English
Controller and contact
The data controller is Francisco José Luluaga Garcia. Growth Lab FJL is a project and trade name, not a separate legal entity. At present it does not identify an incorporated company or a registered self-employed business.
Privacy questions and rights requests can be sent to privacy@growthlab-fjl.com. This active and successfully tested address is forwarded by Cloudflare Email Routing to a private Gmail mailbox. A professional postal address and tax identifier are not approved for publication. A separate Legal Notice remains pending until the information required for publication is approved.
No data protection officer is required under the current activity, scale, and processing model.
Data, purposes, and legal bases
- Commercial enquiries: contact details, professional context, and the message supplied by the visitor are used to answer the requested enquiry, assess fit, and prepare a requested proposal or other pre-contractual step. The legal basis is Article 6(1)(b) GDPR.
- Requested resources: the information required by the relevant form is used only to deliver the specifically requested resource and resolve delivery issues. The legal basis is Article 6(1)(b) GDPR. A resource request does not authorize newsletters, nurturing, or unrelated marketing.
- Conversational contact: the information submitted through the conversational flow is used to capture and respond to the professional enquiry requested by the visitor. The legal basis is Article 6(1)(b) GDPR.
- Site delivery and security: technical request information such as IP address, user agent, route, time, and diagnostic/security logs may be processed by the active hosting infrastructure to serve and protect the website. The legal basis is the controller's legitimate interest in reliable and secure operation under Article 6(1)(f) GDPR.
- Privacy correspondence: contact details, the request, and proportionate identity-verification information where necessary are processed to respond to rights requests and meet legal obligations under Article 6(1)(c) GDPR.
- Consent preference: the self-hosted CookieConsent interface stores a necessary first-party preference cookie. Optional statistics consent is based on Article 6(1)(a) GDPR, but no analytics provider or delivery is currently active.
- Persistent attribution: disabled. The application removes known legacy
_tk_*keys without reading their contents and does not create replacement browser or server persistence. A future attribution mechanism requires a separate ePrivacy/LSSI and GDPR decision before implementation.
Marketing communications are not active. Any future marketing requires separate, explicit, and withdrawable consent and cannot be inferred from a resource request, professional enquiry, form-processing choice, or cookie choice.
Active service providers and recipients
- Netlify: active for website hosting, serverless Functions, and existing Forms submissions.
- Cloudflare: active for DNS and Email Routing. Website records remain DNS-only, so Cloudflare is not acting as a web-content proxy for this site.
- Google Gmail: active only as the destination mailbox for privacy correspondence forwarded through Cloudflare Email Routing.
- PostHog Cloud EU: a Frankfurt project contains a limited historical test dataset. New browser analytics delivery is disabled, and the site does not identify visitors or send new events to the PostHog service.
- Public authorities or professional advisers: information may be disclosed only where required by law or necessary to establish, exercise, or defend legal claims.
GA4 and GTM are not active. Brevo DNS authentication records exist, but production sending and contact processing have not been verified; Brevo is therefore not described as an active processor. DMARC is active in monitoring mode with p=none. CookieConsent is bundled and self-hosted, so it is not an external processor.
International transfers
Netlify, Cloudflare, and Google are providers with operations outside the European Economic Area. Their services may process limited data internationally. Where a restricted transfer occurs, applicable provider terms and safeguards may include European Commission Standard Contractual Clauses, adequacy decisions, and the EU–US Data Privacy Framework where the recipient and transfer are covered. The historical PostHog project is hosted in the EU region in Frankfurt; provider support or subprocessors may still involve international access subject to the applicable contractual safeguards.
Provider transfer information can be reviewed in the official Netlify privacy statement, Cloudflare data processing terms, and Google transfer frameworks. You may request current transfer information, including the applicable PostHog materials, through the privacy contact above.
Retention
- Commercial enquiries: 12 months after the last meaningful interaction.
- Resource-only requests: 90 days after delivery.
- Conversational contact: 12 months after the last meaningful interaction.
- CookieConsent preference: approximately 182 days, unless the visitor replaces or deletes it earlier.
- Privacy requests and technical/security records: only as long as necessary to address the request, demonstrate compliance, secure the service, or meet applicable limitation and provider-log periods.
- Historical PostHog test data: no new data is added. Its final deletion or retention period remains subject to a separate documented owner decision; it is not used for current profiling or automated decisions.
Required and optional information
Fields marked as required are needed to respond to an enquiry, deliver a requested resource, or continue the selected conversational flow. Without them, the requested service cannot be completed. Optional professional context can be omitted. Do not submit special-category or otherwise sensitive information that is not necessary for the request. Statistics consent is optional, and refusing it does not prevent access to content or forms.
Your rights
Subject to the GDPR conditions, you may request access, rectification, erasure, restriction, objection, and portability. Where processing is based on consent, you may withdraw that consent at any time without affecting processing already carried out lawfully. Send a request to privacy@growthlab-fjl.com and describe the right you wish to exercise. Only proportionate information needed to verify identity will be requested.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.
Automated decisions and analytics
There is no active automated decision-making, profiling, lead scoring, AI profiling, or automated pricing or eligibility decision. No active analytics provider receives new browser events. PostHog's limited historical EU test dataset is not being refreshed; GA4 and GTM are not active.
CookieConsent records the browser's preference metadata in its first-party cookie. Eligible same-origin HTTP requests may include that cookie automatically, but application code does not extract its identifier for analytics or send it to an analytics provider. Persistent _tk_* attribution is disabled. See the Cookies Policy for the complete current browser-storage inventory and withdrawal control.
Changes
Material changes will be reflected here with a new update date and, where required, a renewed consent choice.