Checkgrow

Security & Compliance

GDPR Compliance

This page explains who we are as your data controller, what rights you hold under GDPR, and exactly how you can exercise each one.

Data Controller Information

Checkgrow is a Croatian company — registered as Checkgrow d.o.o. in Zagreb, Croatia — operating within the European Union. As an EU-based data controller, GDPR compliance is not a product feature or a marketing claim: it is a legal obligation we take seriously and build our platform around.

Under GDPR, the data controller is the entity that determines the purposes and means of processing your personal data. For all users of Checkgrow, the data controller is:

Checkgrow d.o.o.
Ulica Vjekoslava Heinzela 60
10000 Zagreb, Croatia
VAT: HR16006061302
Email: admin@checkgrow.com

If you have any questions about how your data is processed, wish to exercise your rights, or have a concern about our data practices, contact us at the above email.

Checkgrow never processes your personal data without a valid legal basis under GDPR Article 6. The legal bases we rely on are:

  • Contract Performance (Article 6(1)(b)): Processing necessary to provide the service you signed up for — account creation, platform access, feature delivery, and support.

  • Legitimate Interests (Article 6(1)(f)): Processing necessary for security, fraud prevention, platform stability, and service improvement — where these interests do not override your fundamental rights.

  • Consent (Article 6(1)(a)): Marketing communications and optional analytics tracking require your explicit, freely given consent. You can withdraw this consent at any time.

  • Legal Obligation (Article 6(1)(c)): Retaining billing records for 7 years as required by financial law; complying with court orders or regulatory requests.

When you register for Checkgrow, you explicitly consent to the Terms of Service and Privacy Policy. This consent is recorded with a timestamp, your IP address, and the policy version number for full auditability.

Your Eight Rights Under GDPR

Right 1 — Right of Access (Article 15)

You have the right to obtain a copy of the personal data we hold about you and information about how we process it.

How to exercise it: Download your data directly from My Account → Download My Data → Request Online Archive, or email us at admin@checkgrow.com. We will respond within 30 days.

Right 2 — Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected without undue delay.

How to exercise it: Update your name, email, phone number, job title, and profile information at any time through My Account → Profile tab. For data we hold that you cannot self-edit, contact admin@checkgrow.com.

Right 3 — Right to Erasure / Right to be Forgotten (Article 17)

You have the right to request deletion of your personal data where it is no longer necessary for the purposes it was collected, you withdraw consent, or you object to processing.

How to exercise it: Delete your account through My Account → Delete Account for complete self-service erasure. For partial erasure requests (specific data types), contact admin@checkgrow.com.

Exceptions: Some data (billing records, consent withdrawal logs) must be retained for legal compliance, as described in our Data Retention policy.

Right 4 — Right to Restriction of Processing (Article 18)

You have the right to request that we restrict (but not delete) the processing of your data in certain circumstances — for example, while you contest the accuracy of data or while an objection is being considered.

How to exercise it: Contact admin@checkgrow.com with your specific restriction request. We will respond within 30 days.

Right 5 — Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

How to exercise it: Request a full data archive through My Account → Download My Data → Request Online Archive. The archive is delivered in a machine-readable format (JSON/CSV) within 5–10 business days.

Right 6 — Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing at any time.

How to exercise it: To object to marketing, withdraw your marketing consent through My Account → Consent Management → Withdraw next to "Marketing Communications." For other objections, contact admin@checkgrow.com.

Right 7 — Right to Withdraw Consent (Article 7(3))

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing that took place before withdrawal.

How to exercise it: Manage all your active consents at My Account → Consent Management. The three consent categories are: Terms & Privacy Policy (Required), Marketing Communications (Opt out at any time), and Analytics (Opt out at any time).

Right 8 — Right Not to be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you.

Our practice: Checkgrow's AI features generate suggestions, content, and analysis to assist your decision-making — they do not make autonomous decisions about you or your business. All AI outputs are advisory and require human review before action.

Important

Every consent withdrawal is logged with a timestamp, your IP address, user agent, and optional reason. Admin notifications are sent automatically to ensure compliance follow-up. If you withdraw Terms & Privacy consent, you will be prompted to delete your account.

Checkgrow uses Usercentrics (CMP ID: F6OORt4YMN8e2x) as its Consent Management Platform. Usercentrics provides:

  • A consent banner on first visit for cookie and tracking preferences
  • A detailed preference center accessible at any time via My Account → Cookie Privacy → Privacy Settings
  • GDPR-compliant consent records with full auditability

All non-essential tracking services (such as Google Tag Manager) are blocked until you explicitly grant consent. Essential operational cookies — those required for authentication and platform functionality — cannot be disabled as they are necessary for the service to work.

We retain your data only for as long as necessary:

  • Account Data, Knowledge Base, Campaigns & Tasks, AI Interactions: Until deletion + 30 days

  • Consent Records: Duration of account + 5 years

  • Analytics Data: 24 months

  • Security Logs: 12 months

  • Platform Audit Logs: 24 months

  • Billing Records: 7 years (legal requirement)

You can view a summary of our data retention periods at any time in My Account → Data Retention, with a direct link to the full Privacy Policy for complete details.

International Transfers and Filing a Complaint

Some of our third-party processors are located outside the European Economic Area (primarily in the United States). For these transfers, we ensure appropriate safeguards through:

  • Standard Contractual Clauses (SCCs): EU-approved contractual terms requiring non-EEA processors to apply GDPR-equivalent protections

  • Data Processing Agreements (DPAs): Signed with every processor before any data sharing begins

  • EU-US Data Privacy Framework: Where applicable, we work with processors certified under this framework

Your primary data — content, Knowledge Base, campaigns, and AI results — is stored in the EU (AWS Frankfurt). International transfers only apply to the subset of data sent to AI providers and email services for specific processing tasks.

If you believe Checkgrow has not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority. In Croatia, this is:

Croatian Personal Data Protection Agency (AZOP)
Website: www.azop.hr
Email: azop@azop.hr

We would always appreciate the opportunity to address your concern directly before a formal complaint is filed — please reach out to admin@checkgrow.com first.

Visit AZOP Website