Privacy policy

Last updated: 15 October 2026.

1. Controller and overview

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Hasanain Al-Saadi Growli Media Kanadaring 16 77933 Lahr Germany Phone: +49 1522 9554076 Email: info@growli.media

We have not appointed a data protection officer because this is not legally required. The controller named above is the contact for all questions about data protection.

This privacy policy explains which personal data we process when you visit this website and when you contact us, for what purposes, on what legal basis and for how long. The website is available in German, English and Arabic. The English and Arabic versions of this policy are translations intended to make it easier to understand; in case of deviations or doubt the German version applies.

In short: we do not use advertising or tracking cookies, we do not build user profiles and we do not use automated decision-making. Anonymous audience measurement and the booking calendar of an external provider are only activated with your consent.

2. Legal bases

We process personal data on the basis of the following provisions:

• Art. 6 (1) (a) GDPR – your consent (e.g. statistics, external booking calendar).
• Art. 6 (1) (b) GDPR – performance of a contract or taking steps prior to entering into a contract (e.g. answering your enquiry, arranging an appointment).
• Art. 6 (1) (c) GDPR – compliance with legal obligations (e.g. commercial and tax retention duties).
• Art. 6 (1) (f) GDPR – legitimate interests (e.g. secure and reliable operation of the website, prevention of abuse and spam).
• § 25 (1) TDDDG – consent for accessing or storing information on your device; § 25 (2) no. 2 TDDDG – strictly necessary storage for a service you have expressly requested.

3. Hosting and provision of the website

3.1 Hosting with Vercel

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). When you visit the website, your requests are handled through Vercel's content delivery network (CDN) so that pages arrive quickly and reliably. The server-side functions of our website (e.g. the contact form) are set to a location in Frankfurt am Main (Germany). Static content may be delivered from servers in other countries depending on the visitor's location.

We have a data processing agreement with Vercel (Art. 28 GDPR), which forms part of Vercel's terms and contains the EU Standard Contractual Clauses. The legal basis for using Vercel is Art. 6 (1) (f) GDPR: our legitimate interest lies in providing the website securely, quickly and reliably.

3.2 Server log files

When you visit the website, technical data transmitted by your browser is processed automatically: IP address, date and time of the request, requested URL, referrer URL (previously visited page), browser type and version, operating system, amount of data transferred and HTTP status code. This data is technically necessary to deliver the website, to ensure its stability and security and to trace attacks or errors.

The legal basis is Art. 6 (1) (f) GDPR. The data is not combined with other data sources. The storage period depends on the settings of the hosting provider and is usually only a few days.

3.3 Automatic language selection

On your first visit we choose the language of the website (German, English or Arabic) based on the country you are accessing from and on your browser's language setting. The country is derived from the IP address by the hosting provider and used only for the duration of the request; we do not store it. You can change the language at any time with the language switch. The legal basis is Art. 6 (1) (f) GDPR (user-friendly presentation).

4. Cookies, local storage and consent management

On your first visit we show a consent banner. There you can accept all categories, allow only the necessary ones or make your own selection. Declining is just as easy as agreeing.

The following information is stored in your browser:

• NEXT_LOCALE (cookie, 1 year): stores the language you selected. It is only set when you change the language yourself with a language button. Strictly necessary for the service you requested (§ 25 (2) no. 2 TDDDG; Art. 6 (1) (f) GDPR).
• growli-theme (local storage, until deleted): stores your choice between the light and dark colour scheme. Strictly necessary for the service you requested (§ 25 (2) no. 2 TDDDG).
• growli-consent (local storage, 12 months): stores your consent choice so that we do not have to ask you again on every visit. Strictly necessary (§ 25 (2) no. 2 TDDDG; Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR).

We do not use any other cookies or similar technologies. The services described in sections 5 and 7 are only activated after you consent.

Withdrawal and changes: your consent is voluntary and can be withdrawn at any time with effect for the future. To do so, you can change your selection at any time via the “Cookie settings” link in the footer of the website (or the button at the end of this page). The lawfulness of processing carried out until withdrawal remains unaffected (Art. 7 (3) GDPR). You can also delete stored data in your browser at any time.

