Privacy notice

Last updated: 29 October 2026

Who we are

Metis GRC is a trading name of Metis GRC Consultancy Ltd, a company registered in England and Wales (company number 17257889). Our registered office is 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. We’re registered with the Information Commissioner’s Office (ICO) under registration number ZC244027.

We’re the data controller for the personal information described in this notice. We handle personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

What this notice covers

This notice explains how we use personal information for our own business purposes, for example when you visit our website, contact us, receive outreach from us or work with us as a client.

It doesn’t cover personal information we handle on behalf of our clients during an engagement, for example staff or customer information we see while reviewing a client’s documents or systems. In those cases, we act as a data processor for our client, and that information is handled under our client contract and the client’s own privacy notice. If you have questions about that information, please contact the organisation concerned directly.

The information we collect

When you contact us: your name, company name, email address, and anything you choose to tell us in your message.

When we contact you about our services: business contact details such as your name, job title, company and work email address, gathered from public sources (see below).

When you contact us through social media: for example, if you message or connect with us on LinkedIn about our services, we receive your profile details and any messages you send.

When you use our website: technical information such as your IP address, browser type, device, the pages you visit and how you arrived at our site. Some of this is collected through cookies (see below).

When you become a client: contact and billing details, and information needed to deliver our services.

Where we get it from

Most information comes directly from you. We may also receive or collect it:

  • through referrals from people who know you or your business

  • from public sources, such as LinkedIn, company websites and Companies House

  • automatically, through our website and cookies

Sensitive information

We don’t intentionally collect sensitive information, such as details about health, ethnicity, religion or criminal records. Please don’t share this with us unless it is necessary. If it’s shared with us, we’ll only use it where the law allows, and keep it to the minimum needed.

How and why we use your information

We use your information to:

  • respond to your enquiry and arrange calls (legitimate interests, or steps before entering into a contract)

  • provide our services and manage our relationship with you (contract)

  • contact businesses we believe may benefit from our services (legitimate interests)

  • send service messages, such as appointment details or updates to our terms (contract or legitimate interests)

  • keep our systems and your information secure (legitimate interests and legal obligation)

  • keep financial and business records (legal obligation)

  • establish, defend or pursue legal claims (legitimate interests)

  • understand how our website is used, so we can improve it (consent, through our cookie banner)

Where we rely on legitimate interests, we’ve considered and balanced our interests against your rights. You can ask us for details of this assessment.

We don’t sell your information, and we don’t make decisions about you using purely automated processes.

Contacting businesses about our services

From time to time, we may contact people at businesses we think could benefit from our services, using business contact details from public sources. Every message makes clear who we are. If you’d rather not hear from us, just tell us and we won’t contact you again. We never share your details with others for their marketing.

Case studies and testimonials

We may publish case studies about our work. Case studies are anonymised so our clients can’t be identified, unless a client has given written consent to be named. We’ll only attribute a testimonial or quote to an identifiable person with their agreement, or where they have published it themselves on a public platform, such as a LinkedIn recommendation or an online review. We always reproduce their words accurately, and will remove a testimonial promptly if the person asks us to.

Who we share it with

We use trusted service providers to run our business, who process information on our behalf. These include providers of:

  • website hosting, contact forms and analytics

  • email and secure document storage

  • accounting and invoicing

We only use providers who protect personal information appropriately, and we can give you more details on request.

We may also share information with:

  • our professional advisers, such as our accountant, lawyers or insurers

  • HMRC and other authorities where required by law

  • the police, courts or regulators where we are legally required to

International transfers

Some of our service providers may process data outside the UK, for example in the United States. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or the UK-US Data Bridge.

How long we keep it

  • Enquiries that don’t lead to work: up to 12 months after our last contact

  • Outreach contacts: up to 12 months after our last contact, unless you ask us to stop sooner, in which case we keep only what we need to make sure we don’t contact you again

  • Client and financial records: six years after the end of our engagement, to meet legal and tax requirements

  • Website analytics: in line with our analytics provider’s standard retention settings

How we protect it

We take the security of your information seriously and practise what we recommend to our clients. This includes multi-factor authentication, access controls, and working only with reputable providers. If a data breach affects your information, we’ll notify you and the ICO where we are legally required to.

Your rights

You have the right to:

  • access the personal information we hold about you

  • ask us to correct or delete it

  • object to, or ask us to restrict, how we use it, including at any time to being contacted about our services

  • ask for a copy in a portable format

  • withdraw your consent at any time, where we rely on it

Requests are free of charge in most cases. As the law allows, we may charge a reasonable fee, or decline a request, if it’s clearly unfounded or excessive. We may ask you to confirm your identity before responding, so we don’t share information with the wrong person. We’ll respond within one month.

Complaints

If you’re unhappy with how we’ve handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Cookies

Cookies are small files stored on your device when you visit a website.

Strictly necessary cookies keep our website working and secure. They don’t need your consent.

Analytics cookies help us understand how visitors use our site. We only set these if you accept them through our cookie banner.

You can change your choice at any time using the cookie settings link at the bottom of our website, or through your browser settings.

Changes to this notice

We may update this notice from time to time. The latest version will always be on this page, and we’ll let you know about significant changes where appropriate.

Contact us

Metis GRC Consultancy Ltd
167-169 Great Portland Street, 5th Floor
London, W1W 5PF
aliya@metisgrc.co.uk