Privacy notice
How GRCP collects, uses and protects personal data when you use this website.
Last updated 31 October 2026
Who we are
GRCP is operated by Complify Limited, a company registered in England and Wales (company number 15534944) with its registered office at 30 Dukes Place, London EC3A 7LP. Complify Limited is the controller of the personal data described in this notice and is registered with the Information Commissioner's Office under registration number 00015823614.
This notice covers the public website at grcponline.uk. When candidate and partner accounts open, we will provide a separate notice explaining how we handle exam and certification records.
What we collect
- Founding cohort registrations: your name, email address and the credential or service you are interested in.
- Contact enquiries: your name, email address, organisation (optional), the topic you choose, your message and, if you report a certificate, the certificate number or provider name you give us.
- Training partner applications: organisation name, country, website, delivery model, the credentials you want to deliver, the contact person's name and email address and any information you include about your organisation.
- Certificate verification: the certificate number and, optionally, the surname you enter. We use these only to perform the lookup and do not store them.
- Technical data: our hosting provider automatically processes your IP address and basic request information in server logs, which are used to deliver the site securely and to investigate faults or misuse.
We do not use advertising or analytics cookies. See our cookie notice.
Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Telling you when founding cohort registration, exam dates and training open | Consent, which you can withdraw at any time |
| Responding to enquiries and reports | Our legitimate interests in answering questions and protecting the integrity of the credential |
| Assessing training partner applications | Steps taken at your organisation's request before entering into a contract, and our legitimate interests |
| Answering certificate verification requests | Our legitimate interests in allowing employers and others to confirm a credential |
| Keeping the website secure and working | Our legitimate interests in operating a secure service |
We do not sell personal data and do not use it for automated decision-making that has legal or similarly significant effects on you.
Who we share it with
We share personal data only with service providers who process it on our instructions and under contract:
- our website hosting provider, Vercel Inc.;
- our cloud database provider, which stores form submissions;
- our email provider, which delivers internal notifications about new submissions.
We may also disclose data where required by law, to protect our rights, or to a successor organisation if the GRCP scheme is transferred.
International transfers
Some of our service providers may process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards used.
How long we keep it
- Founding cohort registrations: until you unsubscribe, or 12 months after registration opens, whichever is sooner.
- Enquiries and reports: up to 24 months after our last contact with you, unless a longer period is needed for an investigation or legal claim.
- Training partner applications: for the duration of the partnership, or up to 24 months if the application does not proceed.
- Server logs: for the period set by our hosting provider, typically a short number of days.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to our processing in certain circumstances, including any processing based on legitimate interests;
- receive your data in a portable format where processing is based on consent or contract;
- withdraw consent at any time, without affecting processing that took place before withdrawal.
Contact and complaints
To exercise your rights or ask about this notice, email hello@grcponline.uk with “Data protection” in the subject line, or write to Complify Limited, 30 Dukes Place, London EC3A 7LP.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.