Privacy

Effective Date: [Month DD, YYYY]
Last Updated: [Month DD, YYYY]

1. About This Privacy Policy

Growth Capital Group (“GCG,” “we,” “us,” or “our”) respects your privacy and is committed to handling personal data responsibly.

This Privacy Policy explains how [insert GCG’s full legal entity name], together with any affiliates covered by this policy, collects, uses, stores, shares, and protects personal data when you:

• Visit [insert website URL] or another GCG website on which this Privacy Policy is posted;

• Contact GCG or submit an enquiry through our website;

• Communicate or conduct business with us;

• Explore an acquisition, investment, operating, employment, supplier, or strategic partnership opportunity with us;

• Attend a meeting, presentation, or event involving GCG; or

• Otherwise interact with GCG online or offline.

We refer to these websites and interactions collectively as the “Services.”

For the purposes of applicable data protection law, the organisation responsible for your personal data is generally [insert full legal entity name and registration details], unless another GCG entity tells you that it is responsible for a particular interaction.

This Privacy Policy does not necessarily apply to companies in which GCG invests, companies built or operated by GCG, or other portfolio companies. Those companies may maintain separate privacy policies describing their own data-processing practices.

2. Personal Data We Collect

“Personal data” means information that identifies you or can reasonably be linked to you. The personal data we collect depends on how you interact with GCG.

Information You Provide to Us

When you contact GCG or submit an enquiry through our website, we may collect:

• Your name;

• Your work email address;

• Your telephone number, if provided;

• Your employer, company, or organisation;

• Your job title or professional role;

• The type of enquiry you select, such as a buyer, operator, capital partner, or strategic-partner enquiry;

• The content of your message;

• Your communication preferences; and

• Any other information you choose to provide.

Please avoid including sensitive personal information in a general website enquiry unless it is necessary and GCG has specifically requested it.

Business and Professional Information

If you communicate or conduct business with GCG, we may collect:

• Business contact details;

• Information about your role, employer, or professional experience;

• Records of correspondence, calls, and meetings;

• Information relating to a potential acquisition, investment, partnership, supplier, advisory, or operating relationship;

• Due-diligence information where relevant to a proposed transaction or business relationship;

• Information needed to enter into or administer a contract;

• Billing, payment, tax, or other commercial information where relevant; and

• Information relating to events, presentations, or meetings you attend.

Some information relating to a company or transaction may not itself be personal data. However, this Privacy Policy applies where that information identifies or can reasonably be associated with an individual.

Information About Operators, Candidates, and Prospective Team Members

[Retain this section only if GCG accepts applications, résumés, or operator profiles.]

If you contact us about an employment, advisory, leadership, or portfolio-company operating opportunity, we may collect:

• Your résumé, curriculum vitae, portfolio, or professional profile;

• Employment history, education, qualifications, and skills;

• Professional interests and preferred roles or locations;

• Compensation expectations, where relevant;

• Information received from recruitment agencies, professional references, or publicly available professional sources;

• Interview notes and assessments;

• Information required to conduct legally permitted background, identity, sanctions, or reference checks; and

• Any other information you submit in connection with the opportunity.

We will only request information that is relevant to evaluating or administering the opportunity. Where applicable law requires consent before a particular check is conducted, we will obtain that consent.

Information Collected Automatically

When you visit our website, GCG and its approved service providers may automatically collect certain technical and usage information, including:

• Your Internet Protocol address;

• Approximate location derived from your IP address;

• Browser type and language;

• Device type and operating system;

• Referring and exit pages;

• Pages viewed and links selected;

• The dates, times, and duration of visits;

• Website performance and error information;

• Cookie or similar technology identifiers; and

• General information about how visitors use and navigate the website.

[Confirm which of these items the live GCG website actually collects. Delete any category that is not collected.]

Information From Other Sources

Where permitted by law, we may receive personal data from:

• People or organisations that introduce you to GCG;

• GCG affiliates or portfolio companies;

• Business partners, professional advisers, and service providers;

• Recruitment agencies and professional references;

• Transaction counterparties;

• Conferences, networking events, and industry organisations;

• Public registers and corporate records;

• Publicly available websites, company pages, and professional networking platforms such as LinkedIn; and

• Other sources you have authorised to disclose information to us.

