# Privacy Policy .

Last updated: April 2026

## 1. Introduction

The GrowTeams group operates through two related entities:

- GrowTeams Ltd — a company registered in the Isle of Man (Company Number: 138687C), with its head office in Castletown, Isle of Man. This is the entity that operates this website and engages with prospective and existing UK and US clients. Our commercial dealings and this Privacy Policy are governed by the laws of England and Wales.
- GrowTeams (Pty) Ltd — a company registered in South Africa (Registration Number: 2022/379563/07), based in Cape Town. This is the entity that recruits, employs and manages the South African talent placed with our clients.

We respect the privacy of our website visitors, prospective and existing clients, candidates, employees and contractors. This Privacy Policy explains how each entity collects, uses, stores and protects your personal data in accordance with applicable data protection laws.

## 2. Data Controller

**GrowTeams Ltd** is the data controller for personal data collected through this website (including enquiries submitted via the contact form, savings calculator inputs, and analytics data captured with your consent).

**GrowTeams (Pty) Ltd** is the data controller for personal data relating to South African candidates, employees and contractors (including CVs, engagement records, payroll/payment information and references). Where placement activity requires it, candidate details are transferred to GrowTeams Ltd and onwards to clients on a controller-to-controller basis.

For any questions about how we handle your data, including requests to exercise your rights, please contact us at [recruitment@grow-teams.com](mailto:recruitment@grow-teams.com). We will route your request to the relevant entity.

## 3. Data We Collect

### Candidates

- Full name, email address, and phone number
- Curriculum vitae (CV) and cover letters
- Qualifications, certifications, and education history
- Work history and references
- Video interview recordings

### Clients

- Company name and contact details
- Business registration information
- Hiring requirements and role specifications

### Website Visitors

If you accept analytics cookies, we collect:

- IP address (anonymised before storage)
- Browser type, version, and device type
- Pages visited, time spent, and the order you viewed them in
- Buttons and links clicked (e.g. CTAs, navigation, currency toggle)
- Anonymised session replays via Microsoft Clarity (mouse movements, clicks, scroll depth — sensitive form fields are automatically masked)

If you arrive via a marketing link, we capture and store for the duration of your visit:

- UTM parameters ( utm_source , utm_medium , utm_campaign , utm_content , utm_term )
- Click identifiers ( gclid from Google Ads, fbclid from Meta, msclkid from Microsoft Ads, li_fat_id from LinkedIn)
- Referring website (where you came from)

If you use our savings calculator, we collect inputs you provide (role, seniority, location, headcount, current pain points). If you complete the calculator and submit our contact form, this calculator data is forwarded with your enquiry so our team can prepare a relevant response.

If you submit our contact form, we collect: your name, work email, phone number, company name, company website, departments you're hiring for, target timeline, headcount, your remote-team experience level, and any free-text context you provide. We also calculate an internal lead score from these inputs and attach the marketing attribution captured earlier.

## 4. How We Use Your Data

We use your personal data for the following purposes:

- To match candidates with suitable roles and engagement opportunities
- To manage employment and contractor agreements, payroll, payments, and related administration
- To communicate with you about our services, updates, and opportunities
- To comply with legal and regulatory obligations

## 5. Legal Basis for Processing

We process your personal data on the following legal grounds:

- Consent — where you have given us clear consent to process your personal data for a specific purpose
- Legitimate interest — where processing is necessary for our legitimate business interests, provided these do not override your rights
- Contractual necessity — where processing is necessary to fulfil a contract with you or to take steps at your request before entering into a contract
- Legal obligation — where processing is necessary to comply with a legal obligation

## 6. Data Sharing

Your personal data may be shared in the following circumstances:

- Between GrowTeams (Pty) Ltd (South Africa) and GrowTeams Ltd (Isle of Man / UK operations) — data flows one way from South Africa to GrowTeams Ltd. GrowTeams (Pty) Ltd transfers employee and contractor details to clients as required for placements.
- No personal data is transferred from GrowTeams Ltd back to GrowTeams (Pty) Ltd in South Africa.
- We do not sell your personal data to third parties under any circumstances.

## 6.1 Third-Party Data Processors

We use a small number of carefully chosen service providers (data processors) to operate our website and handle enquiries. They process your data only on our instructions and only for the specific purposes below:

- Google LLC — provides Google Tag Manager and Google Analytics 4. Loaded only after you grant analytics consent. Data may be transferred to and processed in the United States. Google participates in the EU-US and UK-US Data Privacy Frameworks, providing an adequate level of protection under UK GDPR.
- Microsoft Corporation — provides Microsoft Clarity (session replay and behavioural analytics). Loaded only after you grant analytics consent. Data may be transferred to and processed in the United States under the same Data Privacy Frameworks.
- Web3Forms — processes submissions from our contact form and forwards them to our team via email. Data is transmitted directly when you submit the form, regardless of cookie consent (because the form submission is at your initiation, not background tracking).
- Cloudflare, Inc. — hosts our website and provides content delivery and security services. Cloudflare may briefly process IP addresses and request metadata for the purpose of serving the site and protecting it from abuse.

You can withdraw consent for analytics processors (Google, Microsoft) at any time via the **Cookie Preferences** link in our footer. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

## 7. Data Retention

We retain your personal data for a period of 2 years after your employment or contract with us ends. After this period, your data will be securely deleted or anonymised unless we are required by law to retain it for a longer period.

## 8. Your Rights

Under applicable data protection legislation, you have the following rights:

- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your personal data where there is no compelling reason for continued processing
- Right to restrict processing — request that we limit how we use your data
- Right to object to processing — object to our processing of your personal data in certain circumstances
- Right to data portability — request transfer of your data to another organisation or directly to you
- Right to revoke consent — withdraw your consent at any time where processing is based on consent
- Right to object to direct marketing — opt out of receiving marketing communications from us at any time

To exercise any of these rights, please contact us using the details provided below.

## 9. Data Protection

We are committed to protecting your personal data and comply with the following data protection frameworks:

- UK GDPR and the Data Protection Act 2018 — the primary regime under which we operate, applicable as we offer services to and monitor users in the United Kingdom and our commercial dealings are governed by UK law
- EU GDPR — the General Data Protection Regulation, applicable because we offer services to users in the European Union
- Isle of Man Data Protection Act 2018 and the Data Protection (Applied GDPR) Order 2018 — applicable to GrowTeams Ltd as a company established in the Isle of Man; the IoM Applied GDPR is substantively equivalent to UK and EU GDPR
- POPIA — the Protection of Personal Information Act, applicable to GrowTeams (Pty) Ltd's processing of South African personal data

We implement appropriate technical and organisational measures to safeguard your personal data against unauthorised access, alteration, disclosure, or destruction.

## 10. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with our obligations, you have the right to complain to a supervisory authority:

- United Kingdom: the Information Commissioner's Office (ICO) — ico.org.uk
- European Union: the supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement
- Isle of Man: the Information Commissioner — inforights.im
- South Africa: the Information Regulator — inforegulator.org.za

We'd appreciate the chance to address your concerns directly first — please contact us using the details below before going to a regulator.

## 11. Cookies and Tracking

Our use of cookies, session recording, and other tracking technologies is described in detail in our [Cookie Policy](cookie-policy). No analytics or marketing cookies are loaded until you grant consent, which you can change at any time via the **Cookie Preferences** link in our footer.

## 12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

- Email: recruitment@grow-teams.com
- Phone: +44 1992 918012