GRS Military & Medical Solutions
Privacy Policy
This policy explains the data processed by the GRS Military & Medical Solutions site when you browse the page or send a request.
Updated 23 October 2026
Controller and scope
The operator of this site is GRS Military & Medical Solutions. This policy covers the Military page, its forms, technical logs, and related communications.
Data we receive
We process data you enter: name, organization, phone, email, country, comment, request type, and selected kit. We also retain the CTA source, page URL, referrer, and UTM parameters. To protect the form, we record the IP address, a protected hash of it, user-agent, time, verification outcome, and reasons for failed attempts. Incomplete fields may be stored as a draft after you begin interacting with the form.
Purposes and legal bases
We use data to answer requests, configure kits, discuss orders, support or investment, prevent abuse, and demonstrate service security. Legal bases include responding to your request and pre-contractual steps, legitimate interests in site security, legal obligations, and your consent for optional external media.
Recipients and international transfers
Hosting, database, and email providers may process data only to operate the service. If the hosting environment does not provide a country code, country.is receives the IP address and returns only a country code to prefill the form. Cloudflare processes technical data during Turnstile verification. Google Fonts receives standard request metadata when fonts load but not form data. YouTube/Google receives media-related data only after you allow external media or explicitly interact with it. International transfers use the providers’ available legal safeguards.
Retention
Incomplete drafts are retained for up to 30 days, failed and security attempts for up to 90 days, and completed requests for up to 730 days unless a longer period is required for a contract, law, or legal claims. A local browser draft is deleted after successful submission and is not restored after 24 hours.
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdraw consent. You may also complain to a competent data protection authority. Contact us by email; we may need to verify your identity.
Security
Controls include HTTPS, CSRF and origin checks, rate limiting, a honeypot, server-side Turnstile, allowlisted values, prepared statements, payload limits, and event logs. No transmission or storage method can guarantee absolute security.
Google Analytics
Google Analytics 4 (G-162G9EWSRV) loads immediately using Advanced Consent Mode. Before consent and after refusal, analytics_storage is denied: Google receives limited page-view and successful-request signals without reading or writing analytics cookies or using a persistent visitor identifier. These signals may include timestamps, referrers and standard technical request data. Consent enables full analytics; _ga and _ga_* cookies have a renewable lifetime of up to 90 days. We do not send form field contents, contact details or request identifiers in Google events. Advertising features are disabled. Google may process data outside your country; retention depends on service settings. Withdraw consent through the cookie settings in the footer to return to signals without analytics cookies. This does not automatically delete data already sent to Google; contact our email address for deletion requests.