We may combine this information with information you provide directly.

3. Cookies and Similar Technologies

Our website may use cookies and similar technologies to operate, protect, measure, and improve the site.

Cookies are small files or identifiers stored on or accessed through your device. Depending on the configuration of the live GCG website, we may use:

• Essential cookies, which are required for security, navigation, form submission, and other basic website functions;

• Preference cookies, which remember choices you make;

• Analytics cookies, which help us understand website traffic and performance; and

• Advertising or marketing cookies, which may be used to measure campaigns or provide more relevant communications.

[Confirm which cookie categories are actually used. If GCG does not use advertising cookies, delete that category. Insert a link to the cookie-preference panel or Cookie Policy if one is implemented.]

Where required by law, non-essential cookies will not be placed until you have made the relevant choice through our cookie-preference tool. You can also control cookies through your browser settings, although blocking essential or functional cookies may affect how the website works.

Third-party tools used on the website may set or access their own cookies. [Identify the live providers—for example, Framer, Google Analytics, LinkedIn, Meta, HubSpot, or another analytics or CRM provider—and link to their privacy information where appropriate.]

4. How We Use Personal Data

GCG may use personal data to:

• Receive, assess, and respond to enquiries;

• Communicate with prospective buyers, capital partners, family offices, strategic acquirers, operators, advisers, suppliers, and other business contacts;

• Evaluate potential acquisitions, investments, partnerships, mandates, or other commercial opportunities;

• Conduct due diligence and manage transaction processes;

• Establish, administer, and maintain business relationships;

• Negotiate, enter into, and perform contracts;

• Manage events, meetings, presentations, and other communications;

• Evaluate candidates or operators for potential roles, where applicable;

• Operate, maintain, secure, and improve our website;

• Understand website performance and how visitors engage with our content;

• Maintain records and internal reporting;

• Protect GCG, its affiliates, portfolio companies, personnel, counterparties, and other people from fraud, misuse, security threats, and unlawful activity;

• Establish, exercise, or defend legal claims;

• Comply with legal, regulatory, accounting, tax, and reporting obligations;

• Complete a corporate transaction, restructuring, financing, acquisition, or sale; and

• Send relevant business updates or marketing communications where permitted by law.

We will not use personal data for a materially different purpose without providing additional information or obtaining consent where required.

5. Legal Bases for Processing

Where applicable law requires GCG to identify a legal basis, we may process personal data on one or more of the following bases:

Steps Before a Contract or Performance of a Contract

We may process personal data when it is necessary to:

• Respond to a request to explore a business relationship;

• Negotiate or enter into an agreement;

• Provide or receive contracted services; or

• Administer an existing contractual relationship.

Legitimate Interests

We may process personal data where it is reasonably necessary for GCG’s legitimate business interests, provided those interests are not overridden by your rights and interests.

These interests may include:

• Responding to business enquiries;

• Identifying and evaluating commercial opportunities;

• Developing and maintaining professional relationships;

• Operating and protecting our website and business;

• Understanding the effectiveness of our communications;

• Conducting appropriate due diligence;

• Maintaining accurate business records; and

• Establishing, exercising, or defending legal claims.

Consent

We may rely on your consent for certain activities, including:

• Placing non-essential cookies;

• Sending certain electronic marketing communications;

• Processing particular categories of sensitive personal data; or

• Carrying out another activity for which consent is legally required.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred lawfully before consent was withdrawn.

Legal Obligations

We may process personal data when necessary to comply with applicable legal, regulatory, tax, accounting, sanctions-screening, court-order, or law-enforcement obligations.

Other Lawful Grounds

Where permitted by applicable law, we may also process personal data to protect vital interests, perform a task in the public interest, or on another legally recognised basis.

6. Artificial Intelligence and Meeting Tools

[Optional—retain only if GCG actually uses AI-powered meeting, screening, analysis, or organisational tools.]

GCG may use approved technology providers, including artificial intelligence tools, to assist with activities such as:

• Transcribing or summarising meetings;

• Organising business information;

• Reviewing documents;

• Supporting research and analysis; or

• Assisting with administrative workflows.

Where a meeting is recorded or transcribed, GCG will provide notice or obtain consent when required by law. Personal data processed in this context may include a participant’s name, voice, image, statements, and meeting details.

