and are not responsible for, their content or privacy practices.

Customer data in the GRCLens platform

Organisations that use the GRCLens platform control the information they put into it, and we process that information on their behalf under our agreement with them. GRCLens is hosted in four regions: Australia (Sydney), New Zealand (Auckland), Singapore and the United Arab Emirates. A customer's data is stored in the region of that customer's tenancy. Customers can also run GRCLens in their own infrastructure, in which case the data stays with them.

Who we share personal information with

We share personal information with our employees, contractors and affiliated partners who need it to provide the products or services you have, or are looking to buy. This includes service providers that host our systems, analyse data, and provide legal, accounting and marketing services, including marketing agencies that help us keep you up to date. Where a Security Solution Consultants partner is involved, this happens with your knowledge and permission.

We require everyone we share information with to keep it secure and confidential, and to use it only in line with our instructions. We may also need to share personal information:

• if we sell or buy a business or assets, with the prospective seller or buyer; or
• if we have a legal duty to disclose it, including exchanging information with other organisations to protect against fraud and reduce credit risk.

We do not sell or rent personal information to anyone.

Where personal information is stored

We store personal information with cloud service providers in Australia, New Zealand, Singapore and the United Arab Emirates. Information you give us through this website, or in the course of our business, may therefore be stored in or accessed from any of those countries. Where personal information is stored or accessed outside the country you are in, we take reasonable steps to make sure it is protected to a standard comparable to the law that applies to you.

How we protect personal information

We use physical safeguards such as secure areas in buildings, electronic safeguards such as passwords and encryption, and procedural safeguards such as customer authentication to prevent identity theft. We update and test our security controls regularly. Access to personal information is limited to people who need it to provide products or services to you.

We select and monitor service providers who have access to personal information, require them to keep it secure, and do not allow them to use or share it for any other purpose. We train our people on confidentiality and privacy, and we take disciplinary action where those responsibilities are not met.

How long we keep personal information

We keep personal information only for as long as we need it for the purpose it was collected. For clients, that means for the duration of the business relationship and for a period afterwards, so that accounts can be restored if a client renews, for our own operational analysis, and for record-keeping and archiving. For more detail about where and how long your information is kept, contact us.

Access, correction and your other rights

You can ask for access to the personal information we hold about you, and ask us to correct it or, where the law allows, erase it. You can also ask us to stop contacting you. Email privacy@grclens.net. We may need to confirm your identity before acting on a request, and we will respond within the time the law requires.

Complaints

If you have a concern about how we have handled your personal information, contact us first at privacy@grclens.net so that we can try to resolve it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz), or to the privacy regulator where you live.

Changes to this policy

We review this policy regularly and may change it at any time by publishing the updated version on this page. We will take reasonable steps to draw your attention to significant changes, and the date at the top shows when it was last updated. Your use of this website is also governed by our Terms of Use.

Contact us

For questions about this policy, or to make a request or complaint, contact our Data Protection Officer at privacy@grclens.net.