Privacy Policy

1. Who we are and how to reach us

This privacy policy is issued by GrantCookie, which operates the website at grantcookie.com and the application at app.grantcookie.com and provides the service defined in section 2. GrantCookie is a cookie consent management platform. It scans a website for cookies and trackers, shows a consent banner to the people who visit that website and keeps a log of the choices they make. Our legal name and registered address are available on request from privacy@grantcookie.com.

You can reach us at the addresses below. We reply within one working day.

privacy@grantcookie.com: anything about personal data, including this policy, requests to exercise your rights, complaints, our data processing agreement and notices under it, our list of sub-processors and security reviews. This address is also our contact point for questions about how we process personal data under India’s DPDP Act.
support@grantcookie.com: help with your account or the service, closing your account, and notices under our terms and conditions.
sales@grantcookie.com: plans and pricing.
partners@grantcookie.com: partner programmes.

2. What this policy covers and the words it uses

This policy explains what personal data we collect, where it comes from, why we use it, how long we keep it, who we share it with and what rights you have. It applies to the website, the application and the service.

In this policy:

“GrantCookie”, “we”, “us” and “our” mean GrantCookie, the provider of the service.
“The website” means the public pages at grantcookie.com.
“The application” means the pages at app.grantcookie.com, where customers register, sign in and use the service.
“The service” means the cookie consent management platform we provide to customers through the website and the application: the cookie scanner, the consent banner, the per-market rules, the consent log, the cookie policy generator and the integrations, including the JavaScript API, together with related support.
“A customer” is a person or organisation that holds an account in the application.
“A visitor” is a person who reads the website, or opens the application without signing in.
“An end user” is a person who visits a customer’s website where the banner runs.
“A working day” is any day from Monday to Friday, including public holidays.

“You” means the person reading this policy. You may be:

a visitor;
a person who contacts us or subscribes to our newsletter;
a customer, or a person who uses the application on a customer’s behalf; or
an end user.

2.1 Two roles: controller and processor

For personal data about visitors, people who contact us, newsletter subscribers, and customers and the people who use their accounts, we decide why and how the data is used. We are the controller under the EU General Data Protection Regulation (the GDPR) and the UK GDPR and, where those laws apply to us, the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) and the business under the California Consumer Privacy Act as amended by the California Privacy Rights Act (the CCPA). Sections 3.1 to 3.3 describe this data.

For the consent records that customers’ banners create, the technical data an end user’s browser sends when the banner loads, and any personal data that appears in a customer’s scan results, the customer decides why and how the data is used. The customer is the controller, and we process the data on the customer’s documented instructions as its processor. Our data processing agreement with the customer governs this processing. It is published at grantcookie.com/dpa/ and is also available from privacy@grantcookie.com. Where those laws apply, we are also the customer’s data processor under the DPDP Act and its service provider under the CCPA. Section 3.4 describes this data. If you are an end user, the privacy notice of the website you visited is the main notice for you, and section 8.4 explains how we can help.

3. The data we collect and where it comes from

3.1 Visitors

The website shows a banner that asks whether we may use analytics cookies. Until you choose, it sets no cookies, uses no local storage and loads nothing from other parties’ domains. The banner is served from api.grantcookie.com, our own domain. The login page of the application sets no cookies. Our cookie policy describes this in more detail.

When your browser requests a page of the website or the application, it sends our servers the information that any web request carries: its IP address, the page requested, the date and time, the browser and operating system it reports and, if there is one, the page that linked to ours. Our servers use this information to deliver the page and may record it in server logs, which we use only to keep the website and the application running and secure. We do not use these logs to profile you, and we do not try to identify you from them unless we need to investigate an attack or a fault. When your browser loads the banner from api.grantcookie.com, our servers receive the same kind of information, and we count the pageview.

When you make a choice in the banner, we keep a record of it so that we can show what you agreed to: the choice for each category the banner offers, the date and time, the version of the banner you saw and a random consent ID, which the banner also stores in a cookie. To make the record, the banner sends our servers your choice together with the address of the page you were on, the page that linked to it, if any, and your browser’s user agent. If your browser sends Global Privacy Control, the banner records a refusal of analytics cookies without asking you. For the website, we are the controller of these records.