[Confirm before publishing:] GCG does not use solely automated processing to make decisions about individuals that produce legal or similarly significant effects. Where technology assists with an assessment, an authorised person reviews the relevant information and remains responsible for the decision.

7. How We Share Personal Data

We may disclose personal data to the following categories of recipients where reasonably necessary and legally permitted:

• GCG affiliates and authorised personnel;

• Portfolio companies, where relevant to an enquiry or opportunity;

• Website-hosting, infrastructure, security, analytics, communications, document-storage, customer-relationship-management, and other technology providers;

• Professional advisers, including lawyers, accountants, auditors, consultants, insurers, and financial advisers;

• Recruitment agencies, background-check providers, and references, where applicable;

• Banks, payment providers, and tax or accounting providers;

• Potential transaction counterparties, lenders, investors, purchasers, sellers, or their advisers, subject to appropriate confidentiality protections;

• Government bodies, courts, regulators, tax authorities, or law-enforcement authorities where disclosure is required or legally permitted; and

• Another organisation in connection with an actual or proposed merger, acquisition, financing, restructuring, transfer of assets, or similar corporate transaction.

Service providers acting on our behalf are expected to process personal data only for the agreed purpose and to protect it appropriately.

GCG does not disclose personal data merely because an outside party requests it. We evaluate whether the disclosure is authorised, necessary, and proportionate under the circumstances.

[Choose the accurate version before publication:]

• Version A: GCG does not sell personal data or share personal data for cross-context behavioural advertising.

• Version B: GCG may disclose certain online identifiers to advertising or analytics partners in ways that some laws define as a “sale” or “sharing.” See [insert “Your Privacy Choices” link] to exercise applicable opt-out rights.

8. International Data Transfers

GCG, its affiliates, and its service providers may operate in more than one country. As a result, personal data may be accessed, stored, or processed outside the country in which it was originally collected.

Privacy and data protection laws may differ between countries. Where applicable law requires safeguards for an international transfer, GCG will use an approved transfer mechanism or another lawful safeguard. Depending on the circumstances, these measures may include:

• A transfer to a country recognised as providing an adequate level of protection;

• Contractual protections approved under applicable law;

• Specific contractual and security requirements imposed on service providers; or

• Another legally permitted transfer mechanism.

[Identify the countries in which GCG and its principal service providers process data. If the EU, EEA, Switzerland, or UK is in scope, confirm the relevant adequacy mechanism, standard contractual clauses, UK transfer addendum, or other safeguard with counsel.]

You may contact us using the details below to request more information about the safeguards relevant to your personal data.

9. Data Retention

GCG retains personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, regulatory, accounting, tax, security, and reporting requirements.

When deciding how long to retain personal data, we may consider:

• The nature and sensitivity of the information;

• The purpose for which it was collected;

• The duration of the business or professional relationship;

• Whether the information remains relevant to a potential opportunity;

• Applicable limitation periods;

• Legal, tax, accounting, or regulatory obligations;

• The risk of harm from unauthorised use or disclosure; and

• The need to establish, exercise, or defend legal claims.

[Replace the following with GCG’s approved retention periods:]

• General website enquiries: [for example, 24 months after the last meaningful interaction];

• Active business-relationship records: [for the relationship and a defined period afterwards];

• Transaction and contractual records: [insert applicable legal or commercial period];

• Candidate or operator information: [for example, 12 months after the process ends, unless consent is obtained for longer retention];

• Marketing records: [until the individual opts out, plus a limited suppression record]; and

• Analytics and cookie data: [insert the duration configured in the relevant platform or cookie tool].

When personal data is no longer required, we will delete it, anonymise it, or securely isolate it unless continued retention is required or permitted by law.

10. Information Security

GCG uses reasonable administrative, technical, contractual, and organisational measures designed to protect personal data against accidental or unlawful loss, misuse, alteration, destruction, unauthorised access, or disclosure.

These measures may include access controls, confidentiality obligations, secure service providers, authentication procedures, backup processes, and other safeguards appropriate to the nature of the information.

No website, transmission method, or storage system can be guaranteed to be completely secure. You should therefore take appropriate care when deciding what information to send electronically.

