01 / Who is responsible?
Grau Research is a trading name of Grau Solutions Ltd, the controller of personal information handled for this website and business enquiries. We are registered in England and Wales under company number 16935526. Our registered office is 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
For privacy enquiries, write to our registered office or email contact@grau-solutions.com.
02 / What information is involved?
When you email us, we receive the information you provide, such as your name, business contact details, employer, correspondence, and a description of your enquiry. Please leave out unnecessary personal information, credentials, malware samples, and confidential material from your initial message.
The enquiry form prepares an email draft locally in your browser. Preparing or reviewing the draft does not send your entries to us or to a form-processing service. Selecting Open email app passes the draft to your configured email application; your email provider may save or synchronise that draft before you send it. We receive your enquiry when you send the email to us. Selecting Copy draft writes the draft to your device’s clipboard. Our application does not save entries to browser storage or send them to analytics; your browser, clipboard manager, or email application may retain or synchronise information according to its own settings.
Visiting the website also involves technical request information, including your IP address, requested URL, time of access, and browser information. Cloudflare processes this information to deliver the pages and protect the service.
03 / Why we use information
We use business contact details and correspondence to assess and respond to enquiries, arrange discussions, manage business relationships, and maintain relevant records. Our lawful basis is our legitimate interest in responding to prospective clients and operating our business. Delivering and securing the website, and protecting our mailbox from spam and abuse, also serve our legitimate interest in maintaining a reliable and secure service.
Where processing is necessary to take steps you request before entering a contract with you personally, or to perform that contract, we rely on contractual necessity. We may also process information to meet legal obligations or, where necessary for our legitimate interests, establish, exercise, or defend legal claims.
Providing enquiry details is voluntary, but we need enough contact information and context to respond. We do not use enquiry data for advertising profiles or automated decisions with legal or similarly significant effects.
04 / Hosting, email & sharing
Cloudflare hosts and delivers the website as static files. Cloudflare processes technical information to deliver and secure the website; see its privacy policy. The website has no form-submission endpoint, enquiry database, or public file-upload facility.
Our business email is hosted by Microsoft 365 (Exchange Online). Microsoft processes messages, contact details, attachments, and email delivery and security information to operate and protect our mailbox. Its Products and Services Data Protection Addendum sets out the applicable business data protection terms.
Service providers and their authorised subprocessors handle information as needed to supply their services. We may also share relevant information with professional advisers or public authorities where necessary and lawful. We do not sell personal information.
Cloudflare and Microsoft may process personal information outside the UK, including in the European Economic Area and the United States. Where UK transfer restrictions apply, we rely on applicable adequacy regulations or appropriate safeguards, such as standard contractual clauses with the UK Addendum. The Cloudflare data processing addendum and Microsoft data protection terms describe the applicable transfer safeguards. Contact us for information about the safeguards relevant to your data or a copy of applicable safeguards.
06 / How long information is kept
Enquiry correspondence is held in our business mailbox. We do not apply a single automatic deletion period to every message. Retention depends on whether an enquiry is still active, a specific follow-up or engagement is reasonably expected, correspondence is needed for an existing client relationship, or a legal obligation or dispute requires the record.
Our retention policy requires periodic review of mailbox correspondence, with deletion or anonymisation when those reasons no longer apply. Closed enquiries with no continuing business or legal purpose are not retained simply because they remain in the inbox. You can contact us to request deletion; we will explain if a legal requirement or another lawful reason prevents it.
During the changeover from our former email provider, IONOS, existing correspondence may be copied to Microsoft 365. Any remaining copies in the former mailbox are kept only as needed to verify the transfer or recover missing messages, then deleted subject to applicable legal retention requirements.
Deleted correspondence may remain temporarily in our email provider’s recovery systems or backups. Our email provider and Cloudflare also retain operational and security records according to their service policies and applicable legal requirements. The website does not operate a separate enquiry database.
Handling and retention of research samples and investigation material are agreed separately before transfer. This notice does not authorise disclosure of another person’s data.
07 / Your rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict, or receive a portable copy of your personal information. You may object to processing based on legitimate interests. These rights are subject to applicable conditions and legal exceptions. Email us or write to our registered office to make a request.
You can raise a concern with us or complain to the UK Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint for details.
08 / Changes to this notice
We update this notice when our website, service providers, or use of personal information changes. The date above identifies the latest revision.