Privacy Policy

Who we are

Cirraw Ltd is a company registered in England and Wales. We provide Google Workspace security products and services, including CheckPost, Four Eyes, Security Audit, and AI Workflow Training.

CIRRAW LTD · Company No. 17107243 · Registered in England & Wales

What information we collect

We collect only the information necessary to provide our services and respond to enquiries. This may include:

Your name and email address when you contact us or book a call
Your organisation name and job title, if provided
Information about your Google Workspace environment, shared as part of a security engagement
Technical information submitted during a security audit or product deployment

We do not currently use cookies, website analytics tools, or advertising trackers on cirraw.io.

How we use your information

We use the information we collect to:

Respond to your enquiries and manage bookings
Deliver our products and services to you
Fulfil our contractual obligations
Comply with legal and regulatory requirements

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Legal basis for processing

Under UK GDPR, we rely on the following lawful bases:

Legitimate interests — to respond to enquiries and run our business
Contract — to deliver services you have engaged us for
Legal obligation — where we are required to process data by law

Who we share your data with

We may share your data with trusted third-party service providers who help us deliver our services, such as:

Google (Workspace, Calendar, Gmail) — for communication and scheduling
Any subcontractors engaged to assist with a specific engagement, bound by confidentiality

We require all third parties to respect the security of your data and to treat it in accordance with the law. We do not transfer your data outside the UK or EEA.

How long we keep your data

We retain personal data only as long as necessary for the purposes it was collected, or as required by law:

Enquiry and contact data is retained for up to 12 months
Client engagement data is retained for 6 years following the end of the engagement, in line with UK statutory requirements

You may request deletion of your data at any time (see section 08).

Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure.

All client data shared during a security engagement is handled under mutual NDA as standard and is not retained beyond the engagement period without explicit written agreement.

Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request erasure of your data (the ‘right to be forgotten’)
Object to or restrict how we process your data
Data portability, where applicable

To exercise any of these rights, contact us at data-protection@cirraw.io. We will respond within 30 days.

Changes to this policy

We may update this privacy policy from time to time. The current version will always be available at cirraw.io/privacy. We will notify you of material changes where we have your contact details.

This policy was last updated in March 2026.

Questions or requests

Contact us about privacy

If you have any questions about this policy or want to exercise your data rights, get in touch. We aim to respond within 30 days.

data-protection@cirraw.io cirraw.io

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.