English
Controller and contact
The data controller is Francisco José Luluaga Garcia. Growth Lab FJL is a project and trade name, not a separate legal entity. At present it does not identify an incorporated company or a registered self-employed business.
Privacy questions and rights requests can be sent to privacy@growthlab-fjl.com. This active and successfully tested address is forwarded by Cloudflare Email Routing to a private Gmail mailbox. A professional postal address and tax identifier are not approved for publication. A separate Legal Notice remains pending until the information required for publication is approved.
No data protection officer is required under the current activity, scale, and processing model.
Data, purposes, and legal bases
- Commercial enquiries: contact details, professional context, and the message supplied by the visitor are used to answer the requested enquiry, assess fit, and prepare a requested proposal or other pre-contractual step. The legal basis is Article 6(1)(b) GDPR.
- Requested resources: the information required by the relevant form is used only to deliver the specifically requested resource and resolve delivery issues. The legal basis is Article 6(1)(b) GDPR. A resource request does not authorize newsletters, nurturing, or unrelated marketing.
- Conversational contact: the information submitted through the conversational flow is used to capture and respond to the professional enquiry requested by the visitor. The legal basis is Article 6(1)(b) GDPR.
- Site delivery and security: technical request information such as IP address, user agent, route, time, and diagnostic/security logs may be processed by the active hosting infrastructure to serve and protect the website. The legal basis is the controller's legitimate interest in reliable and secure operation under Article 6(1)(f) GDPR.
- Privacy correspondence: contact details, the request, and proportionate identity-verification information where necessary are processed to respond to rights requests and meet legal obligations under Article 6(1)(c) GDPR.
- Consent preference: the self-hosted CookieConsent interface stores a necessary first-party preference cookie. Optional statistics consent is based on Article 6(1)(a) GDPR. Consent revision 3 presents the prepared GA4/GTM disclosure and requests a fresh choice, but no analytics provider or delivery is enabled in this release.
- Persistent attribution: disabled. The application removes known legacy
_tk_*keys without reading their contents and does not create replacement browser or server persistence. A future attribution mechanism requires a separate ePrivacy/LSSI and GDPR decision before implementation.
Marketing communications are not active. Any future marketing requires separate, explicit, and withdrawable consent and cannot be inferred from a resource request, professional enquiry, form-processing choice, or cookie choice.
Active service providers and recipients
- Netlify: active for website hosting, serverless Functions, and existing Forms submissions.
- Cloudflare: active for DNS and Email Routing. Website records remain DNS-only, so Cloudflare is not acting as a web-content proxy for this site.
- Google Gmail: active only as the destination mailbox for privacy correspondence forwarded through Cloudflare Email Routing.
- PostHog Cloud EU: a Frankfurt project contains a limited historical test dataset. New browser analytics delivery is disabled, and the site does not identify visitors or send new events to the PostHog service.
- Public authorities or professional advisers: information may be disclosed only where required by law or necessary to establish, exercise, or defend legal claims.
GA4 and GTM are not active. Brevo DNS authentication records exist, but production sending and contact processing have not been verified; Brevo is therefore not described as an active processor. DMARC is active in monitoring mode with p=none. CookieConsent is bundled and self-hosted, so it is not an external processor.
Prepared but inactive non-production analytics
This release prepares legal, consent, and security controls for a separately authorized non-production GA4 web stream managed through Google Tag Manager. Its proposed purpose is to measure, in aggregate, consented CTA interactions and successful lead outcomes so the site can evaluate content and conversion performance. The legal basis would be the visitor's explicit statistics consent under Article 6(1)(a) GDPR. Current provider switches are disabled, no GTM container is loaded, and Google receives no website analytics data from this release.
- Recipient and terms: Google would become the analytics recipient/service provider identified by the Google Analytics and Google measurement terms accepted for the non-production property. Before activation, the owner must record the contracting entity, applicable processor/controller allocation, accepted terms, and transfer safeguards as external release evidence.
