GDPR & Your Rights

This page explains your rights under the EU General Data Protection Regulation (GDPR) and the UK GDPR, and how to exercise them. It is a companion to our Privacy Policy, which describes in full what personal data we collect and how we use it. If anything here conflicts with mandatory data-protection law that applies to you, that law prevails.

Who Is Responsible for Your Data

The data controller for your personal data is Growth Tonic Ltd, Thiseos 7, Office 101, 2042 Strovolos, Cyprus (VAT number CY10440770M). You can reach us about any data-protection matter at [email protected].

Our Legal Bases for Processing

We only process your personal data where we have a legal basis to do so under GDPR Article 6:

• Performance of a contract — to create and manage your account, provide our services, and process bookings and payments.
• Consent — for session recording and AI features, for marketing communications, and for non-essential cookies. You can withdraw consent at any time.
• Legitimate interests — to improve and secure our services, prevent fraud and abuse, and understand how our services are used, where these interests are not overridden by your rights.
• Legal obligation — to meet our tax, accounting, and other legal duties, and to respond to lawful requests.

Your Rights

If you are in the EU/EEA or the UK, you have the following rights over your personal data:

• Right of access — to be told whether we process your data and to receive a copy of it (Article 15).
• Right to rectification — to have inaccurate or incomplete data corrected (Article 16).
• Right to erasure — to have your data deleted in certain circumstances, also known as the "right to be forgotten" (Article 17).
• Right to restriction — to limit how we process your data in certain circumstances (Article 18).
• Right to data portability — to receive the data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible (Article 20).
• Right to object — to object to processing based on our legitimate interests, and to object to direct marketing at any time (Article 21).
• Right to withdraw consent — where we rely on your consent, you can withdraw it at any time, without affecting processing that took place before withdrawal (Article 7).
• Rights related to automated decision-making — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22). We do not make such decisions about you by solely automated means.

How to Exercise Your Rights

To exercise any of these rights, email [email protected] with details of your request, or use the relevant options in your account settings. We may need to verify your identity before acting. We will respond within one month, as required by GDPR; we may extend this by two further months for complex or numerous requests, and we will tell you if we do. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

International Data Transfers

Some of our service providers are located outside the European Economic Area (for example, in the United States). Where we transfer your personal data outside the EEA, we rely on an adequacy decision of the European Commission, or on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can request a copy of these safeguards at [email protected].

Your Right to Complain

If you have a concern about how we handle your personal data, please contact us first at [email protected] so we can try to resolve it.

You also have the right to lodge a complaint with a data protection supervisory authority. Our lead supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy). If you are in another EU/EEA country or the UK, you may also complain to the supervisory authority in your country of residence.

Updates to This Page

We may update this page from time to time. The "Last updated" date above shows when it was last revised. For the full description of our data practices, see our Privacy Policy.