Privacy policy

1. Controller

Sebastian Vogt (sole proprietorship, brand “GROWIS”)
Eduard-Thöny-Str. 12, 86919 Utting, Germany
Email: office@growismedia.com

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Overview and legal bases

We only process personal data insofar as this is necessary to operate this website, handle your enquiry or hold an intro call, or you have given your consent. The legal bases are:

Consent (Art. 6(1)(a) GDPR, and additionally § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) where your device is accessed)
Contract and pre-contractual measures (Art. 6(1)(b) GDPR)
Legal obligations, such as retention for tax purposes (Art. 6(1)(c) GDPR)
Legitimate interest (Art. 6(1)(f) GDPR). We state the specific interest for each processing operation.

We delete data as soon as the purpose no longer applies and no statutory retention obligations stand in the way. We retain business letters for six years, accounting records and invoices for eight years and other tax-relevant documents for up to ten years (§ 257 HGB, § 147 AO).

3. Hosting, server log files and encryption

Hosting

Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The website is delivered from the data centre in Frankfurt am Main.
Data: IP address, date and time of access, page accessed, referrer URL, browser and operating system
Purpose: Provision, stability and security of the website, defence against attacks
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free operation of the website.
Retention period: Log files are deleted after 30 days unless they are needed to investigate a security incident.
Third country: A transfer to Vercel Inc. in the USA is possible. It is based on the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR).
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: vercel.com/legal/privacy-policy

For security reasons, this website uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

4. Contact by email

If you write to us by email, we process your details in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at a contract, otherwise Art. 6(1)(f) GDPR (interest in answering enquiries). We delete the data once the enquiry has been dealt with conclusively and no retention obligations apply.

5. Enquiry and booking of an intro call

You can book an intro call using our form. In doing so, we process:

Business: industry, region of your customers, website (optional)
Starting point: planned ad budget, work with an agency, your concern (optional)
Contact: name, company, email address, phone number
Appointment: chosen date and time, and on the English version of this website the time zone shown

We use this information to prepare and hold the call and to send you the appointment confirmation. The legal basis is Art. 6(1)(b) GDPR. We need the details not marked as optional for the booking. Without them we cannot arrange an appointment.

If no cooperation comes about, we delete your details after 6 months.

Cal.com (appointment booking)

Provider: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA
Purpose: Display of available times, booking, sending the appointment confirmation and reminders by email and text message
Data: Your details from the form, chosen appointment, technical connection data
Legal basis: Art. 6(1)(b) GDPR
Retention period: Until deleted by us, see above
Third country: Your data is stored and processed by Cal.com, Inc. in the USA. The transfer is based on standard contractual clauses (Art. 46(2)(c) GDPR) in the data processing agreement with Cal.com and, where Cal.com is certified under the EU-US Data Privacy Framework, additionally on that adequacy decision (Art. 45 GDPR).
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: cal.com/privacy

6. Enquiries via ad forms

For our own customer acquisition, we use ads with integrated forms. You enter your details directly on the platform. We then receive them in order to process your enquiry. The privacy policy of the respective provider applies to the processing on the platform itself.

Meta Lead Ads (Facebook and Instagram)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
Purpose: Receiving your enquiry and getting in touch
Data: The details requested in the form, e.g. name, email address, phone number, company, industry
Legal basis: Art. 6(1)(b) GDPR
Retention period: As long as necessary for the enquiry or cooperation. If no cooperation comes about, we delete the data after 6 months.
Third country: A transfer to Meta Platforms, Inc. in the USA is possible. The company is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Further information: facebook.com/privacy/policy

Google lead forms

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Receiving your enquiry and getting in touch
Data: The details requested in the form, e.g. name, email address, phone number, company
Legal basis: Art. 6(1)(b) GDPR
Retention period: As long as necessary for the enquiry or cooperation. If no cooperation comes about, we delete the data after 6 months.
Third country: A transfer to Google LLC in the USA is possible. The company is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Further information: policies.google.com/privacy

7. Holding the intro call

We hold the intro call by phone or video call, as you prefer. Calls are not recorded. The legal basis in each case is Art. 6(1)(b) GDPR.

Google Meet

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data: Name, email address, meeting metadata (e.g. time, duration, IP address), and video and audio if activated
Retention period: We do not store meeting data after the end of the call. Google's retention periods apply to metadata.
Third country: A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Data processing: A contract pursuant to Art. 28 GDPR is in place with Google.
Further information: policies.google.com/privacy

Zoom

Provider: Zoom Communications, Inc., 55 Almaden Boulevard, Suite 600, San Jose, CA 95113, USA
Data: Name, email address, meeting metadata (e.g. time, duration, IP address), and video and audio if activated
Retention period: We do not store meeting data after the end of the call. Zoom's retention periods apply to metadata.
Third country: Zoom Communications, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply.
Data processing: A contract pursuant to Art. 28 GDPR is in place with Zoom.
Further information: zoom.com/en/trust/privacy

8. Organisation and client management

We manage enquiries and client relationships with the following services. Your details from the booking form, from emails and from the intro call end up there.