If you accept analytics cookies, the website uses Google Analytics, a measurement service provided by Google. Through the cookies our cookie policy describes, Google Analytics collects information about your visit, such as the pages you open, the page that linked to ours, the time of your visit, your browser, operating system, device and language, and your approximate location, which Google works out from your IP address. Google states that Google Analytics does not log or store the IP addresses of users in the European Union, Switzerland or the United Kingdom. We use the reports in aggregate, to see which pages are read and how people find the website. We do not use Google Analytics to identify you, and we do not use it for advertising: the website tells Google that advertising storage and ads personalisation are not allowed, and Google signals is switched off. If you refuse analytics cookies, or make no choice, none of this is collected.

Apart from your choice in the banner and, if you accept them, analytics data, we collect nothing else from you unless you use the free website scan, contact us, subscribe to the newsletter or register for an account.

If you use the free website scan, you give us the address of a website. Our server fetches that one page and reports the trackers, services and cookies it finds. To stop the scan being misused, we count scans against a one-way hash of your IP address for a short time, at most one hour, and we keep each result for 30 minutes so that a repeat scan of the same address is answered from the stored result. We do not store your IP address itself and we do not link a scan to you. The website you scan is fetched as any visitor would fetch it; we do not keep a copy of its pages.

3.2 People who contact us or subscribe to the newsletter

If you email us, we receive your email address, your name if you give it, the content of your message and any attachments. A work address may also tell us which organisation you work for.

If you subscribe to our monthly newsletter about privacy law, we collect your email address. So that we can show that you asked to receive it, we also record when you subscribed, the wording of the box you ticked and the page you subscribed from. To stop the form being misused, we count sign-ups against a one-way hash of your IP address for at most one hour. We do not store your IP address with your subscription.

Every issue has an unsubscribe link. You confirm with one click and we stop sending to you. If you unsubscribe and later fill in the form again, your address stays unsubscribed; email privacy@grantcookie.com if you want to receive the newsletter again. We never sell or share your address, and we do not add subscribers to a sales sequence.

3.3 Customers and users of the application

You give us most of this data yourself when you register and use the application. The rest is generated by your use of the service. If you use an account that belongs to a customer organisation, some of it may come from that customer.

Account data: the email address and sign-in credentials you register with. If you give us your name or your company’s name, we keep those too.
Billing data: if you move to a paid plan, the billing details you give us, your plan, your invoices and a record of each payment. We do not store full payment card numbers. No card is needed to start, including for the 14-day trial, so we hold no billing data until you add a payment method.
Configuration data: the domains you add, the regulations you choose, the banner layout, colours, fonts, button shapes and copy you set, any banner text you override, and the integrations you switch on, such as Google Consent Mode v2, IAB TCF v2.3, Google Tag Manager, WordPress, Shopify, Wix or the JavaScript API.
Scan results: we crawl the domains you add, on the schedule your plan includes, and record the cookies, trackers and pixels we find, sorted into categories, with the third parties that set them named. Scan results describe your website rather than a person, but they can contain personal data if your pages do, for example a page address that includes a name. We process any such personal data on your behalf as your processor, as section 3.4 explains. Where your plan includes change alerts, we may send them to the email address on the account.
Usage data: records of your sign-ins, including the date and time and the IP address and browser used, information about how you use the application, and the number of pageviews on your domains. We count pageviews because our plans are priced by volume.
Support data: your correspondence with support and the details of the problem, including any screenshots or exports you send.
Imported consent records: on paid plans you can send us a CSV export of consent records from a previous platform so that your audit trail continues. We import it into your consent log and process it as your processor, as section 3.4 describes.

Once you sign in, the application sets cookies that are strictly necessary to keep your signed-in session and to protect the forms you submit, as our cookie policy describes. Because they are strictly necessary, we do not ask for consent to them.

If you give us another person’s name and email address, for example a colleague’s, please make sure they have seen this policy. Where an agency manages domains for its own clients, the agency is our customer and is responsible for its agreements with those clients.

3.4 Data we process for customers

When a customer adds the banner script to a website, the banner works out where the end user is, at the level of country or region, and applies the rule for the regulations the customer has selected: for example, opt-in where the GDPR applies and opt-out where the CCPA applies. It records the choice the end user makes in the customer’s consent log, which we hold as processor on the customer’s behalf.

A consent record contains only:

the choice made for each category (necessary, functional, analytics and marketing);
the date and time of the choice;
the version of the banner the end user saw, so that the record shows what the end user was asked and not only what they answered; and
where the customer enables IAB TCF v2.3, the consent string that framework defines.

