Privacy Policy

§1 Definitions

Administrator – GROWTH HUB SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Warsaw, the entity determining the purposes and means of processing personal data.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

PKE – the Act of 12 July 2024 - Electronic Communications Law, in force since 10 November 2024, which replaced the previous Telecommunications Law provisions regarding direct marketing.

ushude – Act of July 18, 2002 on the Provision of Services by Electronic Means.

Commercial information – promotional, commercial, or advertising content regarding the Administrator's services and products, including a newsletter.

DPF – EU-US Data Privacy Framework, a mechanism for data transfer to the US based on the European Commission's implementing decision of July 10, 2023, stating an adequate level of data protection in the US for certified entities.

EOG – European Economic Area.

Service – the website at https://growthhub.pl along with its subpages (landing pages, forms, downloadable materials, tools, and email course and newsletter registration pages).

§2 Data controller and contact details

  1. The administrator of personal data is GROWTH HUB SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, entered in the Register of Entrepreneurs of the National Court Register under the number KRS 0001093247, NIP 5223291362, REGON 528060832, share capital of PLN 5,000.
  2. Contact details of the Administrator – registered office address: ul. Gen. Tadeusza Pełczyńskiego 14D / 149, 01-471 Warsaw, Poland; e-mail address: kontakt@growthhub.pl.
  3. The controller has not appointed a Data Protection Officer. For all matters regarding the processing of personal data, you can contact us at kontakt@growthhub.pl.

§3 What data we collect and from where

The Administrator collects personal data provided voluntarily by users at the following touchpoints on the Website:

  1. Contact form / Growth Audit inquiry / Request for quotation: first and last name, business email address, phone number, company name, website address, message content.
  2. Downloadable materials (e-books, guides, playbooks) and interactive tools (calculators, self-assessment): e-mail address, and in the case of tools, also the result of the completed form.
  3. Registration for email courses and newsletter: email address, optional name.
  4. Call / audit booking (online calendar): first and last name, email address, and optionally the information provided during the reservation.
  5. Technical data collected automatically: IP address, cookie identifiers and similar technologies, online identifiers (e.g., Meta and Google advertising identifiers), device and browser information, activity data on the Website (pages visited, clicks, message opens, entry source, UTM parameters, ad campaign identifiers). These data may be used for lead scoring and remarketing activities.

Visitors to the Website can browse its content without providing personal data; providing data is voluntary and occurs when using specific features.

§4 Purposes and legal bases of processing

The controller processes data for separate purposes, indicating the legal basis for each:

Purpose of processing Legal basis
Handling of contact form inquiry / Growth Audit, follow-up contact, offer preparation Article 6(1)(b) of the GDPR (steps taken at the request of the data subject prior to entering into a contract) and Article 6(1)(f) of the GDPR (legitimate interest: responding to an inquiry)
Telephone contact regarding the submitted inquiry consent to telephone contact expressed in the form (Article 6(1)(a) of the GDPR and the Electronic Communications Law requirement for direct marketing conducted by telephone) and Article 6(1)(f) of the GDPR
Delivery of the ordered material / tool output Article 6 paragraph 1 letter b of the GDPR (contract for the supply of digital content on demand)
Sending newsletters and other commercial information by email marketing consent for the e-mail channel required by the Telecommunications Law (a separate, optional checkbox) as a condition for using this channel; the legal basis for data processing is Article 6(1)(f) of the GDPR – the Administrator's legitimate interest consisting in direct marketing of their own services towards persons who have voluntarily provided their data; the data subject has the right to object (Article 21(2) of the GDPR)
Sending educational content as part of a subscribed email course Article 6(1)(b) of the GDPR (performance of the ordered service) and, regarding commercial content, as above for the newsletter
Traffic analytics (Google Analytics 4) as well as online marketing and remarketing (Meta Pixel, Conversions API, Google Ads), utilizing cookies and online identifiers consent given via the cookie banner (Article 6(1)(a) of the GDPR and the PKE requirement regarding the storage of and access to information on a terminal device)
Settlements, accounting, tax obligations Article 6(1)(c) of the GDPR (legal obligation)
Establishment, investigation, or defense of claims Article 6 paragraph 1 letter f GDPR (legitimate interest)

Providing data is voluntary, but necessary to use a given function (e.g., receiving a response, downloading material, receiving a newsletter). Marketing consent for the newsletter is entirely voluntary and its absence does not block the downloading of the material or the handling of the inquiry.

§5 Data recipients and processors

Personal data may be transferred to entities processing data on behalf of the Administrator (based on data processing entrustment agreements), in particular:

  • LH.pl Sp. z o.o. (Pl. Wolności 6/4, 61-738 Poznań, Tax ID [NIP] 7831711517) – hosting and maintenance of the Website (servers located in Poland, EEA),
  • ActiveCampaign, LLC - a marketing automation / CRM system in which we store lead data and conduct email communication,
  • MailerLite Limited (a company registered in Ireland, 88 Harcourt Street, Dublin 2, D02 DK18) – newsletter delivery system,
  • Meta Platforms, Inc. – advertising and measurement tools (Meta Pixel, Conversions API) for campaign and remarketing purposes,
  • Google LLC - analytical and advertising services (Google Analytics 4, Google Ads, Google Tag Manager),
  • online meeting booking tool provider,
  • IT service and technical support providers,
  • Andrzej Nowak Tax Office (kpan.pl) and other advisors – to the extent necessary for settlement purposes.