Google Workspace (Gmail, Calendar, Drive, Sheets)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Email communication, appointment management, document storage and an overview of enquiries
Data: Contact details, information about your business, call notes, status of the enquiry
Legal basis: Art. 6(1)(b) GDPR (initiating and carrying out the cooperation), otherwise Art. 6(1)(f) GDPR (efficient organisation of our client relationships)
Retention period: As long as necessary for the enquiry or cooperation. If no cooperation comes about, we delete the data after 6 months.
Third country: A transfer to Google LLC in the USA is possible. The company is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: policies.google.com/privacy

Notion

Provider: Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA
Purpose: Call notes, project documentation and knowledge base
Data: Contact details, information about your business, call notes, status of the enquiry
Legal basis: Art. 6(1)(b) GDPR (initiating and carrying out the cooperation), otherwise Art. 6(1)(f) GDPR (efficient organisation of our client relationships)
Retention period: As long as necessary for the enquiry or cooperation. If no cooperation comes about, we delete the data after 6 months.
Third country: Notion stores all data in the USA. The transfer is based on standard contractual clauses (Art. 46(2)(c) GDPR), which form part of the data processing agreement. Notion Labs, Inc. additionally participates in the EU-US Data Privacy Framework.
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: notion.com/notion/privacy

ClickUp

Provider: Mango Technologies, Inc. (ClickUp), 350 Tenth Avenue, Suite 500, San Diego, CA 92101, USA
Purpose: Management of enquiries, tasks and projects
Data: Contact details, information about your business, call notes, status of the enquiry
Legal basis: Art. 6(1)(b) GDPR (initiating and carrying out the cooperation), otherwise Art. 6(1)(f) GDPR (efficient organisation of our client relationships)
Retention period: As long as necessary for the enquiry or cooperation. If no cooperation comes about, we delete the data after 6 months.
Third country: Data is transferred to Mango Technologies, Inc. in the USA. The company is currently not certified under the EU-US Data Privacy Framework. The transfer is based on standard contractual clauses (Art. 46(2)(c) GDPR), which form part of the data processing agreement.
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: clickup.com/terms/privacy

Make (automation)

Provider: Celonis s.r.o., Menclova 2538/2, 180 00 Prague, Czech Republic (part of the Celonis group)
Purpose: Automatic transfer of your details between the services listed here, e.g. from the booking form to client management
Data: The details transferred in each case, for example from the booking form
Legal basis: Art. 6(1)(b) GDPR (initiating and carrying out the cooperation), otherwise Art. 6(1)(f) GDPR (efficient organisation of our client relationships)
Retention period: Execution logs are deleted after 30 days.
Third country: The provider is based in the EU. Insofar as sub-processors or group companies outside the EU, in particular in the USA, are given access, the transfer is based on standard contractual clauses (Art. 46(2)(c) GDPR).
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: make.com/en/privacy-notice

Loom (video messages)

Provider: Loom, Inc., a company of the Atlassian group, USA
Purpose: Sending short video explanations to prospects and clients
Data: When viewing: IP address, device and browser information, playback data; possibly your name and email address if you comment
Legal basis: Art. 6(1)(b) GDPR (initiating and carrying out the cooperation), otherwise Art. 6(1)(f) GDPR (efficient organisation of our client relationships)
Retention period: As long as necessary for the enquiry or cooperation. If no cooperation comes about, we delete the data after 6 months.
Third country: Data is transferred to Loom, Inc. in the USA. Atlassian and its US subsidiaries, including Loom, Inc., are certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply.
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: atlassian.com/legal/privacy-policy

9. Communication via WhatsApp and text message

WhatsApp Business

Provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
Purpose: Communication with prospects and clients who contact us via WhatsApp or have agreed to it
Data: Phone number, name, profile picture, message content, metadata such as time and device
Legal basis: Art. 6(1)(b) GDPR or your consent pursuant to Art. 6(1)(a) GDPR
Retention period: As long as necessary for the enquiry or cooperation. If no cooperation comes about, we delete the data after 6 months.
Third country: A transfer to Meta Platforms, Inc. in the USA is possible. The company is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Note: Message content is end-to-end encrypted. WhatsApp may also process metadata for its own purposes.
Further information: whatsapp.com/legal/privacy-policy-eea

