Privacy Policy
Effective date: 26 October 2026
This policy explains what personal data Griotech Ltd ("we", "us", "our") collects when you visit grio.tech or griotech.co.uk, or interact with us, why we collect it, how we use it, and the rights you have over it. We are the data controller for the data described here.
If you have any questions about this policy, contact us at hello@griotech.co.uk.
ABIE indicative proposal requests
When you request an ABIE proposal, we record your email, company, building schedules, equipment quantities, optional floor areas, BMS selections and deployment notes. We use these to assess scope, prepare internal calculations, manage your enquiry and maintain an accurate record of any proposal issued. Floor area is informational and is not used to calculate points or prices.
Our email provider, Resend, sends a confirmation request. Opening the link does not authorise delivery: you must confirm on the page. Confirmation is for the requested transactional proposal or review acknowledgement only, not marketing. Notion holds our restricted commercial enquiry register; protected server storage manages tokens, expiry and delivery reliability. We record provider acceptance separately from any confirmed final delivery.
Confirmation links expire after 24 hours. Unconfirmed enquiries are scheduled for removal after 30 days; closed confirmed enquiries and their proposal history are normally retained for 24 months after the last activity, unless an active relationship or legal obligation requires otherwise. You can request correction or deletion by emailing hello@griotech.co.uk. Deletion covers the enquiry register and workflow records, subject to applicable legal retention and provider backup periods.
1. What we collect
We collect a small amount of personal data, in three contexts:
Information you give us. When you submit our demo request form or contact us by email, we collect your name, work email address, company name, and anything you choose to include in your message.
Information we collect automatically. When you visit the site, our analytics provider records aggregated, anonymised information about your visit: pages viewed, approximate location (country level), device type, and referring source. We do not use cookies for analytics, and we do not collect or store anything that identifies you personally.
Information sent in correspondence. If you email us, we keep the contents of those messages so we can respond and refer back to them later.
We do not collect special category data (such as health, ethnicity, or political views), and we do not knowingly collect data from anyone under 18.
2. Why we collect it, and the lawful basis
We use the data we collect for three purposes:
To respond to enquiries and demo requests. When you fill out our demo form or email us, we use your contact details to reply, schedule a call, or follow up. The lawful basis is your consent (where you've actively submitted information) or our legitimate interest in responding to a business enquiry. The ABIE estimate form lets you switch off follow-up about a demonstration and formal quotation. We record and respect that preference; opting out does not prevent your requested confirmation and estimate emails, and does not subscribe you to marketing.
To send service-related communications. If you book a demo or become a customer, we may send you transactional emails — confirmations, scheduling information, follow-ups related to your enquiry. The lawful basis is contract performance or legitimate interest.
To understand how the site is used. We look at aggregated analytics to see which pages are read, which content is useful, and how visitors find us. The lawful basis is legitimate interest. Because the data is anonymised and cookieless, this processing has minimal impact on your privacy.
We do not use your data for advertising, profiling, or automated decision-making.
3. Who we share it with
We do not sell or rent personal data. We share it only with the service providers who help us operate the site and respond to enquiries. Each processes data on our instructions and under a written agreement.
The current providers are:
- Vercel Inc. — website hosting and privacy-respecting analytics (no cookies, no personal identifiers).
- Notion Labs Inc. — storage of demo requests and enquiry records.
- Resend (Resend.com Inc.) — sending transactional emails on our behalf.
These providers may process data outside the UK, including in the United States. Where they do, transfers are protected by the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework, depending on the provider.
4. How long we keep it
We keep enquiry and demo-request data for as long as necessary to respond to you and follow up on the conversation, and for a reasonable period afterwards (typically up to 24 months) so we can refer back to prior context if you re-engage. After that, we delete or anonymise it.
If you become a customer, we keep records related to that relationship for as long as the relationship lasts, plus any period required by law (for example, financial records for six years).
If you ask us to delete your data sooner, we will, unless we have a legal reason to retain it.
5. Your rights
Under UK data protection law, you have the right to:
- Access the personal data we hold about you.
- Correct it if it's inaccurate or incomplete.
- Ask us to delete it, where there's no overriding reason for us to keep it.
- Restrict how we use it, in certain circumstances.
- Receive a copy in a portable format.
- Object to processing based on legitimate interest.
- Withdraw consent at any time, where consent is the basis for processing.
To exercise any of these rights, email hello@griotech.co.uk. We will respond within one month.
If you believe we've handled your data improperly, you can complain to the UK Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to address it first.
6. Cookies
We do not set cookies for analytics, advertising, or tracking. The only cookies our site may use are strictly necessary ones — for example, to remember a preference you've set during your visit. These do not require consent under UK law.
If we add anything that does require consent in future, we will update this policy and present a clear consent option at that point.
7. Security
We protect personal data with appropriate technical and organisational measures, including encrypted transmission (HTTPS), restricted access, and careful selection of service providers. No system is perfectly secure, and we cannot guarantee absolute protection — but we treat the data we hold with care and respond promptly if anything goes wrong.
If a personal data breach occurs that's likely to affect your rights, we will notify the ICO within 72 hours and, where required, contact you directly.
8. Links to other sites
Our site may link to external websites. We are not responsible for their privacy practices. When you follow a link off our site, that site's privacy policy applies.
9. Changes to this policy
We update this policy when our practices change or when there's a legal reason to do so. The effective date at the top reflects the most recent revision. For material changes, we will note the change clearly when you next visit the site.
10. Contact
For questions about this policy or about how we handle your personal data: