Privacy Policy

HazelGRC Limited (“HazelGRC”, “we”, “us”) is an independent UK advisory firm providing Technology Assurance, Cyber Governance and AI Advisory services. We are the controller of the personal information described in this policy.

Privacy enquiries: privacy@hazelgrc.com.

• Contact and professional details you provide through our enquiry forms, email or events (name, organisation, role, email, telephone).
• Correspondence and enquiry content, including the nature of the advisory support you are seeking.
• Resource download details where you request an executive guide or assessment.
• Website and analytics information, including pages viewed and interactions, as described in our Cookie Policy.

• To respond to enquiries and provide advisory, assurance and advisory-related services.
• To administer relationships with clients, prospective clients and professional contacts.
• To send executive insights and updates where you have asked to receive them.
• To operate, secure and improve our website and services, and to meet our legal and regulatory obligations.

Where UK GDPR applies, we rely on: performance of a contract (delivering services you have engaged us for), legitimate interests (responding to business enquiries, running and securing our business), consent (optional marketing communications and non-essential cookies), and legal obligation (accounting, tax and record-keeping requirements).

This section explains how we handle personal information relating to the HazelGRC Academy, including corporate training, executive education, masterclasses, mentoring and public or in-house events. It supplements, and does not replace, the rest of this policy.

Information we collect

• Participant details: name, work email, organisation, job title, and the programme or session booked.
• Purchaser and billing details where an organisation books on behalf of participants: contact name, billing address, purchase order or invoicing references, and VAT details where applicable.
• Booking and order information: ticket type, quantity, order reference, booking status, cancellations, transfers and substitutions.
• Payment information processed by our payment provider. We do not store full card numbers; we receive confirmation of payment and limited transaction details.
• Delivery information: attendance records, joining details, access credentials issued for virtual delivery, and questions or contributions submitted during a session.
• Accessibility and reasonable-adjustment requests, and dietary or access requirements for in-person events, which may include information you choose to share about health or disability.
• Feedback, evaluation responses and certificates or completion records where a programme provides them.
• Optional marketing preferences, recorded separately from your booking.

How we use it

• To take bookings, confirm orders, issue joining instructions and deliver the programme.
• To process payments, issue invoices and receipts, and maintain accounting records.
• To administer cancellations, transfers, substitutions and refunds under the Academy Programme Terms.
• To provide reasonable adjustments and meet accessibility, safety and venue requirements.
• To issue attendance or completion records and to gather feedback that improves programme quality.
• To send service messages about a programme you have booked (these are not marketing).
• To send Academy updates and executive insights only where you have separately opted in.

Lawful bases

• Contract: administering and delivering a programme you or your organisation has booked.
• Legitimate interests: managing our Academy operations, programme quality, security and record-keeping, and communicating with corporate purchasers about their bookings.
• Consent: optional marketing communications, and any accessibility or dietary information you choose to provide that relates to health.
• Legal obligation: tax, accounting and statutory record-keeping.

Recipients and service providers

We use established third-party services to operate the Academy. Depending on the programme, these may include:

• Ticket Tailor — event registration, ticketing and order management.
• Stripe — payment processing.
• Microsoft 365 — email, documents and business communications.
• Microsoft Teams or Zoom — virtual programme delivery where applicable.
• Accounting, invoicing and payment providers — financial records and reconciliation.
• Venues and delivery partners for in-person events, where attendance details are necessary.

The role of each provider under data protection law varies. Some act on our instructions in relation to specific processing, while others determine aspects of their own processing — for example payment providers acting for fraud prevention and regulatory compliance purposes. We do not represent that every provider listed is a processor. Each provider’s own privacy notice explains how it handles information it holds in its own right.

International transfers

Some providers process information outside the UK. Where personal information is transferred outside the UK, we rely on an applicable safeguard — such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — together with additional measures where appropriate. You can request further information about the safeguards applied.

Retention

• Booking, attendance and delivery records: retained for the duration of the relationship and a reasonable period afterwards for administration and dispute handling.
• Financial and tax records: retained for the period required by UK accounting and tax law.
• Accessibility and dietary information: deleted shortly after the relevant session, unless you ask us to retain it for future programmes.
• Marketing preferences: retained until you withdraw consent, plus a record of the withdrawal itself.
• Website enquiries: when you contact us through the website enquiry form, we store your enquiry so that we can respond and follow up, and we keep a record of whether the notification emails about it were accepted by our email service. Enquiries that do not proceed become due for deletion twelve months after our last meaningful two-way contact with you, or twelve months after submission if there is no further contact; automated messages and unanswered reminders do not extend this period. We review records manually each month and delete them within 30 days of becoming due, together with related notes and our records of the emails sent, unless a documented hold applies.

