Privacy Policy.

Depending on how you interact with us, we may collect:

• Directly from you, when you book a consultation, message us on WhatsApp, fill in a form, or sign up to a plan
• Automatically, through cookies and analytics tools when you browse our website
• From third parties, such as platforms you grant us access to (e.g. Google, Meta, your CRM) in the course of delivering services

We use personal data for the following purposes:

You can withdraw consent to marketing communications at any time by clicking "unsubscribe" or contacting us directly.

We may contact you by email, SMS or WhatsApp with relevant updates, tips or offers if you have consented, or if you are an existing client and have not opted out (in line with the "soft opt-in" rules under PECR). You can opt out at any time free of charge.

We do not sell personal data. We may share it with:

• Sub-processors and service providers who support our operations, such as hosting providers, CRM/booking software providers, payment processors, and communication platforms (e.g. WhatsApp Business, email/SMS providers)
• Professional advisers (e.g. accountants, solicitors) where necessary
• Regulators or authorities where required by law
• A buyer, in the event we sell or transfer part or all of our business, subject to confidentiality obligations

All third-party providers we use are required to protect your data and only process it for the purposes we specify.

Some of our services (e.g. running review requests, booking systems, SMS/email follow-up, missed-call text-back) involve us processing personal data belonging to our clients' own customers, on our clients' instructions. In this context:

• Our client is the data controller for their customers' data
• GrowBy acts as a data processor, processing that data only as instructed by the client, under a data processing agreement where required
• Individuals with queries about how their data is used by a specific local business should contact that business directly; GrowBy will assist our client in responding to such requests where relevant

Our website may use cookies and similar technologies to:

• Enable core website functionality
• Understand how visitors use our site (analytics)
• Support advertising or retargeting (if applicable)

You can control or disable cookies through your browser settings. Disabling some cookies may affect site functionality.

We retain personal data only for as long as necessary for the purposes it was collected, including to comply with legal, accounting or reporting requirements. As a general guide:

• Client contract and billing records: retained for 6 years after the relationship ends (UK tax/accounting requirements)
• Enquiry data from non-converting leads: retained for up to 24 months, then deleted
• Marketing consent records: retained until consent is withdrawn, plus a record of the withdrawal

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including access controls, encrypted connections, and restricted staff access on a need-to-know basis. No system is completely secure, and we cannot guarantee absolute security of data transmitted to us.

Where any of our service providers store or process data outside the UK/EEA, we ensure appropriate safeguards are in place (such as the UK's International Data Transfer Agreement or adequacy regulations) before the transfer occurs.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten"), subject to legal exceptions
• Restrict or object to certain processing
• Request data portability
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled

To exercise any of these rights, contact us using the details in Section 13.

Our services are directed at businesses, not children. We do not knowingly collect personal data from individuals under 16.

For any questions about this Privacy Policy or to exercise your data rights, contact:

We may update this Privacy Policy from time to time. The current version will always be published on our website, with the "last updated" date shown at the top.