5. Audience measurement (Vercel Web Analytics and Speed Insights)

With your consent (category “Statistics”) we use Vercel Web Analytics and Vercel Speed Insights of Vercel Inc. (address see section 3.1) to understand how the website is used and to improve loading times.

The following is processed: time, page visited (URL), referrer, filtered URL parameters, browser and version, operating system and version, device type, approximate location (country, region, city) and performance metrics (e.g. loading time). The services work without cookies and without storing identifiers on your device. To tell visits apart, a hash value derived from the request is used, which is discarded after 24 hours at the latest; visitors are not recognised across pages or websites and no user profiles are created. We also count anonymous events, e.g. “contact form sent” or “click on a WhatsApp, phone or email link”, to see which offers lead to enquiries. Events are recorded without your name or message content.

The legal basis is your consent under Art. 6 (1) (a) GDPR and, insofar as information on your device is accessed, § 25 (1) TDDDG. Vercel acts as a processor. Without your consent these services are not loaded.

6. Contacting us

6.1 Contact form

If you contact us via one of the forms on this website, we process the data you enter: name, email address, selected topic and your message. In addition, your browser transmits technically necessary information; we also record the selected language and the form used. To prevent abuse, we briefly process your IP address in working memory in order to limit too many requests in a short time; it is not stored permanently for this purpose. We also use a field that is invisible to humans (honeypot) that detects automated spam entries; no cookies are set and no profiles are created.

The purpose is to process and answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry relates to a contract or pre-contractual measures, otherwise Art. 6 (1) (f) GDPR (effective handling of enquiries, spam prevention). Providing your name, email address, topic and message is necessary for us to be able to reply; without this information we cannot process the form.

Technical delivery by email: your enquiry is delivered to our mailbox via the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend processes the data on our behalf; the data processing agreement under Art. 28 GDPR forms part of Resend's terms of service and contains the EU Standard Contractual Clauses. Processing takes place mainly in the USA (see section 10).

6.2 Email and telephone

If you contact us by email or telephone, we process the data you provide (e.g. name, contact details, content of the message) to handle your request. The legal basis is Art. 6 (1) (b) or (f) GDPR.

6.3 WhatsApp

The website contains links that open the messenger WhatsApp. You only leave our website when you click the link; further communication takes place via WhatsApp (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). In particular, your phone number, your name in the messenger and the content of your messages are processed. WhatsApp messages are end-to-end encrypted; WhatsApp processes metadata according to its own terms (https://www.whatsapp.com/legal/privacy-policy-eea). Use is voluntary; you can always reach us by email, phone or form as well. The legal basis for our processing is Art. 6 (1) (b) or (f) GDPR.

7. Appointment booking via Cal.com

For free introductory calls we offer a booking calendar from the service Cal.com (Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA). The calendar is embedded in our page but only loaded once you have agreed – either via the category “External content” in the consent banner or by clicking “Load calendar”. Only then does your browser connect to the servers of Cal.com; your IP address is transmitted to Cal.com and Cal.com may store or read information on your device. According to our tests, loading the service sets a technically necessary cookie for bot protection ("__cf_bm", security provider: Cloudflare, usually valid for 30 minutes).

When you book, we and Cal.com process the data you enter: name, email address, selected appointment and, where applicable, your details about your project. Cal.com sends the appointment confirmation and reminders by email. Depending on the chosen location of the appointment (e.g. video conferencing service or phone), further providers may be involved; you will find information on this in the booking confirmation.

Legal bases: for loading the calendar Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent); for carrying out the booking Art. 6 (1) (b) GDPR (pre-contractual measures). Cal.com processes the data on our behalf; the data processing agreement (https://cal.com/dpa) forms part of Cal.com's terms of service and is supplemented by Standard Contractual Clauses. Processing takes place mainly in the USA (see section 10). Further information: https://cal.com/privacy.

