Start selling

Privacy Policy

To protect the privacy of the users of our services and to meet legal requirements, we publish this Privacy Policy, which explains how we process and protect personal data collected when you use the website or our other services.

We pay particular attention to respecting the privacy of users visiting our website (the “Website”). We therefore take the utmost care to ensure the security of the personal data we process and that processing complies with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).

Our Website also uses cookies and similar technologies. Information on how they work can be found in the Cookie policy

1. Data controller

The controller of personal data is GROWNOW sp. z o.o. with its registered office in Warsaw, Al. Jerozolimskie 134, 02-305 Warsaw, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000897332, NIP: 7010707288, REGON: 36791860100000 (the “Controller”). The Controller has appointed a Data Protection Officer.

For matters relating to the processing of personal data, including the exercise of your rights, you can contact the Data Protection Officer at iod@grow.pl

2. Categories of personal data processed

We process data that users provide or leave when using the Website, e.g. through forms and cookies (including ID numbers and browser “user agent” data).

3. Purposes and legal bases of processing

  • We collect users’ personal data and use it for purposes related to running the Website, including managing and improving it, and for analytical and statistical purposes – the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Providing this data is voluntary. We store the data for as long as our legitimate interest exists or until an objection is upheld.
  • Where processing is connected with providing services electronically, we collect and process personal data in order to offer content or services (e.g. functions on our website) – the legal basis is that processing is necessary for the performance of a contract (Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR in conjunction with the Polish Act of 18 July 2002 on providing services by electronic means). Providing the data is voluntary but necessary to use the services. We store the data for the period necessary to conclude and perform the contract.
  • We may process personal data to establish, pursue or defend against claims – the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We store the data until the claims become time-barred or the proceedings end.
  • If you consent to receiving a newsletter, the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Providing the data is voluntary but necessary to receive the newsletter. We store the data for as long as our legitimate interest exists or until an objection is upheld.
  • If you send us a message (e.g. by completing a form or sending an email), we process personal data to respond to the enquiry or take other action requested by the sender – the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Providing the data is voluntary but necessary to receive a response or for us to take the requested action. We store the data for as long as our legitimate interest exists or until an objection is upheld.
  • We may process personal data contained in correspondence (e.g. emails) in order to conclude and perform contracts with our business partners – the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) or the conclusion and performance of a contract with a business partner who is a natural person (Art. 6(1)(b) GDPR). We store the data for the period necessary to achieve the purpose of processing, i.e. for as long as our legitimate interest exists (or until an objection is upheld), and for the time necessary to conclude and perform the contract.
  • We process personal data to fulfil our legal obligations, e.g. in relation to accounting and tax (Art. 6(1)(c) GDPR in conjunction with other regulations). We store the data for the period required by law.
  • Personal data contained in correspondence (e.g. emails) with business partners and their representatives may be processed for the purpose of analysing, creating, training and improving algorithms – the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We use personal data only to the extent necessary, apply the necessary safeguards, and pseudonymise and anonymise the data. We store personal data for the period necessary to achieve the purpose of processing, i.e. for as long as our legitimate interest exists (or until an objection is upheld).
  • We also process personal data to ensure the security of our IT systems and to manage them, and for analytical and statistical purposes – the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We store the data for as long as our legitimate interest exists or until an objection is upheld.
  • We process personal data to optimise business and organisational processes (e.g. to shorten customer service times or automate tasks) – the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We store the data for as long as our legitimate interest exists or until an objection is upheld.

Advertising and marketing

We may process users’ personal data to carry out marketing activities. Providing data for marketing purposes is voluntary; however, if it is not provided, the Controller or its partners will not be able to deliver marketing content to the user.

Advertising and marketing activities may consist of:

Contextual advertising: displaying marketing content to the user that is not tailored to their preferences. The legal basis is the legitimate interest of the Controller or its partners (Art. 6(1)(f) GDPR). We store the data for as long as our legitimate interest exists or until an objection is upheld.

