Growth Index Privacy Policy.

Purpose of this privacy policy

This privacy policy aims to give you information on how Growth Index (GXPME Limited) collects and processes your personal data, through your use of this website and the data you provide to us, as we collate information to inform the development, publishing, and distribution of Growth Index.

1. Important information and who we are

Controller

Growth Index is a wholly owned subsidiary of ORESA Limited, GXPME Limited is the controller and responsible for your personal data (collectively referred to as “we”, “us” or “our” in this privacy policy).

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out below.

Contact details

If you have any questions about this privacy policy or our privacy practices, please contact our data privacy manager in the following ways:

• Full name of legal entity: GXPME Limited, company registered in England (registration number 14810157)
• Email address: laura.lally@oresa.co.uk
• Postal address: Harrogate Business Park, Hookstone Avenue, Harrogate, HG2 8ER.

2. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, last name, title, photo image, audio recordings
• Contact Data includes postal address, email address and telephone numbers.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Correspondence data including email exchanged between us.
• Marketing and Communications Data includes your communication preferences (i.e., whether you wish to be contacted by email, text, or post).

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data) or information on criminal convictions. 

3. How is your personal data collected?

We use different methods to collect data from and about you including through:

Direct interactions. You may give us your Identity and Contact by corresponding with us by phone, email or otherwise. This includes personal data you provide when:

• Communication data: when we interact with you about your inclusion on Growth Index.
• Contact data: when you sign up to hear more about Growth Index.

Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. 

Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:

• Technical Data from analytics providers such as Google based outside the UK.
• Contact Data from ORESA Ltd where you have an existing relationship with them.
• Identity, Contact, and Company from publicly available sources such as Companies House based in the UK, your company’s website, LinkedIn, or through tools connected to LinkedIn such as Contact Out and Rocket Reach.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To contact you to advise you that your company is to be included in the Top 100 ranked companies in the UK.
• To update you on Growth Index.
• To invite you validate your company data that is to be included in our publications.
• To invite you to complete one of our surveys to help us understand the factors that led to your success, your views on leadership and current business issues.
• To invite you to events that celebrate your success. 

To provide our services to you in the most effective way, it is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground, we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest
To register you as a relevant contact / leader of a Growth Index company	(a)Identity (b) Contact	Necessary for our legitimate interest (to register you on our systems)
To profile you as a relevant contact / leader of a Growth Index company	(a)Identity (b) Contact (a) Career	Necessary to build a personal profile for the purpose of detailing in a Growth Index report
To manage our relationship with you which will include notifying you about changes to our terms or privacy policy.	(a) Identity (b) Contact (a) Marketing and Communications	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated)
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Technical	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation
To keep you informed about relevant events and opportunities that may be of interest to you or members of your organisation	(a) Identity (b) Contact (c) Marketing and Communications	Necessary for our legitimate interests (to develop our services and grow our business)

With your permission and/or where permitted by law, we may also use your personal data for marketing purposes, which may include contacting you by email, telephone, or post with information, news, and offers on our products and services. You will not be sent any unlawful marketing or spam. We will always work to fully protect your rights and comply with our obligations under the Data Protection Legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003, and you can always opt-out. We will always obtain your express opt-in consent before sharing your personal data with third parties for marketing purposes and you will be able to opt-out at any time.

5. Disclosures of your personal data

We will share your personal data with other companies in our group for administrative and market research purposes. This includes ORESA Limited.

If we sell, transfer, or merge parts of our business or assets, your personal data may be transferred to a third party. Any new owner of our business may continue to use your personal data in the same way(s) that we have used it, as specified in this Privacy Policy.

In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

We may sometimes contract with third parties to supply certain products and services, such as website hosting.

6. International transfers

We may store some or all your personal data in countries outside of the UK. These are known as “third countries”. We will take additional steps to ensure that your personal data is treated just as safely and securely as it would be within the UK and under the Data Protection Legislation as follows:

• We will only store or transfer personal data in or to countries that are deemed to provide an adequate level of protection for personal data. For further information about adequacy decisions and adequacy regulations, please refer to the Information Commissioner’s Office.
• We will use specific approved contracts which ensure the same levels of personal data protection that apply under the Data Protection Legislation. For further information, please refer to the Information Commissioner’s Office.

Please contact us using the details at the beginning of this privacy notice for further information about the data protection safeguards used by us when transferring your personal data to a third country.

7. Data security

The security of your personal data is essential to us, and to protect your data, we take several important measures, including the following:

• limiting access to your personal data to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality
• procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data) including notifying you and/or the Information Commissioner’s Office where we are legally required to do so.

8. Data retention

We will not keep your personal data for any longer than is necessary considering the reason(s) for which it was first collected. 

9. Your legal rights

Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:

• The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know.
• The right to access the personal data we hold about you.
• The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. 
• The right to be forgotten, i.e., the right to ask us to delete or otherwise dispose of any of your personal data that we hold.
• The right to restrict (i.e., prevent) the processing of your personal data.
• The right to object to us using your personal data for a particular purpose or purposes.
• The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
• The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
• Rights relating to automated decision-making and profiling. We do not use your personal data in this way.

It is important that your personal data is kept accurate and up to date. If any of the personal data we hold about you changes, please keep us informed as long as we have that data.

Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first.

10. Cookies

Our Site may place and access certain first-party Cookies on your computer or device. First-party Cookies are those placed directly by us and are used only by us. We use Cookies to facilitate and improve your experience of Our Site and to provide and improve our [products] and services. We have carefully chosen these Cookies and have taken steps to ensure that your privacy and personal data is protected and always respected.

All Cookies used by and on Our Site are used in accordance with current Cookie Law.

Our Site uses analytics services provided by Google Analytics. Website analytics refers to a set of tools used to collect and analyse anonymous usage information, enabling us to better understand how Our Site is used. This, in turn, enables us to improve Our Site and the products and services offered through it.

Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review. This version was last updated on 22^nd April 2022.