Data may also be transferred to entities authorized to receive them under the provisions of law. The list of tools may change along with the development of the Service; the current scope can be obtained by contacting the Administrator.

§ 6 Transfer of data to third countries (USA)

  1. Due to the use of marketing and analytical tools, some data may be transferred to a third country – the United States of America. This applies to data such as first and last name, e-mail address, phone number, company name, job title, IP address, online identifiers, and data regarding activity on the Website and in messages (opens, clicks), processed by: ActiveCampaign, LLC, Meta Platforms, Inc., and Google LLC.
  2. These entities are certified under the EU-US Data Privacy Framework (DPF). The transfer takes place on the basis of the European Commission's implementing decision of July 10, 2023, stating the adequate level of protection of personal data in the USA for certified entities. The validity of this decision was upheld by the judgment of the General Court of the European Union of September 3, 2025.
  3. The newsletter is operated by MailerLite Limited based in Ireland (EEA); this entity may use sub-processors in the USA when providing the service, based on the DPF or standard contractual clauses.
  4. In cases where a specific transfer is not covered by the scope of the DPF, the Controller applies standard contractual clauses (SCCs) approved by the European Commission as well as additional technical and organizational measures (including encryption and data minimization) to ensure a level of protection essentially equivalent to the GDPR.
  5. A copy of the appropriate safeguards (e.g., standard contractual clauses) can be obtained by contacting the Administrator.

§ 7 Profiling and automated processing

  1. User activity data can be used for profiling for marketing purposes – in particular, for matching advertising content (remarketing in Meta and Google) and preliminary assessment of query-to-offer fit (lead scoring).
  2. Profiling does not produce legal effects on the user or similarly significantly affect them within the meaning of Article 22 of the GDPR – we do not make fully automated decisions that produce such effects. Decisions regarding cooperation are made by humans.
  3. An individual has the right to object to processing (including profiling) for direct marketing purposes (Article 21(2) of the GDPR).

§8 Data Retention Period

  1. Data from contact inquiries – for the time necessary to handle the inquiry and conduct correspondence, and thereafter for the period of limitation of potential claims.
  2. Data processed for the purpose of the newsletter and direct marketing – until the marketing consent is withdrawn or an objection to direct marketing is raised.
  3. Data processed based on consent for cookies/online marketing – until the consent is withdrawn or the respective cookies expire.
  4. Billing data – for the period required by tax and accounting regulations.
  5. Register of consents and proof of their provision – for the period necessary to demonstrate accountability.

§ 9 Rights of the data subject

Everyone has the right to:

  1. access to one's data and obtaining a copy thereof,
  2. rectification (correction) of data,
  3. data deletion,
  4. restrictions on processing,
  5. data transfer,
  6. objecting to processing based on legitimate interests, and in the case of direct marketing – objecting at any time (Article 21(2) of the GDPR),
  7. withdrawal of consent at any time (including marketing consent for the newsletter – by clicking the unsubscribe link in each message or via email contact, and cookie consent – by changing consent settings); the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal,
  8. lodging a complaint with a supervisory authority – the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa).

Rights are exercised by contacting kontakt@growthhub.pl. The Administrator may request information to identify the person making the request.

§ 10 Cookies and similar technologies

  1. The website uses cookies and similar technologies. We distinguish between: essential cookies (necessary for the operation of the Website – their use does not require consent), analytical cookies (measuring traffic and statistics, e.g., Google Analytics 4), and marketing cookies (advertising campaigns, remarketing, and conversion measurement, e.g., Meta Pixel, Google Ads).
  2. Analytical and marketing cookies are activated only after consent is given via the consent banner displayed upon entering the Website. Consent can be changed or withdrawn at any time via the consent settings. The legal basis is Article 6(1)(a) of the GDPR and the provisions of the Polish Law on Electronic Communications (PKE) concerning the storage of and access to information on the user's terminal equipment.
  3. The user can also manage cookies from their browser settings; restricting essential cookies may affect the functionality of the Website.

§11 Voluntary provision of data

Providing data is voluntary. Failure to provide the data required in a given form makes it impossible to use a specific function (e.g., processing an inquiry, downloading material). Giving marketing consent for the newsletter and consent for analytical and marketing cookies is entirely voluntary and does not condition access to the other functions of the Website.

§12 Data security

The controller implements appropriate technical and organizational measures ensuring the protection of personal data adequate to the risks and categories of data, in accordance with the GDPR, including transmission encryption (SSL/TLS) and restriction of access to data.

§13 Changes to the Privacy Policy

  1. The Administrator reserves the right to amend this Policy. Users will be informed of significant changes with appropriate advance notice (e.g., via a notice on the Website or in the newsletter).
  2. Questions regarding the Policy should be sent to kontakt@growthhub.pl.
  3. Last modified date: 29.06.2026.