A consent record does not contain the end user’s name, email address or IP address. The banner does not ask for a name or an email address, and we do not combine consent records with other data we hold. Consent records that a customer imports from another platform hold the fields in the file the customer sends us.

To show the banner and record a choice, the end user’s browser sends our servers its IP address and the other technical data that any web request carries, such as the user agent string and the browser’s language setting, and the service associates the request with a country or region. We use this technical data on the customer’s behalf while the request is handled, to show the banner in the end user’s language, to apply the customer’s settings and to keep the service secure. It is not added to the consent record. Our servers may record it in server logs, which we keep only for as long as we need them for those purposes and then delete on a fixed schedule, as our data processing agreement sets out.

Anything the banner stores in an end user’s browser, for example to remember that person’s choice, is stored on the customer’s behalf, and the customer’s own cookie policy is the place that describes it.

Where the customer switches on Google Consent Mode v2 or IAB TCF v2.3, the banner passes the end user’s choice to the tags and vendors on the customer’s website in the form that each framework defines. What they do with it is governed by the customer’s agreements with them and by the customer’s own privacy notice.

If a customer’s scan results contain personal data, we process it only to produce the scan results for that customer.

3.5 Data we do not ask for, and what happens if you give us none

We do not ask for special categories of personal data, such as data about health, religion, ethnicity, sexuality or political opinions, or for government identifiers. If you send us such data in a message or attachment, for example details of a disability in an accessibility report, we use it only to deal with your message. The only sensitive personal information, as the CCPA defines it, that we collect is your account sign-in credentials, which we use only to authenticate you and secure your account.

Apart from what the scanner finds on the pages of the domains customers add, we do not gather personal data from public sources or social networks, and we do not buy it from data brokers.

You are not obliged to give us any personal data. But we cannot open an account without an email address and sign-in credentials, take payment without billing details, or answer a message without a way to reply.

4. Why we use the data and the legal basis

The GDPR and the UK GDPR require a legal basis for each use of personal data. Where we rely on legitimate interests, we use the data only in ways you would reasonably expect and where our interest is not overridden by your interests and rights. You can ask privacy@grantcookie.com how we weighed them. You have the right to object to any use based on legitimate interests, as section 8.1 explains.

What we do	Data involved	Legal basis under the GDPR and the UK GDPR
Run, secure and troubleshoot the website and the application	Server logs for the website and the application, usage data	Legitimate interests: keeping the website and the application available and defending them against abuse
Answer your enquiries	Contact data, support data	Legitimate interests in responding to you; for customers and prospective customers, steps taken at your request before entering into a contract, and performance of the contract
Record your choice in the banner on the website, and be able to show it	Consent record for the website	Legal obligation, where the law requires us to show that consent was given; otherwise legitimate interests in respecting and evidencing your choice
Measure how the website is used, in aggregate	Analytics data collected by Google Analytics	Consent, given in the banner, which you can withdraw at any time with the cookie preferences button
Send the monthly newsletter	Subscriber email address and subscription record	Consent, which you can withdraw at any time by unsubscribing
Create and administer your account, provide the service and count pageviews to apply plan limits	Account, configuration and usage data	Performance of our contract with you or, where you use an account on behalf of a customer organisation, legitimate interests in providing the service that organisation has asked for
Send service messages: change alerts, security notices, and notice of changes to our terms and conditions, our data processing agreement or this policy	Account data	Performance of our contract; for security notices, also legal obligation
Take payment and issue invoices	Billing data	Performance of our contract; legal obligation to keep accounting and tax records
Prevent, detect and investigate fraud, abuse and security incidents affecting the website and the application	Server logs for the website and the application, usage data, account data	Legitimate interests in protecting the website, the application, our customers and their end users; legal obligation where an incident must be reported
Understand how features are used, in aggregate, to improve the service	Usage data	Legitimate interests in improving the service; we make no decisions about individuals with this data
Establish, exercise or defend legal claims and comply with the law	Any of the data described in sections 3.1 to 3.3	Legal obligation; legitimate interests in protecting our legal position
Deliver the banner, apply the customer’s settings, keep the service secure, store, export and delete consent records, and produce scan results for a customer	Consent records, technical data sent when the banner loads, personal data in scan results	We act on the customer’s instructions as processor. The customer chooses its own legal basis, usually its duty to be able to show that consent was given

We make no decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile you for advertising.

