Privacy policy

Privacy contact

Growth Force SIA
Registration number: 40203383989
Registered address: Katrīnas dambis 26-6, Rīga, LV-1045, Latvia
toni@gvoima.fi

Our role

• Workspace data: when an organisation (our customer) uses SBG, it decides what data its workspace contains and who can access it. The customer is the controller of that data, and Growth Force SIA processes it on the customer's behalf under the service agreement.
• User accounts and service operation: Growth Force SIA is the controller of the data needed to run, secure and support the service.

What data we process

• User account: name, email address, organisation, role and access rights, language, password stored only as a hash, two-step verification settings, and sign-in and security events.
• Workspace content: partnership, contract, content, measurement and report information, and messages between the organisation and its partners.
• Channel statistics: metrics from connected Google Analytics 4 and Meta sources, and LinkedIn figures imported from official exports supplied by an administrator. These may include page views, visitors, impressions, reactions, comment and share counts, follower counts and aggregated audience breakdowns where available.
• Message inbox, if the organisation enables it: comments and mentions received on the organisation's own channels, including the sender's public name and the message text, so that the team can respond.
• Sales contacts, if the organisation enables them: name, role, purpose of contact and source.
• Public company information for partnership research, such as company websites and news.

Why and on what basis

We do not use personal data for advertising, marketing profiling or automated decisions with legal effects. We do not sell data.

• To provide the service under the agreement with the customer and, for workspace data, on the customer's instructions (GDPR Article 6(1)(b)).
• To keep the service secure and prevent misuse (legitimate interest, Article 6(1)(f)).
• To meet legal obligations (Article 6(1)(c)).

LinkedIn data

LinkedIn figures are currently imported from official export files supplied by the organisation's administrator. Imported Page, content and aggregated audience statistics are stored in the workspace with their source and period. An automatic LinkedIn API connection is not active in production.

SBG does not post, comment or send messages on LinkedIn, or use these figures for advertising or profiling individuals. If an API connection is enabled later, disconnecting removes the access credential stored by SBG but does not revoke the LinkedIn authorisation or delete previously imported statistics. The administrator can also revoke the authorisation in LinkedIn's settings.

Who processes data on our behalf

Channel data comes from Google, Meta and LinkedIn through services used by the organisation. These providers process data under their own privacy policies and transfer arrangements; their current details are available directly from the providers.

• Google Cloud: servers in Finland and backups in the EU.
• Google Workspace: service emails such as password resets.

How long we keep data

• Workspace data: for the duration of the customer agreement. After the agreement ends, the data is returned or deleted as agreed with the customer.
• User accounts: while the account is in use. An account is removed when the organisation removes the user or the agreement ends.
• Sales contacts: until the retention date set by the user, at most 12 months.
• Daily database backups in Google Cloud Storage: deleted at 30 days of age; soft delete keeps them recoverable for another 7 days. VM disk snapshots and local release rollback copies have separate retention practices.

Security

Encrypted connections (HTTPS), encrypted storage of channel connection credentials, role-based access rights, two-step verification, and daily backups with a tested restore.

Cookies

SBG uses only cookies that are necessary for the service: the sign-in session (valid for up to 8 hours), the selected workspace, and short-lived cookies that protect the authorisation flow when an organisation connects Google, Meta or LinkedIn. No analytics or advertising cookies are used.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. For workspace data, contact the organisation whose workspace you use, or contact us and we will forward your request.

You can lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija) or with the supervisory authority where you live or work; in Finland, the Office of the Data Protection Ombudsman.

Changes

We update this policy when the service changes. The date of the latest update is shown at the top of this page.