Text message reminders

Provider: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Cal.com uses its own text message service provider as a sub-processor for sending.
Purpose: Reminder of your booked appointment
Data: Phone number, name, appointment
Legal basis: Art. 6(1)(b) GDPR
Retention period: As for the appointment booking, see above
Third country: Your data is stored and processed by Cal.com, Inc. in the USA. The transfer is based on standard contractual clauses (Art. 46(2)(c) GDPR) in the data processing agreement with Cal.com and, where Cal.com is certified under the EU-US Data Privacy Framework, additionally on that adequacy decision (Art. 45 GDPR).
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: cal.com/privacy

10. Newsletter and email sequences

Brevo

Provider: Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France
Purpose: Sending newsletters and automatic email sequences, for example after an intro call
Data: Email address, name, company, time of sign-up and confirmation, opening and click behaviour
Legal basis: Your consent, Art. 6(1)(a) GDPR. Sign-up uses the double opt-in procedure. Where applicable, we inform existing clients about similar services pursuant to § 7(3) UWG (German Act against Unfair Competition); you can object to this at any time.
Retention period: Until you unsubscribe. We keep proof of consent for up to three years.
Withdrawal: At any time via the unsubscribe link in every email or by emailing us
Third country: Processing takes place in the EU.
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: brevo.com/legal/privacypolicy

11. Proposals, invoices and payments

lexoffice (Lexware Office)

Provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany
Purpose: Creating proposals and invoices, accounting
Data: Name, company, address, email address, service and invoice data
Legal basis: Art. 6(1)(b) and (c) GDPR
Retention period: Statutory retention for up to ten years (§ 257 HGB, § 147 AO)
Third country: Processing takes place in Germany.
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: office.lexware.de/datenschutz

Stripe

Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland
Purpose: Processing payments
Data: Name, email address, invoice amount, payment data (e.g. card or account details), IP address
Legal basis: Art. 6(1)(b) GDPR
Retention period: Statutory retention for up to ten years
Third country: A transfer to Stripe, Inc. in the USA is possible. The company is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Note: Stripe is partly an independent controller for payment processing, for example for fraud prevention.
Further information: stripe.com/privacy

PayPal

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg
Purpose: Processing payments
Data: Name, email address, invoice amount, transaction data
Legal basis: Art. 6(1)(b) GDPR
Retention period: Statutory retention for up to ten years
Note: PayPal is an independent controller for payment processing.
Further information: paypal.com/legalhub/paypal/privacy-full

12. Cookies and consent management

Cookies are small text files stored on your device. We use technically necessary cookies without consent (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). We only load all other cookies and comparable technologies, in particular for analysis and advertising, after you have given your consent.

Consent management

Provider: Our own solution, operated by us on this website. No data is transferred to a consent management provider.
Purpose: Obtaining, storing and proving your consent
Data: Consent status, time, shortened IP address, browser information
Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to provide proof)
Retention period: We store your choice in the cookie “growis_einwilligung” on your device for 12 months. We keep proof of your consent for 36 months.

You can change or withdraw your consent at any time. Open cookie settings

13. Google Tag Manager

Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Managing and embedding the analytics and advertising services listed below. The Tag Manager only loads them after you have given your consent.
Data: IP address and technical connection data. The Tag Manager itself does not set any cookies.
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third country: A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Withdrawal: At any time with effect for the future via the cookie settings.
Further information: policies.google.com/privacy

14. Google Analytics 4

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Analysing how visitors use our website in order to improve content and flow
Data: Pages viewed, time spent, origin of the visit, device and browser information, approximate location, pseudonymous user ID. Google does not store IP addresses.
Cookies: _ga and _ga_[ID]: distinguishing visitors, retention period up to 2 years
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Retention period: Event data is deleted after 2 months.
Third country: A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Data processing: A contract pursuant to Art. 28 GDPR is in place with Google.
Withdrawal: At any time with effect for the future via the cookie settings.
Opt-out: Additionally via the browser add-on from Google
Further information: policies.google.com/privacy

15. Google Ads conversion tracking

Google Ads conversion tracking

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Measuring whether a visit via a Google ad leads to an appointment booking, and optimising our ads
Data: Ad click ID, time of conversion, device and browser information, IP address
Cookies: _gcl_au and _gcl_aw: attribution of ad clicks, retention period 90 days
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third country: A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Withdrawal: At any time with effect for the future via the cookie settings.
Further information: policies.google.com/privacy · Settings for personalised advertising

