Draft for review by qualified legal counsel before launch. Not yet a final legal document. Items in [square brackets] must be completed by the business and its lawyer.
Privacy policy
Last updated: [DATE]. This policy explains how [LEGAL ENTITY NAME] ("Growth Lab", "we"), [REGISTERED ADDRESS], handles personal data when you visit this site, register for a webinar, enrol in a programme or use the student platform. Contact: [PRIVACY CONTACT EMAIL].
What we collect
- Webinar registration: name, email, phone or WhatsApp number, country, time zone, and your consent choices with the time you gave them.
- How you found us: the advertisement, campaign, source and page you arrived from, stored in your browser until you register (see "Cookies and browser storage").
- Enrolment and payment: the plan you choose, the terms version you accepted, the bank transfer receipt you upload (an image or PDF), the amount, date and bank reference you enter, and our verification notes. We do not collect card numbers.
- Student platform: your account, lesson progress, quiz and assignment answers, instructor feedback, class attendance, achievements, notifications, watchlist, risk plan and trading-journal entries you choose to write.
- Service records: emails we send you and whether they were delivered, and basic security logs such as sign-in attempts.
Why we use it, and our legal basis
- To register you for a webinar and send the details and reminders: [LEGAL BASIS, e.g. performing a service you asked for].
- To contact you about the programme and send marketing: only if you tick the optional box ([LEGAL BASIS: consent]). You can withdraw at any time.
- To enrol you, verify payment, give you access and teach you: [LEGAL BASIS: contract].
- To keep accounts and records secure, prevent abuse and meet accounting and legal duties: [LEGAL BASIS: legitimate interests / legal obligation].
- To understand which advertising brings students, using the first-touch information above and aggregate figures: [LEGAL BASIS].
Who we share it with
We do not sell personal data. We use service providers that process data for us under agreements: database, authentication and file storage ([SUPABASE REGION]); website hosting ([HOSTING PROVIDER, e.g. Vercel]); email delivery ([EMAIL PROVIDER, e.g. Resend]); and, if we enable them, advertising measurement tools. Staff see only what their role needs. Teaching staff can see the work of students in their cohort; other students cannot see your work. We may disclose data if the law requires it. [ADD ANY OTHER RECIPIENTS: payment, video, analytics, professional advisers].
International transfers
Some providers may process data outside your country. [COUNSEL: describe safeguards, such as standard contractual clauses, for the jurisdictions your students live in.]
How long we keep it
- Webinar leads who do not enrol: [RETENTION PERIOD, e.g. 24 months from last contact], then deleted or anonymised.
- Student account, progress and journal: while you are a student and for [PERIOD] afterwards.
- Payment records and receipts: [PERIOD REQUIRED BY ACCOUNTING AND TAX LAW].
- Security and audit logs: [PERIOD].
Security
Data is encrypted in transit. Access is controlled by role, enforced in the database; staff accounts use two-step verification; payment receipts are stored privately and shown to authorised finance staff only through short-lived links; passwords are never stored by us in readable form. No system is perfectly secure, and we will tell you and the authorities about a breach where the law requires.
Cookies and browser storage
We use essential cookies to keep you signed in. We store campaign information in your browser's local storage so we can tell which advertisement brought you; it is sent to us only if you submit a registration form. [COUNSEL: confirm whether consent or a banner is required in your target countries, and add any analytics or advertising pixels if they are ever enabled.]
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict some uses, and withdraw consent at any time (marketing emails also have an unsubscribe instruction). Write to [PRIVACY CONTACT EMAIL]; we will reply within [TIME LIMIT]. You may also complain to your local data-protection authority: [AUTHORITY].
Age
Our programmes are for adults aged [18+]. We do not knowingly collect data from children.
Changes
We will post updates here and, for material changes, tell you by email.