Privacy Policy

This Privacy Policy explains how Groowth Limited (company number 16123337), registered at 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London, W1T 6EB, United Kingdom ("Groowth", "we", "us" ) collects and uses your personal data in connection with the Groowth Mystery Shopper Program (the "Program"). Groowth is the controller of your personal data.

We are registered with the UK Information Commissioner's Office (ICO). Questions or requests: privacy@groowth.co.uk.

1. The data we collect

When you apply to the Program, we collect:

• Identity: first name, last name, date of birth.
• Contact: email address, UK mobile number, UK delivery address.
• Eligibility screening: allergens you tell us about (special category data — health) and dietary preferences (some of which can reveal religious belief, e.g. Halal/Kosher).
• Verification: one-time SMS code, plus technical metadata used to detect duplicate or fraudulent applications (e.g. whether the phone number has been used before).
• Marketing preferences: whether you opted in to receive marketing emails, and the date/version of any consent.

When you participate in a task, we additionally collect:

• task and order details (which site, voucher used, completion status);
• your feedback, ratings, comments, photos and any other content you submit; and
• messages you exchange with us by email, SMS, WhatsApp or other channels.

2. Why we use it & our lawful basis

Running the Program (Article 6(1)(b) — contract / pre-contract)

We use your identity, contact, verification and task data to assess your application, contact you about tasks, issue vouchers, receive your feedback and run the Program generally.

Allergen eligibility screening (Article 9(2)(a) — explicit consent)

Allergens are special category (health) data. We process them on the basis of your explicit consent, given when you submit your application, for the limited purpose of assessing whether the Program is suitable for you. If you declare any allergen, we will normally not invite you to tasks. We delete the allergen field shortly after we have made the eligibility decision. You can withdraw your consent at any time by emailing us — withdrawal does not affect the lawfulness of earlier processing.

Dietary preferences (Article 6(1)(b) — contract / preferences)

Dietary preferences (e.g. vegetarian, vegan) are used to match you to suitable tasks. Where a preference reveals religious belief (Halal, Kosher) we rely on your explicit consent (Article 9(2)(a)) given on the form.

Fraud prevention & integrity (Article 6(1)(f) — legitimate interests)

We use phone verification and duplicate-detection on phone, email and address to stop one person creating multiple applications, and to protect the Program from fraud and abuse. Our legitimate interest is running the Program securely and fairly. You can object — see "Your rights" below.

Marketing (Article 6(1)(a) — consent)

If you tick the marketing opt-in, we will send you occasional emails about new shopper opportunities and offers. You can unsubscribe at any time via the link in any marketing email, or by emailing us.

Legal compliance (Article 6(1)(c) — legal obligation)

Where we have to, we will use your data to comply with UK law (for example responding to HMRC enquiries, court orders or ICO investigations).

3. Who we share it with

We share personal data only with the categories of recipient below, and only as needed:

• Service providers (processors) who help us run the Program, including Airtable (database), Twilio (SMS verification), Base44 (this application platform), Google (Drive, Docs, Workspace), Meta (WhatsApp messaging) and Ideal Postcodes (address lookup).
• Kitchen operators / franchisees — we share your feedback and photos with the operator of the site you reviewed. Feedback shared with operators is anonymised wherever practical (we remove your name and contact details).
• Deliveroo — we share voucher and order references with Deliveroo to issue and reconcile vouchers.
• Professional advisors — accountants, auditors, lawyers and insurers (e.g. our cyber/data insurer), where needed.
• Marketing technology — if you have consented to cookies, our website may share limited information with advertising and analytics providers such as Meta (see our Cookie Policy).
• Authorities — where legally required (HMRC, ICO, courts, police).
• Buyers/successors — in connection with a sale, merger, restructuring or financing of Groowth.

We will not sell your personal data. Aggregated, fully anonymised insights (which are no longer personal data) may be shared or sold.

4. International transfers

Several of our service providers are based in the United States or operate global infrastructure. When personal data is transferred outside the UK we rely on appropriate safeguards under Article 46 UK GDPR, including the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses with the UK Addendum, or transfers to countries covered by a UK adequacy decision (such as transfers to the United States under the UK Extension to the EU-US Data Privacy Framework where the recipient is certified).

5. How long we keep it

We keep your application and task data for 24 months from your last activity on the Program (for example, your last accepted task or your last contact with us). After that, we will delete or anonymise it.

• Allergen data is deleted shortly after the eligibility decision is made.
• Anonymised mystery shop reports may be kept indefinitely for business records — they no longer identify you.
• Blacklist records — if we remove or blacklist you, we keep a minimal record (such as a hashed phone or email and the reason and date) for as long as needed to prevent re-onboarding and to protect the Program from fraud. Legal basis: legitimate interests.
• We may keep limited records for longer where required by law (for example tax, accounting or to defend legal claims).

6. Security

We take security seriously. We use access controls, encryption in transit, reputable cloud providers and limited access on a need-to-know basis. We also hold cyber and data breach insurance (Hiscox — cyber & data breach cover, £250,000 limit of indemnity). If a personal data breach occurs that is likely to result in a risk to you, we will notify the ICO within 72 hours where required, and notify you without undue delay where the risk to you is high.

7. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted (where one of the GDPR grounds applies);
• restrict or object to processing (including processing based on legitimate interests);
• withdraw any consent at any time (without affecting the lawfulness of earlier processing);
• receive a copy of certain data in a portable, machine-readable format;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (we do not make such decisions).

To exercise any right, email privacy@groowth.co.uk. We will respond within one month. We may need to verify your identity before acting.

8. Complaints

If you're unhappy with how we've handled your data, please contact us first at privacy@groowth.co.uk — we'd like the chance to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

9. Cookies & tracking

See our Cookie Policy for full details of how we use cookies and similar technologies.

10. Children

The Program is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted information to us, please email privacy@groowth.co.uk so we can delete it.

11. Changes to this Policy

We may update this Privacy Policy at any time by posting a new version at this URL. The "Last updated" date and version number at the top of the page will change. If a change is material we will use reasonable efforts to notify you by email.

12. Contact

Groowth Limited
4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London, W1T 6EB, United Kingdom
privacy@groowth.co.uk