16. Meta Pixel

Meta Pixel

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
Purpose: Measuring the success of our ads on Facebook and Instagram, building audiences and re-engaging visitors to our website
Data: Pages viewed, time, device and browser information, IP address, click ID. Meta may link this data to your Facebook or Instagram account.
Cookies: _fbp and _fbc: attribution of visits and ad clicks, retention period 90 days
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Joint controllership: We are jointly responsible with Meta for collecting the data and transferring it to Meta (Art. 26 GDPR). The agreement on this stipulates that Meta is responsible for fulfilling your rights. Meta is solely responsible for further processing.
Third country: A transfer to Meta Platforms, Inc. in the USA is possible. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply.
Withdrawal: At any time with effect for the future via the cookie settings.
Further information: facebook.com/privacy/policy

17. LinkedIn Insight Tag

LinkedIn Insight Tag

Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland
Purpose: Measuring the success of our ads on LinkedIn, analysing visitor groups and re-engaging visitors
Data: Pages viewed, referrer URL, IP address (shortened), device and browser information, time
Cookies: e.g. li_sugr, bcookie, UserMatchHistory, AnalyticsSyncHistory; retention period up to 1 year
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third country: A transfer to LinkedIn Corporation in the USA is possible. The company is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Withdrawal: At any time with effect for the future via the cookie settings.
Further information: linkedin.com/legal/privacy-policy

18. Embedded videos

YouTube

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Displaying videos on our website
Data: IP address, device and browser information, page viewed, playback data; for logged-in users, assignment to the Google account
Cookies: We use the privacy-enhanced mode (youtube-nocookie.com).
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third country: A transfer to Google LLC in the USA is possible. The company is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Withdrawal: At any time with effect for the future via the cookie settings.
Further information: policies.google.com/privacy

Vimeo

Provider: Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA
Purpose: Displaying videos on our website
Data: IP address, device and browser information, page viewed, playback data
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third country: Data is transferred to Vimeo.com, Inc. in the USA. The transfer is based on the EU-US Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR), under which Vimeo is certified.
Withdrawal: At any time with effect for the future via the cookie settings.
Further information: vimeo.com/privacy

19. Google Maps

Google Maps

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Displaying an interactive map
Data: IP address, device and browser information, location of the map view, interactions with the map
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third country: A transfer to Google LLC in the USA is possible. The company is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
Withdrawal: At any time with effect for the future via the cookie settings.
Further information: policies.google.com/privacy

20. Review widgets

Google reviews

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Displaying our Google reviews on the website
Data: IP address, device and browser information, page viewed
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third country: A transfer to Google LLC in the USA is possible. It is based on the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR).
Withdrawal: At any time with effect for the future via the cookie settings.
Further information: policies.google.com/privacy

Trustpilot

Provider: Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen K, Denmark
Purpose: Displaying our Trustpilot reviews on the website (TrustBox)
Data: IP address, device and browser information, page viewed, display of the widget
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third country: The provider is based in the EU.
Withdrawal: At any time with effect for the future via the cookie settings.
Further information: legal.trustpilot.com

ProvenExpert

Provider: Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin, Germany
Purpose: Displaying our ProvenExpert rating seal on the website
Data: IP address, device and browser information, page viewed, language setting
Legal basis: Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third country: The provider is based in Germany. Insofar as servers outside the EU are used, the transfer is based on standard contractual clauses.
Withdrawal: At any time with effect for the future via the cookie settings.
Data processing: A contract pursuant to Art. 28 GDPR is in place with the provider.
Further information: provenexpert.com/en-gb/privacy-policy

21. Fonts and graphics

We embed fonts and graphics locally from our own server. No connection to third-party servers is established for this when the website loads.

22. Recipients and transfers to third countries

Your data is only received by the service providers named in this policy, insofar as this is necessary for the respective purpose, and in individual cases by our tax adviser, authorities or courts if we are legally obliged to provide it. We have contractually bound processors pursuant to Art. 28 GDPR. We do not sell personal data.

For certified providers, we base transfers to the USA on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). The adequacy decision is currently valid but is under review by the Court of Justice of the EU. We therefore additionally base transfers on standard contractual clauses where possible. You can obtain a copy of the standard contractual clauses on request. A list of certified companies can be found at dataprivacyframework.gov.

23. No automated decision-making

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

24. Your rights

You have the right to:

access to your stored data (Art. 15 GDPR)
rectification of inaccurate data (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An email to office@growismedia.com is sufficient for your request.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de. You can also contact the supervisory authority in your country of residence.

25. Right to object

Right to object pursuant to Art. 21 GDPR
If we process your data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds. You can object to processing for direct marketing purposes at any time without giving reasons.

26. Changes to this privacy policy

We adapt this privacy policy when our website, the services we use or the legal situation change. The version published here applies.