Privacy Policy

1. Who we are

This Privacy Policy explains how Growth100X (operated by Sumit Sagar, India) (“Growth100X”, “we”, “our”, “us”) collects, uses, and protects information when you visit growth100x.com, fill out our forms, or engage us for services. For the purposes of GDPR we act as a data controller for our marketing site and a data processor for client-specific engagements (covered by a separate Data Processing Addendum on request).

2. Information we collect

2.1 Information you give us

• Contact & audit forms: name, email, company name, website URL, role, business stage, and the free-text answers you provide about your goals, current stack, and pain points.
• Calendar bookings: when you book a call through our Google Calendar appointment scheduler, Google collects your name, email, and any meeting questions on our behalf.
• Engagement data: if you become a client, the information shared with us for the engagement — assets, credentials (where strictly necessary and shared via a vaulted password manager), and project-specific context.
• Direct communication: the contents of emails, WhatsApp, LinkedIn, or other messages you send us.

2.2 Information we collect automatically

• Usage data: pages viewed, time on page, referrer, approximate country / city, device class (mobile / desktop), and browser type — collected via Google Analytics 4 (through Google Site Kit) and Jetpack Stats.
• Server logs: standard web-server logs (IP address, timestamp, requested URL, user-agent) kept transiently by our hosting provider (WordPress.com) and CDN (Cloudflare) for security and abuse-prevention.
• Cookies & similar tech: see Section 7.

3. How we use information

We use the information described above to:

• Respond to your enquiries, deliver requested resources (audits, proposals, intro calls), and follow up on conversations you started.
• Deliver the services you engage us for, and keep you informed about the work in progress.
• Operate, secure, and improve our website and content (which posts to write next, which pages to fix).
• Comply with our legal obligations (accounting, tax, anti-spam, lawful requests from competent authorities).
• With your separate, explicit opt-in: send periodic updates about new services, case studies, or relevant content. You can unsubscribe at any time from the link in any such email.

4. Legal bases for processing (for EEA / UK visitors)

Under GDPR / UK GDPR, we rely on the following legal bases:

• Consent — for any optional marketing communications and non-essential cookies (you can withdraw consent at any time).
• Performance of a contract — to deliver services you’ve engaged us for, including pre-contractual steps you request (e.g., a quote).
• Legitimate interests — to operate and secure our website, prevent fraud and abuse, understand how our content performs, and respond to enquiries you initiate. We balance this against your rights and you can object at any time (see Section 9).
• Legal obligation — to comply with applicable tax, accounting, and other statutory requirements.

5. How we share information

We do not sell or rent personal information to anyone. We share information only in these limited cases:

• Sub-processors who help us run the business (hosting, email, analytics, scheduling, payments) — listed in Section 6.
• Legal & safety — when we have a good-faith belief that disclosure is necessary to comply with a law or court order, protect our rights, prevent fraud, or protect the safety of any person.
• Business transfer — if we are involved in a merger, acquisition, or sale of assets, in which case you’ll be notified before any data is transferred under a different policy.
• With your consent — any sharing beyond the above will be explicitly disclosed and requires your opt-in.

6. Sub-processors we use

We rely on a small set of trusted vendors to operate the site and run the business. Each is selected with care, has its own privacy framework, and processes data only as needed:

If you’d like the current up-to-date list for a specific engagement, request it via our contact link — we’ll share it under our standard DPA.

7. Cookies & analytics

We use a small number of cookies:

• Strictly necessary cookies — to make the site work (load balancing, security tokens). These cannot be turned off.
• Analytics cookies — Google Analytics 4 and Jetpack Stats, used in an aggregated and IP-anonymised way to understand how visitors use the site so we can improve it.
• No advertising / cross-site tracking cookies — we don’t run ads and we don’t share data with ad networks.

You can clear or block cookies from your browser settings at any time. For EU / UK / California / India visitors, where required, we’ll ask for opt-in consent to non-essential cookies before loading them.

8. Data retention

• Form submissions & enquiries: kept for up to 24 months from last interaction, then deleted, unless you become a client (in which case engagement records are retained for the period required by applicable tax / accounting law — typically 6–8 years in India).
• Analytics data: retained for up to 14 months in aggregated form.
• Email communications: retained in Google Workspace for as long as reasonably needed; older threads are archived or deleted on a rolling basis.
• You can request deletion at any time (see Section 9).

9. Your rights (GDPR, CCPA, India DPDP Act)

Depending on where you live, you may have the following rights over your personal information:

• Right to access a copy of the information we hold about you.
• Right to rectification if any of it is inaccurate or outdated.
• Right to erasure (“right to be forgotten”) subject to our legal retention obligations.
• Right to restrict or object to certain processing, including direct marketing.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to withdraw consent at any time, where consent is the legal basis.
• Right to non-discrimination for exercising any of the above (CCPA).
• Right to lodge a complaint with your local data protection authority — for example, the ICO (UK), your DPA in the EU, the California Attorney General (CCPA), or the Data Protection Board of India under the DPDP Act, 2023.

To exercise any of these rights, contact us using the link at the end of this page — we respond within 30 days.

10. International data transfers

We’re based in India, and several of our sub-processors are in the United States and the EU. Where personal data of EEA / UK residents is transferred outside the EEA / UK, we rely on the EU Standard Contractual Clauses (or equivalent safeguards) entered into directly by us or by the relevant sub-processor.

11. Security

We take reasonable, industry-appropriate technical and organisational measures to protect your information: TLS / HTTPS for all site traffic, two-factor authentication on internal accounts, principle-of-least-privilege access, vaulted credentials, and regular reviews of our vendor stack. No system is perfectly secure — if you believe your data has been compromised through us, contact us immediately.

12. Children’s privacy

Our services are aimed at businesses and professionals, not children. We do not knowingly collect personal information from anyone under the age of 16. If we learn we have, we’ll delete it promptly.

13. Changes to this policy

We may update this Privacy Policy as our services or the law evolves. When we do, we’ll update the “Last updated” date at the top. Material changes will be flagged on the site or sent to you by email where appropriate.

14. Contact us

If you have any questions about this Privacy Policy, want to exercise a right, or need our DPA for an engagement — book a 30-minute call below and we’ll route you to the right person.