Privacy Policy

Last updated: 25 October 2026

Grand Proposals is operated by Grand Diamonds LLC, registered in Wyoming, United States, with business activities managed from the United Kingdom. Grand Diamonds LLC is the controller responsible for the personal information described in this policy.

Business address: 30 N. Gould St., Sheridan, WY 82801, US
Privacy contact: clients@grandproposals.com

Information We Collect

We collect information needed to respond to enquiries and arrange your experience. This may include names, contact details, passport information, travel dates, ring sizes, design preferences, correspondence, booking approvals, payment records and photographs.

Where necessary for identity or payment verification, we may request supporting documents, including recent bank statements. Contact us before sending sensitive documents so we can explain what is needed and how to provide it.

We may also collect dietary preferences, allergy information and accessibility requirements that you choose to provide to help us arrange your experience. Where this reveals health information or other sensitive personal information, we request your explicit consent to use it and share the necessary details with relevant service providers.

We receive information from you, a person arranging the experience with you, and providers involved in your booking. When you visit our website, our service providers may collect technical information, such as your IP address, browser and device information.

We also use Google Ads conversion tracking through Google Tag Manager to record clicks on our WhatsApp and email buttons and measure advertising performance. These conversion events do not include the contents of your messages or documents. Further details appear under Cookies.

If you provide another person’s information, please ensure you are entitled to share it and make this policy available to them.

How We Use Your Information

We use information to answer enquiries, plan and deliver your experience, source your diamond, obtain diamond and ring-design approvals, manage requested design alterations, arrange reservations and dining, administer initial and balance payments and refunds, prevent fraud, maintain records and handle complaints or legal obligations. We also measure clicks on our WhatsApp and email buttons to understand and improve the performance of our Google Ads campaigns.

Where UK GDPR applies, we rely on:

  • Contract: taking steps you request before booking and delivering our agreement with you.

  • Legitimate interests: administering our business, coordinating arrangements for accompanying travelers, protecting against fraud and handling disputes, balanced against your rights.

  • Legal obligation: meeting requirements that provide a valid legal basis under applicable data-protection law.

  • Consent: where required, including Google Ads conversion tracking and associated cookies, and promotional use of photographs. We request explicit consent for health information or other sensitive personal information used to arrange your experience.

Without information necessary for a booking or required verification, we may be unable to provide the relevant service.

Who Receives Your Information

We do not provide customer documents or private correspondence to others for advertising or marketing. We share limited website interaction and technical information with Google to measure our advertising performance, as explained below.

We share relevant information where needed with:

  • UK authorities: required identity and passport information where you ask us to assist with an ETA or another applicable entry application.

  • Private jet providers and aircraft operators: passenger and passport information needed for your flights.

  • Hotels: reservation details and identity or passport information where required.

  • Activity and ticket providers: names and basic details required for bookings, without passport copies for ordinary activity tickets.

  • Relevant service providers: dietary, allergy or accessibility details necessary to meet your requests, with your explicit consent where these reveal sensitive personal information.

  • Google: information about clicks on our WhatsApp and email buttons, together with associated advertising identifiers and technical information, for Google Ads conversion measurement. We do not use enhanced conversions or include customer documents or message contents in these conversion events.

We do not provide passport copies or identity documents to drivers, photographers or jewelers. A photographer processes the photographs taken to provide your agreed portrait service.

Banks and providers of hosting, email, messaging and document storage may process information to support our services. Information may also be disclosed to professional advisers or authorities where necessary for legal obligations or claims.

Some providers act as independent controllers under their own privacy notices and retention arrangements.

International Processing

We manage customer information from the United Kingdom and use Hostinger for website hosting and business email, and Apple iCloud for document storage and backup. These services may involve processing in the European Economic Area, the United States and other countries where the providers and their service providers operate.

Hostinger’s published data-processing terms include Standard Contractual Clauses and a UK International Data Transfer Addendum for applicable transfers. Apple’s published privacy policy describes international processing and the use of Standard Contractual Clauses for information collected in the UK and European Economic Area.

We also use Google Ads conversion tracking through Google Tag Manager. Associated website interaction and technical information may be processed in the United States and other countries where Google operates. Google describes its transfer safeguards as including the EU–U.S. Data Privacy Framework and its UK Extension, and Standard Contractual Clauses where applicable. Further details are available in Google’s information about data-transfer frameworks.

You can contact us at clients@grandproposals.com for further information about the arrangements relevant to your information.

Instagram

We use Instagram to share content and promote our services through paid advertising. If you interact with our account or contact us there, we may process your username, messages and information you choose to share to respond to you and manage our presence.

We use advertising tools and performance reports provided by Meta to select audiences and understand how our promotions perform. Meta also processes information under its own privacy policy. We do not upload customer documents or customer contact lists to Meta for advertising.

Cookies

We use cookies and similar technologies to remember your privacy choices and measure advertising performance.

Cookie preferences: our consent-management cookie, cc_cookie, stores your choices and related consent information. It is configured to expire after 182 days unless deleted earlier. Updating your choices may renew this period.

Google Ads conversion tracking: we use Google Tag Manager to manage tags that measure clicks on our WhatsApp and email buttons. Google receives information about these clicks and associated advertising identifiers and technical information. This helps us measure and improve our advertising campaigns.

