Privacy Policy

GrowthOps HQ is a trading name of Rasharn Fraser, a sole trader operating in England and Wales ("GrowthOps HQ", "we", "us"). Contact: rasharn@growthopshq.com.

This policy explains how we collect, use, store, share and otherwise process personal data in connection with our website, enquiries, sales and onboarding, Review Growth, Growth Systems, customer support, payments, CRM activity, business communications, marketing where applicable, and the provision and management of client services. It covers personal information about our own clients, prospective clients and business contacts, and personal information we may process on behalf of our clients to provide their selected services.

Client and prospective-client information: name, business name, role where relevant, email address, telephone number and business contact details, enquiry information and service interests, communications with us, sales and onboarding information, selected services or plans, account and billing information, and transaction or payment confirmation information.

Business and onboarding information: business and location details, Google Business Profile information and access, branding and logos, website and domain information, calendars and appointment settings, CRM information, service details, communication preferences, workflows, account and integration details, and other information reasonably required to implement an agreed service.

Client-customer information: depending on the services a client selects and the information that client supplies, we may process information about that client's own customers, prospects or leads. This may include names, email addresses and telephone numbers, enquiry, appointment and booking information, communication history, lead status and customer history, review-request status, CRM records, information needed for follow-up or customer reactivation, missed-call information, and information supplied during AI or automated communications. We do not receive every category for every customer; the exact data depends on the services used.

Website and technical information: where applicable, IP address, browser and device information, website interaction information, referring and campaign (UTM) source, form submissions, and security and diagnostic information. See our Cookie Policy.

Communications: emails, website enquiries, SMS, CRM conversations, support communications and messages about onboarding, billing or service delivery, and telephone communications where they are logged or recorded and this has been disclosed.

We obtain personal information directly from you; through website forms; during onboarding and service delivery; through email, telephone and other communications; from payment providers; through integrations and Google Business Profile connections authorised by a client; from information supplied by our clients; through the CRM and business-management systems used to provide our services; from publicly available business sources where we lawfully use them for business-to-business prospecting; and from third-party service providers where appropriate. We do not obtain private customer information without appropriate authority.

• Responding to enquiries and communicating with prospective and existing clients, including quotations and service information.
• Onboarding clients, and setting up and operating Review Growth, including sending review requests on behalf of clients.
• Configuring and operating Growth Systems, including CRM, booking, lead follow-up, missed-call recovery, customer reactivation on behalf of clients, AI messaging and, where agreed, AI voice and call functionality.
• Processing and managing payments, client accounts and customer support.
• Monitoring and maintaining service performance, securing systems and preventing misuse.
• Record keeping, accounting and tax obligations, enforcing contracts and complying with legal obligations.
• Improving our services and operations, and lawful business-to-business sales and marketing.

Our role depends on the processing activity. GrowthOps HQ may act as a controller for personal information relating to its own prospective clients, clients, business contacts, website users, billing, account administration, service communications, legal obligations and business operations.

When GrowthOps HQ processes personal information supplied by a client solely in order to provide services according to that client's instructions, the client will generally determine the purpose of that processing and GrowthOps HQ may act as a processor on the client's behalf. Examples include review-request campaigns, customer reactivation, lead follow-up, CRM operations, booking communications, missed-call recovery, AI messaging, AI voice and call systems and other client-configured customer communication. Our actual legal role is determined by the processing itself, not by labels alone.

Where a client supplies personal information relating to its customers, leads or other individuals, the client is responsible for ensuring that it has an appropriate lawful basis, permission or other authority required to collect, use and provide that information for the intended service. This is particularly relevant to review requests, previous-customer review campaigns, customer reactivation, marketing communications, lead follow-up, SMS, email, telephone and AI-assisted communications. We may refuse or suspend processing we reasonably believe would breach data protection, marketing or platform rules.

Depending on the activity, we rely on:

• Contract: where processing is necessary to enter into or perform a contract, provide an agreed service, manage a subscription, handle onboarding, administer a client account or process service-related requests.
• Legitimate interests: where appropriate, for operating and improving our business, securing systems, preventing fraud or misuse, managing business relationships, maintaining records, reasonable business development and communicating with existing or prospective business clients. We consider whether those interests are overridden by the rights and interests of the individuals affected; this basis does not apply automatically to every activity.
• Consent: where required, including for certain marketing, communications or technology use. You can withdraw consent at any time.
• Legal obligation: where necessary to comply with legal, regulatory, accounting or tax obligations.