- Reviewed event data: only the approved event name, schema version, deployment environment, sanitized path, and closed categorical CTA or lead properties may be supplied by the site. Names, email addresses, form values, full URLs, query strings, URL fragments, raw referrers, User-ID, advertising identifiers supplied by the site, and stable application identities are prohibited.
- Technical metadata: the Google tag may automatically generate or derive timestamps, a pseudonymous browser client/session identifier, browser and device characteristics, language, screen information, and approximate location from the connection. Google Signals, Ads links, user-provided data collection, User-ID, automatic pageviews, and conflicting Enhanced Measurement are required to remain disabled.
- Hosts and storage: the prepared boundary is limited to
www.googletagmanager.com,www.google-analytics.com, andregion1.google-analytics.com. A later consented preview may create first-party GA cookies such as_gaand a stream-specific_ga_*; their observed names, purpose, duration, and deletion behavior must be verified before activation. None is created by the current disabled configuration. - Withdrawal: withdrawing statistics consent immediately invalidates the application sink and prevents new canonical events from being delivered. Loaded third-party JavaScript cannot be described as physically unloaded. Every post-withdrawal request must be inventoried; any consent-state or cookieless ping blocks activation until the owner explicitly accepts and documents it or rejects the provider architecture.
International transfers
Netlify, Cloudflare, and Google are providers with operations outside the European Economic Area. Their services may process limited data internationally. Where a restricted transfer occurs, applicable provider terms and safeguards may include European Commission Standard Contractual Clauses, adequacy decisions, and the EU–US Data Privacy Framework where the recipient and transfer are covered. The historical PostHog project is hosted in the EU region in Frankfurt; provider support or subprocessors may still involve international access subject to the applicable contractual safeguards.
Provider transfer information can be reviewed in the official Netlify privacy statement, Cloudflare data processing terms, and Google transfer frameworks. You may request current transfer information, including the applicable PostHog materials, through the privacy contact above.
Retention
- Commercial enquiries: 12 months after the last meaningful interaction.
- Resource-only requests: 90 days after delivery.
- Conversational contact: 12 months after the last meaningful interaction.
- CookieConsent preference: approximately 182 days, unless the visitor replaces or deletes it earlier.
- Prepared non-production GA4 property: if separately activated, user-level and event-level data retention is set to 2 months with reset on new activity turned off. No new GA4 data is collected by this release. A future production target of 14 months requires separate owner approval and updated disclosures before use.
- Privacy requests and technical/security records: only as long as necessary to address the request, demonstrate compliance, secure the service, or meet applicable limitation and provider-log periods.
- Historical PostHog test data: no new data is added. Its final deletion or retention period remains subject to a separate documented owner decision; it is not used for current profiling or automated decisions.
Required and optional information
Fields marked as required are needed to respond to an enquiry, deliver a requested resource, or continue the selected conversational flow. Without them, the requested service cannot be completed. Optional professional context can be omitted. Do not submit special-category or otherwise sensitive information that is not necessary for the request. Statistics consent is optional, and refusing it does not prevent access to content or forms.
Your rights
Subject to the GDPR conditions, you may request access, rectification, erasure, restriction, objection, and portability. Where processing is based on consent, you may withdraw that consent at any time without affecting processing already carried out lawfully. Send a request to privacy@growthlab-fjl.com and describe the right you wish to exercise. Only proportionate information needed to verify identity will be requested.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.
Automated decisions and analytics
There is no active automated decision-making, profiling, lead scoring, AI profiling, or automated pricing or eligibility decision. No active analytics provider receives new browser events. PostHog's limited historical EU test dataset is not being refreshed; the prepared GA4 and GTM path remains disabled and inactive.
CookieConsent records the browser's preference metadata in its first-party cookie. Eligible same-origin HTTP requests may include that cookie automatically, but application code does not extract its identifier for analytics or send it to an analytics provider. Persistent _tk_* attribution is disabled. See the Cookies Policy for the complete current browser-storage inventory and withdrawal control.
Changes
Material changes will be reflected here with a new update date and, where required, a renewed consent choice.