1 - INTRODUCTION.
GROWTHROADAI, S.L. (hereinafter, "Growth Road" or "we"), with NIF/CIF B10589711 and registered office at C/ Dalia 275, 28109 - (Alcobendas) – Madrid, owns the domains “www.growthroad.org”; “www.growthroad.es”; “www.mihijonosabequeestudiar.com” and “www.hazmatchcontucarreraideal.com” where the websites and the Platform (in the case of growthroad.es) are hosted, which is made available to its Users to allow them access to the Services.
This Privacy Policy is an integral part of the Terms and Conditions of Use and the Services, and will apply to the processing of personal data of Users of our Platform and Services, including both data provided by Users directly and those that may be collected automatically or provided by third parties during the provision of any Service and/or in the development of a contractual relationship with us.
We care about the privacy of our Users, and we are committed to protecting all their information, which is why our Privacy Policy describes how Growth Road collects such data, complying with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), the Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights, as well as any other regulations that may apply.
Accessing and using our Platform and its Services implies the processing of personal information of its Users in accordance with the purposes contained and duly informed in this policy.
Navigating or using our Platform, as well as its Services and functionalities, implies full and unconditional acceptance by the User of what is contained in this Privacy Policy and in the Terms and Conditions (both of Use and of the Services).
Users should read our policy carefully to ensure they fully understand it. Additionally, we recommend that they frequently check the Policy to be aware of any updates or changes it may contain.
If any User does not agree with our policies, we ask them to leave the Platform and not to use any of our services.
1.1 WHAT ROLE DO WE HOLD IN THE PROCESSING OF YOUR DATA?
Growth Road will act as the data controller for the personal data of Users that are provided by them or collected in other ways through the Platform, which will be processed in accordance with the parameters set out in this policy.
Furthermore, Growth Road may also act as a data processor of the personal data of Users when such data has been provided by their respective educational institutions.
Therefore, Growth Road will be responsible for processing when it determines the purposes and means of the processing. This position is adopted in the following processing activities:
(i) Provision of services directly to individual clients.
(ii) Addressing requests and communications from users received through the website.
(iii) Compliance with applicable legal and regulatory obligations to the activity of Growth Road.
For its part, Growth Road will hold the role of data processor when it processes personal data of students as a result of the hiring of its Services by educational institutions.
1.2 WHAT PERSONAL DATA DO WE PROCESS?
We collect and process personal information from individual users and contacts from institutions to continuously provide and improve our Services.
Specifically, Growth Road processes the following types of Personal Data:
Information provided to us by Users: we receive and store all the information that users provide to us in order to be able to use the Platform, enjoy our Services, and get in touch with us. This information includes:
Account information: full name and email address.
Course information: all responses, data, and general information that the user may provide in completing the courses and questionnaires.
Information provided to us by representatives of educational institutions: we receive and store all the information provided to us by the contact persons of educational institutions that wish to enjoy our Services or contact us. This information includes:
Contact information: full name, email address, phone number, and the institution they work for.
Student information: full name and email address, for the creation of user accounts.
Advisor information: full name and email address.
Information we receive automatically: we automatically collect and store certain types of information and metadata about the usage of our Services by all users, including interaction with the content and functionalities available through the Services. For example: IP address; traffic and browsing data; device and service parameters; activity data on the Platform; information regarding interaction with the content, the Growth Road guidance course, and account configuration preferences.
We may also receive information from cookies. For more information about cookies, please consult our Cookie Policy. It should be noted that some of our Services may not be usable if consent is not given, or if it is subsequently revoked.
Information we receive from other sources: we may receive personal information from other sources, such as, for example, when users interact with us through their social media accounts (Whatsapp, LinkedIn, Instagram, Tiktok, and Facebook), we may know their username on such social network or platform, as well as the rest of the public information from the profile, and/or the information included in the message or comment they send us.
