Privacy foundations that reflect how you actually work
Privacy is the foundation. How data is collected and protected decides whether anything built on top of it can be trusted. This is the largest part of the practice, and for most clients it is where the work begins.
What this covers
The work, in practice
Privacy and data foundation audits
A diagnostic of what already exists: privacy statements and website privacy information, cookie statements and tracking practices, consent mechanisms, forms and customer journeys, vendor relationships, processing arrangements and the records behind all of it. You leave with a clear picture of where things actually stand and prioritised advice on what to do next.
Building privacy and data foundations
From that diagnosis, we build what is missing: privacy statements and notices, website privacy information, cookie statements and consent wording, data processing agreements, records of processing activities, data mapping and the vendor documentation behind it all.
Website and digital privacy reviews
We review websites and digital customer journeys to check that what a business actually does with data lines up with what it tells users it does, across privacy and cookie information, forms, consent mechanisms, marketing data collection and third-party technologies. We can review the work again once it has gone live.
Data mapping and data relationship reviews
Data rarely sits in one place. We map what is collected, where it comes from, why, where it is stored, who has access, which systems and vendors touch it, whether it is shared or crosses borders, how long it is kept, and where AI enters the picture. Especially valuable across multiple booking systems, event platforms and marketing tools at once.
Vendor and third-party data governance
Guest and client experience organisations depend on a web of vendors and suppliers. We map the governance and documentation those relationships actually require, and work directly with the vendors themselves where that is the faster route.
How clients start
Say what you need, in your own words
You should be able to come to Griffinity and simply describe the problem. For this area, that usually sounds like one of these.
- Audit where we are, and tell us what we are missing
- Review our privacy foundations and our website
- Build the documents we need
- Help us understand our data, and how it actually moves through our business
- Help us understand our vendors, and whether AI is touching our data anywhere we haven't accounted for
What you leave with
Advice becomes deliverables
The exact output depends on the scope. The aim is never simply to produce documents. It is to build foundations that reflect how the organisation actually collects and uses data.
- Privacy and data foundation diagnostic with prioritised next steps
- Privacy statements, notices and website privacy information
- Cookie statements and consent wording
- Data processing agreements and vendor documentation
- Records of processing activities
- Data map across systems, vendors and borders
- Website and digital journey review, with a post-go-live re-review
- Board-ready findings and recommendations
How engagements work
From diagnosis to ongoing practice
Griffinity supports the full journey, and you can engage at any single point in it or move through the whole arc.
Diagnose
Understand where you are.
Audit
Identify the gaps and the risks.
Advise
Determine what is actually needed.
Build
Create the foundations and the documents.
Implement
Put practical process into operation.
Govern
Establish accountability and oversight.
Review
Assess and improve what is already live.
Teach
Build knowledge in the people who live with it.
Evolve
Adapt as the organisation and its AI change.
Governance is not a once-off project. We walk through implementation, review what has gone live, assess new vendors and new use cases, and help capability mature as your technology does.
Also part of the same foundation
Start with the decisions your organisation needs to make
Tell us what is changing, what feels unclear, and what leadership needs to be able to approve or explain.