Privacy Policy.

Who is collecting your data

GrowBeyond Solutions (“GrowBeyond”, “we”, “us”) is the data controller for all personal data processed through growbeyond.ltd and the related client platform at app.growbeyond.ltd. We operate from Bangkok, Thailand, serving clients in Denmark, the wider EU, and globally. For any question about your data, contact us at hello@growbeyond.ltd.

What data this site processes

There are two categories.

1. Things you actively give us

Your name, email, and message when you submit the contact form. Stored in our database so that we can reply to you. Never shared, never added to a mailing list — this site runs no newsletter and no sales follow-up.

2. Things stored on your device

By default, only Cloudflare’s strictly-necessary cookies (bot-protection on the contact form — see the Cookie Policy). Analytics cookies are set only if you opt in via the consent banner (see section 3). Once you answer the banner — accept or decline — your choice itself is kept in a small on-device record so we don’t ask twice; it’s not a cookie and never leaves your browser.

3. Things measured — only if you allow it

If you accept the consent banner, Google Analytics 4 records anonymised, aggregate usage (which pages are viewed, rough region, device type) so that we can see what is useful. Decline and nothing is measured — the Analytics script never loads. No cross-site tracking, no advertising profiles, no selling of data. Change your choice anytime via “Cookie settings” in the footer.

Why we are allowed to process this data

Under the GDPR, every piece of processing requires a legal basis. Ours are:

• Consent (Art. 6(1)(a)) — for Google Analytics. It runs only after you opt in via the banner, and you can withdraw anytime via “Cookie settings” in the footer.
• Legitimate interest (Art. 6(1)(f)) — for the contact form (you submitted it; we need to reply) and for security/bot-prevention (Cloudflare Turnstile). You can object via email.
• Contractual necessity (Art. 6(1)(b)) — for any data exchanged once we’re working together on an engagement.

How long we keep things

• Contact-form leads — for the active conversation, then archived for up to 24 months for context if you re-engage. Deleted on request.
• Cloudflare bot-protection — short-lived, set and expired by Cloudflare (30 minutes to 30 days).
• Google Analytics — only if you opt in: aggregate usage retained up to 14 months; the _ga cookies last up to 2 years (cleared sooner if you withdraw consent).

Who we share data with

A short and complete list:

• Cloudflare — DNS, CDN, and Turnstile bot-protection. They process IPs and basic request metadata as a sub-processor. Cloudflare’s privacy policy.
• Google (Analytics) — only if you accept analytics. Google processes anonymised usage data as a sub-processor; data may be handled in the US under Standard Contractual Clauses and Google’s EU-US Data Privacy Framework certification. Nothing is shared with Google until you opt in.
• The hosting provider — our own EU VPS hosts both the marketing site and the platform (files + database); DNS and bot-protection run through Cloudflare. one.com provides email for the growbeyond.ltd mailboxes. They host infrastructure, nothing more.

We do not sell data, share it with advertisers, run retargeting pixels, embed third-party trackers, or send your data to anyone for any purpose unrelated to delivering the service.

International data transfers

Some sub-processors (Cloudflare, and Google Analytics if you opt in) operate globally. Where data leaves the EEA, it’s covered by Standard Contractual Clauses (SCCs)or an adequacy framework (Google’s EU-US Data Privacy Framework) — the GDPR-approved transfer mechanisms. We keep our own primary database (contact-form leads) on a VPS in the EU.

Your rights

Under the GDPR you may request any of the following at any time. We will act within 30 days:

• Access — a copy of every piece of data we hold about you.
• Rectification — fix anything wrong.
• Erasure — delete everything (the “right to be forgotten”).
• Portability — get your data in a machine-readable format.
• Objection — stop processing based on legitimate interest.
• Lodge a complaint — with the Danish Data Protection Authority (Datatilsynet) or your local supervisory authority.

To exercise any of these, email hello@growbeyond.ltd. We reply within one working day.

Children

This site is not directed at anyone under 16, and we do not knowingly collect data from children. If you believe a child has submitted personal data, contact us and we will delete it immediately.

Changes to this policy

If we change anything material, we will update this page and the “updated” date at the top. Analytics is opt-in: it stays off until you accept the consent banner, and you can withdraw anytime via “Cookie settings” in the footer — opt-in, never assumed.

Questions

Email hello@growbeyond.ltd. We read every message.