Data Protection

GDPR Compliance

GraftPal is fully committed to protecting user privacy and complying with the General Data Protection Regulation. Here's how we safeguard your data.

How We Comply

Our GDPR Principles

Privacy is built into GraftPal from the ground up, not bolted on as an afterthought

Lawful Basis

We process personal data only when we have a valid legal basis, typically contract performance, legitimate interest, or your consent.

Data Minimisation

We collect only the data necessary to provide the Service. We don't harvest data for advertising or sell it to third parties.

Security by Design

We implement appropriate technical and organisational measures to protect personal data, in line with industry best practices.

International Transfers

When data is processed outside the UK or EEA, we rely on adequacy decisions, the UK International Data Transfer Agreement or Addendum, and the EU Standard Contractual Clauses.

Data Processing Agreements

We have data processing terms in place with every sub-processor, listed in our Privacy Policy, and give customers notice before adding a new one.

Breach Notification

If a breach affects your data we tell customers without undue delay, and within 48 hours, and report to the ICO within 72 hours where the law requires.

Your Rights

Your Data Rights Under the GDPR

If you are in the UK, EU or EEA, you are entitled to the following rights regarding your personal data

Right to access your personal data
Right to rectification of inaccurate data
Right to erasure (right to be forgotten)
Right to restrict processing
Right to data portability
Right to object to processing
Right to withdraw consent at any time
Right to lodge a complaint with a supervisory authority

To exercise any of these rights, contact our privacy team at privacy@graftpal.com. We will respond within one month.

Data Processing Agreement

Our Data Processing Agreement is built into section 11 of our Terms of Service and applies automatically, with no separate signature needed. If you need a signed copy for your records, contact us at legal@graftpal.com.

Data Controller vs. Processor

When you use GraftPal, you are the Data Controller for the personal data you input (e.g., your client records). GraftPal acts as a Data Processor, processing data on your behalf in accordance with your instructions and our DPA.

Contact our privacy team

For any GDPR-related enquiries, you can reach our privacy team at privacy@graftpal.com.