We do not use enhanced conversions or send customer documents or message contents through these conversion events. Google’s conversion-measurement cookies with the prefix _gcl_ normally last for 90 days. Cookie expiry does not determine how long Google retains the resulting information.

Where consent is required, advertising cookies are used only after you agree. You can manage your preferences through our cookie controls and delete cookies through your browser settings.

Our website does not currently change its behaviour in response to browser “Do Not Track” signals. These signals are distinct from legally recognised opt-out preference signals, which we honour where applicable law requires.

For further information, see How Google uses cookies.

How Long We Keep Information

We keep personal information only for as long as needed for its purpose, applicable recordkeeping obligations or legal claims.

  • Enquiries that do not become bookings: up to 12 months after the last meaningful contact, with earlier deletion where the information is no longer needed.

  • Passport copies used solely for travel arrangements: deleted once no longer needed, normally within 30 days after your trip ends or your booking is cancelled, unless needed to resolve an outstanding travel arrangement or legal claim.

  • Dietary, allergy and accessibility information: deleted within 30 days after your trip ends or your booking is cancelled, unless needed to address an unresolved issue.

  • Our copies of delivered portrait photographs: deleted within 90 days after delivery, allowing time for you to download or request another copy. Separately authorised promotional use follows the permission agreed with you.

  • Contracts, invoices, payment and refund records, diamond or design approvals and alteration requests: normally seven years after the end of the calendar year in which your booking is completed or cancelled. Relevant records may be retained longer where required by law or necessary for a legal claim.

  • Identity and source-of-funds documents collected for verification: retained for any applicable mandatory recordkeeping period. Where no such obligation applies, supporting copies are deleted within 30 days after verification and any related enquiry are complete, unless needed for an identified fraud investigation or legal claim. We retain only the necessary record of the check performed.

  • Cookie records: our cookie-preference cookie is configured to expire after 182 days. Google’s conversion-measurement cookies with the prefix _gcl_ normally last for 90 days. Cookies may be deleted earlier or their expiry renewed through use or preference changes.

  • Technical website records: retained while needed to operate, secure and troubleshoot the website, subject to the hosting provider’s applicable retention arrangements. Cookie expiry does not determine how long Google retains information collected through conversion tracking.

Deletion covers email attachments, downloaded documents and cloud copies within our control. Where necessary to meet the periods above, we also remove copies from Trash and Recently Deleted folders.

Items left in Hostinger email Trash or iCloud Drive’s Recently Deleted folder may remain recoverable for up to 30 days. Device backups follow Apple’s separate arrangements and may remain for up to 180 days after iCloud Backup is turned off for the device. This is not a general 180-day deletion period for individual files.

Where a legal obligation or ongoing dispute requires longer retention, we keep only the relevant information for as long as necessary. Independent providers, including hotels and aircraft operators, follow their own retention requirements.

Security and Communications

We receive customer documents through our business email hosted by Hostinger. Documents may remain in our email account and be stored on a protected device, with backup through Apple iCloud.

We protect access using passcodes, biometric authentication and two-factor authentication. Access is limited to people who need information to perform their work. No electronic storage or communication system is completely secure.

Please contact us before sending passport copies, bank statements or other sensitive documents so we can explain what is required and how to submit them. Our retention and deletion arrangements cover email attachments, downloaded documents and cloud copies within our control.

If you communicate with us through WhatsApp, email or another third-party service, that provider also processes information under its own privacy terms.

Photographs and Publicity

Photographs arranged as part of your experience are used to provide your agreed portrait service. The photographer processes the images needed to create and deliver your photographs.

We request separate permission from each identifiable person before using their photographs, testimonials or personal story on our website, social media or in advertising. Booking an experience does not give permission for publicity, and declining publicity does not affect your service.

You may withdraw consent to our future promotional use by emailing clients@grandproposals.com. Withdrawal does not affect use that was lawful before consent was withdrawn.

Your Rights

Depending on applicable law and the circumstances, you may have the right to:

  • Access your personal information and obtain a copy.

  • Correct inaccurate or incomplete information.

  • Request deletion or restrict how information is used.

  • Object to processing based on legitimate interests.

  • Receive certain information in a portable format.

  • Withdraw consent where processing relies on it.

  • Opt out of direct marketing and, where applicable, the sale or sharing of personal information, targeted advertising or certain profiling.

These rights are subject to applicable conditions and exceptions. Withdrawing consent does not affect earlier lawful processing.

To make a request, email clients@grandproposals.com. We may request proportionate information to verify your identity or an authorised representative’s authority. We respond within the period required by applicable law.

Where U.S. state law gives you a right to appeal a refusal, send your appeal to the same email address. We will explain the outcome and any further complaint options. We will not unlawfully discriminate against you for exercising your privacy rights.

Our customer and booking decisions involve human review. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Google Ads uses conversion information to measure and optimise advertising; this does not determine whether we accept your booking.

Questions and Complaints

For privacy questions or concerns, contact clients@grandproposals.com.

Where UK data-protection law applies, you may complain to the Information Commissioner’s Office (ICO). You may also contact another competent privacy regulator or state authority where applicable.

You do not have to contact us before exercising your right to complain to a regulator.

Changes to This Policy

We may update this policy to reflect changes to our services, information practices or legal obligations. The latest version will appear on this page with an updated date.

Where required, we will notify you of material changes and obtain consent before using your information for a new purpose that requires it.