Privacy Policy

Last updated: 27/09/2026

This Privacy Policy describes how Jorge Mayayo (hereinafter "George Growth", "we" or the "Controller") processes the personal data of users who access georgegrowth.com (the "Site") or contact us through the channels indicated.

1) Data controller

• Data controller: Jorge Mayayo (sole trader)
• Tax ID (NIF/CIF): 53764463P
• Address: Calle Vicente Aleixandre, 1, 28232 Las Rozas de Madrid, Madrid (Spain)
• Contact email: jorge@georgegrowth.com
• Data Protection Officer (if applicable): Not applicable

Applicable legislation: Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).

2) Data we may process, and where it comes from

We collect data when:

• You browse the Site: online identifiers, IP address, logs, cookies or similar technologies (see the Cookie Policy).
• You use contact, booking or download forms: first name, surname, email, telephone, company, job title, interests, the content of your message; and technical data about the submission.
• You engage us or request a proposal: billing details (tax ID, address), professional details and payment details (where applicable).
• Social media / newsletters: profile identifiers, interactions and preferences (according to each platform's settings).

Data comes from the user, from cookies and analytics and, where applicable, from suppliers (for example calendar tools, CRM, email marketing).

3) Purposes of processing

• Responding to requests for information, proposals or meetings.
• Providing consultancy and marketing services and administrative management (invoicing, support, accounting).
• Commercial communications about content, events or services related to performance marketing (only where consent exists or there is a legitimate interest in accordance with the applicable rules).
• Web analytics and improving the experience (cookies and aggregate measurement).
• Site security and the prevention of abuse and fraud.

4) Legal bases

• Consent (Art. 6(1)(a) GDPR): forms, newsletters, non-technical cookies, downloads and lead magnets.
• Performance of a contract or pre-contractual measures (Art. 6(1)(b)): handling proposals, engagement and delivery.
• Legitimate interest (Art. 6(1)(f)): security, service improvement and minimal remarketing compatible with reasonable expectations (where used, it is disclosed in the Cookie Policy and an opt-out is offered).
• Legal obligation (Art. 6(1)(c)): invoicing, accounting and tax obligations.

5) Data retention

• Enquiries and communications: up to 12 months from the last interaction.
• Clients and invoicing: for the duration of the relationship and, once it ends, 6 years (commercial law) / 4 years (tax law), or whichever period is required.
• Newsletters: until you unsubscribe or withdraw consent.
• Cookies and analytics: according to the periods set out in the Cookie Policy.

6) Recipients and processors

We may share data with suppliers acting as processors under an Article 28 GDPR contract, including:

• Hosting provider: loading.es (Spain).
• Email and productivity suite: Google Workspace (Google Ireland Limited / Google LLC).
• Website contact form: our own. The data is stored on the hosting server (Spain) and received by email and in a Google Workspace spreadsheet.
• In-house or third-party CRM for lead management (hosted in the EU, or with appropriate safeguards where transfers occur).
• Tag manager: Google Tag Manager (Google Ireland Limited).

In addition, where third-party pixels and tags are integrated (for example the Meta Pixel, Google Analytics, Google Ads or the ChatGPT Ads pixel), those third parties may process data as independent controllers or joint controllers (at the collection stage, where applicable). We will also share data with public authorities where there is a legal obligation to do so.

7) International transfers

Where we use suppliers outside the EEA, or suppliers belonging to groups with entities in the United States or other countries, we apply valid safeguards:

• Google (Workspace / Tag Manager / Analytics / Ads): European entity (Google Ireland). Where applicable, transfers to Google LLC (USA) are covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
• Meta Platforms (Meta Pixel): Meta Platforms Ireland Limited (EU). Where applicable, transfers to Meta Platforms, Inc. (USA) under the DPF and/or Standard Contractual Clauses.
• CRM (if outside the EU): Standard Contractual Clauses and a transfer impact assessment.

You can request further detail by writing to jorge@georgegrowth.com.

8) Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to jorge@georgegrowth.com with the subject line "Data protection", providing proof of your identity. If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.

9) Security

We apply technical and organisational measures proportionate to the risk, in order to preserve the confidentiality, integrity and availability of the data. That said, no system is 100% infallible.

10) Minors

Our services are aimed at people over the age of 18. If we detect data belonging to minors without valid authorisation, we will delete it.

11) Changes to this policy

We may update this Policy to reflect legal changes or changes in how we process data. The version in force will be published together with the date it was updated.