Privacy policy

Controller:

Zakomo FZCO
IFZA, Dubai Silicon Oasis
Dubai, United Arab Emirates

Represented by: Jörg Müller
Email: [email protected]

A data protection officer has not been appointed.

1. Applicable law and place of processing

Growmindr is operated by a company established in the United Arab Emirates, but is expressly also aimed at customers in the European Economic Area. We therefore process personal data in accordance with the General Data Protection Regulation (GDPR), whose territorial scope in this respect follows from Art. 3(2) GDPR, as well as Federal Decree-Law No. 45 of 2021 of the United Arab Emirates on the Protection of Personal Data (PDPL).

All processing takes place on servers in Dubai, United Arab Emirates. For the United Arab Emirates there is no adequacy decision of the European Commission under Art. 45 GDPR. We therefore base transfers from the EEA on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) under Art. 46(2)(c) GDPR; for data that customers introduce into the Platform, these clauses are part of the Data Processing Agreement. In addition, we take the technical and organisational measures described in Annex 1 of that agreement.

In all data protection matters you can reach us directly at [email protected].

2. Two roles

• For the website and your customer account we are the controller.
• For the content that customers introduce into the Platform — in particular

contact data of outreach recipients — the respective customer is the controller; we process this data exclusively as a processor (Section 7).

3. Visiting the website

When growmindr.com is accessed, our server processes the technically necessary connection data: requested address, time, amount of data transferred, status code, referrer, browser identifier and IP address. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and trouble-free operation. Server logs are deleted after 14 days at the latest.

The website is delivered through a Cloudflare tunnel. In doing so, Cloudflare processes connection data including the IP address as a processor in order to ensure delivery, TLS encryption and protection against attacks.

No cookies are set on the website, and neither localStorage nor sessionStorage nor comparable techniques are used to store or read information on your device. Consent for access to terminal equipment — in Germany Section 25(1) TDDDG — is therefore not required; a consent banner is deliberately omitted.

Embedded fonts are loaded from Google Fonts. In the process, your IP address is transmitted to Google Ireland Limited. The legal basis is Art. 6(1)(f) GDPR (consistent presentation of the website).

4. Reach measurement

For reach measurement we operate a self-hosted instance of the open-source software Umami on our own server. No transmission to an analytics service provider takes place.

Umami works cookie-free. From the IP address, browser identifier and a randomly changing value, an identifier is formed that summarises a visit; the IP address itself is not stored. The only things stored are: page accessed, referring page, time, country and region derived from the IP address, browser, operating system, device type, screen resolution and language setting. It is not possible for us to draw conclusions about a specific person from this.

In addition, we record anonymous events about the usage flow (such as clicking a registration button) in order to recognise where prospects drop off.

The legal basis is Art. 6(1)(f) GDPR. The data is deleted after 24 months.

5. Registration and use of the account

For an account we process name, email address, a hashed password, the chosen role in the team, and the times of sign-in and last activity. The legal basis is Art. 6(1)(b) GDPR (performance of the contract).

To confirm the email address and for team invitations, we send emails via our own mail server. Sessions are represented by a technically necessary cookie that is set exclusively after sign-in (httpOnly, SameSite=Strict, only over HTTPS) and expires after 15 minutes of inactivity. It is strictly necessary for the service you have expressly requested and is therefore exempt from consent.

For security and abuse prevention, we keep an activity log of security-relevant events in the account (Art. 6(1)(f) GDPR).

6. Billing

Paid plans are billed through Paddle. Paddle acts as Merchant of Record and thus as its own controller: your contracting party for payment processing is Paddle, not us. Payment data is collected directly by Paddle; we receive neither card numbers nor bank details, but only the plan, status and term of the subscription. In addition, Paddle's data protection notices apply at https://www.paddle.com/legal/privacy.

7. Data that customers introduce

If a customer introduces personal data into the Platform — in particular contact data of outreach recipients, message content, and open, click and unsubscribe events — the customer is the controller for this. We process this data exclusively on instructions on the basis of the Data Processing Agreement, which forms part of the contract and includes the Standard Contractual Clauses for transfer to the United Arab Emirates.

As the recipient of an email sent via Growmindr, please address requests for access, rectification and erasure to the sender, that is, to the customer who wrote to you. You can also unsubscribe via the unsubscribe link in every email; the address is then permanently blocked for further campaigns of that customer. If a request reaches us directly, we forward it without delay to the responsible customer and support them in responding.

8. Recipients and processors

• Cloudflare — delivery of the website, protection against attacks.
• Paddle — payment processing, acting there as its own controller.

No external analytics, advertising or tracking services are used. The database, object storage, reach measurement and the AI functions run on our own infrastructure in Dubai.

Optional services that are connected only at the customer's express instruction and for which the customer stores its own access key: Hunter.io and Apollo.io for contact enrichment, and the mail server configured by the customer for sending. Without a stored key, no transmission takes place.

9. Artificial intelligence

The AI-assisted functions for text creation use a language model operated on our own server. Inputs do not leave our infrastructure and are not used to train third-party models. Should an external provider be connected in the future, we will inform you of this in advance at this point.

10. Retention period

• Server logs: 14 days.
• Reach measurement: 24 months.
• Account and contract data: for the duration of the contract; thereafter until

the expiry of statutory retention periods, with processing restricted to those purposes.

• Content introduced by the customer: up to 30 days after the contract ends,

then deletion.

• Backup copies: rolling, overwritten after 14 days at the latest. A deletion

only affects backup copies once they expire.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent you have given at any time with effect for the future. Corresponding rights are available to you under the PDPL.

Right to object: Insofar as we process data on the basis of legitimate interests, you can object to this processing at any time on grounds relating to your particular situation.

To do so, contact [email protected]. On request, we will provide you with a copy of the Standard Contractual Clauses.

Irrespective of this, you have the right to lodge a complaint with a supervisory authority. Within the EEA, this is the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement; in the United Arab Emirates, the UAE Data Office.

12. Necessity of provision

Providing name and email address is necessary to set up an account. Without this information we cannot perform the contract. Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

13. Changes

We adapt this policy when the processing changes. The version published on this page in each case is authoritative.