PRIVACY.

1. Controller

grw+ GmbH
Sophie Friedrich
Nithartstr. 1
81543 Munich, Germany
Email: sophie@grwplus.com

2. General website use

When you visit grwplus.com, our hosting provider processes technical server data such as your IP address, browser, requested page and time of access. We use this data to deliver the website securely and reliably. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure operation of the website.

The public website is hosted by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, California 94104, USA. You can read the provider's privacy policy at netlify.com/privacy.

3. Contact, appointments and newsletter

If you contact us, we process the information you provide to answer your request. The legal basis is Article 6(1)(b) GDPR if your request concerns a contract. In other cases it is Article 6(1)(f) GDPR. We use Tally BV for embedded contact forms and Calendly LLC for appointment booking links. Their own privacy policies apply when you use those services.

Newsletter emails are sent only after confirmation through a double opt-in process. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time using the unsubscribe link or by contacting us.

4. The Plus Club

The following information applies to the platform at theplus.club. The platform is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel processes server logs containing the IP address, time, requested page and browser information to provide and protect the platform. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and reliable hosting. Transfers to the United States are covered by the applicable transfer mechanism and our data processing agreement with the provider.

We use Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, for accounts, authentication and the database. The database is hosted in Frankfurt, Germany. Supabase processes account details, community memberships, benefits, event registrations, check-ins, feedback, product test participation and platform activity required for the service. The legal basis is Article 6(1)(b) GDPR. Where a separate consent is requested, the legal basis is Article 6(1)(a) GDPR. Standard contractual clauses apply where support access involves a third country.

Supabase Auth uses technically necessary session cookies when you sign in. Section 25(2)(2) TDDDG applies to storage on your device and Article 6(1)(b) GDPR applies to further processing. We do not use advertising cookies, tracking cookies or third party analytics.

Channel and touchpoint analytics

We use separate links and, in some cases, separate discount codes for marketing channels such as events, podcast episodes, newsletters, social media posts and print materials. This helps us understand which channel led to visits, registrations, benefit unlocks and redirects to partner shops.

When such a link is opened, we increase a daily counter for the relevant channel. Our analytics database does not store an IP address, device identifier, browser identifier or exact time for the individual visit. The token in the link identifies a channel and not a person.

If you unlock a benefit through such a link, the channel may be stored on that benefit unlock. If you register through the link, the registration is counted for the channel. The token is then removed from the account data.

The legal basis for providing a channel-specific benefit is Article 6(1)(b) GDPR. Aggregated performance measurement is based on Article 6(1)(f) GDPR. Our legitimate interest is to assess marketing measures, account for partner services and operate the platform economically.

Brands and creators receive aggregated values only. Small groups are hidden. They do not receive names, email addresses or individual unlocks. You may object to the personal attribution to a touchpoint at any time in your account settings or by emailing sophie@grwplus.com.

We retain daily values for 13 months and then keep weekly values only. Weekly values and aggregated redemption data are deleted after 36 months at the latest. Attribution on a benefit unlock is deleted with the unlock and no later than 90 days after the benefit ends. We do not use advertising pixels, individual tracking cookies or third party analytics for this process.

Marketing Analytics for brands and personal brands

Brand and creator accounts can document and compare the results of marketing measures. This may include visitors, engagements, new followers, reviews, leads, orders, customers, impressions, clicks, costs, revenue and publicly verifiable media mentions. Values are labelled with their source, period and data quality. The platform calculates separate indicators for activation, media value and financial contribution. These indicators do not make automated decisions about people and do not create a public ranking.

The legal basis is Article 6(1)(b) GDPR where analytics are part of a contract with the brand or creator. Necessary evidence, quality control and publicly available media mentions are processed under Article 6(1)(f) GDPR. The data is visible only to the authorised brand team, the relevant creator and authorised grw+ admins. Operational measurements and media mentions are deleted no later than 24 months after the marketing measure ends, unless legal retention duties or ongoing legal claims require longer storage.

Following and weekly updates

Signed-in users can follow brands, creators and event formats. The selection is stored in the account. A weekly email is sent only after voluntary activation. The legal basis is Article 6(1)(a) GDPR. Consent can be withdrawn in the profile or through the unsubscribe link in each email. Promotional partner offers after an event are sent only with separate consent.

Email delivery and maps

System emails are delivered by Sendinblue SAS, Brevo, 106 Boulevard Haussmann, 75008 Paris, France. Brevo processes the recipient address and email content on our behalf. Account, membership and event messages are based on Article 6(1)(b) GDPR. Optional updates are based on consent. Map tiles are loaded from the OpenStreetMap Foundation. Your browser sends the IP address to that provider. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in a usable map.

5. Retention and your rights

We keep account data while the account exists and delete or anonymise it after a valid deletion request, unless legal retention duties apply. Consent data is kept until withdrawal or until the period stated with the consent ends. Specific retention periods for touchpoint and marketing analytics are stated above.

You may request access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction under Article 18 and data portability under Article 20. You may object to processing based on Article 6(1)(f) GDPR under Article 21. You may withdraw consent at any time for the future under Article 7(3).

Contact sophie@grwplus.com to exercise these rights. You may also lodge a complaint with a supervisory authority. The competent authority for grw+ GmbH is the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Germany, lda.bayern.de.

Last updated: October 2026