1. Who we are
Gratia Group is the registered trading name of Individual Entrepreneur Gratia Group, identification number 131293036, registered in Georgia (the country). Our registered office is Telavi, Kakheti, Georgia, 2200.
We are responsible for deciding how business enquiries, our client relationship records and our own administration information are used. For privacy matters, contact info@gratiagroup.co.uk, addressed to Claude Truter, or write to our registered office.
2. Information we handle
- Enquiries and correspondence: your name, company, email address, contact details you choose to provide, approximate team size and the content of your message.
- Client administration: authorised contact details, agreements, service records, invoices and payment-related administration. This website does not collect card details or take payments.
- Service information: technical configuration, user account details, support requests, logs and evidence needed for the services authorised by a client.
- Website connection information: the hosting provider may process IP addresses, browser and device information, requested pages, timestamps and security logs to deliver and protect the website.
We obtain information directly from you, from an authorised client contact, or from the systems a client authorises us to review or manage. Please do not put passwords, payment details, health records or other sensitive information in a website enquiry.
3. How the enquiry form works
The form prepares a message for your own email application. Entering information or selecting Prepare enquiry does not submit a message to Gratia Group or to a third-party form service.
When you choose Open in your email app, the prepared content is passed to your email software. You review and send it there. We receive the enquiry only when the email reaches us. Your email provider handles the message under its own terms.
The website code does not save form entries to a database, cookies, local storage or session storage. Entries and the preview are held in the page while it is open. Your browser or email app may retain information according to your own settings.
4. Why we use information
| Purpose | Basis, where UK or EU GDPR applies |
|---|---|
| Reply to enquiries and manage business contact relationships | Legitimate interests in responding to requests and administering a professional business relationship. |
| Take requested steps towards a contract, or provide services contracted by an individual | Contract or steps requested before entering a contract. |
| Maintain billing, accounting and required records | Legal obligations and legitimate interests in keeping accurate business records, as applicable. |
| Deliver and protect the website, prevent misuse and resolve disputes | Legitimate interests in security, reliable operation and protecting legal rights. |
| Process client-controlled personal data during IT services | The client's documented instructions and the data-processing terms of the engagement. The client determines the basis for its own processing. |
Where another law applies, we use the corresponding permitted grounds for those purposes. If we rely on consent for a particular activity, we explain that activity and how consent can be withdrawn.
We do not sell personal information or use enquiry information for advertising. The website's pricing calculator produces an indicative estimate; it does not make a binding decision or assess a person's eligibility for services.
5. Information in client systems
When we handle personal data on a client's behalf, the client normally remains the controller or responsible party and Gratia Group acts as its processor or operator for the agreed work.
The engagement's written instructions and data-processing terms govern access, confidentiality, authorised subcontractors, security, assistance with rights requests and the return or deletion of service data. This website policy does not replace those terms.
If your employer or another organisation uses our services and your request concerns its data, contact that organisation first. We support its response in accordance with the engagement.
6. Who information may be shared with
Information may be handled by the providers needed to deliver the website, email, authorised technical services and business administration. Relevant categories include hosting and infrastructure providers, email providers, client-authorised software and support platforms, specialist contractors, and professional advisers such as accountants or lawyers.
Contractors who need access to client information are subject to the relevant confidentiality and data-processing arrangements. We may also disclose information where required by law or necessary to establish, exercise or defend legal rights.
Website hosting: this website is hosted by Verpex, a third-party provider, using the Frankfurt, Germany hosting arrangement identified for Gratia Group. Hosting, connection logs and security processing are subject to the applicable hosting agreement.
Fonts are served from the same website as the pages. Loading them does not contact an external font service.
If you follow a link to an external website, that organisation's own privacy notice applies to its processing.
7. Where information is processed
Gratia Group is operated from Georgia. Information you send to us and client information we are authorised to access may therefore be processed in Georgia, even when the client's systems are hosted elsewhere.
The website hosting arrangement is in Frankfurt, Germany. Information sent to Gratia Group and client information we are authorised to access can also be processed in Georgia. Supplier support or infrastructure access may involve other locations under the relevant supplier terms; contact us for information relevant to your engagement.
For a client engagement involving a restricted international transfer, the applicable safeguards must be identified in the written data-processing and transfer arrangements before the relevant access or transfer begins. Depending on the law and parties involved, these can include EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, and arrangements addressing South African POPIA transfer requirements.
A website policy does not itself create those contractual safeguards. Contact us for information about the arrangements relevant to your enquiry or engagement, including how to request a copy of applicable safeguards subject to appropriate redactions.
8. How long information is kept
- Unsuccessful enquiries: our policy is to delete enquiry records within 30 days after the enquiry is closed, unless information is needed for a legal obligation or dispute.
- Client relationship records: ordinarily up to five years after an engagement ends, where needed for accounting, contractual administration or legal claims. A longer period may apply if required by law.
- Client-controlled service data: retained, returned or deleted according to the written engagement and the client's authorised instructions, subject to legal requirements.
- Hosting and security records: retention depends on the provider's security and operational settings and applicable terms. We do not set a fixed duration for records held independently by a hosting or account platform.
Records subject to a legal hold may be retained until the matter is resolved. Where deletion from backups is not immediate, copies remain subject to access restrictions until they are overwritten or expire under the relevant backup arrangements.
9. Your rights
Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction of processing or a portable copy of information. You may withdraw consent for an activity based on consent without affecting earlier lawful processing.
We may need enough information to verify your identity and locate the relevant records. We respond within the time limits that apply to the request. Some information may need to be retained despite a deletion request because of a legal obligation or legal claim.
10. Questions and complaints
Contact Claude Truter at info@gratiagroup.co.uk if you are concerned about how we handle information. You may also contact the relevant supervisory authority without first contacting us.
- United Kingdom: the Information Commissioner's Office.
- South Africa: the Information Regulator.
- European Union: the data protection authority in the country where you live, work or consider an infringement occurred.
- Georgia: the State Audit Office's personal data protection department.
- Other locations: the authority responsible for privacy matters under the law that applies to you.
11. Security and information we do not seek
Security and access arrangements for services are set out in the relevant engagement. We use information only for the purposes described here and limit service access to the authorised work. No website or method of electronic communication can guarantee absolute security.
The website is intended for business contacts and is not designed to collect personal information from children. If information is sent in error, contact us so we can consider appropriate deletion or restriction.
12. Changes to this policy
We update this policy when our practices or website features change and show the revision date above. Material changes are communicated where the applicable law requires. Please also read our Cookie Notice for the technologies used by this website.
Policy questions: info@gratiagroup.co.uk
Gratia Group · Telavi, Kakheti, Georgia, 2200