Privacy Policy

Data Controller

GROW Enterprise Ltd is the data controller responsible for your personal data collected through this website. This address is our registered office for legal and data protection purposes only — we are an online business and do not receive visitors at this address.

Legal basis for processing your data

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

What we collect

• ✦Name and contact details (email, phone, address)
• ✦Payment information (processed securely by our payment provider)
• ✦Order history and preferences
• ✦Website usage data (cookies, analytics)
• ✦Communications with our support team

How we use your data

• ✦To process and fulfil your orders (legal basis: contract)
• ✦To communicate about your order or enquiry (legal basis: contract)
• ✦To provide customer support (legal basis: legitimate interests)
• ✦To send marketing emails (legal basis: consent — you can unsubscribe at any time)
• ✦To improve our website and services (legal basis: legitimate interests)
• ✦To comply with legal and regulatory obligations (legal basis: legal obligation)

Who we share data with

• ✦Payment processors — to handle transactions securely
• ✦Courier/delivery services — to deliver your order
• ✦Analytics tools — to understand website usage (with your consent where required)

We do not sell your personal data to third parties.

How long we keep your data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. For example, order records are kept for 6 years for tax and accounting purposes. Marketing consent records are kept until you withdraw consent. Website analytics data is anonymised or deleted after 26 months.

International data transfers

Some of our service providers may process your data outside the UK. Where this happens, we ensure appropriate safeguards are in place — such as standard contractual clauses approved by the ICO — to protect your data to the same standard as UK GDPR requires.

Cookies

We use cookies to improve your experience on our website. For full details, please read our Cookie Policy.

Your rights under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

• ✦Right of access — request a copy of the personal data we hold about you
• ✦Right to rectification — request correction of inaccurate or incomplete data
• ✦Right to erasure — request deletion of your data (where there is no compelling reason to continue processing)
• ✦Right to restrict processing — request that we limit how we use your data
• ✦Right to data portability — request your data in a structured, machine-readable format
• ✦Right to object — object to processing based on legitimate interests or for direct marketing
• ✦Right to withdraw consent — where processing is based on consent, you can withdraw it at any time
• ✦Right to lodge a complaint — you can complain to the ICO (Information Commissioner's Office) if you believe your data rights have been violated

To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receiving your request, as required by UK GDPR.

Supervisory authority

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the UK's supervisory authority:

Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

Contact

For privacy-related questions or to exercise your data rights, contact [email protected].