1.3 FOR WHAT PURPOSES DO WE PROCESS PERSONAL DATA?
We process personal data to operate, provide, and improve the Services we offer to our clients. Specifically, we use the information for the purposes indicated below, and under the following bases of legitimacy:
To fulfill our contract with Users or with educational institutions:
Provision of Services: we use the Personal Data of our Users to be able to provide them with our Services.
Problem resolution and improvement of Services: we also process the personal data we collect to improve our Services, as well as to resolve problems and errors that are detected or communicated by the Users, in order to offer them a better experience on our Platform.
Communication with users: we process personal data to contact our users about their account, the Services, or their activity on the Platform.
For our legitimate interests:
To protect our Services: we use the information to prevent misuse of our Services.
To improve the functionality of the Platform: we use the information to analyze how users interact with our Services and Platform, to understand their usage in order to improve them.
To develop new products: we use the information to analyze the interaction of the Services and Platform, to understand their usage, and thereby develop new products.
To comply with our legal obligations:
Compliance with legal obligations: in some cases, we collect and process personal data to comply with the law.
Retention of certain data: in many cases, the legislation that applies to us, such as billing, requires us to retain data about transactions.
With the consent of the data subjects:
Provision of Services: aside from the legitimacy for the processing of Users' personal information based on compliance with the contract, upon registering on the Platform, Users express their consent for the processing of their data for this purpose, which includes profiling (the main objective of the Services).
Marketing communications: we may process Users' data to send them marketing communications about our Services, provided they give us their express consent.
Other specific purposes for which we collect consent: we may also communicate and request consent from Users to process their personal data for any specific purpose that arises in the future.
Users may revoke their consent at any time (mainly directly through our Services), although it should be noted that in such cases, it may not be possible to use a service or function that requires the collection or use of that personal information.
1.4 HOW LONG DO WE RETAIN PERSONAL DATA?
We retain data for as long as necessary to fulfill the purposes for which it was collected.
On the other hand, we keep other personal data we collect when you use our Services, as well as those we receive from other sources, for a maximum of 18 months.
We may also retain certain data for longer than specified in our policy to meet legal requirements and for security reasons.
The previous periods will apply, provided that the consent has not been revoked by the interested User, submitting a request for deletion, limitation of processing, portability, or objection to the processing of their personal data through our contact email.
1.5 PERSONAL DATA OF MINORS
We do not knowingly process data of minors under 14 years old unless we have explicit authorization from their parents or legal guardians. Thus, we understand that in the event that the User is a minor according to applicable law, the appropriate consent has been given by their parents or legal guardians, so that the use of our services is being carried out with the acknowledgment, understanding, and acceptance of the terms set forth herein, as well as about the services themselves.
If we become aware that personal data of a minor has been provided or collected through our Services without prior consent, we will take appropriate measures to delete it as soon as possible, reserving the right to suspend or terminate the Services and the use of the Platform.
We are not responsible for acts performed by persons without the necessary legal capacity or the alteration or concealment of their conditions that incapacitate them to act. Parents or legal guardians of minors under 14 years who are Users of any of our services or applications can contact us via the email address atencionalcliente@growthroad.es to unsubscribe and delete their data.
1.5 DATA COMMUNICATION
We may share limited information with providers or professionals we contract for specific work. This includes, for example, cloud service providers like Amazon Web Services, which host our data.
We may also share information in compliance with and application of a law, to respond to a request for information by governmental and public authorities.
Beyond these cases, Growth Road will not share Users' personal data without their express consent.
Notwithstanding the above, at Growth Road we may share information about Users that has been previously anonymized so that it cannot reasonably be used to identify them. For example, we may share aggregated statistics of Users to describe our business to partners or the public.
Similarly, we may share aggregated and anonymized information with universities that contract our services, regarding the results of courses completed by Users brought by the universities themselves.
INTERNATIONAL DATA TRANSFERS.
Growth Road operates and supports its products, services, and applications from Spain without prejudice to the use of platforms and providers located in other countries in the framework of their provision, subject to the provisions of the applicable data protection regulations at all times.
