Privacy Policy — Breaknorm

At Growspot, respect for our customers' and users' privacy and personal data is at the core of our commitments. One of our actions to achieve this is to provide you with detailed information about how we collect and process your personal data through this privacy policy.

Who is the Data Controller?

This privacy policy covers the purposes and processing carried out by Growspot as a data controller. For information about the purposes and processing carried out by Growspot as a data processor, please consult the Data Processing Agreement (hereinafter “DPA”).

Growspot (Growspot Ltd., headquartered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom) provides its users with a data enrichment solution to facilitate contact and communication with their stakeholders. Growspot offers several features such as a browser extension, API, web application, and website (hereinafter the “Services”).

As part of its activities, Growspot processes personal data of customers, users, prospects, candidates, and website visitors.

When Does Growspot Collect Personal Data?

Depending on the purposes of processing, Growspot collects personal data at different times. Growspot notably collects personal data in the following situations:

during candidate searches and receipt of job applications;
during prospect research, appointment scheduling, and communications;
during webinar organization and newsletter subscription;
when entering into contracts with customers, suppliers, partners, and other contractors, as well as during payment processing, communications with them, and Service delivery;
during user assistance and support requests;
when users create an account, log into the web application, and use the Services;
when visitors browse Growspot's website;
when receiving data subject rights requests.

What Data Does Growspot Process?

As part of its activity and Service provision, Growspot processes the following personal data:

Identification data — name, first name, date of birth, gender. These may be necessary for account creation and contract conclusion;
Contact data — email address and phone number. These may be necessary for account creation and contract conclusion;
Application data — professional background, education, experience, resumes, and cover letters;
Professional data — job positions, companies, or professional needs;
Browsing data — cookie data, IP address, logs, user journey;
Usage data — service utilization, user feedback and reviews, and session history;
Device identification data — browser type, operating system, and processor;
Payment data — banking information, amounts due, invoices. These are necessary for contract conclusion and service provision;
Support data — support needs and customer communications. Description of difficulties encountered by the user is essential for finding an appropriate solution.

Processing Purposes, Legal Bases, and Retention Periods

Purposes	Personal Data	Legal Bases	Retention
Identify and recruit new talent	Identification, Contact, Application data	Legitimate interests; Contractual execution	Duration of recruitment process
Identify, contact, and communicate with prospects	Identification, Contact, Professional data	Legitimate interests in developing customer base	3 years from last contact
Organize webinars and send newsletters	Identification, Contact, Professional data	Consent	Duration of subscription or until webinar
Payment reception, processing, and management	Identification, Payment data	Contractual execution; Legal obligation	Until final payment or legal obligation
Management of contractual and commercial relationships; Dispute management	Identification, Contact, Professional data, Communications	Contractual execution; Legitimate interests	Duration of contract or dispute
Assistance and support management	Identification, Contact, Support data	Legitimate interests in ensuring proper service	Duration of assistance or support
Website and web application security, including fraud prevention	Navigation, Device identification, Usage data	Legitimate interests in ensuring proper service	1 year from collection
Improvement of website, web application, and services	Navigation, Usage data	Consent; Legitimate interests	25 months from collection
Reception and response to data subject rights requests	Identification, Contact data, Communication content	Legal obligation	Duration of request

Who Are the Recipients of the Data?

As part of its activities, Growspot may need to transmit your personal data to recipients. These are either internal or external recipients.

Internal Recipients

Employees and people working for Growspot who need access to data to perform their assigned tasks. For example, the tech team to respond to technical support requests.

External Recipients

Data processors that Growspot uses to carry out its activities or third parties. For example, a data processor may be the company providing the CRM or online payment tool, and a third party may be a law firm, accounting firm, or administration.

Growspot commits to concluding a DPA with each of its processors to ensure they comply with applicable data protection regulations and maintain the confidentiality of the data they process.

Growspot may also need to share personal data when required by legal, regulatory, or judicial decision, or in case of audits conducted in the context of investment, sale, or transfer of all or part of Growspot's activities.

Does Growspot Transfer Data Outside the European Union?

As part of its activities, Growspot and its processors may transfer data outside the European Union, particularly to the United Kingdom.

Growspot ensures that transfers are carried out either under an adequacy decision or under the European Commission's standard contractual clauses in their June 4, 2021 version, or through any other transfer instrument explicitly authorized by applicable data protection regulations.

To obtain a copy of the transfer instrument, you can contact Growspot at [email protected]

What Are the Rights of Data Subjects?

Individuals whose data is processed by Growspot can exercise the following rights:

Right of access — to access and obtain information and a copy of data processed by Growspot;
Right to object — to oppose Growspot's use of your data for a specific purpose;
Right to rectification — to request Growspot to update personal data;
Right to erasure — to request Growspot to delete personal data;
Right to restriction — to request Growspot to limit processing carried out on personal data;
Right to data portability — to retrieve data you provided to Growspot or request its transmission to a third party;
Right to post-mortem directives — regarding the fate of personal data after death.

When processing is based on consent, it is also possible to withdraw consent.

To exercise these rights, simply contact Growspot at: [email protected]. Please indicate the nature of the right you wish to exercise.

It is also possible to file a complaint with the Information Commissioner's Office (ICO).

What Security Measures Does Growspot Implement?

To ensure the security of personal data it processes, Growspot implements technical and organizational measures to ensure the confidentiality, availability, access, and integrity of processed personal data.

For example, Growspot implements measures to ensure users use strong passwords, that strict access control exists, and that connection logs are encrypted at rest and retained for one year.

How Are Cookies Handled?

Growspot has implemented a specific policy regarding trackers and cookies. It can be consulted here.

Privacy Policy Modifications

This privacy policy may be subject to modifications and updates to take into account changes in Growspot's activities and Services. It is recommended to consult it regularly to stay up to date with the latest developments.