Overview
At a glance
Where data leaves the EEA, it is covered by a lawful transfer safeguard.
Customers are told of a breach affecting their data without undue delay after we become aware of it.
Governed by our written AI Use Policy.
Our Article 28 Data Processing Agreement is available on request.
Security
Security practices
Riskwise GRC is a small, senior-led firm. These are the controls that protect client information today.
- 2-Step Verification is enforced for every Google Workspace account.
- Work laptops use full-disk encryption.
- Passwords are kept in a password manager.
- Access to client data is limited to our Director and, where authorised and necessary, our privacy contact.
- All staff and contractors sign written confidentiality agreements.
- Our website is served only over encrypted HTTPS connections.
Security questionnaires
We are happy to complete your organisation's security or vendor due diligence questionnaire.
Data protection
How we handle personal data
- Our role
- When we process personal data on a client's behalf during an engagement, we act as a processor under a Data Processing Agreement. For our own website enquiries and business contacts, we are the controller, as described in our Privacy Policy.
- Transfers outside the EEA
- Some of our suppliers process data outside the European Economic Area, including in the United States. Each transfer is covered by a safeguard recognised under the GDPR: the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. The table below shows which applies to each supplier.
- Retention
- Client engagement records are kept for 7 years, in line with Irish statutory requirements. Enquiries that do not lead to an engagement are deleted within 12 months. At the end of a processing engagement, client data is returned or deleted as set out in our Data Processing Agreement.
- Your rights
- To access, correct or delete your personal data, or to object to how we use it, email wande@riskwisegrc.com. You can also complain to the Data Protection Commission at dataprotection.ie.
Sub-processors
Who processes data for us
We give clients 30 days' notice, by email and on this page, before adding or replacing a sub-processor of their data.
Sub-processors of client data
The only supplier that processes our clients' personal data.
| Supplier | What it does | Where it processes data | Transfer safeguard |
|---|---|---|---|
| Google (Google Workspace) | Email and document storage | Global, including the United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
Website and demo suppliers
These suppliers support our public website and training platform demo. They do not process client data.
| Supplier | What it does | Where it processes data | Transfer safeguard |
|---|---|---|---|
| Netlify | Hosts our website | International, including the United States | Standard Contractual Clauses and EU-U.S. Data Privacy Framework |
| Formspree | Delivers messages sent through our website forms | United States (Amazon Web Services) | Standard Contractual Clauses |
| Uploadcare | File uploads in our training platform demo | United States (Amazon Web Services) | Standard Contractual Clauses and EU-U.S. Data Privacy Framework |
| Google Fonts | Loads our website typefaces in your browser | Global, including the United States | EU-U.S. Data Privacy Framework |
Artificial intelligence
How we use AI
We use Claude, on a business plan, to support internal work such as drafting, research and website development.
We do not enter client data or personal data into AI tools. Our use of AI is governed by a written AI Use Policy.
Our training platform demo was built with AI assistance, but does not use AI when you use it.
Training platform
Our compliance training platform
Before the platform processes any customer's data, we will publish here where it is hosted, the security controls that protect it, and any additional sub-processors, and we will update our Data Processing Agreement to match.
Incidents
Reporting a concern
Our privacy contact coordinates personal data breaches, data subject requests and data protection questions.
If a breach affects a client's personal data, we notify the client without undue delay after becoming aware of it, so they can meet their own obligations.
If you believe you have found a security issue on our website, or have a concern about how we handle data, please contact us.
Documents
Documents and requests
Data Processing Agreement
Our Article 28 GDPR agreement for engagements where we process personal data on your behalf.
Request →Security questionnaire
We will complete your organisation's security or vendor due diligence questionnaire.
Request →AI Use Policy
The policy that governs how everyone working for us uses AI tools.
Request →
How to request
These documents are available on request. Choose "Request" beside the one you need and our contact form will open with the document already filled in. We will reply by email.
Need something else? Ask us through the contact form.