Data Controller
Decode & Grow Ltd
Legal
Privacy Policy
Your privacy is not just important to us — it's foundational to how we run our business.
Who we Are
Decode & Grow Ltd is a UK-based consultancy helping business owners automate systems and scale without admin chaos. We provide business process automation, systems architecture, and operational consulting services to SMEs across the UK and internationally.
Company Number
16814320 (Registered in England and Wales)
ICO Registration Number
ZC120811
Privacy contact: info@decodengrow.com — for any data protection query, please put "Privacy" in the subject line so it reaches the right person promptly.
We have not appointed a formal Data Protection Officer (DPO), as this is not currently required for a business of our size and processing activities. Our founder, Daria Gavrilova, is the designated privacy contact.
What we collect
Information You Provide Directly
- Name and email address
- Phone number
- Company name, size, and industry
- Website URL
- Payment details (collected and processed by Stripe — we do not store full card details ourselves)
- Information submitted through our contact/enquiry forms
- Any information you send us by email or during consultations
Information We Collect Automatically
- Website usage data (pages visited, time on site, navigation paths)
- Device and browser type
- IP address
- Referring URLs
- Cookies for performance, functionality, and analytics (see our Cookie Policy for full detail)
Information Processed Through AI Tools
As part of delivering our services, some of the information above may be processed using third-party AI tools (see Section 6, "AI Use Disclosure," below).
Children's data
We do not knowingly collect personal data from children under 16. Our services are directed at businesses and business decision-makers, not consumers or minors. If we become aware that we have inadvertently collected data from a child, we will delete it promptly.
Why We Collect It — and Our Legal Basis
UK GDPR requires us to state the legal basis for each way we use your data. Here's the breakdown:
PurposeWhat this coversLegal basis
Delivering servicesBuilding automations, systems, reports, and deliverables you've engaged us forContractNecessary to perform our agreement with you
Responding to enquiriesReplying to forms, emails, consultation bookingsLegitimate interestCore to running the business
Processing paymentsInvoicing and payment via StripeContract, Legal obligationAccounting and tax records
Website improvementAnalytics, usage patternsConsent, Legitimate interestConsent for non-essential cookies; legitimate interest for essential analytics
Sending updatesNewsletters, marketing emailsConsentOnly if you've opted in — withdraw at any time
Legal complianceTax records, responding to lawful requests from authoritiesLegal obligation
We do not sell or share your data with third parties for marketing purposes. Ever.
How Long We Keep Your Data
Data typeRetention periodWhy
Client / contract data3 yearsafter contract endsPost-engagement queries, disputes, or follow-on work — in line with standard UK limitation periods for contract claims
Financial / invoicing records6 yearsUK statutory requirement under HMRC record-keeping rules
Lead / enquiry data12 monthsfrom last contact, unless opted in to marketingIf we haven't heard from you in a year, we assume you're no longer interested and delete the record
Marketing / newsletter subscribersUntil unsubscribeor 24 months of inactivity, whichever is soonerKeeps our list current and avoids holding stale data
Website analytics data14 monthsGoogle Analytics defaultPlatform default setting; aggregated where possible
After these periods, your data is securely deleted or anonymised. To request earlier deletion, see Section 8 — Your Rights.
How we protect it
Encryption
All sensitive data is encrypted in transit and at rest.
Access Controls
Strict permissions limit who can view your data. Currently, access is limited to our founder, business partner, and vetted staff/contractors, each bound by signed confidentiality agreements.
Secure Storage
We use enterprise-grade cloud services with robust security standards.
Section 6
AI Use Disclosure
We use AI tools as part of delivering our consulting and automation services. Here's exactly what that means in practice:
What we use
Tools such as OpenAI's API/ChatGPT and similar AI systems, integrated into automations we build (often via Make.com) or used directly in our own workflow.
What data may pass through them
Depending on the project, this can include business information, lead/contact details, and content you or your business has provided to us, where AI assistance is part of the agreed service (e.g. drafting, summarising, classifying, or matching information).
Human oversight
AI tools assist and draft — they do not make final decisions about you or your data on our behalf. A human always reviews and approves outputs before they're acted on or delivered. We do not use AI to make automated decisions that produce legal effects or similarly significantly affect individuals without meaningful human review.
Data handling by AI providers
Our AI providers process data under their own enterprise/API terms, which typically exclude using submitted data to train their general models. We do not control these providers' infrastructure directly, but we select providers with appropriate data protection commitments and do not submit special category data (e.g. health, biometric data) to AI tools without a specific, separate lawful basis and safeguard in place.
Your right to object
If you do not want your data processed via AI tools as part of a specific engagement, let us know and we will discuss alternative, fully human-led handling where feasible.
If our use of AI tools changes materially, we will update this section and, where appropriate, notify clients directly.
Third-Party Services
We work with the following providers to deliver our services. All are required to handle data securely and in line with data protection law.
Make.com
Workflow automation
OperationsGoogle Analytics (GA4)
Website analytics
AnalyticsNotion
CRM & content management
OperationsOpenAI
AI-assisted service delivery
AI toolsStripe
Payment processing
PaymentsPerplexity
AI-assisted service delivery
AI toolsAnthropic (Claude)
AI-assisted service delivery
AI toolsInternational data transfers
Some of our third-party providers (including those listed above) may store or process data outside the UK and EEA, including in the United States. Where this happens, we rely on appropriate safeguards required under UK GDPR, such as the UK International Data Transfer Addendum (IDTA) or the provider's participation in a recognised adequacy framework (e.g. the UK-US Data Bridge, where applicable). You can request details of the specific safeguard used for any provider by contacting us.
If you are a client or lead based outside the UK, your data may be transferred to and processed in the UK and other countries as set out above.
Your Rights
Under UK GDPR, you have the right to:
- 01
Access your data
request a copy of all information we hold about you
- 02
Correct your data
fix anything inaccurate or incomplete
- 03
Delete your data
request erasure, where applicable
- 04
Restrict or object to processing
limit how we use your data, or object to certain uses (e.g. marketing)
- 05
Data portability
receive your data in a portable format, where technically feasible
- 06
Withdraw consent
opt out of consent-based processing (e.g. marketing emails) at any time
How to exercise these rights
Email us at info@decodengrow.com with "Privacy" in the subject line. We'll respond within one calendar month, as required by law.
Complaints
If you're unhappy with how we've handled your data, please contact us first so we can try to resolve it directly. If you remain unsatisfied, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk at any time.
Changes to This Policy
We may update this policy from time to time. When we do, we will:
- Revise the Effective Date at the top
- Post the updated version on this page
- Notify you by email if changes are material
We recommend reviewing this page periodically.
Contact Us
We're here to help.
info@decodengrow.com — we'll respond within 2 business days
Start with a free systems audit. No pitch, no pressure — just a clear map of where your time is going.
Legal© 2025 Decode & Grow Ltd. Registered in England and Wales. Company Number 16814320.
Registered with the Information Commissioner's Office — Registration No. ZC120811.