Under the CCPA, we use personal information only for business purposes: providing the service you asked for, keeping it secure and free of abuse, debugging, maintaining and improving the service, and performing services on a customer’s behalf.

Under the DPDP Act, we process your personal data with your consent, as for the newsletter and analytics cookies, or for a legitimate use the Act permits, in particular where you gave us the data voluntarily for a stated purpose, such as opening an account, asking for support or taking a paid plan, and have not told us that you do not consent to its use for that purpose.

5. How long we keep the data

We keep personal data only for as long as we need it for the purposes in section 4. When a period ends, we delete the data or reduce it to aggregate figures that identify no one. Copies in backups are removed as the backups expire.

Data	How long we keep it
Server logs for the website and the application	Deleted on a rolling basis after a fixed period that we set for security and troubleshooting; kept longer only while we investigate a specific security incident
Contact and support correspondence	Until the enquiry is closed and any follow-up has ended; correspondence tied to a customer account is kept for the life of the account
Newsletter subscription	Until you unsubscribe. After that we keep only what we need to make sure we do not email you again
Account data	For the life of the account, then deleted after closure, except for what the rows below require us to keep
Configuration data and scan results	For the life of the account. For 30 days after closure the customer can ask support@grantcookie.com for a copy of its configuration, as our terms and conditions describe. We then delete configuration data and scan results without undue delay
Billing records and invoices	For as long as tax and accounting law requires us to keep them
Usage data	For as long as we need it for billing, security and improving the service, then deleted or reduced to aggregate figures
Consent records held for a customer	While the customer’s account is open, unless the customer tells us to delete them sooner. For 30 days after closure the customer can ask privacy@grantcookie.com for a copy, whatever plan it was on, and we then delete them without undue delay, as our data processing agreement sets out. The customer decides how long it needs to keep proof of consent under the law that applies to it
Consent records for the website	For as long as we need to be able to show that consent was given, then deleted
Cookies that remember your choice in the banner	As our cookie policy sets out: 30 days, and 365 days for the consent ID
Analytics data in Google Analytics	For the retention period set in our Google Analytics account, after which Google deletes it
Technical data sent when the banner loads	Used while the request is handled and not added to the consent record. Server logs that contain it are kept only for as long as we need them to deliver the banner and keep the service secure, then deleted on a fixed schedule, as our data processing agreement sets out
Records of rights requests and how we handled them	For as long as we need them to show how we handled the request

If a legal hold, dispute or investigation requires it, we keep the affected data until the matter is resolved, and no longer.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose personal data only to the categories of recipient below, and only as much as each needs.

Service providers that process data on our instructions, such as providers of hosting and data storage, email delivery, payment services and support tools. Each is bound by a written contract that limits what it may do with the data. For the data we process for customers, these providers are our sub-processors, and customers receive at least 30 days’ notice by email before we add or replace one, except where we must replace one urgently, as our data processing agreement sets out.
Google, which provides Google Analytics. It receives analytics data only if you accept analytics cookies.
Professional advisers, such as accountants, auditors and lawyers, where they need the data to advise us.
Authorities, regulators and courts, where the law requires it, or where disclosure is necessary to protect the rights, property or safety of GrantCookie, our customers, their end users or others. We review each request and disclose only what is required.
A buyer or successor, if we sell or transfer the business or part of it. We will tell you before your data is transferred, and this policy, or one at least as protective, will continue to apply.

Within a customer’s account, anyone the customer gives access to can see the account’s data, including scan results and consent records. An agency can see the data of each client it manages in its account. Section 3.4 describes the consent signals passed to a customer’s own tags and vendors through an integration.

We do not name individual providers here because they change. You can ask privacy@grantcookie.com for the current list. It covers every provider that handles personal data for us, whether as our service provider or as a sub-processor for customers, and states what each one does and the country in which it processes the data.

7. International transfers

Our service providers may store or access personal data in countries other than the one you live in, and some of those countries may not protect personal data as your own law does. Where that happens, we protect the data as follows.

