Privacy Policy

1. ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how EFG Group Ltd, trading as GrowthZum, collects, uses, stores, shares and protects personal information.

It applies to personal information processed in connection with:

• the GrowthZum website;
• GrowthZum user accounts;
• subscriptions and free trials;
• prospecting and business research;
• email outreach functionality;
• LinkedIn and other professional-network functionality;
• artificial intelligence features;
• customer support;
• billing and payments;
• integrations with third-party services;
• marketing carried out by GrowthZum itself; and
• other services provided through the GrowthZum platform.

Where we say “GrowthZum”, “we”, “us” or “our”, we mean:

EFG Group Ltd Trading as GrowthZum

Company number: 16558737

Registered office: Ground Floor, 5 North Court Armstrong Road Maidstone Kent ME15 6JZ United Kingdom

Email: hello@growthzum.com

Website: growthzum.com

2. WHO IS RESPONSIBLE FOR YOUR INFORMATION?

For many of the activities described in this Privacy Policy, EFG Group Ltd is the controller of your personal information.

This means we determine why and how that personal information is processed.

However, GrowthZum also provides tools that allow our customers to collect, store, analyse and use information relating to their own prospects and business contacts.

When GrowthZum processes personal information solely on behalf of one of our customers and according to that customer’s instructions:

• the customer will ordinarily be the controller; and
• GrowthZum will ordinarily act as the processor.

Where this applies, requests concerning that processing may need to be directed to the GrowthZum customer responsible for the relevant campaign.

3. INFORMATION WE MAY COLLECT

The information we process depends upon how you interact with GrowthZum.

We may process the following categories of personal information.

3.1 Account information

When you create or manage a GrowthZum account, we may collect:

• your name;
• business name;
• job title;
• email address;
• telephone number;
• password or authentication credentials;
• account role;
• account preferences;
• profile information;
• business website;
• business sector; and
• other information you provide when registering.

Passwords are not intended to be stored in readable form.

3.2 Subscription and billing information

When you start a trial or purchase a subscription, we may process:

• your name;
• company name;
• billing address;
• subscription plan;
• payment status;
• transaction references;
• VAT information where applicable;
• billing history;
• subscription start and renewal dates;
• cancellation information; and
• limited payment-method information supplied by our payment processor.

GrowthZum may use a third-party payment processor such as Stripe or another authorised payment provider.

We do not ordinarily receive or store your complete payment-card number.

3.3 Connected email-account information

If you connect an email account to GrowthZum, we may process information necessary to provide the integration.

Depending upon the permissions you grant, this may include:

• your email address;
• mailbox identity;
• authentication tokens;
• sender information;
• messages created through GrowthZum;
• email recipients;
• subject lines;
• message content;
• sending status;
• delivery information;
• replies;
• timestamps;
• message identifiers; and
• campaign-related metadata.

GrowthZum will only use permissions made available by the relevant email provider and authorised by you.

3.4 Prospect and business-contact information

GrowthZum is designed to assist businesses with B2B prospecting.

As part of this functionality, GrowthZum may process information about business owners, directors, employees, representatives and other professional contacts.

This may include:

• name;
• employer;
• company;
• job title;
• professional role;
• business email address;
• business telephone number;
• company website;
• professional profile URL;
• public professional information;
• business location;
• company sector;
• company size;
• professional responsibilities;
• publicly available biography information;
• publicly available website information;
• communication history;
• campaign status;
• reply status;
• opt-out status;
• suppression status;
• prospect score;
• prospect category; and
• other information relevant to B2B sales or prospecting.

The fact that information relates to a person’s work does not necessarily mean it stops being personal data. The ICO confirms that UK GDPR may apply where B2B marketing involves identifiable individual business contacts.

4. WHERE PROSPECT INFORMATION COMES FROM

GrowthZum may obtain prospect and business-contact information from several sources.

These may include:

• publicly available company websites;
• publicly available staff pages;
• publicly available professional profiles;
• search engines;
• public business directories;
• Companies House and similar company registers;
• information supplied by GrowthZum customers;
• third-party business-data providers;
• email-verification providers;
• business-enrichment services;
• publicly accessible web pages;
• APIs;
• connected customer systems; and
• information generated or inferred from publicly available information.

GrowthZum may also infer information such as:

• likely job role;
• likely relevance to a campaign;
• business classification;
• company characteristics;
• likely email-address format;
• prospect-match score; or
• suitability for a customer’s specified target market.

Such inferred information may be inaccurate and should not be treated as verified fact.

5. INFORMATION COLLECTED AUTOMATICALLY

When you use GrowthZum, we may automatically collect technical and usage information.

This may include:

• IP address;
• browser type;
• operating system;
• device type;
• device identifiers;
• login timestamps;
• pages viewed;
• features used;
• account activity;
• button interactions;
• searches;
• errors;
• diagnostic information;
• approximate location derived from IP address;
• referral source;
• session information; and
• security logs.

We may use cookies and similar technologies for some of this processing.

6. CUSTOMER SUPPORT INFORMATION

If you contact GrowthZum for support, we may process:

• your name;
• email address;
• company;
• account details;
• support messages;
• screenshots;
• attachments;
• bug reports;
• technical information; and
• records of communications with us.

We use this information to respond to your request and improve the Service.

7. HOW WE USE PERSONAL INFORMATION

We may use personal information for the following purposes.

7.1 Providing GrowthZum

We use information to:

• create and operate accounts;
• authenticate users;
• provide subscriptions;
• process payments;
• provide prospecting functionality;
• perform business research;
• provide email and campaign tools;
• operate integrations;
• provide AI features;
• maintain account history;
• manage suppression lists;
• respond to support requests; and
• otherwise deliver the GrowthZum platform.

7.2 Prospect research and matching

GrowthZum may process business information to:

• identify businesses relevant to customer search criteria;
• analyse business websites;
• identify professional contacts;
• determine whether businesses appear to match specified target criteria;
• rank or score prospects;
• identify likely decision-makers;
• enrich existing records;
• detect unsuitable or irrelevant results; and
• generate prospect recommendations.

7.3 Email address identification and verification

GrowthZum may:

• identify publicly available business email addresses;
• use third-party providers to identify business contact details;
• infer likely email formats;
• generate possible email addresses; and
• verify whether an email address appears deliverable.

An email marked as verified or carrying a confidence score is not guaranteed to belong to the intended person or remain active.

8. ARTIFICIAL INTELLIGENCE

GrowthZum uses artificial intelligence and automated technologies to provide some functions.

These may include:

• reading and summarising business websites;
• identifying relevant information;
• classifying businesses;
• assessing prospects;
• drafting messages;
• personalising outreach;
• recommending follow-ups;
• producing prospect summaries;
• suggesting campaign content; and
• assisting with other sales-related workflows.

Information submitted to AI providers may include information required to perform the relevant task.

We seek to limit information shared with external providers to what is reasonably necessary for the feature concerned.

AI output can contain errors.

GrowthZum users remain responsible for deciding whether generated content should be relied upon or sent.

9. AUTOMATED SCORING AND PROFILING

GrowthZum may use automated processing to generate:

• prospect-match scores;
• relevance scores;
• confidence scores;
• fit categories;
• recommended prospects;
• “Strong Fit”;
• “Good Fit”;
• “Needs Confirmation”;
• or similar classifications.

These tools are intended to assist customers with B2B prospecting.

GrowthZum is not intended to make automated decisions that produce legal or similarly significant effects concerning individuals.

Customers must not use GrowthZum for automated decision-making concerning matters such as:

• credit;
• employment;
• insurance;
• healthcare;
• housing;
• criminal justice; or
• other high-impact regulated decisions.

10. OUR LAWFUL BASES FOR PROCESSING

Under UK data-protection law, we must have a lawful basis for processing personal information.

Different lawful bases may apply depending upon the circumstances.

10.1 Contract

We may process information where necessary to enter into or perform a contract with you.

Examples include:

• creating your GrowthZum account;
• providing your subscription;
• delivering features you have requested;
• administering your trial;
• providing customer support; and
• managing your subscription.

10.2 Legitimate interests

We may rely upon legitimate interests where the processing is necessary for a legitimate business purpose and those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• providing and improving GrowthZum;
• operating a B2B software business;
• securing our systems;
• preventing fraud;
• identifying abuse;
• maintaining service quality;
• understanding how customers use GrowthZum;
• providing customer support;
• maintaining business records;
• developing new features;
• protecting legal rights;
• conducting appropriate B2B marketing; and
• processing relevant professional information for business prospecting.

For B2B contacts, the ICO recognises that legitimate interests may often be an appropriate lawful basis, but there is no automatic rule: the organisation must assess purpose, necessity and the balance with the person’s rights.

10.3 Consent

We may rely upon your consent where required.

This may apply, for example, to:

• certain marketing communications;
• certain cookies or tracking technologies; or
• another activity where consent is legally required.

Where processing relies on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing carried out lawfully before withdrawal.

10.4 Legal obligations

We may process information where necessary to comply with legal or regulatory requirements.

Examples include:

• tax requirements;
• accounting obligations;
• fraud investigations;
• court orders;
• legal claims; and
• regulatory obligations.

10.5 Legal claims

Where necessary, we may process information for the establishment, exercise or defence of legal claims.

11. B2B DIRECT MARKETING

GrowthZum may process professional contact information for B2B prospecting and marketing purposes.

We recognise that:

• B2B marketing can involve personal information;
• UK GDPR may therefore apply;
• the appropriate lawful basis must be considered;
• PECR may also apply depending on the communication and recipient; and
• individuals have an absolute right to object to the use of their personal information for direct marketing.

Where GrowthZum itself sends direct marketing using personal information, we will seek to identify an appropriate lawful basis.

Where a GrowthZum customer uses GrowthZum to carry out its own marketing, that customer is responsible for its own compliance as controller.

12. RIGHT TO OBJECT TO DIRECT MARKETING

You have the right to object at any time to personal information being used for direct marketing.

If GrowthZum itself is using your information for GrowthZum marketing, you may object by:

• using an unsubscribe link where provided; or
• emailing hello@growthzum.com.

If your information is being processed by a GrowthZum customer for that customer’s marketing campaign, you should generally contact that sender directly.

Where reasonably possible, GrowthZum may assist the customer in implementing your request.

The ICO states that the right to object to processing for direct marketing is absolute.

13. SUPPRESSION LISTS

If you opt out of marketing, we may retain limited information on a suppression or do-not-contact list.

This might include:

• your email address;
• domain;
• contact identifier;
• date of opt-out; and
• suppression status.

This is necessary so that your preference can continue to be respected.

Deleting every record of an opt-out could result in the person accidentally being contacted again.

The ICO specifically recommends maintaining a suppression or do-not-contact list for individuals who have objected to electronic direct marketing.

14. MARKETING FROM GROWTHZUM

GrowthZum may send communications about:

• GrowthZum features;
• product updates;
• offers;
• subscription changes;
• educational material;
• new services; and
• related GrowthZum products.

We will only send such communications where permitted by applicable law.

You may unsubscribe from GrowthZum promotional emails at any time.

This does not prevent us from sending essential communications concerning:

• your account;
• subscription;
• security;
• payments;
• legal changes;
• service availability; or
• support.

15. HOW GROWTHZUM CUSTOMERS USE PERSONAL INFORMATION

GrowthZum customers determine their own:

• prospect criteria;
• campaigns;
• recipients;
• outreach content;
• lawful basis;
• marketing strategy; and
• communications.

When a customer uploads or otherwise supplies personal information to GrowthZum, the customer is responsible for ensuring it has an appropriate basis for doing so.

GrowthZum’s Terms prohibit customers from deliberately using GrowthZum unlawfully.

16. INFORMATION WE SHARE

We do not sell your personal information merely because you use GrowthZum.

We may share personal information with third parties where reasonably necessary for the purposes described in this policy.

These categories may include:

• hosting providers;
• cloud infrastructure providers;
• artificial-intelligence providers;
• email providers;
• email-verification providers;
• data-enrichment providers;
• authentication providers;
• payment processors;
• analytics providers;
• customer-support systems;
• security providers;
• software-development infrastructure;
• professional advisers; and
• regulators or authorities where legally required.

17. SUBPROCESSORS AND SERVICE PROVIDERS

GrowthZum may engage third-party providers to process personal information on our behalf.

Where those providers act as processors, we seek to impose appropriate contractual data-protection obligations.

We may change service providers as GrowthZum develops.

The exact providers used may depend upon:

• the feature;
• customer configuration;
• geographic location;
• connected integrations; and
• technical requirements.

18. PAYMENT PROCESSING

Payments may be processed by an external payment provider.

The payment provider may process:

• name;
• billing information;
• payment-card information;
• transaction details;
• fraud-prevention information; and
• device or technical information.

The payment provider may act as an independent controller for some aspects of its service.

Its own privacy policy will apply to processing undertaken for its purposes.

19. EMAIL PROVIDERS

Where you connect a third-party email service, the relevant provider will continue to process information according to its own terms and privacy policy.

GrowthZum only obtains the permissions you authorise through the relevant integration.

You may disconnect a connected email account through GrowthZum where functionality is available.

You may also need to revoke GrowthZum’s access through the third-party provider itself.

20. LINKEDIN AND OTHER PROFESSIONAL NETWORKS

GrowthZum may provide features that relate to LinkedIn or other professional networks.

GrowthZum is not necessarily affiliated with or endorsed by those providers.

If you access a third-party service, that service’s own privacy policy applies to its processing.

GrowthZum may only process information from those services where technically and legally available to us.

21. INTERNATIONAL DATA TRANSFERS

Some GrowthZum service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally and applicable law requires safeguards, we will use an appropriate mechanism.

This may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved Standard Contractual Clauses;
• contractual safeguards; or
• another legally recognised transfer mechanism.

22. HOW LONG WE KEEP PERSONAL INFORMATION

We do not intend to keep personal information indefinitely where it is no longer reasonably required.

Retention periods depend upon:

• the type of information;
• why it was collected;
• contractual requirements;
• legal requirements;
• tax and accounting rules;
• fraud-prevention needs;
• security requirements;
• dispute or legal-claim risks; and
• customer instructions.

Examples include the following.

Account information

We may retain account information while your account remains active and for an appropriate period following closure.

Billing information

Billing and transaction records may be kept for the periods required by accounting, taxation and legal obligations.

Prospect information

Prospect information may remain in a customer’s workspace while reasonably required for that customer’s activities, subject to customer instructions and GrowthZum retention controls.

Campaign communications

Campaign records may be retained while the customer’s account remains active and for an appropriate limited period following termination.

Suppression information

Do-not-contact records may be retained for longer where necessary to ensure an opt-out continues to be respected.

Security logs

Security and system logs may be retained for a reasonable period for fraud prevention, incident investigation and security purposes.

The ICO recommends that direct-marketing information is kept accurate and not retained longer than necessary.

23. DELETION OF CUSTOMER ACCOUNTS

When a GrowthZum customer closes an account, personal information associated with the account may be deleted or anonymised in accordance with our retention procedures.

Some information may remain temporarily within:

• backups;
• disaster-recovery systems;
• financial records;
• legal records;
• security logs; or
• suppression lists.

Backup information will generally be deleted through the normal backup-rotation process rather than immediately.

24. SECURITY

GrowthZum uses technical and organisational measures designed to protect personal information.

These may include measures such as:

• access controls;
• authentication;
• encryption where appropriate;
• secure communications;
• account permissions;
• logging;
• monitoring;
• secure cloud infrastructure;
• restricted administrative access;
• data minimisation; and
• backup processes.

No internet-connected service can guarantee absolute security.

Users are responsible for protecting their own GrowthZum credentials and connected accounts.

25. PERSONAL-DATA BREACHES

Where GrowthZum becomes aware of a personal-data breach, we will assess the incident and take appropriate action.

Where legally required, we may notify:

• affected customers;
• the Information Commissioner’s Office;
• affected individuals; or
• other relevant authorities.

Where GrowthZum acts as processor for a customer, we will notify the relevant customer without undue delay where required by applicable law.

26. YOUR DATA-PROTECTION RIGHTS

Depending upon the circumstances, you may have rights including:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object;
• rights relating to automated decision-making; and
• the right to withdraw consent where processing relies upon consent.

These rights are not absolute in every circumstance.

27. RIGHT OF ACCESS

You may have the right to request confirmation of whether we process your personal information and obtain a copy of relevant information.

This is commonly known as a subject access request.

To make a request, email:

hello@growthzum.com

We may need to verify your identity before responding.

28. RIGHT TO RECTIFICATION

If personal information GrowthZum controls about you is inaccurate or incomplete, you may ask us to correct it.

Contact:

hello@growthzum.com

29. RIGHT TO ERASURE

In certain circumstances, you may ask us to erase personal information.

This right does not apply in every situation.

We may need to retain information where necessary, for example:

• to comply with law;
• to establish or defend legal claims;
• for security;
• for fraud prevention; or
• to maintain a suppression record necessary to honour your marketing objection.

30. RIGHT TO RESTRICT PROCESSING

In certain circumstances, you may ask us to restrict how your information is used.

For example, this may apply while the accuracy of information or the lawfulness of processing is being considered.

31. RIGHT TO DATA PORTABILITY

Where applicable, you may have a right to receive certain information you supplied to us in a structured, commonly used and machine-readable format.

This right generally applies where processing:

• is based upon consent or contract; and
• is carried out by automated means.

32. RIGHT TO OBJECT

You may have the right to object to processing based upon legitimate interests.

If you object, we will consider:

• our reasons for processing;
• your circumstances;
• your rights; and
• whether there are compelling legitimate grounds to continue.

However, where the objection concerns direct marketing, the right to object is absolute.

33. AUTOMATED DECISION-MAKING RIGHTS

Where applicable law gives you rights in relation to solely automated decisions producing legal or similarly significant effects, those rights will apply.

GrowthZum’s ordinary prospect-ranking and sales-assistance features are not intended to make decisions of this nature.

34. REQUESTS RELATING TO A GROWTHZUM CUSTOMER

Sometimes GrowthZum holds information because one of our customers uploaded or generated that information through the Service.

In those circumstances, the customer may be the controller.

If so, we may:

• direct your request to that customer;
• notify the customer of your request; or
• assist the customer in responding.

GrowthZum will not ordinarily override the lawful instructions of a customer where we act only as processor.

35. IDENTITY VERIFICATION

To protect personal information, we may ask you for information necessary to confirm your identity before responding to a data-protection request.

We will not intentionally request more information than reasonably necessary for that purpose.

36. RESPONSE TIMES

We aim to respond to valid data-protection requests within the timescales required by applicable law.

Complex requests or numerous requests may take longer where the law permits an extension.

37. FEES FOR DATA-PROTECTION REQUESTS

We do not ordinarily charge for exercising data-protection rights.

Where permitted by law, we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

38. CHILDREN

GrowthZum is a B2B service and is not intended for children.

You must be at least 18 years old to create a GrowthZum account unless we expressly permit otherwise.

GrowthZum is not designed to knowingly collect information from children for prospecting or outreach purposes.

If you believe information concerning a child has been processed through GrowthZum incorrectly, contact:

hello@growthzum.com

39. SPECIAL-CATEGORY INFORMATION

GrowthZum is not designed for prospecting based upon special-category personal data.

This includes information concerning:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• genetic information;
• biometric identification;
• health;
• sex life; or
• sexual orientation.

GrowthZum customers must not use the Service to unlawfully target individuals on the basis of such information.

40. CRIMINAL-OFFENCE DATA

GrowthZum is not designed as a service for collecting, analysing or making decisions based on criminal-offence information.

Customers must not use GrowthZum unlawfully for such purposes.

41. COOKIES

GrowthZum may use cookies and similar technologies.

These may include:

Strictly necessary cookies

Used for functions such as:

• authentication;
• account security;
• session management;
• fraud prevention; and
• platform operation.

Preference cookies

Used to remember user preferences.

Analytics cookies

Used to understand how GrowthZum is used and improve the Service.

Marketing cookies

Where used, these may help measure advertising or marketing performance.

Where consent is legally required for non-essential cookies, we will seek appropriate consent.

Further information may be provided in a separate GrowthZum Cookie Policy.

42. ANALYTICS

We may use analytics services to understand:

• number of visitors;
• feature usage;
• account journeys;
• conversion;
• technical performance;
• errors;
• user behaviour within the platform; and
• product engagement.

Where appropriate, we seek to minimise or aggregate information used for analytics.

43. FRAUD, ABUSE AND SECURITY MONITORING

GrowthZum may analyse account activity to:

• detect fraudulent accounts;
• identify account compromise;
• prevent spam;
• detect excessive sending;
• enforce usage limits;
• identify abusive behaviour;
• protect third-party services;
• investigate security incidents; and
• enforce our Terms.

This may include automated risk indicators.

44. BUSINESS TRANSFERS

If GrowthZum or EFG Group Ltd is involved in:

• a merger;
• acquisition;
• restructuring;
• investment;
• sale;
• transfer of assets; or
• sale of all or part of the business,

personal information may be disclosed to relevant parties where reasonably necessary for that transaction.

Any recipient will be expected to process information appropriately and subject to applicable data-protection law.

45. LEGAL DISCLOSURES

We may disclose personal information where reasonably necessary:

• to comply with law;
• to comply with a court order;
• to respond to a lawful regulatory request;
• to investigate suspected fraud;
• to prevent crime;
• to protect GrowthZum;
• to protect our users;
• to defend legal claims; or
• to protect the rights or safety of another person.

46. AGGREGATED AND ANONYMISED INFORMATION

GrowthZum may create aggregated or anonymised information that no longer identifies individuals.

We may use this information for purposes such as:

• analytics;
• product development;
• benchmarking;
• service improvement;
• business planning; and
• reporting.

Information that has been genuinely anonymised is not personal data.

47. PRODUCT IMPROVEMENT

We may use appropriate information concerning how GrowthZum is used to:

• diagnose problems;
• improve workflows;
• improve search quality;
• improve prospect matching;
• improve campaign functionality;
• improve user experience;
• develop new features; and
• measure performance.

Where possible, we may use aggregated or minimised information.

48. USE OF CUSTOMER DATA FOR AI MODEL TRAINING

GrowthZum will not intentionally use confidential Customer Data to train a generally available GrowthZum AI model unless:

• this is clearly disclosed;
• we have an appropriate legal basis; and
• any required contractual permission has been obtained.

Where third-party AI services are used, their treatment of submitted information will depend upon the relevant contractual arrangement and service configuration.

GrowthZum seeks to use business-grade provider arrangements appropriate for SaaS processing.

49. THIRD-PARTY LINKS

GrowthZum may contain links to external websites and services.

GrowthZum is not responsible for the privacy practices of those third parties.

You should review their privacy policies before providing personal information.

50. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

Reasons may include:

• new GrowthZum features;
• changes to how information is processed;
• legal changes;
• regulatory guidance;
• new service providers;
• security changes; or
• clarification of existing wording.

The date at the top of this policy will show when it was last updated.

Where a change materially affects how we use personal information, we may provide additional notice where appropriate.

51. HOW TO CONTACT US

For privacy questions, data-protection requests or concerns, contact:

GrowthZum EFG Group Ltd Company number: 16558737

Ground Floor, 5 North Court Armstrong Road Maidstone Kent ME15 6JZ United Kingdom

Email: hello@growthzum.com Website: growthzum.com

52. COMPLAINTS

If you have a concern about how GrowthZum processes personal information, please contact us first at:

hello@growthzum.com

You also have the right to complain to the UK’s data-protection regulator:

Information Commissioner’s Office (ICO)

Further information about making a complaint is available from the ICO.

53. INFORMATION ABOUT PROSPECTS WHO HAVE NOT SIGNED UP TO GROWTHZUM

If you have been contacted by a GrowthZum customer but you do not have a GrowthZum account, your information may have been processed through the GrowthZum platform as part of that customer’s B2B prospecting activity.

Information may have originated from:

• your employer’s website;
• a publicly available professional profile;
• a public business directory;
• another publicly accessible source;
• a business-data provider;
• a GrowthZum customer’s own records; or
• an authorised enrichment provider.

GrowthZum may process information including:

• your name;
• employer;
• professional role;
• business email address;
• professional profile URL;
• relevant publicly available professional information; and
• campaign interaction information.

Where GrowthZum is processing that information solely on behalf of the customer, the customer will generally be responsible for determining the purpose and lawful basis of the processing.

You may contact the sender directly to:

• ask where your information came from;
• request access;
• correct inaccurate information;
• object to marketing;
• request deletion where applicable; or
• opt out of further communications.

You may also contact GrowthZum at hello@growthzum.com, and we will take reasonable steps to assist where appropriate.

54. PUBLICLY AVAILABLE INFORMATION

The fact that information is publicly accessible does not necessarily mean that it may be used without restriction.

Where GrowthZum acts as controller in relation to publicly available personal information, we will seek to process it in accordance with applicable data-protection law.

Where information has been obtained from another source rather than directly from the individual, applicable transparency requirements may require information to be provided about matters including the source, purpose and lawful basis. ICO guidance confirms that organisations have transparency obligations when personal data is obtained from third-party or public sources.

55. LEGITIMATE INTERESTS AND PROSPECT DATA

Where GrowthZum relies upon legitimate interests to process B2B contact information for its own purposes, relevant interests may include:

• identifying appropriate businesses and professional contacts;
• enabling businesses to identify commercially relevant prospects;
• maintaining accurate professional information;
• operating GrowthZum’s B2B prospecting functionality;
• protecting the GrowthZum platform from misuse; and
• developing and improving GrowthZum.

Where appropriate, we consider:

Purpose

Whether there is a genuine legitimate business purpose for the processing.

Necessity

Whether processing the information is reasonably necessary and proportionate to achieve that purpose.

Balancing

Whether the individual’s rights, freedoms and reasonable expectations override the relevant business interest.

This reflects the three-part legitimate-interests assessment described by the ICO.

56. DATA ACCURACY

We take reasonable steps appropriate to the nature of GrowthZum to help maintain data quality.

However, professional information changes frequently.

For example:

• employees move companies;
• job titles change;
• companies close;
• websites become outdated;
• email addresses change; and
• public information may itself be inaccurate.

GrowthZum cannot guarantee that prospect information is always current or correct.

If you identify inaccurate information concerning you, contact:

hello@growthzum.com

57. YOUR RESPONSIBILITY WHEN USING GROWTHZUM

GrowthZum customers are responsible for using personal information appropriately.

Customers should:

• only use information for legitimate business purposes;
• identify an appropriate lawful basis;
• comply with relevant direct-marketing rules;
• respect objections;
• respect unsubscribe requests;
• avoid excessive or intrusive contact;
• keep information appropriately secure;
• avoid unlawfully processing sensitive information; and
• provide privacy information where required.

GrowthZum reserves the right to suspend users who materially or repeatedly misuse personal information through the Service.

58. CONTACTING GROWTHZUM ABOUT A MARKETING MESSAGE

If you receive an outreach message sent using GrowthZum and wish to stop receiving communications from the sender, the quickest method will normally be to:

1. 1.use the opt-out or unsubscribe method contained in the message, where provided; or
2. 2.contact the sender directly.

If you cannot resolve the issue with the sender, you may contact:

hello@growthzum.com

Please provide enough information for us to identify the relevant account or campaign.

We may retain the minimum information necessary to ensure your request continues to be respected.

59. DATA PROTECTION CONTACT

GrowthZum does not currently state that it has appointed a formal Data Protection Officer.

Privacy and data-protection enquiries should therefore be directed to:

hello@growthzum.com

GrowthZum / EFG Group Ltd Ground Floor, 5 North Court Armstrong Road Maidstone Kent ME15 6JZ United Kingdom

60. SUMMARY

GrowthZum is designed to help businesses identify and communicate with relevant B2B prospects.

We aim to:

• process personal information fairly;
• limit processing to appropriate business purposes;
• protect personal information;
• respect opt-outs and objections;
• provide transparency about our processing;
• work with reputable technology providers;
• give individuals appropriate control over their information; and
• comply with applicable UK data-protection and privacy