Privacy policy

This policy explains what personal data we collect through this website, why we collect it, how long we keep it and what you can require us to do about it. It is written to be read rather than to be survived.

Who we are

The controller of the personal data described here is:

We are not required to appoint a data protection officer, and we have not appointed one. Requests about your data are handled at the address above and are answered by us directly.

What this policy covers

This policy covers the website at gridsearch.ai and the forms, booking links and email addresses reachable from it.

It does not cover data we handle inside a client engagement — for example data we see in your systems while carrying out an audit or an integration. In that situation we act on your instructions as a processor, not as a controller, and the terms are set in the contract between us rather than here. There is a short note on that at the end.

What we collect and why

When you submit the contact form

We collect your first and last name, email address, and the message you write. If you choose to fill them in, we also collect your company name, telephone number and the service your enquiry concerns.

We use this to read your enquiry and reply to it, and to keep a record of the exchange if it leads to a proposal. The legal basis is your consent, which you give by ticking the box on the form. You can withdraw it at any time, and withdrawing it does not affect replies we already sent.

When you book a call

If you book a meeting through the scheduling link, we collect your name, email address and the time you selected, together with anything you add in the booking notes. We use it to hold the meeting. The legal basis is your consent, or the steps taken at your request before entering into a contract.

When you subscribe to our newsletter

We collect your email address, and your name if you give it. We use it to send occasional emails about our work. The legal basis is your consent. Every email contains an unsubscribe link, and unsubscribing takes effect immediately.

When you simply read the site

Our hosting provider records technical information in server logs, including your IP address, the pages requested and your browser type. This is used to keep the site available and to investigate abuse and security incidents. The legal basis is our legitimate interest in operating the site securely.

Separately, the site uses cookies. Analytics cookies are only set if you accept them in the cookie banner, and nothing non-essential is set before you do. The cookie policy lists each cookie, what it does and how long it lasts.

If you become a client

We hold the contact and company details needed to perform the contract, together with contract documents, invoices and payment records. The legal basis is the performance of the contract and, for accounting records, our legal obligations under Romanian law.

How long we keep it

We do not keep personal data indefinitely, and the period depends on why we hold it.

What	How long	Why that long
Contact form enquiries that do not lead to a contract	24 months from the last exchange	Long enough to pick up a conversation that resumes, short enough not to accumulate
Newsletter subscription	Until you unsubscribe	Consent-based, and yours to end
Record that consent was given, after it ends	A further 3 years	So we can show consent existed if it is ever questioned
Meeting bookings that do not lead to a contract	24 months	As above
Contracts, invoices and accounting records	10 years	Required by Romanian accounting law
Documentation produced for an audit of a funded project	As required by the funding contract	Funding programmes set their own archiving periods, and they differ by programme and call
Server logs	Up to 12 months	Security investigation

When a period ends, the data is deleted or anonymised. Where a record has to be kept for accounting reasons, we keep only that record and not the surrounding correspondence.

Who else handles your data

We do not sell personal data, and we do not share it for anyone else’s marketing. We do use service providers who process data on our behalf, under contract and on our instructions:

• HubSpot — hosts this website and provides the forms, the customer records and the newsletter. Data is stored in the European Union.
• Zoho Mail — hosts our email, so correspondence you send us is stored there. Our account is on Zoho’s European data centre.
• Our accountant and accounting software — receive invoicing and payment data where there is a contract.

We also disclose data where the law requires it, for example to a public authority acting within its powers, or where it is necessary to establish or defend a legal claim.

Transfers outside the EEA

Our website and customer records are hosted by HubSpot on infrastructure in the European Union. HubSpot, Inc. is established in the United States and may access the data from there in order to provide and support the service.

That access is a transfer outside the European Economic Area. It takes place on the basis of the EU–US Data Protection Framework, supplemented by the standard contractual clauses approved by the European Commission. You can ask us for a copy of the clauses that apply.

Our email is held on Zoho’s European data centre, so it is stored inside the European Union. Where companies in the Zoho group outside the EEA access it in order to provide support, that access takes place on the basis of the same standard contractual clauses.

Your rights

Under the GDPR you can require us to do the following, and we will not charge you for it.

• Tell you what we hold — a copy of your personal data, and an explanation of what we do with it.
• Correct it — if something we hold about you is wrong or out of date.
• Delete it — where we no longer have a reason to keep it. Records we are legally required to retain are the exception, and we will say so if that applies.
• Restrict what we do with it — while a correction or an objection is being resolved.
• Receive it in a portable form — in a structured, machine-readable file, where we hold it on the basis of consent or a contract.
• Object — to processing based on our legitimate interests.
• Withdraw consent — at any time, where consent is the basis we rely on.

Write to contact@gridsearch.ai. We reply within one month. If a request is genuinely complex we may extend that, and we will tell you before the month is out rather than afterwards. We may ask you to confirm your identity, but only where we have real doubt about who is asking.

Complaints

If you think we have handled your data wrongly, tell us first — it is usually quicker to fix than to escalate. You are entitled to go straight to the supervisory authority instead, and you do not need our agreement to do so.

Security

Access to the systems holding your data is limited to the people who need it, protected by individual accounts and multi-factor authentication. Data is encrypted in transit, and the website is served over HTTPS only.

No measure makes a breach impossible. If one occurs and it is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly where the regulation requires it.

Automated decisions and profiling

We do not make decisions about you by automated means, and we do not profile you. Analytics tells us which pages are read; it is not used to score, rank or categorise individuals.

Children

This site is addressed to businesses and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, tell us and we will delete it.

When we work on your systems

During an engagement — an audit, an integration, a migration — we may see personal data held in your systems. In that work you remain the controller and we act as a processor on your written instructions.

What we may do with that data, how long we hold it, how it is secured and whether anyone else is involved are set out in the data processing agreement that forms part of our contract, not in this policy. We do not use data from a client engagement for our own purposes.

Changes to this policy

If we change how we handle personal data, we update this page and change the date at the top. Where a change materially affects you and we hold your contact details, we tell you rather than relying on you to notice.