Where lawful, we may contact businesses and relevant business representatives about our services. Business contact information may come from direct enquiries, referrals, existing relationships, publicly available business information, legitimate business databases or prospecting sources, or the business itself. Where we rely on legitimate interests for business-to-business marketing, communications will be relevant to the person's professional role, and we comply with applicable UK privacy and electronic-marketing rules. You can ask us to stop marketing communications at any time, and we will respect objections and opt-outs.

Payments are processed by third-party payment providers, including Stripe where applicable. Payment-card information is generally entered directly into the payment provider's systems. GrowthOps HQ may receive transaction information, payment status, billing information and identifiers required to administer the customer account, but does not ordinarily receive or store the customer's complete payment-card number.

We share personal data with service providers where reasonably necessary to run our business or deliver agreed services. These may include CRM, hosting and website providers; payment processors; email, SMS and telephony providers; AI technology providers; automation and integration providers; technical providers where actually used; professional advisers such as accountants and legal advisers; contractors assisting with service delivery; Google and Google Business Profile; and other providers needed to deliver an agreed Growth System. We limit disclosure to what is reasonably necessary for the relevant purpose, or share data where required by law.

GrowthOps HQ does not sell personal data. Information a client supplies for Review Growth, reactivation, CRM, lead follow-up, booking or other customer-processing activities is not added to our own marketing database or used for our unrelated marketing purposes unless there is a separate lawful basis to do so.

Where we act as a processor, we use third-party providers (sub-processors) to deliver the relevant services, such as CRM infrastructure, communications and telephony, hosting, AI services, and automation and integration services. Not all processing takes place on our own infrastructure. Where required by law or contract, we put appropriate contractual protections in place with these providers.

Some technology providers we use may store, process or permit access to personal information outside the United Kingdom. Where personal information is transferred outside the United Kingdom, GrowthOps HQ will take appropriate steps required by applicable data protection law, which may include reliance on adequacy regulations, appropriate contractual safeguards or another lawful transfer mechanism. Where we act as a processor, such transfers are handled consistently with the client's instructions and applicable contractual obligations.

We keep personal information only for as long as reasonably necessary for the purpose it was collected, including providing the services, maintaining the client relationship, handling disputes, enforcing agreements, meeting legal, accounting and tax requirements, and security and fraud prevention. Retention periods vary depending on the category of information, the purpose, client instructions, contractual and legal requirements, and whether an active account or service exists.

Where we act solely as a processor for client customer data, at the end of the service we delete or return that data in line with applicable contractual requirements and client instructions, unless the law requires us to keep it. Deletion from backups may not be instantaneous, but data scheduled for deletion is not kept in active use because a backup copy exists.

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, misuse, alteration, unauthorised disclosure and destruction. No internet or technology system can guarantee absolute security.

We will respond to suspected personal data breaches and comply with applicable notification and assistance obligations. Where we act as a processor and become aware of a relevant breach affecting client data, we will notify the relevant client without undue delay where required.

Depending on the circumstances and lawful basis, you may have the right to access your personal information, have it corrected, erased or restricted, object to its use, receive it in a portable format, and withdraw consent where consent is relied upon. Not every right applies in every circumstance.

You have the right to object at any time to the use of your personal information for direct marketing.

To make a request, email rasharn@growthopshq.com.

Where we process information solely as a processor for a client, a request about that data may need to be handled by the client as controller. In that case we may pass the request to the relevant client and assist them in responding, or respond directly where we are legally responsible for that processing.

Please contact us first at rasharn@growthopshq.com. You also have the right to raise concerns with the UK Information Commissioner's Office (ICO) at ico.org.uk.

GrowthOps HQ may use cookies, local storage and similar technologies where applicable for website functionality, preferences, security and campaign or source information. Please see the Cookie Policy for further information.

Our website may link to third-party websites or services, such as our payment provider's checkout pages. We are not responsible for their privacy practices; please review their privacy information where appropriate.

Our services are business-focused and not intentionally directed at children. If we become aware that personal information relating to a child has been provided inappropriately, we may take reasonable steps to address it.

We may update this policy from time to time to reflect changes to our services, operations, technology or providers, or legal and regulatory developments. Material changes will be communicated where reasonably appropriate.

GrowthOps HQ, trading name of Rasharn Fraser, sole trader. Email: rasharn@growthopshq.com.