Personal data covered by the GDPR leaves the European Economic Area only for a country the European Commission has found adequate, or under a transfer safeguard the GDPR recognises.
Personal data covered by the UK GDPR leaves the United Kingdom only for a country covered by UK adequacy regulations, or under a transfer safeguard the UK GDPR recognises.
Personal data covered by the DPDP Act is not transferred to any country the Government of India has restricted by notification.
Data we process for customers is transferred only as our data processing agreement with the customer allows. Where a transfer needs them, that agreement provides for the European Commission’s standard contractual clauses and, for transfers from the United Kingdom, the UK Addendum to them.

Google may process analytics data in the United States and in other countries where it operates. That transfer relies on a safeguard of the kind described above, and privacy@grantcookie.com can tell you which.

You can ask privacy@grantcookie.com which safeguard applies to a particular transfer and for a copy of it. We may remove commercial terms before sending it.

8. Your rights

Your rights depend on where you live and which law applies to you. Whatever law applies, we do not treat you differently for exercising a right.

8.1 Rights under the GDPR and the UK GDPR

Access: ask whether we hold personal data about you and receive a copy, with the information in this policy.
Rectification: ask us to correct or complete your data.
Erasure: ask us to delete your data where we no longer need it, where you withdraw consent, where you object and we have no overriding grounds, or where we processed it unlawfully.
Restriction: ask us to keep your data but stop using it while we check its accuracy or your objection, or where you need it for a legal claim.
Portability: receive the data you gave us, where we process it by automated means on the basis of consent or contract, in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible.
Objection: object to processing based on legitimate interests, and we will stop unless we can show compelling grounds that override your interests. Object to direct marketing at any time, and we will stop without asking why.
Withdrawal of consent: withdraw consent at any time where we rely on it, without affecting earlier processing. For analytics cookies, use the cookie preferences button in the bottom-left corner of the website.
Automated decisions: we make none that produce legal or similarly significant effects, so this right does not currently arise.

8.2 Rights of California residents under the CCPA

If you are a California resident, you have the right to: know the categories of personal information we collect, the categories of sources, the purposes, the categories of third parties we disclose it to, and the specific pieces we hold about you; delete personal information we collected from you, subject to the exceptions the law allows; correct inaccurate personal information; opt out of the sale or sharing of personal information; limit the use of sensitive personal information; and not be discriminated or retaliated against for exercising any of these rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the twelve months before the date at the top of this policy, and we do not knowingly sell or share the personal information of anyone under 16. Because we do not sell or share, we do not provide a “Do Not Sell or Share My Personal Information” link, and there is nothing to opt out of. The only sensitive personal information we collect is your account sign-in credentials. We use them only to authenticate you and secure your account, a use for which the CCPA gives no right to limit, so that right does not arise. We do not offer financial incentives in exchange for personal information. If any of this changes, we will update this policy and provide the required opt-out first.

This policy is our notice at collection. We collect, and in the twelve months before the date at the top of this policy collected, the following categories of personal information, as the CCPA lists them: identifiers, such as your email address and IP address; commercial information, such as your plan, invoices and payments; internet or other electronic network activity information, such as server logs, how you use the application and, if you accept analytics cookies, how you use the website; professional or employment-related information, namely your company name if you give it; and sensitive personal information, namely your account sign-in credentials. We collect them from you, from your browser and your use of the service and, for people who use a customer’s account, from that customer. We disclosed each category for business purposes to the categories of recipient in section 6. We did not sell or share any of them. Section 4 gives the purposes and section 5 how long we keep each category.

When we provide the service to customers, we act as their service provider. That data consists of identifiers, such as IP addresses; internet or other electronic network activity information, such as consent choices; geolocation data at country or regional level only, which the banner uses to choose the rule that applies; and any personal data that appears in a customer’s scan results. We collect it from end users’ browsers on the customer’s website, or from the customer’s pages when we scan them, and the customer’s own notice at collection applies to it.

You may use an authorised agent to make a request. We will ask the agent for your written permission and may ask you to confirm your identity with us directly.

8.3 Rights under India’s DPDP Act

If you are in India, you have the right to: a summary of the personal data we process about you and of the processing, and the identities of the data fiduciaries and data processors with whom we have shared it, with a description of what we shared; correction, completion, updating and erasure of your personal data; a readily available means of grievance redressal, which you can use by writing to privacy@grantcookie.com; nomination of another person to exercise your rights if you die or become unable to; and withdrawal of consent, where our processing is based on it, as easily as you gave it.

The Act asks you to raise a grievance with us before you approach the Data Protection Board of India. We answer grievances within the time set out in section 9.