8. External links and online presences

8.1 Instagram

This website contains a link to our Instagram profile. No Instagram plugins are embedded; you only leave our website when you click the link, and the operator's privacy policy then applies (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; https://privacycenter.instagram.com/policy/). For our Instagram profile we may receive statistical analyses (Insights); according to the case law of the CJEU there may be joint controllership with the operator for the data processed in this context.

8.2 Google (“Add as preferred source”) and Google Business Profile

In the footer we link to a settings page of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) where you can add our website as a preferred source. The image of the button is loaded from our own server; a connection to Google is only established when you click the link. Google's privacy policy then applies (https://policies.google.com/privacy).

We also maintain a business profile with Google (Search and Maps). If you view, rate or ask questions on this profile, Google processes your data under its own responsibility. We only process reviews you have published in order to reply to them.

8.3 References and customer testimonials

On the website we show reference projects of our clients (company name, screenshots, link and, where applicable, a customer testimonial). This is only done with their consent. Where personal data of a natural person is processed in the process (e.g. the name of a person in a quote), the legal basis is their consent (Art. 6 (1) (a) GDPR) or our legitimate interest in presenting our work (Art. 6 (1) (f) GDPR) with the client's consent. You can withdraw your consent at any time; we will then remove the reference within a reasonable period (contact: info@growli.media).

9. Fonts and images

The fonts used on this website (Inter, Montserrat and IBM Plex Sans Arabic) are delivered from our own server. No connection is made to servers of Google or other font providers. The preview images of our reference projects are also stored on our server; when our pages load, no connection is made to the clients' websites.

10. Recipients and transfers to third countries

Recipients of your data – as described above – are our service providers acting as processors: Vercel Inc. (hosting, audience measurement), Plus Five Five, Inc. (“Resend”; email delivery of the contact form) and Cal.com, Inc. (appointment booking). We have data processing agreements under Art. 28 GDPR with all three, which form part of the respective terms of service. Where we use subcontractors for projects, they only receive personal data if this is necessary for the service and are contractually bound to confidentiality and data protection. Beyond that we only pass on data if we are legally obliged to do so or you have consented.

Some of these providers are based in the USA or process data there. The USA is not generally regarded as a country with a level of data protection equivalent to that of the EU. We base the transfer on (a) the European Commission's adequacy decision on the EU-US Data Privacy Framework, insofar as the provider is certified there, and/or (b) the EU Standard Contractual Clauses contained in the data processing agreements (Art. 46 (2) (c) GDPR) and supplementary measures, and – for services you activate voluntarily – (c) your explicit consent (Art. 49 (1) (a) GDPR). There is a risk that US authorities access data without effective legal remedies being available to you. Copies of the safeguards are available on request.

11. Storage periods

• Server log files: usually a few days (see section 3.2).
• Enquiries via form, email, phone or WhatsApp: until your matter has been finally dealt with; afterwards we delete the data unless statutory retention duties apply or the data is needed to assert or defend legal claims.
• Booking data: until the appointment and follow-up; afterwards as for enquiries. At Cal.com, storage is governed by its own terms.
• If a contract is concluded, we retain contract, invoice and accounting records in accordance with the statutory periods (currently up to 6 or 8 to 10 years under § 257 HGB and § 147 AO).
• Consent choice and settings in your browser: up to 12 months or until you delete the data.

12. Your rights

You have the following rights towards us regarding your personal data:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing (Art. 21 GDPR),
• withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR).

Right to object under Art. 21 GDPR: you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on Art. 6 (1) (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal message to info@growli.media is sufficient.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, https://www.baden-wuerttemberg.datenschutz.de. You can also contact the supervisory authority of your place of habitual residence.

13. No automated decision-making, data security

There is no exclusively automated decision-making including profiling under Art. 22 GDPR.

For security reasons and to protect the transmission of confidential content, such as your enquiries, this website uses SSL/TLS encryption (recognisable by “https://” and the lock symbol in your browser). In addition we take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.

14. Changes to this privacy policy

We adapt this privacy policy when our website, the services used or the legal situation change. The current version published here applies.