Privacy Policy

Grails Privé (“we”, “us”, “our”) is the UK private company responsible for the personal information described in this policy. This policy applies to joingrails.com, our private platform, membership applications, club groups, services, transactions with us and marketing communications.

We act as controller when deciding why and how this information is processed. Stripe, banks, advertising providers and messaging platforms also process information for their own purposes under their privacy notices. A member trading with you is independently responsible for the information they receive.

We collect information directly from you, from your use of our services, from members and references you provide, and from payment, advertising and technology providers.

Identity and contact details

Name, email address, telephone number, postal and billing addresses, location, account identifiers and profile details.

Membership and professional information

Applications, club selections, business details, trading history, references, verification records, membership status and communications with our team.

Activity and transaction records

Listings, buying requests, photographs, descriptions, messages, service orders, invoices, payment status, refunds, disputes and support correspondence.

Payment information

Billing details, payment references, amounts, currency, card brand and last digits, bank transfer details and records needed to reconcile payments or issue refunds. Card numbers and security codes entered into Stripe are handled by Stripe, not stored in our application database.

Technical and advertising information

IP address, browser and device details, approximate location, referring pages, campaign identifiers, cookies, pages viewed, interactions, conversion events and interests inferred from those interactions.

Preferences and requests

Consent records, marketing subscriptions, privacy choices, opt-outs and requests to exercise privacy rights.

Identity documents and financial information supplied for verification are restricted to that purpose, fraud prevention, payment administration and legal compliance. Do not send card security codes, account passwords or unnecessary sensitive information in messages or application forms.

We use personal information for the purposes below. Under the UK GDPR and EU GDPR, our legal bases are performance of a contract or steps requested before a contract; compliance with legal obligations; consent; and legitimate interests balanced against your rights.

Providing information required for an application, payment or ordered service is necessary to process that request. Marketing and optional tracking choices are not conditions of membership. We do not make membership decisions solely through automated processing that produces legal or similarly significant effects.

Stripe processes card and supported electronic payments, payment authentication, fraud checks, billing and refunds. Information sent to Stripe includes contact and billing details, order references, amount, currency and device or payment information needed to complete the transaction. Stripe acts as a processor for certain activities and an independent controller for others, including its own regulatory and fraud-prevention obligations. See Stripe’s Privacy Policy.

For bank transfers, we and our banking providers process the payer’s name, bank details visible on the transfer, amount, currency, payment reference, transaction date and reconciliation records. We use these records to identify payments, provide services, prevent fraud, process refunds and meet accounting obligations. Never send online banking credentials to us.

Payment and identity records are not provided to advertising platforms. Any advertising conversion event is limited to permitted event and attribution data; it does not include full card details, bank account details, identity documents or private messages.

Our website uses essential storage for security, service functionality and remembering privacy choices. Analytics and advertising technologies are enabled by default. You can turn them off using Privacy choices. Turning them off does not prevent you from browsing or applying for membership.

Google Analytics measures use of our website. Google Ads and Meta advertising tools measure campaign performance, attribute applications and purchases, and support remarketing and audience targeting. These tools use cookies, pixels, tags, click identifiers and browser or server-side events. Relevant data includes IP address, device and browser information, pages viewed, campaign source, event time and conversion value. Privacy choices apply to the browser technologies controlled by this site.

Where matching is used for advertising, identifiers may be hashed before transmission. You can turn off advertising in Privacy choices. Hashing does not make personal information anonymous. Private group conversations, verification documents and detailed financial information are excluded from advertising data.

Change your choices at any time using Privacy choices. Turning a category off stops subsequent processing controlled by that choice. Browser settings can also remove cookies. Choices are specific to the browser unless you make an account-level request to us.

Google and Meta also process data under their own policies. Read Google’s partner-site information and Meta’s Privacy Policy. Advertising preferences can be managed through Google My Ad Center and Meta account settings.

We send marketing by email, SMS and WhatsApp only with your consent for the relevant channel. Consent to one channel does not subscribe you to another. Applying for membership, accepting our terms or paying for a service does not by itself subscribe you to marketing. Marketing messages identify Grails Privé. Messages can be delivered using automated systems; frequency varies. Consent is not a condition of a purchase.

You can withdraw consent at any time. Click the unsubscribe link in an email, reply STOP to an SMS or WhatsApp marketing message, or email hello@grailsprive.com and tell us which channels to stop. We process opt-outs promptly and retain a suppression record to prevent further marketing to the opted-out contact. Normal messaging or data charges from your network provider apply. Reply HELP or contact us for assistance. An opt-out confirmation can be sent to confirm your request; further marketing requires a new opt-in.

Mobile telephone numbers and SMS or WhatsApp opt-in records are not sold or disclosed to other businesses for their own marketing, or used for advertising audience matching. Messaging providers process them only to operate our messaging programme, subject to contractual restrictions.

Opting out of marketing does not stop essential service messages, including application decisions, security notices, payment receipts, contractual changes and responses to your requests. We do not include promotional content in messages sent solely for those purposes.

We disclose information to providers that support hosting, databases, communications, member administration, security, payment processing, analytics, advertising and professional advice. They receive the information required for their functions, subject to appropriate contractual and legal safeguards. These include Cloudflare, Stripe, Google, Meta, WhatsApp and Telegram, and our banking and communications providers.

