Privacy notice: how Sterling handles information from this website.

sterling-grc.com is operated by Sterling International Consulting FZE (licensed as Stearling International Consulting FZE), United Arab Emirates, which decides how information collected through this website is used. Enquiries are handled by Sterling's group companies in the United Arab Emirates, the Philippines and India. This notice covers the public website, its enquiry forms and the website assistant. Consulting engagements, Sterling Academy learning accounts, Effivity and other Sterling platforms have their own privacy information, and Sterling's Data privacy policy covers how personal data is handled across the whole business.

Our registered address is Creative Tower, Creative City, Fujairah, United Arab Emirates. For any question or request about your information, write to privacy@sterling-grc.com. You do not need to be a client to ask about your own information.

We collect only what each part of the website needs. The table below sets out each route, what it collects and why.

Please share only what is needed to explain your requirements. Do not include passwords, payment details, identity documents, health information or confidential client records in a form or in the assistant. If a project needs sensitive material, agree an exchange method with your Sterling contact first.

Links to Sterling Academy at academy.sterling-grc.com and references to Effivity are links only: no information passes from this website to those services when you follow a link. Each has its own privacy information, which applies once you are there.

We use enquiry details to understand your requirements, reply, discuss suitable support and keep a record of the discussion. Each enquiry produces two emails: an internal notification to Sterling containing your details, and an acknowledgement to you, sent at most once a day to the same address, which does not repeat what you wrote. If you give a telephone number, we may use it for that discussion. An acknowledgement confirms that your enquiry arrived; it does not mean we have assessed your requirements or accepted an order. Submitting a form does not add you to a marketing list. If you tick the optional box on a readiness check or download to be kept informed, we may send you occasional information about the standard you chose and related Sterling services by email; every such email tells you how to stop them, and you can stop them at any time by writing to privacy@sterling-grc.com.

A readiness check produces a report sent to the email address you give, an internal notification to Sterling and an acknowledgement to you. Your score and the text of your report are produced by automated means from your answers; your contact details are not used in producing the report. The report is a self-assessment to prepare for a discussion; it is not a decision about you or your organisation, and it does not determine whether Sterling will work with you. A download request produces the document by email and an internal notification.

This notice is written for visitors worldwide. Where EU or UK data protection law applies, the basis for each use is as follows.

• A service you are considering for yourself: steps you ask us to take before a contract, such as preparing a proposal.
• A business enquiry, including one made for an employer or another organisation: our legitimate interests in responding, coordinating relevant support and keeping a proportionate record.
• Form protection, website security, the pre-filled country, the nearest-office display and logs: our legitimate interests in preventing abuse and in delivering and protecting the website and its visitors.
• Consent records and optional cookies, including analytics and advertising measurement: your consent, which you can withdraw at any time through the consent banner.
• Privacy requests and legal duties: compliance with a legal obligation.
• The optional ‘keep me informed’ emails: your consent, which you can withdraw at any time.

Where we rely on legitimate interests, we weigh necessity, your reasonable expectations and your rights, and you can object by writing to privacy@sterling-grc.com. You can also ask us at any time to stop following up an enquiry.

The website assistant answers questions about standards, certification and Sterling's services from the pages of this website. Its answers are produced by automated means and can be incomplete; for advice on your own situation, speak to a Sterling consultant. Where the assistant is not switched on, the panel shows fixed guidance only and what you type in it is not sent or stored.

The assistant receives what you type, the page you started on and the country code supplied by Cloudflare. It asks for your first name and, before it shows a full answer, your work email; giving them is optional. To produce each answer, your messages, your first name and the relevant page text are sent to the assistant's answering service, a provider that processes them under contract only to produce the answer and does not use them to train its systems. Your email address is not sent to it.

Every conversation is stored on the website. If you give your email, the conversation is kept as an enquiry: you receive a copy by email with the pages used and any white paper offered, Sterling's sales team receives it, and a Sterling consultant may contact you about your question. If you do not give an email, the conversation is not treated as an enquiry; it is reviewed internally by Sterling to follow up questions and improve the website and its answers. We use this information to answer you and to take the steps you ask for, and in our legitimate interest in following up questions about our services and improving the website. Giving your email does not add you to a marketing list.

