Privacy and cookie policy

Controller

SECOND ACT (SARL, SIREN 752954222), 18 Boulevard Montmartre, 75009 Paris, France, which operates the GrowCBase brand, is the controller of the data described in this policy.

Contact for any privacy question: info@growcbase.com

Data we collect

When you send the contact form, we receive:

• your name, professional email address and company;
• the plan and target market you select;
• your message, if you write one (optional);
• the site language, the date and time of the request, a request reference and the page it was sent from;
• campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), only when they are present in the address of the page you submitted from;
• ad click identifiers (gclid, gbraid, wbraid), only when they are present in that address and you have accepted advertising measurement.

Name, professional email and company are needed to answer you. Please do not include sensitive information in your message.

We handle enquiries in our professional mailbox. Form content is not written to application logs.

Purposes and legal bases

• Replying to your request and preparing the offer you asked for: steps taken at your request before a possible contract (Article 6(1)(b) GDPR), where applicable.
• Corresponding with you as the representative of a business that contacted us: our legitimate interest in answering and following up business enquiries (Article 6(1)(f) GDPR).
• Protecting the website and the form against abuse and spam: our legitimate interest in keeping the service secure (Article 6(1)(f) GDPR).
• Measuring, only with your consent, whether our Google Ads advertisements lead to contact requests (Article 6(1)(a) GDPR). You can withdraw consent at any time, without affecting earlier processing.

We do not use this data for newsletters or third-party marketing, we do not sell it, and the current form involves no automated decision-making or profiling.

Recipients

Only the people at SECOND ACT who handle enquiries have access to requests, together with the technical providers that run the website and email:

• Railway: hosting of the website and the form;
• Resend: sending form messages to our mailbox;
• Cloudflare: email routing for growcbase.com addresses;
• Google: the professional mailbox where requests are received and, only if you accept advertising measurement, the Google Ads service (conversion measurement).

Cloudflare also provides the domain name system (DNS) for growcbase.com and is not used as a proxy for the website.

To deliver and secure their services, these providers may process technical data such as IP address, time of access and browser information, under the retention periods they document.

International transfers

The website runs in a European Railway region, but Railway, Resend, Cloudflare and Google belong to groups based in the United States, and these providers or their subprocessors may process data outside the European Economic Area. Their published data processing terms provide for the European Commission’s standard contractual clauses and, where applicable, adequacy decisions:

• Railway data processing agreement
• Resend data processing agreement
• Cloudflare customer data processing addendum
• Google privacy frameworks

To obtain details of these safeguards or a copy, write to info@growcbase.com.

Retention

• Requests that do not lead to a contract: kept for 12 months after the last contact, then deleted.
• If a contract is signed: data kept as long as needed to perform it and to meet applicable legal obligations.
• Technical records kept by providers: according to the periods each provider documents.
• Cookies and advertising measurement data: the periods stated in the Cookies section; data received by Google is kept according to the periods Google documents.

Your rights

You can request access to your data, its rectification or erasure, the restriction of its processing and, where applicable, its portability.

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests.

To exercise these rights, write to info@growcbase.com or to SECOND ACT, 18 Boulevard Montmartre, 75009 Paris, France.

You can also lodge a complaint with the CNIL or with the data protection authority of the EU country where you live or work.

Cookies

The website uses essential cookies, which do not depend on consent:

• gcb_locale: stores the language you choose yourself in the header language selector or with the language buttons on the contact page, for 180 days. It is used to choose the entry language when you open the site’s main address; the language in each page address always takes precedence. Detecting your browser language does not set the cookie, and the footer language links save nothing.
• gcb_visit: a random value created when you open the contact page, valid for 2 hours. It ties the form to your browser to prevent forged or duplicate submissions. It is not used for analytics or advertising.
• gcb_receipt: created after a request is accepted, valid for 60 minutes. It lets us show the confirmation and the request reference without sending the request again. It contains the reference and the chosen plan and market, not your contact details.

Advertising measurement, only with your permission. We ask whether you accept advertising measurement; accepting and rejecting are equally prominent and the contact form works whatever you choose.

• gcb_consent: stores your choice (accepted or rejected), its date and a random code for that choice, for 180 days; after that we ask again.
• If you accept, your browser loads the Google Ads tag (AW-1070101458) from googletagmanager.com. Ad personalisation and Google Analytics remain switched off.
• If you accept, the Google tag may set its own cookies on this domain (_gcl_au, _gcl_aw), which link the visit to an ad click, for up to 90 days according to Google’s documentation.
• If you accept, your browser stores locally (gcb_attribution and gcb_measured), for up to 30 days, the campaign parameters of your visit and the references of requests already measured, to keep the campaign origin and avoid counting the same request twice.

When a contact request is accepted and measurement is permitted, we report a conversion to Google with the random request reference and the page address, reduced to the ad click identifiers. Your name, email, company and message are never sent to Google. Google also receives technical data such as IP address and browser information. Without permission, nothing is loaded from Google or sent to Google.

You can change or withdraw your choice at any time under “Measurement preferences” in the footer. When you reject, the tag is no longer loaded and we delete the measurement data listed above from your browser. Requests sent while measurement was rejected are not measured later.

You can also delete or block cookies in your browser settings; without the essential cookies, the root address uses your browser language and the contact form may not accept a submission.

Changes

We update this page when the processing described here changes. The date at the top shows the current version.