8.4 Requests about data we process for a customer

If you are an end user and want to know what a customer’s consent log holds about you, or want a record corrected or deleted, contact the operator of the website you visited. It is the controller and decides how to respond. The consent record does not hold your name or contact details, so we cannot find your record from an email address alone.

If you write to us instead, we reply within one working day, tell you to contact the website’s operator and, where we can identify the customer from your message, forward it to that customer. We then help the customer respond, as our data processing agreement requires.

Customers whose plan includes consent log export can export their consent log from the application, and any customer can ask privacy@grantcookie.com to find, export or delete the records that an end user’s request concerns, as our data processing agreement describes.

9. How to exercise your rights and how long we take

Email privacy@grantcookie.com. Tell us which right you want to exercise and which email address or account the request concerns. You do not need to use a form or cite a law.

Identity: we need to be sure a request comes from you. Customers may be asked to write from the email address on the account. Anyone else may be asked for details that match what we hold. We ask only for what verification needs and use it for nothing else.
First reply: we reply within one working day to confirm that we have your request.
Answer: we answer without undue delay and within the period that the law applying to you sets. Under the GDPR and the UK GDPR, that period is one month from receipt. We may extend it by up to two further months where a request is complex or you have made several, and if we do, we tell you within the first month and explain why. Under the CCPA, the period is 45 days, which we may extend once by up to a further 45 days where that is reasonably necessary, telling you within the first 45 days. Under the DPDP Act, and under any other law that applies to you, we answer within the period that law sets.
Cost: requests are free. If a request is clearly unfounded or excessive, in particular because it repeats an earlier one, we may charge a reasonable fee or decline it, and we will explain why.
Refusals: if we decline all or part of a request, we tell you why and how to complain.
Newsletter: use the unsubscribe link in any issue. You do not need to contact us.
Account closure: email support@grantcookie.com from the address on the account. Section 5 explains what happens to your data afterwards. If you need to keep your consent log, export it before you close the account, if your plan includes consent log export, or ask privacy@grantcookie.com for a copy within 30 days of closure.

10. Children

The service is for people and organisations that run websites. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email privacy@grantcookie.com and we will delete it.

Customers’ websites may be visited by children. The customer is responsible for deciding whether the banner suits its audience and for meeting any rules about children that apply to its website. The consent record we hold on the customer’s behalf does not tell us the end user’s age.

11. Security

We protect personal data with technical and organisational measures that match the risk, including:

encryption of data in transit between your browser and the website, the application and the banner;
measures that protect sign-in credentials;
access controls that limit personal data to the people at GrantCookie who need it for their work; and
written contracts that require our service providers to protect the data they handle for us.

Our data processing agreement sets out the measures we apply to the data we process for customers.

No system is completely secure. If a personal data breach affects data we control, we notify the supervisory authority and the people affected where the law requires it. If a breach affects data we process for a customer, we tell the customer without undue delay and in any case within 72 hours of becoming aware of it, as our data processing agreement provides. Keep your sign-in details confidential and tell support@grantcookie.com at once if you suspect your account has been compromised. We answer customers’ security reviews through privacy@grantcookie.com.

12. Changes to this policy

We review this policy whenever the service or the law changes in a way that affects it. The “Last reviewed” date at the top is updated every time we review this policy, including reviews that find nothing to change. If a change affects how we use your data in a way that matters to you, we tell customers and subscribers by email before it takes effect, and we post the updated policy on the website. When we change this policy, we keep the earlier version, and you can ask privacy@grantcookie.com for it.

13. How to complain

If you are unhappy with how we handle your personal data, please write to privacy@grantcookie.com first so that we can try to put it right. We reply within one working day, look into your complaint and tell you the outcome without undue delay.

You can also complain to a supervisory authority at any time, except that in India the DPDP Act asks you to raise a grievance with us first.

In the European Economic Area: the supervisory authority in the member state where you live, where you work or where you believe the problem occurred.
In the United Kingdom: the Information Commissioner’s Office.
In California: the California Privacy Protection Agency or the California Attorney General.
In India: the Data Protection Board of India, once you have raised a grievance with us and are not satisfied with our answer.
Elsewhere: your local data protection or consumer protection authority.

If your complaint concerns data we process on a customer’s behalf, the authority will usually deal with the customer as controller. You can still raise the matter with us, and we will cooperate with the authority.