Privacy notice

How GoRaC uses personal information in the GoRaC portal.

Who we are

GoRaC is the data controller for the information in this portal. We use it to run cyber security and compliance assessments for the organisations we work with.

What we hold

• Your name, work email address, job title and phone number, as given to us by your organisation.
• The answers and comments you and your colleagues give in assessments, and who changed each answer and when.
• Policies and documents we prepare for your organisation or that you upload, who accepted them, and the names and work email addresses of people asked to read and confirm them.
• If your organisation connects Microsoft 365: the settings and account details our checks need, such as account names, administrator roles, when accounts last signed in and device names. We don't read email, files or chats, and the connection can't change anything.
• Sign-in records and a log of significant actions, kept for security.

Assessment answers describe your organisation's IT systems. Please don't include passwords or other secrets.

Why we use it

To deliver the services your organisation has asked us for (our legitimate interests and our contract with your organisation), to keep the portal secure, and to meet our legal obligations.

Where it's kept

Data is stored in the United Kingdom (London) with our hosting providers, Supabase and Vercel, under data processing agreements. Emails are sent through our email provider. We don't sell personal information or use it for advertising.

To help us draft reports and policies, assessment answers and documents may be processed by our AI provider, Anthropic, under our agreement with them; our team reviews everything before it reaches you.

How long we keep it

For as long as we work with your organisation, and afterwards only as long as we need to for legal or contractual reasons. Your organisation can ask us to delete its data at any time.

Your rights

You can ask for a copy of your personal information, ask us to correct or delete it, or object to how we use it. Contact your account manager at GoRaC. You can also complain to the Information Commissioner's Office at ico.org.uk.