Privacy Policy
Danuta Grochowska, trading as Social Growth Systems ("I", "me", "my"), is committed to protecting your personal data. This Privacy Policy explains how I collect, use, store and protect it.
For the data I collect about you as a visitor, enquirer or client, I am the data controller. I am registered with the Information Commissioner's Office under registration number ZC211790.
For the personal data I handle on behalf of my clients, for example the names and messages of people who contact a client through the client's own Facebook or Instagram account, my client is the controller and I am the processor. That processing is governed by the Services Agreement between us.
1. What Personal Data I Collect
Information you give me
- Contact data: name, business name, email address, phone number and billing address
- Order data: services purchased, order history and subscription details
- Payment data: handled by the payment provider. I never see or store your full card details.
- Communications data: the content of messages, emails or enquiries you send me
- Prize draw data: name, business name, email address and social profile link, where you enter the Free Audit Prize Draw
Information collected automatically when you use my website
- Technical data: IP address, browser type, time zone and operating system
- Usage data: pages visited, links clicked and time spent on the site
These are collected through cookies. See my Cookie Policy for the full detail and how to change your choices.
2. How I Use Your Data
| Purpose | Legal basis |
|---|---|
| Register you as a client and manage your account | Contract |
| Provide and deliver the services you have ordered | Contract |
| Send invoices, take payment and keep accounting records | Contract, and legal obligation (tax law) |
| Respond to enquiries and provide support | Legitimate interests: running and supporting my business |
| Run and improve my website | Legitimate interests, and consent where non-essential cookies are used |
| Send marketing emails | Consent |
| Administer the Free Audit Prize Draw | Legitimate interests: running the promotion I have advertised, in line with its published terms |
| Defend or bring legal claims, and keep records to do so | Legitimate interests, and legal obligation |
Marketing
I will only send you marketing emails if you have given me consent. Many of my clients and prospects are sole traders or partnerships, who are entitled under UK law to be asked for consent before receiving marketing email, so I ask, every time. You can unsubscribe at any time using the link in any email, or by emailing me. Withdrawing consent does not affect anything I sent before you withdrew it.
3. Sharing Your Data
I share your data only where necessary, with the following categories of recipient:
| Who | Why | Where |
|---|---|---|
| PayPal (and the card provider used at WooCommerce checkout) | To take payment for shop orders | EU / USA |
| Hostinger (hosting) and WordPress / WooCommerce (platform) | To run the website and the online shop | EU |
| Google (Drive, Forms, Sheets, Analytics) | File storage and sharing, prize draw entries, website analytics | EU / USA |
| Meta Platforms | Publishing, scheduling and advertising on your behalf | EU / USA |
| Canva | Creating design work | Australia / USA |
| Mailchimp | Sending emails you have consented to receive | USA |
| Pandle (accounting software) | Bookkeeping and tax | UK |
| Professional advisers (legal, insurance) | Advice, bound by confidentiality | UK |
| Regulatory authorities or law enforcement | Where required by law | UK |
I will never sell your personal data.
4. International Transfers
Some of the providers above are based outside the United Kingdom, mainly in the United States. Where your data is transferred outside the UK, I make sure the transfer is protected by an approved safeguard: either a UK adequacy decision, or the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask me for details of the safeguard used for any particular transfer.
5. Data Security
I take appropriate technical and organisational measures to protect your personal data, including two-factor authentication on my accounts, access controls, and a documented data storage and retention policy. I never hold client passwords. Access to your data is restricted to what is needed to deliver my services.
6. Data Retention
| What | How long |
|---|---|
| Signed contracts and intake forms | 6 years after the end of the relationship (UK tax and contract law) |
| Invoices and payment records | 6 years after the end of the relationship |
| Content, calendars and delivery records | 6 years after the end of the relationship |
| Client-supplied brand assets (logos, photos, footage) | Deleted 30 days after the relationship ends, unless you ask in writing to keep them longer |
| Enquiries and leads that do not become clients | Deleted after 12 months of inactivity |
| Prize draw entries | Deleted 6 months after the draw, unless you have separately consented to marketing |
| Marketing list data | Until you unsubscribe, or after 2 years of no engagement |
7. Your Rights Under UK GDPR
You have the right to:
- Access a copy of the personal data I hold about you
- Ask me to correct inaccurate or incomplete data
- Ask me to erase your data (the "right to be forgotten"), subject to my legal obligations
- Restrict or object to how I process your data
- Ask for your data in a portable, commonly used format
- Withdraw consent at any time, where consent is the legal basis
- Object to direct marketing at any time. This is an absolute right.
To exercise any of these, email dana@socialgrowthsystems.co.uk. I will respond within one month. There is no fee.
8. Cookies
My website uses cookies. Non-essential cookies, including analytics and any live chat widget, are only set after you agree to them through the cookie banner. You can change or withdraw your choice at any time through the cookie settings on this site. Full detail is in my Cookie Policy.
9. Changes to This Policy
I may update this Privacy Policy from time to time. Any material change will be posted on this page with a revised date.
10. Complaints
If you believe I have not handled your personal data correctly, please email me first at dana@socialgrowthsystems.co.uk. I would welcome the chance to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk or on 0303 123 1113.