Your chosen profile, listings, buying requests and group messages are visible to the relevant members. WhatsApp and Telegram visibility also depends on the product and your settings; your telephone number, username or profile details can be visible to other participants. Joining a private group does not make its contents inaccessible to the group’s members. Members are prohibited from harvesting contact details or disclosing private club content without authority.

We share information with reference providers and verification partners to assess eligibility, and with authorities, courts, insurers and advisers when necessary to meet legal duties, investigate wrongdoing or protect legal rights. In a genuine business sale or restructuring, relevant information is shared under confidentiality protections and this policy continues to apply until any lawful notified change.

We do not sell personal information for money. Disclosure of online identifiers and activity to advertising providers can constitute a “sale” or “sharing” under California law. Your advertising choices control this disclosure. We do not use sensitive information to build advertising audiences.

We operate internationally and use providers that process information in the United Kingdom, European Economic Area, United States and other countries. Data transferred outside the UK or EEA receives the safeguards required by the applicable data-protection law: an applicable adequacy decision, an approved transfer mechanism such as the EU Standard Contractual Clauses with the UK Addendum or UK International Data Transfer Agreement, or an applicable statutory exception. Reliance on a certification framework is limited to recipients and data covered by a valid certification.

You can request details of the safeguards relevant to your information at hello@grailsprive.com.

We keep information for its stated purpose and delete or anonymise it when no longer required. Our retention criteria are the duration of the relationship, the service provided, legal recordkeeping duties, consent and the time needed to resolve disputes or enforce rights.

• Unsuccessful or withdrawn applications: up to 24 months after the application closes, unless a specific fraud-prevention or legal reason requires a longer record.
• Active membership and service records: for the relationship, followed by up to six years for contractual, accounting and claims records. Routine profile information is removed earlier when it is no longer needed.
• Payment and tax records: six years after the relevant financial period, or a longer period required by law.
• Verification material: only for the verification and any necessary review or dispute period; unnecessary document copies are deleted after the decision. A limited decision record is retained with the membership record.
• Analytics event data: no more than 14 months. Advertising providers apply their own disclosed retention to data they control.
• Consent, opt-out and privacy-request records: for as long as needed to demonstrate and honour the relevant choice and legal obligations.

A documented legal hold suspends deletion of records relevant to a dispute, investigation or legal duty. Access is limited to authorised personnel and service providers, with technical and organisational measures appropriate to the data and risk. No internet service can guarantee absolute security. Report suspected exposure or misuse to our contact address promptly.

You can request access to your personal information, correction, erasure, restriction, and a portable copy of information provided under consent or contract. You can withdraw consent and object to processing based on legitimate interests. Your right to object to direct marketing is absolute. Other rights are subject to the conditions and exceptions in the applicable law, including duties to retain transaction records.

Send requests to hello@grailsprive.com or our business address. Tell us the email or account associated with the request and what you want us to do. We verify identity proportionately and do not request more information than necessary. An authorised representative must demonstrate authority. Requests are normally free; any legally permitted fee or refusal is explained.

We respond to UK and EEA requests within one month. A lawful extension of up to two additional months for complex or multiple requests is notified within the first month with reasons. You can complain to the UK Information Commissioner’s Office or your local supervisory authority. You do not have to complain to us first.

Residents of other jurisdictions can contact us to exercise applicable access, deletion, correction, portability and targeted-advertising rights. If we refuse a request, you can appeal by replying with “Privacy appeal”; we explain our decision and applicable regulator complaint options.

This section is our notice at collection and California privacy notice. The categories collected are identifiers; customer records such as contact and billing details; commercial information; internet and network activity; approximate geolocation; professional information; user-supplied content; and interest inferences. Sensitive personal information is limited to identity or financial information supplied for verification, payment or account security. We do not request precise location, biometric identification or the contents of unrelated private communications.

The information, sources, purposes, recipient categories and retention criteria for each activity are set out above. Identifiers, internet activity, commercial conversion events and interest inferences are disclosed to Google and Meta for advertising with consent. These disclosures can constitute sale or sharing for cross-context behavioural advertising. We do not sell or share identity documents, bank details or private club messages for advertising, and we do not knowingly sell or share information about anyone under 16.

You can request the categories and specific pieces of information held about you, information about disclosures, correction, deletion and a portable copy. You can opt out of sale or sharing without verifying your identity or creating an account. Use Do not sell or share my personal information and disable advertising. We recognise Global Privacy Control as an opt-out signal for the browser sending it. To extend an opt-out to an identifiable account, contact us using the email associated with that account.

We use sensitive personal information only to provide requested services, process payments, maintain security, prevent fraud and comply with law, not to infer characteristics for advertising. We do not discriminate against you for exercising a privacy right or require you to waive it. No financial incentive is offered in exchange for personal information.

Submit requests or authorised-agent requests to hello@grailsprive.com. For requests to know, delete or correct, we acknowledge receipt within 10 business days and respond within 45 calendar days. Any permitted extension, up to a total of 90 days, is explained within the original period. Opt-out requests are acted on as soon as practicable and within 15 business days. We use verification information only for verification and security.

Membership and services are for people aged 18 or over. We do not knowingly collect children’s personal information for membership or marketing. Contact us if a child’s information has been submitted.

We publish changes to this policy with a new effective date. Material changes are brought to members’ attention, and new consent is obtained where required. An update does not retrospectively remove your rights or permit an incompatible use of information without a lawful basis.