Behavioural advertising: displaying marketing content to the user that matches their interests. Users’ personal data, including data collected through cookies and similar technologies, is processed by the Controller and trusted partners for marketing purposes in connection with behavioural advertising (i.e. advertising tailored to the user’s preferences). Such processing involves profiling users. The legal basis is the user’s consent (Art. 6(1)(a) GDPR). We store the data until consent is withdrawn.
If the user does not consent to behavioural advertising, they will receive marketing content that may not match their interests and needs.

Other forms: direct marketing of goods and services (sending commercial information electronically and telemarketing). Personal data is used to send marketing content to the user, e.g. by SMS/MMS or phone. Such activities are carried out only if the user has consented to receiving commercial content or has provided their data for this purpose. The user may withdraw consent to receiving commercial content at any time, which does not affect the lawfulness of processing before withdrawal. The legal basis is the legitimate interest of the Controller or its partners (Art. 6(1)(f) GDPR). We store the data for as long as our legitimate interest exists or until an objection is upheld.

Profiling

Collected personal data may be subject to profiling for marketing purposes (behavioural advertising). This means that automated processing is used to evaluate selected factors relating to users (e.g. pages visited, content clicked, information viewed) in order to analyse their behaviour or make predictions. On this basis, the user receives marketing content tailored to their needs and interests.

Social media

The Controller processes the personal data of users who visit the Controller’s social media profiles (e.g. Facebook, YouTube, Instagram, Twitter, TikTok, LinkedIn). This data is processed only in connection with running the profiles, including informing about the Controller’s activities and promoting events, services and products. The legal basis is the Controller’s legitimate interest (Art. 6(1)(f) GDPR). We store the data for as long as our legitimate interest exists or until an objection is upheld.

4. Sharing of data

The Controller does not transfer personal data to international organisations.

Because the Controller uses providers that may transfer personal data outside the European Economic Area (“EEA”), personal data may, to the extent necessary, be transferred outside the EEA. In such cases, transfers are based on a European Commission adequacy decision. Where there is no adequacy decision, the safeguards set out in Chapter V of the GDPR apply, such as standard contractual clauses. For information about transfers or copies of the safeguards, please contact the Controller.

Where necessary, the Controller will share personal data, to the extent required, with entities providing services to the Controller, e.g. IT services for the Website or legal advice.

Personal data may be shared with our partners, in particular companies belonging to the Group One capital group, in order to present an offer.

5. User rights

Users have the following rights:

a) Right of access

At the user’s request, the Controller will provide the personal data concerning the user and answer questions about its processing.

b) Right to rectification

If personal data processed by the Controller is incomplete, out of date or incorrect, the user may ask the Controller to rectify it.

c) Right to object

The user may object to the processing of their personal data. If the user’s rights, interests and freedoms override the Controller’s rights, obligations and interests in using the personal data, processing will be restricted or the data will be deleted.

d) Right to restriction of processing

There are several situations in which the user may request that we restrict the use of their personal data, including (but not limited to) when the user:

  • has successfully raised a general objection (described above);
  • disputes the accuracy of the personal data we hold;
  • believes we have used personal data unlawfully but does not want us to delete it.

e) Right to erasure

There are situations in which the user may request the deletion of their personal data, including (but not limited to) when:

  • we no longer need to process the personal data;
  • has successfully raised a general objection (described above);
  • we have processed the personal data unlawfully.

f) Right to data portability

The right to data portability allows personal data to be transferred between organisations. It applies to data you have provided to us and can be exercised where processing is automated and based on consent or a contract.

g) Right to lodge a complaint with a supervisory authority

The user has the right to lodge a complaint with the supervisory authority for personal data protection – in Poland, the President of the Personal Data Protection Office (UODO).

h) Right to withdraw consent

The user may withdraw consent to the processing of personal data at any time. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Last updated: 18 January 2026