Do not enter passwords, payment details, health information or other confidential or sensitive information in the assistant. If you prefer, use the enquiry form or the Contact page.

Authorised Sterling team members who handle enquiries see the information you submit. We also use service providers that process information on our behalf, under contract and only for the purposes in this notice:

• Website hosting: SiteGround hosts the website and its database, including enquiry records, in its data centre in Singapore.
• Security and delivery: Cloudflare sits in front of the website, filtering traffic, supplying the country code used for the nearest-office display and running the Turnstile security check on forms.
• Email delivery: Postmark, operated by ActiveCampaign, delivers the internal notification of each enquiry and the acknowledgement to you. Open and link tracking are switched off.
• Business email: Microsoft 365 holds the mailboxes that receive enquiry notifications.
• Analytics and tag management: Google, through Google Analytics 4 and Google Tag Manager, only after you consent.
• Advertising measurement: LinkedIn, through the LinkedIn Insight Tag, only after you consent.
• Video hosting: Google, through YouTube in privacy-enhanced mode, when you open a page with an embedded video.
• Website assistant: the assistant's answering service receives your messages, your first name and the page text needed to answer them, under contract and only to produce the answer, as described above.

Your consent choices are recorded on the website itself by its consent tool. Cloudflare also uses Turnstile signals, as an independent controller, to improve its bot detection, as its Turnstile Privacy Addendum explains. We do not sell your information, and we do not share it with other organisations for their own marketing. We may disclose information where the law requires it, or to establish, exercise or defend legal claims.

Sterling team members handle website enquiries from the United Arab Emirates, the Philippines and India, and SiteGround stores the website records, including enquiries, in its data centre in Singapore, so your enquiry may be accessed and stored outside the country where you are. Readiness check and download records are stored with the enquiry records at SiteGround in Singapore and handled by the same Sterling teams.

Postmark stores the data it processes for email delivery in the United States, including the enquiry details contained in internal notification emails. Our Microsoft 365 Exchange Online service identifies the United Arab Emirates as the location of core mailbox data at rest; that does not describe every location involved in email delivery. Cloudflare states that cookie data may by default be processed in its data centre in the United States. Google and LinkedIn process data in the countries their own privacy information describes.

Where EU or UK law requires safeguards for a transfer, we rely on the safeguards our service providers offer, such as standard contractual clauses. Write to privacy@sterling-grc.com for information about the safeguards that apply to your information.

The website assistant's answering service processes conversations in the United States.

Website records, email copies, delivery records, exports and backups are separate copies; deleting one does not automatically delete the others. You can ask us about a particular record or a deletion.

Depending on the law that applies and the circumstances, you may be able to ask for access to your information, correction, deletion, restriction of its use or a portable copy; object to a use; or withdraw consent where we rely on it. There are also protections for decisions made entirely by automated means; the website does not make such decisions about you. Rights can have limits, for example where information must be kept to meet a legal duty.

Write to privacy@sterling-grc.com with your request and, if you have one, your enquiry reference. We may ask for proportionate information to confirm that the request concerns you, or that a representative may act for you; please do not send identity documents with a first message. Requests are normally free. For EU and UK GDPR requests the response period is one month, and any extension we are allowed will be explained within that month.

Please contact us first at privacy@sterling-grc.com so we can try to put things right; our Complaints and feedback policy explains how we investigate. You may also complain to a data protection authority where the law gives you that right: for EU GDPR matters, the authority where you live or work or where the issue arose; for UK matters, the Information Commissioner's Office. Contacting Sterling does not affect that right.

No. The website is meant for organisations and the professionals who work for them. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us information, write to privacy@sterling-grc.com and we will delete it.

We update this notice when the way the website handles information changes. The date at the top identifies this version, and significant changes are shown on this page before they take effect. The Cookie policy and the Terms of use sit alongside this notice, and Sterling's wider commitments are on the Company policies page, including the Data privacy policy and the Information security policy.

5 October 2026: this notice now describes the readiness checks, document downloads, the optional ‘keep me informed’ emails, the pre-filled country, embedded videos and how long readiness check and download records are kept, how the website assistant handles conversations, and what the assistant collects when it is switched on.