Privacy policy

This policy explains how Growmo B.V. handles personal data when you visit growmo.org or contact us. We keep data collection to a minimum: no analytics, no tracking cookies and no third-party embeds.

1. Controller

Growmo B.V., Verheeskade 497, 2521 DG Den Haag, Netherlands. Chamber of Commerce (KvK) 93642954, VAT NL866478061B01. Email: . We are the controller for the processing described here. We are not required to appoint a Data Protection Officer.

2. What data we process

Contact form and email

• your first and last name and email address (required);
• the services you are interested in;
• the content of your message;
• your phone number and website (optional);
• confirmation that you agreed to this privacy policy, with the date and time;
• a shortened, irreversibly hashed form of your IP address and your browser user agent, used only to limit automated abuse of the form.

Server logs

Our hosting provider automatically records technical data when a page is requested: IP address, date and time, requested URL, HTTP status, referrer and browser type. These logs are used to keep the website available and secure and to diagnose errors.

3. Why we process it and on what legal basis

• Answering your enquiry and preparing a possible agreement — Article 6(1)(b) GDPR (performance of a contract or steps prior to it). Where no contract is envisaged, we rely on our legitimate interest in responding to business enquiries, Article 6(1)(f) GDPR. You also give consent when you submit the form and confirm you have read this policy (Article 6(1)(a) GDPR).
• Website security, abuse prevention and troubleshooting — Article 6(1)(f) GDPR (our legitimate interest in a secure, functioning website).
• Legal and administrative obligations, where they apply to correspondence connected to an assignment — Article 6(1)(c) GDPR.

Providing your data is voluntary. Without a name, email address and message we cannot reply to your enquiry.

4. How long we keep it

• Enquiries: deleted after 24 months if they do not lead to a business relationship.
• Correspondence within a client relationship: kept for the duration of the relationship and afterwards only as long as required by law, for example the Dutch seven-year tax retention obligation for administrative records.
• Server logs: kept only for a short period by our hosting provider for security and troubleshooting purposes.

5. Who processes data on our behalf

We use a small number of carefully selected service providers, each bound by a data processing agreement and permitted to process data only on our instructions:

• Lovable / Supabase — website hosting and the database in which contact form submissions are stored;
• Resend — delivery of the notification email generated by the contact form;
• Proton — our business mailbox, where your enquiry and any further correspondence are received and stored.

We do not sell your personal data and we do not share it with third parties for advertising. We may share data with advisers or authorities where we are legally required to do so.

6. International transfers

Our providers process data primarily within the European Economic Area. Where a provider or its sub-processors process data outside the EEA, for example in the United States, the transfer is covered by appropriate safeguards under Chapter V GDPR — normally the European Commission's Standard Contractual Clauses (SCCs) combined with additional technical and organisational measures such as encryption in transit and at rest, and where applicable an adequacy decision such as the EU–US Data Privacy Framework. You can request more information about these safeguards by emailing us.

7. Security

The website is served over HTTPS. Contact form submissions are stored in a database that is not publicly readable and is accessible only through our protected server code. Access to enquiries is limited to people within Growmo who need it to respond to you.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict our processing of your data;
• receive your data in a portable format;
• object to processing based on our legitimate interests, and withdraw your consent at any time — withdrawal does not affect processing that already took place.

To exercise a right, email . We respond within one month. We do not ask you to send a copy of your ID or passport. If we cannot reasonably establish that the request comes from you, we may ask a limited, proportionate follow-up question — for instance confirmation from the email address used for the original enquiry.

9. Complaints

If you believe we process your data unlawfully, we would like to hear from you first. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your country of residence.

10. Cookies

This website uses only strictly necessary technical storage and no tracking cookies. See our cookie policy.

11. Automated decision-making

We do not use automated decision-making or profiling that produces legal effects for you.

12. Changes to this policy

We may update this policy when our services or legal obligations change. The date at the top of this page shows when it was last revised.