Privacy Policy

Last updated: October 2026

NodeForce GRC Ltd, trading as NodeForce, is the data controller for the personal data described here. Privacy contact: advisory@nodeforce.co.uk.

1. Who we are

NodeForce GRC Ltd (trading as NodeForce) is a UK GRC consultancy. We are the controller for the data described here. Contact us about privacy at advisory@nodeforce.co.uk.

2. What data we collect

Enquiries and bookings: name, work email, phone (if given), company, role, message, call booking details.
Clients: company and contact details, billing details, project information and evidence you share so we can deliver the work.
Website use: page views, referral source, approximate location (city/region), device and browser type, via analytics cookies.
Emails and calls: correspondence, and notes of calls.

3. Why we use it and our lawful basis

Reply to enquiries and book calls (enquiry details): legitimate interests, or steps before a contract.
Deliver and administer client work (client and project details): contract.
Invoicing and accounting (billing details): contract and legal obligation.
Analytics (website use data): consent.
Security and fraud prevention (website and account data): legitimate interests.

4. Who we share it with

Supabase — Website hosting, database and authentication (verify).
Resend — Transactional email (verify).
Twilio — SMS and WhatsApp dispatch (verify).
Google — Analytics (Google Analytics 4) (United States).

We do not sell personal data.

5. International transfers

Where a processor is outside the UK, transfers use the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation.

6. Cookies and analytics

We use Google Analytics 4. It sets the cookies _ga and _ga_*. Google Signals and advertising features are not enabled.

_ga — distinguish visitors. Duration: TODO.
ga* — store session state. Duration: TODO.

7. How long we keep it

Enquiries that do not become clients: 24 months after last contact.
Client records and project files: 6 years after the engagement ends.
Accounting records: 6 years.
Analytics data: per the analytics settings.

8. Security

We use access controls and encryption in transit, and we check our suppliers.

9. Your rights

You have rights of access, correction, erasure, restriction, objection and portability, and you can withdraw consent. Email advisory@nodeforce.co.uk to use them. We respond within one month.

10. Complaints

You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

11. Changes to this policy

We update the date at the top when this policy changes.

NodeForce GRC Ltd
Registered in England and Wales