Privacy policy
Last updated 9 October 2026
This policy explains how GrantProof Ltd uses personal data.
Who we are
GrantProof Ltd is a company registered in England and Wales (company number 17315366), with its registered office at 3 Manor Road, Sandown, PO36 9JA, United Kingdom. We provide software that helps research organisations record staff time on grants and calculate grant salary costs.
For the personal data described in this policy, GrantProof Ltd is the controller. You can contact us about it at accounts@grantproof.co.uk.
Data in the GrantProof platform
Organisations such as universities and research institutes use GrantProof to manage information about their research staff, such as names, work email addresses, staff numbers, job and salary details, and timesheets. For that data, the organisation you work for is the controller, and we process it only on its instructions, under a contract with it.
That organisation's own privacy notice explains how it uses the data. Questions and requests about it should go to that organisation. If you send them to us, we will pass them on promptly.
What we collect and why
People who request a demo or contact us
- What we collect
- The details you give us, such as your name, work email address, organisation, job title and message.
- Why we use it
- To reply, arrange a demo and follow up on your enquiry.
- Lawful basis
- Our legitimate interest in responding to enquiries about our service.
Contacts at customers, prospects and suppliers
- What we collect
- Names, work contact details and our correspondence with you.
- Why we use it
- To manage our business relationship and contracts.
- Lawful basis
- Performing a contract, or our legitimate interest in running our business.
Visitors to our website
- What we collect
- Technical data such as your IP address, browser type and the pages you request, recorded by our hosting provider.
- Why we use it
- To run the website and keep it secure.
- Lawful basis
- Our legitimate interest in operating a secure website.
Anyone whose data appears in our business records
- What we collect
- Contracts, invoices and related records.
- Why we use it
- To meet our legal, tax and accounting obligations.
- Lawful basis
- Legal obligation.
We do not sell personal data, and we do not use it for automated decision-making that affects you.
Who we share it with
We use trusted service providers who process personal data only on our instructions and under contracts that protect it. They provide:
- website and application hosting
- database hosting and secure file storage
- email, including business email and the delivery of emails we send
- error monitoring, to find and fix faults
- an AI assistant our staff use for support and administration, under business terms that do not allow it to use your data to train its models
We may also share personal data with our professional advisers, or where the law requires it, for example with a regulator or the police.
Transfers outside the UK
Data in the GrantProof platform is stored in London. Some of our providers, including our email and error-monitoring services, process data in the United States or the European Union. Where data leaves the UK, it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by contract terms approved by the Information Commissioner, such as the International Data Transfer Agreement or Addendum. You can ask us for details of these safeguards.
How long we keep it
| Data | How long we keep it |
|---|---|
| Demo requests and enquiries that do not lead to a contract | Up to 2 years after our last contact with you |
| Customer and supplier contacts and correspondence | For the length of the relationship, then up to 6 years |
| Contracts, invoices and accounting records | 6 years after the end of the financial year they relate to |
| Website technical logs | A short period set by our hosting provider, for security |
| Data in the GrantProof platform | As set by our contract with the organisation that controls it. When a contract ends, the data is returned to that organisation and then deleted. |
When we delete data, copies in backups are removed as those backups expire.
Your rights
You have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct data that is wrong or incomplete
- ask us to delete your data
- ask us to restrict how we use your data
- object to us using your data on the basis of our legitimate interests
- ask us to transfer data you gave us to another organisation
To use any of these rights, email accounts@grantproof.co.uk. We will respond within one month, and there is normally no charge. Some rights have limits, and we will explain if one applies.
How to complain
If you are unhappy with how we have handled your personal data, please tell us first at accounts@grantproof.co.uk. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome.
You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
If you live outside the UK, you may also be able to complain to the data protection authority in your country.
Security
We protect personal data with encryption in transit and at rest, access controls, and audit logging. Only people who need access to do their job have it.
Cookies
Our website does not use analytics or advertising cookies. The GrantProof platform uses only the cookies it needs to keep you signed in securely.
Changes to this policy
We will update this policy when how we use personal data changes, and change the date at the top. Significant changes will be highlighted on this page.