CCPA Compliance

CCPA — California Consumer Privacy Act

How GROW ensures compliance with the California Consumer Privacy Act

Cal. Civ. Code §1798.100 et seq. · CPPA / California AG

GROW is CCPA Compliant

Certified since April 2026

Our platform was built with Privacy by Design, embedding CCPA principles into every feature.

What is the CCPA?

The California Consumer Privacy Act (CCPA), as amended by the CPRA, is a state law that grants California residents specific rights over their personal information held by businesses.

Effective since January 2020 and expanded by the CPRA in 2023, the CCPA is enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General. It applies to qualifying businesses serving California residents.

How GROW applies the CCPA

Data minimization

We only collect data strictly necessary to provide the service.

Specific purpose

Each piece of data we collect has a clear purpose disclosed to the consumer.

Right to opt-out

You can opt out of the sale or sharing of your personal information at any time.

Consumer rights

We implement mechanisms to exercise all CCPA rights (know, delete, correct, opt-out, limit).

Accountability

We keep up-to-date records of processing activities and vendor agreements.

Data Protection Officer

We have a Privacy Officer available to handle consumer inquiries.

Legal bases for processing

We process your data based on the following grounds under the CCPA/CPRA:

Contractual necessity: To provide contracted services (scheduling, reports, team management).

Legitimate business purpose: To improve the platform and send service-related communications.

Consumer consent: For marketing communications and analytics cookies.

Legal obligation: To comply with tax and regulatory obligations.

International data transfers

Some of our service providers are located outside the United States (e.g. cloud servers, WhatsApp API). In these cases:

We require them to adopt equivalent data protection standards;
We sign Data Processing Agreements (DPAs) with all partners;
We prefer partners with ISO 27001 and SOC 2 certifications.

Incident response

In the event of a security incident involving personal data, GROW commits to:

Notify the California AG within the timeframe required by law;
Inform affected consumers when there is significant risk;
Take immediate steps to mitigate the impact;
Document the incident and actions taken.

Contact — Privacy / CCPA

For CCPA-related questions, to exercise consumer rights, or to report incidents:

Email: privacy@grow.com.br

Response time: within 45 days