If GCG becomes aware of a personal-data incident, we will investigate and take appropriate action, including notifying affected individuals or authorities where required by applicable law.

11. Your Privacy Rights

Depending on where you live and the law that applies, you may have the right to:

• Ask whether GCG processes personal data about you;

• Request access to personal data GCG holds about you;

• Request correction of inaccurate or incomplete personal data;

• Request deletion of personal data in certain circumstances;

• Ask us to restrict certain processing;

• Object to processing based on particular legal grounds;

• Object to direct marketing;

• Withdraw consent where processing is based on consent;

• Request a portable copy of certain personal data;

• Opt out of certain sales, sharing, targeted advertising, or profiling where applicable;

• Request information about the sources, purposes, and recipients of your personal data;

• Ask for human review of certain automated decisions, where applicable;

• Lodge a complaint with an appropriate data protection or privacy authority; and

• Exercise your rights without unlawful discrimination or retaliation.

These rights are not absolute. A request may be limited or refused where an exception applies—for example, where GCG must retain information to comply with law, protect another person’s rights, preserve legal privilege, or establish or defend a legal claim.

To submit a privacy request, contact us at [privacy email address]. Please include enough information for us to understand your request. We may ask you for information reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.

Where permitted, you may use an authorised representative to submit a request. We may ask for evidence of the representative’s authority and may need to verify your identity directly.

We will respond within the period required by the applicable law.

Right to Object

Where GCG relies on legitimate interests, you may have the right to object to that processing based on your particular circumstances. You may object to the use of your personal data for direct marketing at any time.

Regulatory Complaints

We encourage you to contact GCG first so that we can try to resolve your concern.

You may also have the right to complain to the data protection or privacy authority in the country or region where you live, work, or believe an infringement occurred.

[Identify the authority or authorities most relevant to GCG’s established entity and target audience—for example, the Nigeria Data Protection Commission, an EU national data protection authority, or the UK Information Commissioner’s Office.]

12. Marketing Communications

Where permitted by law, GCG may use your business contact information to send communications concerning GCG, its work, events, opportunities, or related subjects that may be relevant to your professional interests.

You can opt out of marketing communications at any time by:

• Selecting the unsubscribe link in an email, where available; or

• Contacting us at [privacy or marketing email address].

Opting out of marketing will not prevent us from sending necessary administrative, transactional, legal, or relationship-related communications.

GCG may retain limited information about an opt-out request so that we can respect that preference in the future.

13. Sensitive Personal Data

GCG does not intend to collect sensitive personal data through its general website enquiry form.

Sensitive personal data may include information concerning health, race or ethnicity, religious or philosophical beliefs, political opinions, trade-union membership, sexual orientation, biometric identifiers, or other legally protected categories.

Please do not submit this information through a general enquiry unless GCG has specifically requested it and has provided an appropriate explanation.

If GCG needs to process sensitive personal data for a particular purpose, it will do so only where legally permitted and will apply any additional notice, consent, or protection required by law.

14. Children’s Privacy

The GCG website and Services are intended for business and professional audiences and are not directed to children.

GCG does not knowingly collect personal data from children through the website. [Confirm the applicable minimum age—often 16 or 18 depending on the service and jurisdiction.]

If you believe a child has provided personal data to GCG, please contact us so that we can investigate and, where appropriate, delete the information.

15. Third-Party Websites and Services

Our website may contain links to websites, platforms, or services operated by third parties. GCG does not control those third parties or their privacy and security practices.

This Privacy Policy does not apply to a third party’s collection or use of personal data. We encourage you to review the third party’s privacy information before providing personal data or using its services.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our business, website, technology, service providers, or legal obligations.

When we make an update, we will revise the “Last Updated” date at the top of the policy. If a change materially affects how we use personal data, we will provide additional notice where required by law.

We encourage you to review this Privacy Policy periodically.

17. Contact GCG

Questions, concerns, and privacy requests may be directed to:

Growth Capital Group
Legal entity: [Full legal entity name]
Registered address: [Street, city, postal code, country]
Company or registration number: [Registration number]
Privacy email: [privacy@gcg-domain.com]
General email: [general contact email]
Website: [https://www.gcg-domain.com]

Data Protection Officer or privacy lead: [Name or role, if applicable]
EU or UK representative: [Name and contact details, if legally required]