Privacy policy

Who we are

GREX is a product of GrowthEx Ltd, a company registered in England and Wales (company number 16090644). Our registered office is Future Business Centre Cambridge Campus, Kings Hedges Road, Cambridge, CB4 2HY.

For the personal data described in this policy, GrowthEx Ltd is the controller. That means we decide how and why it is used. You can contact us about anything in this policy at privacy@grex.ai.

We are registered with the Information Commissioner's Office (ICO) under registration number ZC010128. Our Data Protection Manager is Tom Dewhurst, co-founder, who you can reach at the same address.

What this policy covers

This policy covers personal data we handle when you:

• visit grex.ai or any page on it;
• book a strategy session, request a GTM Gap Report, download research or otherwise contact us;
• are a business contact we think may be interested in GREX; or
• are a contact at one of our customers, suppliers or partners.

It does not cover data that our customers put into their own GREX workspace. For that data the customer is the controller and we act as their processor, under the terms of our customer agreement and data processing agreement. If your data is in a customer's workspace, please contact that customer first.

As a processor we use customer data only to deliver the services, limit it to what the work needs (usually names, business emails and company details). When the agreement ends we give the customer a full export, keep the data for 7 days so they can retrieve it, then delete it and confirm in writing.

Data we collect

Data you give us

• Contact and enquiry details: your name, work email, company, team size, the metric you're responsible for, and anything you tell us in a form, email or call.
• Meeting bookings: the details you enter when booking a session through our scheduling tool, and notes from the session.
• Report requests: your company website and contact details when you ask for a GTM Gap Report or download our research.
• Customer and supplier details: contact, billing and contract information for the people we work with.

Data we collect automatically

• Usage data: pages viewed, clicks, referring site, browser and device type, approximate location derived from your IP address, collected by our product analytics tool.
• Company-level visitor data: we use your IP address to look up the organisation a visit comes from (for example, "a visitor from Acme Ltd viewed the pricing page"). We do not use this to identify you as an individual, and it does not place cookies on your device.
• Advertising measurement: if you accept marketing cookies, whether a visit from one of our ads led to an enquiry.

Data we get from other sources

• Business contact data: names, job titles, work email addresses and company details from public sources (such as company websites and professional networks) and from B2B data providers, used for business-to-business marketing.
• Public data about your company: when you request a GTM Gap Report, we analyse publicly available information about your company's website, search and AI visibility, advertising and online presence.

We do not ask for, and do not want, special category data (such as health information) through this website.

How we use it and why

UK data protection law requires a lawful basis for each use. Ours are:

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for more detail, and you can object at any time (see Your rights). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Business marketing

We market GREX to businesses. We may email or message people at companies we think could benefit from GREX, using work contact details. Every message tells you who we are and gives you a simple way to opt out. If you are a sole trader or in a partnership, we'll only send you marketing emails if you've agreed to receive them.

If you opt out, we'll stop. We keep a minimal record of your email address on a suppression list so we don't contact you again.

Who we share it with

We don't sell personal data. We share it only with:

• Service providers who work for us (sub-processors), under contract and only on our instructions. They're listed in the table below.
• Growth Division LLP, our partner agency, whose specialists help design and deliver some of our growth systems, under a contract that protects your data.
• Specialist contractors, such as paid media and design specialists, who work on customer accounts under signed subcontractor agreements covering confidentiality and data protection. We remain responsible for their work. Some are based outside the UK.
• Professional advisers such as lawyers and accountants, under a duty of confidentiality.
• Authorities where the law requires it, or to protect our rights or someone's safety.
• A buyer or investor if we sell, merge or restructure the business, under confidentiality terms. You'll be told if your data becomes subject to a different privacy policy.

We may also use B2B data and outreach tools for business marketing. We'll update this list when it changes.

International transfers

Some of our providers and specialist contractors are based in, or access data from, outside the UK, mainly the United States and the European Economic Area, and in some cases South Africa. When data leaves the UK we make sure it is protected by one of the safeguards UK law allows: a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified), or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard.

How long we keep it

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in some circumstances;
• restrict how we use it in some circumstances;
• object to uses based on legitimate interests, and to direct marketing at any time (we'll always stop marketing when you ask);
• data portability for data you gave us under a contract or consent;
• withdraw consent at any time, for example through Cookie settings. This doesn't affect anything we did before you withdrew it.

To use any of these rights, email privacy@grex.ai. We'll respond within one month, and may need to confirm your identity first. There's normally no charge.

Complaints

If you're unhappy with how we've handled your data, please tell us first at privacy@grex.ai. We'll acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.

Security

We use appropriate technical and organisational measures to protect personal data, and we follow a written data protection policy. In practice:

• data is encrypted in transit, and held with reputable providers that have their own security certifications;
• GREX connects to a customer's tools only when they choose to, through each vendor's own sign-in (OAuth). We don't ask for or share passwords;
• access keys are held server-side, never in a customer's workspace, and every call made with them is logged against that workspace;
• access is per person, with role permissions and multi-factor authentication, and limited to the people who need it;
• customers' ad and analytics accounts stay in their name, and any access we're given can be revoked by them at any time.

Customers can ask us to complete their supplier security questionnaire and to sign their own data processing agreement. No system is completely secure. If we become aware of a breach that affects you, we'll tell you, and the ICO where the law requires it.

Cookies and similar technologies

Cookies are small files stored on your device. We also use similar technologies such as local storage and tracking pixels. We only use cookies that aren't strictly necessary if you agree to them, and you can change your choice at any time in Cookie settings (also linked in the footer of every page).

Pages may also embed tools from third parties, such as our meeting scheduler, which set their own cookies when you use them. You can also block or delete cookies in your browser settings, though some parts of the site may then not work as intended.

Children

Our website and services are for businesses and are not aimed at anyone under 18. We don't knowingly collect data from children.

Changes to this policy

We'll update this policy when how we use data changes. The date at the top shows the latest version. If a change matters to you, we'll tell you directly where we can.

Contact us

GrowthEx Ltd, Future Business Centre Cambridge Campus, Kings Hedges Road, Cambridge, CB4 2HY.
Email: privacy@grex.ai