Continuum GRC Privacy Policy

Table of Contents

Last Updated: August 14, 2026

Continuum GRC is committed to protecting the privacy of individuals and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Privacy Rights Act (CPRA), and other relevant U.S. and international regulations. This Privacy Policy explains how Continuum GRC and its affiliates (collectively, “Continuum GRC,” “we,” “us,” or “our”) collect, use, store, disclose, and protect personal information when you interact with our websites (including continuumgrc.com and auditmachine.com), mobile applications (such as the Continuum GRC ITAM App), and related services (collectively, the “Services”).

“Personal information” means any information that identifies, relates to, describes, or could reasonably be linked to an individual.

By using our Services, you acknowledge the practices described in this Privacy Policy. If you do not agree, please do not use the Services. Providing certain personal information is voluntary; however, withholding requested information may limit your ability to use some features.

This policy applies to personal information processed by Continuum GRC, including data transferred from the European Union, European Economic Area, United Kingdom, or within the United States, consistent with applicable notice, choice, security, data integrity, access, and enforcement principles.

Data Controller

The data controller for personal information collected through our Services is the Continuum GRC entity that collects the data or the entity to which you submit it. Personal information may be shared with other Continuum GRC entities or affiliates as needed to fulfill the purposes for which it was provided. By submitting personal information, you consent to such transfers, including cross-border transfers where necessary.

Information We Collect

We collect personal information that you voluntarily provide and certain information collected automatically.

Information you provide may include:

Identifying and contact details (name, job title, company name and address, email address, phone number, and similar information)
Account and registration details
Communications and inquiry content
Job application materials (resumes, cover letters, and related information)
Transaction and payment-related information when you purchase services or publications (processed securely; we do not store full payment card details beyond what is required)
Optional demographic or survey information you choose to provide

Information collected automatically may include:

IP address, browser type, device information, referring URLs, and usage data
Cookies and similar technologies (see Cookies and Analytics section)

We do not actively seek sensitive personal information (such as race, ethnicity, political opinions, religious beliefs, health data, or criminal history) unless required for legal, contractual, or recruitment purposes and with appropriate notice and consent where required. If you voluntarily provide such information, you consent to its processing as described in this policy or at the point of collection.

How We Use Personal Information

We use personal information only for the purposes for which it was collected or as otherwise permitted by law, including to:

Provide, operate, maintain, and improve the Services
Register users, create and manage accounts, and authenticate access
Respond to inquiries, requests, and support needs
Process transactions, orders, and service delivery
Administer job applications and recruitment
Send administrative notices, service-related communications, and (with your consent) marketing communications
Conduct analytics, research, and service improvement
Comply with legal obligations, enforce our terms, and protect our rights, security, and property
Detect, prevent, and address fraud, security, or technical issues

We do not use personal information for purposes incompatible with those disclosed at the time of collection without additional notice or consent where required.

Marketing and Communications

We send marketing communications (such as newsletters or promotional materials) only with your explicit consent or as otherwise permitted by law. You may unsubscribe at any time by using the link in the communication or by contacting us at the addresses below. Transactional and service-related messages are not considered marketing and may continue even if you opt out of marketing.

Cookies and Analytics

We use cookies and similar technologies to remember preferences, enable functionality, analyze usage, and improve the services. You can manage cookie preferences through your browser settings. Disabling certain cookies may limit some features but will not prevent basic access to the Services.

We may use third-party analytics providers that receive anonymized or aggregated data for reporting and improvement purposes. This data is not used to identify individuals.

Sharing of Personal Information

We do not sell personal information. We share personal information only in the following circumstances:

With your consent
With service providers and processors who perform services on our behalf (subject to contractual confidentiality and data protection obligations)
As necessary to fulfill a transaction or request you initiate
To comply with law, legal process, or governmental requests
To protect the rights, property, or safety of Continuum GRC, our users, or others
In connection with a corporate transaction (such as a merger, acquisition, or sale of assets), subject to appropriate protections
Among Continuum GRC affiliates as needed to operate the Services

When we link to or facilitate access to third-party sites or services (for example, publication ordering platforms), those third parties have their own privacy practices. We encourage you to review them. Continuum GRC is not responsible for the privacy practices of third-party sites.

Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, to provide the services, to comply with legal, accounting, or reporting obligations, or to resolve disputes. Retention periods vary by data type and purpose. When personal information is no longer needed, we delete or anonymize it in accordance with our practices and applicable law.

You may request deletion of your personal information by contacting us (subject to legal retention requirements).

Your Rights and Choices

Depending on your location and applicable law (including GDPR and CPRA), you may have the right to:

Access the personal information we hold about you
Correct inaccurate or incomplete information
Request deletion of your personal information
Restrict or object to certain processing
Data portability
Opt out of the sale or sharing of personal information (we do not sell personal information) and certain targeted advertising
Withdraw consent where processing is based on consent
Lodge a complaint with a supervisory authority

To exercise these rights, update your account information where available, or contact us using the details below. We will respond in accordance with applicable law. We may need to verify your identity before fulfilling certain requests. Some rights may be limited by legal obligations or legitimate interests.

Registration is not required for most public areas of our websites. Certain features require an account.

Security

We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These measures include encryption in transit (such as TLS/SSL), access controls, and confidentiality obligations for personnel. No method of transmission or storage is completely secure. You are responsible for safeguarding your account credentials.

Children’s Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us.

International Transfers

Personal information may be processed in the United States and other countries that may have different data protection laws than your country of residence. Where required, we implement appropriate safeguards for cross-border transfers (such as standard contractual clauses or other lawful mechanisms).

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top will reflect the most recent revision. Material changes will be indicated by posting a notice on our primary website or by other appropriate means. Your continued use of the Services after the effective date of changes constitutes acceptance of the updated policy, except where additional consent is required by law.

Contact Us

For questions about this Privacy Policy, to exercise your rights, or to submit privacy-related requests or complaints, please contact:

Email: [email protected] Alternative contact: [email protected]

Website: https://www.auditmachine.com/ or https://continuumgrc.com/

We are committed to addressing your inquiries promptly and in accordance with applicable privacy laws.