UK & EU GDPR Notice

For practitioner account data (name, email, billing details, professional profile), Grovvve Ltd is the data controller under both UK GDPR and EU GDPR.

For client data entered into the platform by a practitioner, the practitioner is the data controller and Grovvve acts solely as a data processor, processing personal data only on the practitioner's documented instructions under our Data Processing Agreement (DPA), as required by Article 28 of both regimes.

We rely on the following legal bases, depending on the processing activity:

• Contract - to create your account, provide the platform, and process subscription payments
• Legitimate interests - to secure the platform, prevent fraud, and improve our service, balanced against your rights
• Legal obligation - to meet tax, accounting, and regulatory requirements
• Consent - for optional communications such as product updates, which you may withdraw at any time

Special category data (such as health information within client records) is processed by practitioners as controllers, under the lawful bases available to them (typically explicit consent or provision of healthcare, per Article 9(2) UK/EU GDPR); Grovvve processes it only as instructed under the DPA.

Personal data is primarily stored and processed within the European Union. Where processing occurs outside the UK or EU/EEA - for example via a subprocessor located elsewhere - we rely on an applicable adequacy decision or Standard Contractual Clauses (SCCs) approved by the European Commission and, for UK transfers, the UK International Data Transfer Addendum.

A current list of subprocessors and their locations is available on request at privacy@grovvve.com.

Whether you are based in the UK or EU/EEA, you have the following rights over your personal data:

• Right of access - obtain confirmation that we process your data, and a copy of it
• Right to rectification - correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") - request deletion, subject to certain exceptions
• Right to restrict processing - limit how we use your data in specific circumstances
• Right to object - object to processing based on legitimate interests or for direct marketing
• Right to data portability - receive your data in a structured, machine-readable format
• Right to withdraw consent - at any time, where processing is based on consent

To exercise any of these rights, email privacy@grovvve.com. We will respond within one month, as required by Article 12 UK/EU GDPR.