Privacy Notice

1) Who we are (data controller)

GrowthZoneAI is the 'data controller' for the personal information we collect and use.

Website: www.growthzoneai.co.uk
Email: hello@growthzoneai.co.uk

2) What personal information we collect

Depending on how you interact with us, we may collect:

• Identity and contact details (e.g., name, email address, phone number, business/organisation name).
• Enquiry details (what you ask us about, goals, challenges, and any information you choose to share).
• Website usage and technical data (e.g., pages visited, time on page, clicks, IP address, device/browser information) where cookies/analytics are enabled.
• Service and project information (notes, documents, meeting notes, deliverables) if you become a client.
• Payment/admin records (invoices, transactions and correspondence) if you become a client.

3) How we use your information (purposes)

We use personal information to:

• Respond to enquiries and communicate with you.
• Provide our services, including audits, training, support, and agreed deliverables.
• Arrange calls/meetings and manage our relationship with you.
• Improve our website and understand how people use it (analytics), where enabled and where you consent.
• Run and measure advertising on social platforms (only where enabled and where you consent to marketing cookies/tags).
• Send you marketing updates only if you have opted in (or where a lawful 'soft opt-in' applies for existing customers).
• Manage our business admin (accounts, invoicing, record-keeping).

4) Our lawful bases for processing (UK GDPR)

We rely on one or more of the following lawful bases:

• Consent – for marketing emails (where you opt in) and for non-essential cookies/tags such as analytics and advertising cookies (where required).
• Contract – where processing is needed to deliver services you have requested or agreed.
• Legal obligation – where we must keep records for tax/accounting or other legal requirements.
• Legitimate interests – for genuine business reasons (for example, responding to enquiries), balanced against your rights.

5) Cookies, analytics and advertising tags

We use cookies and similar technologies on our website. Some are strictly necessary for the site to work. Others help us understand website performance (analytics) or measure and improve advertising (marketing/advertising tags).

Where required, we will ask for your consent before setting non-essential cookies/tags, and you can change your choices at any time.

For more detail, please see our Cookies Policy.

6) Google Analytics (GA4)

We use Google Analytics (GA4) to understand how visitors use our website — for example, which pages are visited, how long people spend on a page, and where people may drop off.

We aim to use GA4 in a privacy-minded way, including:

• Only running analytics cookies where you consent (where required).
• Avoiding deliberately sending personal information in URLs or form fields into analytics.
• Reviewing our settings periodically to keep data collection appropriate.

7) Social media advertising (optional marketing tags)

When we run paid advertising, we may use marketing/advertising tags ("pixels") from social platforms to measure performance (e.g., page views or form submissions after an ad), and in some cases to build audiences for retargeting.

Examples of platforms we may advertise on include:

• Meta (Facebook/Instagram)
• LinkedIn
• X (Twitter)
• Threads
• Bluesky
• TikTok (if/when we advertise there)
• Other platforms used for campaign measurement and reporting

We will only enable marketing tags where you have consented to marketing/advertising cookies via our cookie controls (where required).

8) Who we share information with

We keep sharing to a minimum. We may share information with trusted suppliers who help us run the business, for example:

• Website hosting and website support providers.
• Google (Google Analytics) where enabled.
• Advertising platforms (e.g., Meta, LinkedIn) where enabled and where you consent to marketing cookies/tags.
• Email, calendar, and document tools needed to communicate and deliver services.
• Accounting/bookkeeping tools (e.g., FreeAgent) and bank feed integrations where relevant.
• Professional advisers (accountants, legal advisers) where necessary.

We require suppliers to protect your information and only use it for the services they provide to us.

9) International transfers

Some suppliers (including Google and some advertising/AI/cloud services) may process data outside the UK. Where this happens, we take steps required by law to protect your information (for example, using appropriate contractual safeguards).

10) How long we keep your information

We keep personal information only as long as needed for the purpose it was collected, including for legal, accounting, or reporting requirements.

Typical retention examples (adjust to suit):

• Enquiries that don't become clients: up to 12 months (unless you ask us to delete sooner).
• Client records and invoices: typically 6 years (UK tax/accounting record keeping).
• Marketing lists: until you unsubscribe or we remove inactive contacts.

11) Security

We use reasonable technical and organisational measures to protect your information. This includes access controls, secure accounts, and sensible data-minimisation practices.

12) Your rights

You have rights under UK data protection laws, including:

• Access, rectification, erasure, restriction, objection, data portability, and the right to withdraw consent (where applicable).
• You can object to direct marketing at any time.

To exercise your rights, email us at hello@growthzoneai.co.uk.

13) Complaints

If you're unhappy with how we've handled your information, please contact us first and we'll try to put it right.

You can also complain to the UK Information Commissioner's Office (ICO): https://ico.org.uk/

14) AI tools and how we handle data

As part of our services, we may use AI-assisted tools (including large language models) to help draft, structure, summarise, or improve content, documents, and workflows.

Our approach is 'human-first' and safety-minded:

• We aim to minimise personal data used in AI tools (using redacted or anonymised examples where possible).
• We do not intentionally input confidential client information into third-party AI tools unless it is necessary for delivery and we have agreed safeguards with you.
• AI outputs can be wrong or incomplete. We encourage sensible human review and verification for important decisions.
• We choose suppliers and settings carefully, but third-party services can change over time. We keep this under review.

15) Children

Our services and website are not aimed at children, and we do not knowingly collect personal data from children.

16) Changes to this notice

We may update this Privacy Notice from time to time. The latest version will always be posted on our website with the updated date.