User data may be stored or processed on our servers in Europe, provided that they may also be stored or processed in other countries where our Providers related to our services and applications have their presence, operate or maintain their facilities. The data processors that may participate in our services and applications located outside the European Union (EU) and the European Economic Area (EEA), such as the United States and the United Kingdom, must have an adequate level of protection, under the conditions and guarantees required by law and contract.
When transferring data outside the European Economic Area (EEA), we use the Standard Contractual Clauses, and we rely on the European Commission's Adequacy Decisions concerning specific countries, as the case may be, or other legally compliant mechanisms or conditions for such data transfers. This means that the transfers will be carried out according to the minimums established in the GDPR.
The data transfers that may be made will be necessary for the operation and provision of the applications, products, and services described for the stated purposes. By using our applications, products, and services, you acknowledge and accept that your data will be processed outside your country of residence.
1.6 HOW DO WE PROTECT PERSONAL DATA? SECURITY MEASURES
Growth Road is committed to fulfilling its obligation of confidentiality and secrecy regarding the personal data it processes and adopts the administrative, technical, and physical security measures required by privacy legislation to reasonably ensure its protection against alteration, loss, unauthorized processing or access, taking into account the state of the technology at all times. However, we cannot fully guarantee the absolute invulnerability of our security systems or those of third parties, as no currently implemented security measure is absolutely unbreakable, so Growth Road shall not be held responsible in any case for incidents that may arise regarding personal data stemming from an attack or unauthorized access to its systems in such a way that it is impossible to detect them by the implemented security systems, without prejudice to the possible obligation to communicate the fact to the competent authorities and to the affected users.
Any third party, agent, or representative of Growth Road who needs to access your information is also obligated to implement reasonable technical and organizational measures for the protection of your information.
Our Platform may contain links to third-party sites or providers. It should be noted that these third parties or providers are governed by their own policies, so it is recommended to review their terms and conditions, privacy policies, and cookie policies before using such platforms or services. Notwithstanding the above, Growth Road conducts preliminary filtering of providers to try to select those who offer the best security guarantees. But we cannot be held responsible for the use and management they make of your information.
1.7 WHAT ARE USERS’ RIGHTS AS DATA SUBJECTS?
As a data subject, you have the right to request Growth Road at the following address atencionalcliente@growthorad.es:
access to your data,
rectification of your data, as we also want to ensure that your information is accurate and up-to-date,
deletion of your data,
limitation of the processing of your data,
opposition to the processing of your data when the legitimacy for processing your data is our legitimate interest,
withdrawal of consent for the processing of personal data when the legitimacy for processing the data is the consent of the data subject, and
portability of personal data when the legitimacy for processing such data is the consent of the data subject or the execution of a contract.
To exercise the aforementioned rights, affected individuals must address Growth Road through the postal or email address indicated at the beginning of this Policy.
For security reasons, we may additionally ask for a photocopy of the ID card, electronic signature, or scanned copy of the ID card, in accordance with the legally established minimum content.
We will process your request as soon as possible, always within the margins and timeframes stipulated by the GDPR and the applicable current legislation at the time of such request.
Furthermore, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD) if you have doubts or are not satisfied with the exercise of your rights by submitting a written request addressed to the postal address C/Jorge Juan nº 6, C.P: 28001 (Madrid), with telephone number (+34) 912 663 517 or via their electronic headquarters.
ANNEX I – DEFINITIONS
DEFINITIONS
"Personal Data" means any information relating to an identified or identifiable natural person.
"Service/s" refers to the SaaS (Software as a Service) services provided to clients (individuals and/or educational institutions). That is, to the services of access via https://app.growthroad.es, or through any other designated URL, by clients (individuals and/or educational institutions) to the Software, as well as any online or offline auxiliary product or service provided to such clients by Growth Road, under the agreement with them.
"Software" or "Platform" means the software program developed, operated, and maintained by Growth Road, based on an artificial intelligence system that allows determining the vocational and academic profile of Users after completing the guidance Course hosted on the Platform itself.
"User/s" refers to both individual clients of Growth Road and students from educational institutions that hire our Services.