Privacy Policy

1. Who We Are

Poleis Limited (“Poleis”, “we”) is a UK-based consultancy providing professional services in governance, risk, compliance and related advisory areas. It is registered in England and Wales (Company No. 16924500), with its registered office in London, United Kingdom. For the purposes of data protection law, Poleis is the data controller for the personal data described in this policy, except for customer content in the GRC workspace (section 3).

Privacy questions and requests: privacy@poleis.com.

2. Personal Data We Collect

Enquiries. If you use the contact form or write to us, we receive your name, email address, organisation, country, the services you are interested in, your message and any attachments you choose to send. Enquiries made through the form are emailed to us and kept in a restricted list in the administrator area.

Newsletter. If you subscribe, we store your email address and the confirmation and unsubscribe details needed to run the subscription. Every message has an unsubscribe link.

Resource Library accounts. We store your first and last names, email address, topic interests, saved resource references, a password hash, a recovery-code hash and your registration date. If you turn on two-step sign-in, we store an encrypted authenticator secret. For security we also keep a log of account events (registration, e-mail confirmation, sign-ins and failed sign-ins, password changes and resets) with the time and your IP address.

Training accounts. We store the name, company, email address or username, programme access, password hash, two-step sign-in details (encrypted) and last sign-in time entered for you by your trainer or Poleis. Some classroom accounts may be shared by a group where arranged by the organisation or trainer. In such cases, activity may not be attributable to an individual user.

GRC workspace accounts. We store your name, email address, organisation, role, password hash and two-step sign-in details (encrypted), plus an access log containing your email address, IP address and sign-in times.

Payments. GRC subscriptions are paid through Stripe. We receive your subscription status and billing identifiers, but we do not receive or store full card numbers.

Administrators. The restricted administrator area stores administrator email addresses, password hashes and security activity records used to manage website content and resources.

3. Customer Content in the GRC Workspace

Organisations using the GRC workspace enter their own content: risks, controls, assets, suppliers, policies, evidence files, assessments and similar records, which may include names and work contact details of their staff and suppliers. For this content the customer is the data controller and Poleis acts as its processor, handling it only to provide the service on the customer’s documented instructions.

The terms for this processing are set out in a Data Processing Agreement available to GRC customers (contact privacy@poleis.com). The providers we use to run the service are listed on the Subprocessors page. Please do not enter personal data into the workspace that is not needed for governance, risk and compliance work.

4. Website Technical Data

Sign-in, recovery, registration and contact attempts are limited using hashed identifiers derived from your email address or IP address. We use the Cloudflare Turnstile check on some forms to tell people from automated programs; Cloudflare receives technical information such as your IP address and browser details to do this. Our hosting provider may also process technical information for security, performance and operational purposes.

5. Cookies

We do not use analytics, advertising or marketing cookies. We use only essential session cookies to keep you signed in and protect forms in the Resource Library, Training, GRC and administrator areas. Details are in our Cookie Policy.

6. How We Use Personal Data and Why

We use personal data to:

• Respond to enquiries and discuss potential services or engagements (legitimate interests, or steps taken at your request before a contract)

• Provide the accounts, resources, training materials and GRC workspace you have signed up for (contract)

• Send the newsletter you subscribed to (consent, which you can withdraw at any time)

• Keep our services secure, prevent abuse and keep records of security activity (legitimate interests)

• Process subscriptions and meet accounting and legal obligations (contract and legal obligation)

We do not use personal data for advertising and we do not make automated decisions that have legal or similarly significant effects on you.

Our services are intended for business and professional users and are not directed at children.

7. Data Sharing and Subprocessors

We do not sell or rent personal data. We share it only with service providers that help us run the services, under appropriate terms: Aruba (hosting, databases and email), Cloudflare (the Turnstile human check) and Stripe (GRC payments). See the Subprocessors page for what each does and where. We may also disclose personal data to professional advisers or when the law requires it.

8. International Hosting and Access

The website and databases are hosted through Aruba in Italy, and email services are hosted in Italy; emails may be accessed and downloaded in the United Kingdom. Cloudflare and Stripe may process data outside the UK and the European Economic Area. Where this happens, we rely on UK adequacy regulations or approved safeguards such as standard contractual clauses with the UK addendum.

9. Data Retention

• Enquiries: up to 24 months after our last contact, or longer while we have an ongoing professional relationship.

• Newsletter: until you unsubscribe.

• Resource Library and Training accounts: retained while the account remains active and deleted when the account is closed or deletion is requested, unless retention is required by law or for security purposes.

• Resource Library account security log: up to 12 months.

• GRC workspace: for the duration of the subscription. After it ends, organisation data is deleted within 90 days unless the customer asks for earlier deletion or the law requires otherwise. Access logs are kept for up to 12 months.

• Administrator account and activity records: while needed for website administration and security.

• Published text versions are retained for restoration and business continuity purposes. Archived resources remain stored but unavailable for download and are reviewed periodically for permanent removal.

10. Security

We protect accounts with password hashing, optional or required two-step sign-in, secure sessions, access controls between organisations and audit records. No online service can be completely secure, so please use a strong, unique password and keep your authenticator and recovery codes safe.

11. Your Rights

Under UK data protection law you have rights in relation to your personal data, including the right to request access, correction, deletion, restriction or portability, and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time.

To exercise your rights, email privacy@poleis.com. If you use the GRC workspace on behalf of an organisation, please contact your organisation first; we will help it respond.

12. Complaints

If you are unhappy with how your personal data has been handled, please contact us first at privacy@poleis.com. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by the “Last updated” date at the top of this page.