PRIVACY POLICY
CONTROLLER IDENTIFICATION
This Privacy Policy describes how Growininsights, S.A. (“Growin”), tax and registration number (NIPC) 513214399, with registered office at Avenida da República, 57, 4.º, 1050-189 Lisbon, Portugal, processes personal data in the context of its activity and of this website (growin.com).
For any question about your personal data, or to exercise your rights, contact our Data Protection Officer at dpo@growin.com.
INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA
The General Data Protection Regulation (Regulation (EU) 2016/679 – “GDPR”) and Portuguese Law No. 58/2019, of 8 August, ensure the protection of natural persons with regard to the processing of personal data and the free movement of such data. “Personal data” means any information relating to an identified or identifiable natural person. By reading this Policy, the user is informed about the processing of personal data carried out by Growin. This Policy covers the website, recruitment and business relations; other processing activities have their own information, provided in the relevant context.
PURPOSES OF PROCESSING PERSONAL DATA
We process personal data in the following contexts:
Website visitors — We process the contact details you submit through forms and strictly necessary technical data, to respond to contact and information requests, on the basis of pre-contractual steps (Art. 6(1)(b) GDPR) or our legitimate interest in responding (Art. 6(1)(f)). We keep this data for up to 12 months after the last contact.
Job applicants — We process identification, contact details, CV, professional background and interview records, for the management of the recruitment process, on the basis of pre-contractual measures taken at your request (Art. 6(1)(b)); retention for future opportunities takes place only with your consent (Art. 6(1)(a)). Retention: duration of the process; where the process ends without hiring, 12 months from the end of the process, for the defence of potential claims (Art. 6(1)(f)); with your consent, 36 months, renewable only through a new express authorisation. More details in the section “Recruitment and job applications”.
Clients and suppliers — We process contact details of representatives and billing data, for the performance and management of contracts (Art. 6(1)(b)), tax obligations (Art. 6(1)(c)) and business management (Art. 6(1)(f)). Retention: duration of the contract plus statutory periods (as a rule, 10 years for tax-relevant records).
Commercial communications — We process professional contact details to communicate about our services, on the basis of consent (Art. 6(1)(a)) or legitimate interest with the right to object, as applicable. Retention: until you object or withdraw your consent and, at most, 24 months after the last contact.
LAWFULNESS OF PROCESSING
The legal basis of each processing operation is indicated in the previous section, alongside the respective purpose. In summary, Growin processes personal data:
- with the consent of the data subject (Art. 6(1)(a) GDPR);
- where necessary for pre-contractual steps taken at the request of the data subject or for the performance of a contract (Art. 6(1)(b));
- to comply with legal obligations to which it is subject (Art. 6(1)(c));
- for the purposes of legitimate interests, except where overridden by the interests or fundamental rights and freedoms of the data subject (Art. 6(1)(f)).
STORAGE PERIOD
The retention periods for each processing operation are indicated in the section “Purposes of processing personal data”. Growin keeps personal data only for as long as necessary for the purposes for which they were collected, unless a legal or contractual obligation requires a longer period, deleting or anonymising them at the end of that period.
RECRUITMENT AND JOB APPLICATIONS
When you apply through this website, your application data is registered in our recruitment platform and processed to assess your application, evaluate your professional profile and communicate with you throughout the selection process, on the legal basis of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). The fields marked as mandatory in the application form are necessary for the assessment of your application; without them we are unable to consider it.
The presentation of your professional profile to clients of Growin is part of the recruitment process you are applying to – that is what your application asks us to do (Art. 6(1)(b) GDPR). Presentation is limited to the opportunity concerned and to the information needed for the assessment. If you prefer that your profile not be presented to a specific client, simply let us know at any time via dpo@growin.com or through your recruiter, without affecting your application. Use of your profile for other opportunities, outside this process, requires us to contact you and a new application on your part.
We keep your CV and contact details for future opportunities only if you have given us your consent (Art. 6(1)(a) GDPR), for a period of 36 months from the date of consent, renewable only through a new express authorisation; you may withdraw it at any time via dpo@growin.com. If you do not give (or withdraw) this consent, your data is kept for 12 months from the end of the recruitment process, for the defence of potential claims (Art. 6(1)(f) GDPR), and is then deleted.
Growin does not make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The assessment of applications is always carried out with human intervention.
DATA COMMUNICATION
Personal data may be disclosed to:
- clients, in the case of job applicants – only the professional profile, within the scope of the recruitment process they are applying to and limited to the opportunity concerned, as described above;
- service providers that process data on our behalf (processors) – including our recruitment platform JazzHR (Employ Inc.), email and productivity services (Google Workspace), accounting services and the technical providers of website hosting and management and of communication platforms;
- public authorities, where legally required. We do not sell personal data, nor do we disclose it for purposes other than those described in this Policy.
INTERNATIONAL DATA TRANSFERS
Applicant data is stored in the JazzHR recruitment platform, hosted in the United States by Employ Inc., a company certified under the EU-U.S. Data Privacy Framework – the framework recognised by the European Commission adequacy decision under Art. 45 GDPR. Any other transfer outside the European Economic Area only takes place with equivalent safeguards.
INFORMATION SECURITY
We apply technical and organisational measures appropriate to the protection of personal data, within the framework of the group information security management system, certified under ISO/IEC 27001. Access to personal data is limited to those who need it for the purposes described in this Policy, under confidentiality duties.
RIGHTS’ EXERCISE
You may, at any time, exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, as well as withdraw any consent given, by contacting our Data Protection Officer at dpo@growin.com. We reply within one month at the latest.
Where processing is based on the legitimate interests of Growin, you may object to it at any time, on grounds relating to your particular situation (Art. 21 GDPR).
DATA PROTECTION AUTHORITY
You also have the right to lodge a complaint with the Portuguese supervisory authority, the National Data Protection Commission (CNPD – www.cnpd.pt).
COOKIES
This website uses cookies as described in our Cookies Policy (https://www.growin.com/cookies-policy/).
THIRD PARTY PAGES
This website may contain links to third-party websites. Growin does not control and is not responsible for their content or privacy practices, and we recommend that you read the privacy policies and terms and conditions of those websites.
PRIVACY POLICY CHANGES
This Policy is reviewed periodically. The version in force, with its date, is always available on this page. Relevant changes will be highlighted on the website.
Updated: 2 October 2026