Recording of sessions

Some programmes may be recorded for participant access or quality purposes. Where a session will be recorded, we tell participants in advance and explain how the recording will be used and how long it will be kept. Participants may keep cameras and microphones off where recording takes place.

Marketing

Marketing consent is always a separate, optional and unticked choice. Booking a programme, or accepting the Academy Programme Terms, never opts you into marketing. You can withdraw consent at any time using the unsubscribe link in any message or by emailing us.

Mentoring and Career Pathways

When you apply for mentoring, make a team enquiry or register interest as a mentor, we collect the details you provide in the form (such as name, email, country, timezone, background, experience, goals, preferences and optional organisation or profile link), together with the page you applied from and whether you opted in to marketing. A personal email is accepted and no account is needed.

• We use this to assess suitability, discuss options and prepare any written offer. Lawful basis: steps taken at your request before a contract, and legitimate interests.
• If you enrol, we may hold development assessments, mentor session notes and the work you submit. Please use fictional or sanitised material only.
• Applications are seen only by authorised HazelGRC staff. If you enrol, the mentor assigned to you (who may be a vetted associate in our delivery network) sees only what is needed to support you, under confidentiality obligations.
• For employer-sponsored participants, any reporting to the sponsor is agreed with you at the outset. We do not share the content of individual discussions beyond what was agreed.
• Application information is not sent to AI services.
• Retention: unsuccessful or withdrawn applications become due for deletion six months after they are closed. Interest registrations and organisational enquiries that do not proceed become due twelve months after our last meaningful two-way contact with you, or twelve months after submission if there is no further contact; automated messages and unanswered reminders do not extend this period. HazelGRC reviews records manually each month and deletes them within 30 days of becoming due, together with related notes and our records of emails sent to you, unless a documented hold applies. A hold is used only where a complaint, dispute or legal obligation justifies it; we record the reason and a review date, and the original due date is kept. Records of people who enrol follow a separate schedule, which will be published before paid enrolment opens.
• Deleted information may remain in backups until those backups expire under the hosting provider’s retention arrangements. If a backup is restored, HazelGRC uses its deletion log to reapply previous deletions before restored records are returned to normal operational use. Our email delivery provider retains its own technical logs under its retention arrangements.
• You can ask us to delete your information at any time by emailing academy@hazelgrc.com. We will handle requests in accordance with your rights under data protection law and any obligations that require us to keep certain information.
• Marketing consent is optional, recorded separately and can be withdrawn at any time. Acceptance of programme terms is recorded separately at enrolment.

• Purpose: if you subscribe, we use your email address only to send you the monthly HazelGRC Executive Briefing, which covers technology assurance, cyber governance and AI oversight. We rely on your consent.
• Information collected: your email address, the page you subscribed from, the date and time of subscription, and the consent wording you agreed to. If you withdraw, we also record the date you did so.
• Withdrawing consent: you can withdraw at any time by emailing hello@hazelgrc.com. We will stop sending the Briefing to you promptly and will not send it again unless you later give fresh, verified consent. Submitting the signup form again does not reactivate a withdrawn address.
• Active subscriptions: we keep your subscription record while you remain subscribed. At least once a year we review whether records remain necessary, and we address invalid or undeliverable addresses when we identify them. We do not track whether you open our emails for this purpose.
• Suppression information: when you withdraw, we remove the page you subscribed from and keep only your email address, the fact that you have withdrawn, the date you did so and the date you originally subscribed. The subscription date stays with this record so that we can show the period during which the Briefing could have been sent to you. We use this solely to make sure you are not sent the Briefing again, and keep it for as long as we send the Briefing or until it is no longer needed to respect your preference.
• Evidence of previous consent: we separately keep the consent wording you agreed to and its version, so that we can show the Briefing was sent with your consent. We check monthly for evidence that has reached its review date, 12 months after you withdraw, and clear the wording and version at that review unless a complaint, dispute or other justified reason requires us to keep it for longer, in which case we record the reason and a further review date.
• Erasure requests: you can ask us to erase your information. We assess each request under applicable data protection requirements, including whether limited information remains necessary to respect your marketing preferences.

We do not sell personal information. We share it with the service providers described above, with professional advisers, and where required by law or to establish, exercise or defend legal claims.

We apply technical and organisational measures appropriate to the sensitivity of the information we hold, including access control, encryption in transit and supplier due diligence.

Subject to conditions in law, you may request access to your personal information, correction, erasure, restriction, portability, and object to certain processing. Where we rely on consent, you may withdraw it at any time. To exercise a right, contact privacy@hazelgrc.com. You may also complain to the Information Commissioner’s Office (ico.org.uk).

HazelGRC Limited — privacy@hazelgrc.com · General enquiries hello@hazelgrc.com. See also the Academy Programme Terms.