On this page
01Who we are & what this covers
Growlith Academy ("Growlith", "we") is a growth engineering firm operating from bureaus in New York, London, Sydney and Dubai (DIFC). This policy explains how we handle personal data when you visit growlithacademy.com, contact us, subscribe to our newsletter, or engage us as a client.
For visitors and prospects, we are the data controller — we decide what is collected and why. For client engagements, our Data Processing terms describe how we act as your processor.
02Information we collect
We collect deliberately little. The full picture fits in three short lists.
Information you give us
- Enquiry & application forms — name, email, company, website, rough revenue band, and the message you write.
- Newsletter ("The Telemetry") — your email address, nothing else.
- Client correspondence — whatever you choose to send us by email or in working documents.
Information collected automatically
Standard server logs (IP address, timestamp, requested URL, user agent) kept briefly for security and abuse monitoring, plus pseudonymous Google Analytics 4 statistics about page performance. Details live in the Cookie Policy.
Information we never collect
We do not collect special-category data (health, religion, biometrics), payment card details through this site, or data from advertising pixels — we run none.
03Why we use it (and our legal bases)
Every use maps to a purpose and, where the GDPR applies, a legal basis:
| Purpose | Legal basis |
|---|---|
| Answering enquiries and running the application process | Legitimate interest — responding to people who contact us |
| Sending The Telemetry newsletter | Consent (unsubscribe in every issue) |
| Understanding site usage via analytics | Consent, where required |
| Keeping the site secure and preventing abuse | Legitimate interest — security |
| Client work under an engagement | Contract performance |
We don't use your data for automated decision-making or profiling with legal effect. We're engineers, not brokers.
04Who else sees it
We share personal data only with processors that run our infrastructure, each bound by contract to process solely on our instructions:
| Processor | Role |
|---|---|
| Cloudflare | Edge hosting, DNS, DDoS protection and lead-routing workers |
| Google (Analytics, Workspace) | Aggregate site measurement; email & documents |
| Email delivery provider | Sending The Telemetry to subscribers who opted in |
05International transfers
Our bureaus span New York, London, Sydney and Dubai, and some processors run global infrastructure. Where personal data leaves the UK or EEA, it travels only under UK/EU adequacy decisions or the Standard Contractual Clauses (plus the UK IDTA / Addendum), with supplementary technical measures such as encryption in transit and at rest.
06How long we keep it
- Server logs — up to 30 days, then deletion.
- Enquiry & application records — up to 24 months, so we can pick up conversations where they left off.
- Newsletter data — until you unsubscribe, then suppressed indefinitely to honour your opt-out.
- Client engagement data — for the term of the engagement plus any statutory retention period.
07Your rights
Wherever you are, you can ask us to show, correct, delete or export your data, and object to or restrict processing. Here is how the regimes line up.
If you're in the UK or EEA (GDPR)
You hold rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. You may also complain to your national data protection authority (in the UK, the ICO).
If you're in California (CCPA/CPRA)
You can request disclosure of the categories of data we hold, ask for deletion, and opt out of any "sale" or "sharing" — noting that we do not sell or share personal information as those terms are defined.
Exercising any right
Email contact@growlithacademy.com from any address you've used with us. We respond within 30 days at the latest — usually within two business days — and never charge for a request.
08How we protect it
Access is least-privilege and limited to team members who need it. Data moves over TLS in transit, is encrypted at rest, and our edge layer (Cloudflare) absorbs malicious traffic before it reaches origin. We review access quarterly and after any team change.
09Children
Our services are aimed at businesses, not children. We don't knowingly collect data from anyone under 16; if you believe a child has given us data, contact us and we'll delete it promptly.
10Changes & contact
Material changes will be announced on this page with a new version number and date. Questions or requests: contact@growlithacademy.com — Growlith Academy Ltd, 1 Finsbury Ave, London EC2M, United Kingdom.