Privacy Policy

1. Privacy at a Glance

General Information

This notice explains what happens to your personal data when you visit this website or contact us. Personal data is any information that can be used to identify you.

When you only visit the website, we process technical access data in server log files. If you email us, call us, book a meeting or apply for a job, we process the information you provide for that purpose. We load Google Analytics only if you have agreed. Fonts are served from our own server.

2. Hosting and Server Log Files

We host the content of this website with the following provider:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

We have a data processing agreement with Hetzner under Art. 28 GDPR. Processing takes place in the European Union. Details are available here: https://www.hetzner.com/legal/privacy-policy

When you open the website, the server automatically records data that your browser sends. This includes your IP address, the date and time of the request, the address you requested, the referrer, browser type and operating system, and the HTTP status code.

Purpose: Providing the website and keeping it secure and stable, and preventing abuse.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is the technically secure and reliable operation of the website.

Retention: Log files are kept only for as long as needed for operation and security, and are then deleted. Individual entries may be kept longer while a specific security incident is being investigated.

The connection to this website is encrypted with TLS.

3. General Information and Mandatory Information

Responsible Party

The controller for data processing on this website is:

growsome GmbH
Alstertor 9 - apoffices
20095 Hamburg
Germany

Phone: +49 (0) 172 5443693
Email: hello@growsome.agency

Your Rights

You have the right to:

• Access your stored data (Art. 15 GDPR)
• Correction of inaccurate data (Art. 16 GDPR)
• Deletion of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing based on a legitimate interest (Art. 21 GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

An email to hello@growsome.agency is enough to object or to exercise any other right. The supervisory authority responsible for growsome GmbH is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, https://datenschutz-hamburg.de. You may also contact the authority in the place where you live.

Apart from Google Analytics, the processing described in this notice is not based on consent. You can withdraw consent at any time with effect for the future.

You are not legally or contractually required to provide data. Without the access data your browser sends automatically, the website cannot be delivered. Without the details in an inquiry, a meeting request or an application, we cannot deal with that request.

We do not use automated decision-making, including profiling, under Art. 22 GDPR.

4. Contact

If you contact us by email or phone, we process your contact details, the content of your message and the correspondence that follows.

Purpose: Handling your request.

Legal basis: Art. 6(1)(b) GDPR where the request concerns a contract or pre-contractual steps. Otherwise Art. 6(1)(f) GDPR. The legitimate interest is replying to your request. Where we have to keep messages, Art. 6(1)(c) GDPR also applies.

Recipients: People at growsome who handle the request, and the email service provider we use, acting as a processor.

Retention: We delete the correspondence once the request has been dealt with and no claims are expected. If it becomes a contract or a business record, statutory retention applies, generally six years under section 257 of the German Commercial Code (HGB) and ten years under section 147 of the German Fiscal Code (AO).

5. Scheduling

For appointments we link to https://tinyurl.com/meet-growsome. Visiting growsome.agency does not send any data. A connection is made only when you click the link.

The short link is provided by TinyURL. When you open it, TinyURL processes connection data, in particular your IP address, the time, your browser type and the short address you requested, and forwards you to the booking page. TinyURL is based in the United States and is the controller for this redirect. Privacy notice: https://tinyurl.com/app/privacy-policy

The booking page is Google Calendar. For people in the European Economic Area the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We process the details you enter in the form, usually your name, email address, preferred time and any optional note, plus technical data that Google collects when you open the page. Google may set cookies on its own site. Google’s privacy policy applies to that: https://policies.google.com/privacy

Purpose: Arranging and holding the appointment.

Legal basis: Art. 6(1)(b) GDPR where the meeting is about entering into a contract. Otherwise Art. 6(1)(f) GDPR. The legitimate interest is organising the conversation.

Recipients: TinyURL for forwarding the short link. Google for the booking page; we receive the appointment details you enter so that we can hold the meeting. Google may transfer data to Google LLC in the United States. Google is certified under the EU-US Data Privacy Framework. Standard contractual clauses under Art. 46 GDPR apply in addition.

Retention: We delete the appointment data that reaches us once the meeting and the necessary follow-up are finished, unless a longer period applies under the contact section or a statutory retention duty. TinyURL and Google keep their own technical data according to their privacy notices.

6. Applications

If you apply using the email addresses given on this website, we process the documents you send, in particular your contact details, cover letter, CV and certificates, and our reply.

Purpose: Running the application process and deciding whether to enter into an employment relationship.

Legal basis: Art. 6(1)(b) GDPR. The application process is a pre-contractual step at your request. After a rejection we keep the documents under Art. 6(1)(f) GDPR so that we can defend against possible claims.

Recipients: The people at growsome who review the application, and the email service provider acting as a processor.

Retention: If we hire you, the documents we need become part of the personnel file. Otherwise we delete the application as a rule six months after the process has ended. We keep a candidate pool only if you give separate consent.

7. LinkedIn

The website contains links to LinkedIn, including the team profiles. There is no LinkedIn plugin and no LinkedIn pixel. Data is sent to LinkedIn only when you click a link.

The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn may then transfer data to the United States. The safeguards are described in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy

After you click, LinkedIn is the controller for its own processing.

8. Google Analytics

If you accept in the consent bar, we load Google Analytics 4 with the measurement ID G-GK292LZ7D8. Without consent the tag is not loaded and no analytics cookies are set. The choice is stored locally in your browser. If you clear the site data for growsome.agency, the question appears again.

For people in the European Economic Area the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy

The data processed includes pages viewed, referrer, approximate location, device, browser and interactions. Google Analytics 4 uses the IP address to derive a location and does not store it in full. Google sets the cookies _ga and _ga_GK292LZ7D8, each for up to two years.

Purpose: Statistics on how the website is used.

Legal basis: Consent under Art. 6(1)(a) GDPR and section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The website remains usable without consent.

Recipients: Google Ireland Limited. A transfer to Google LLC in the United States is possible. Google is certified under the EU-US Data Privacy Framework. Standard contractual clauses under Art. 46 GDPR apply in addition.

Retention: User and event data in Google Analytics is deleted after the period set in the property. The default is two months.

You can withdraw consent by clearing the stored choice in your browser. Google also offers an opt-out add-on: https://tools.google.com/dlpage/gaoptout

9. Cookies and External Content

We set analytics cookies only after consent to Google Analytics. We do not embed maps, videos or fonts from third parties. Fonts are served from our own server.

10. Changes

We update this privacy policy when the processing or the legal requirements change.

Last updated: 6 November 2026