Privacy Policy
At DNA Growth, we respect your privacy and are committed to protecting your personal data. This policy explains what we collect, how we use it, and the rights you have over your information — across all jurisdictions where we operate, including the EU, UK, United States, Canada, India, and beyond.
Introduction & Who We Are
DNA Growth (trading as DNA Growth Global) is a global professional services firm providing outsourced finance, accounting, financial planning & analytics, strategic advisory, and technology solutions. Our registered websites are https://www.dnagrowth.com and https://www.blog.dnagrowth.com (together, the “Websites”).
We act as the data controller for personal data collected through our Websites. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over your information.
This policy applies to all visitors, prospective clients, existing clients, and anyone who interacts with our Websites or contacts us directly. It is designed to comply with applicable privacy laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA) / CPRA, Canada’s PIPEDA, and other applicable regional privacy regulations.
By using our Websites, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our Websites.
Information We Collect
Information You Provide Directly
When you contact us, request a consultation, submit an inquiry, or engage our services, we may collect:
- Full name
- Business email address
- Phone number (including country code)
- Company name and job title
- Country or region
- The content of your message or inquiry
- Any additional information you voluntarily share with us
This information is used solely to respond to your inquiry, assess how we can help your business, and — where you become a client — to fulfil our contractual obligations to you.
Information Collected Automatically
When you visit our Websites, we and our service providers automatically collect certain technical and usage data, including:
- IP address and approximate geographic location (country/city level)
- Browser type and version
- Device type and operating system
- Pages visited, time spent on each page, and navigation paths
- Referral source (how you arrived at our Website)
- Date and time of your visit
This data is collected via cookies, web beacons, and analytics tools (see Section 5). It helps us understand how our Websites are used so we can improve them.
Blog Comments (blog.dnagrowth.com)
Our blog may allow visitors to leave comments. If you submit a comment, we collect your name, email address, website (optional), the content of your comment, your IP address, and your browser user agent string. This data is used to display your comment and to help detect spam.
Your email address is not published publicly. Your submitted name and comment will be visible on the blog once approved.
Embedded Content
Our blog and website may contain embedded content from third-party platforms (for example, videos, social media posts, or interactive tools). Embedded content behaves as if you had visited those third-party websites directly — those platforms may collect data about you, set their own cookies, and track your interaction with the content, particularly if you are logged into their platform at the time.
We recommend reviewing the privacy policies of any third-party platforms whose content appears on our Websites.
How We Use Your Information
We use the personal data we collect for the following purposes:
- Responding to inquiries: To reply to messages, consultation requests, and service enquiries you send us.
- Delivering services: To fulfil contractual obligations where you or your organisation engage DNA Growth for professional services.
- Website improvement: To analyse how our Websites are used, identify issues, and enhance user experience.
- Marketing communications: To send relevant updates, insights, or promotional materials — only where you have given explicit consent or where applicable law permits it.
- Security and fraud prevention: To protect our Websites, detect suspicious activity, and prevent misuse.
- Legal and regulatory compliance: To meet obligations under applicable laws, respond to lawful requests, and enforce our terms.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
Legal Basis for Processing (GDPR — EU, UK & EEA)
If you are located in the European Union, United Kingdom, or European Economic Area, we are required under the GDPR (and UK GDPR) to identify a lawful basis for processing your personal data. We rely on the following bases:
Legitimate Interests (Article 6(1)(f))
For website analytics, security monitoring, fraud prevention, and improving our services. We have assessed that our legitimate interests are not overridden by your rights and freedoms.
Performance of a Contract (Article 6(1)(b))
Where you or your organisation have engaged DNA Growth for professional services, processing is necessary to fulfil that contract.
Consent (Article 6(1)(a))
For non-essential cookies (analytics and marketing), and for sending you marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
Legal Obligation (Article 6(1)(c))
Where processing is required to comply with applicable law, regulation, or a lawful order.
If you have questions about the specific legal basis applicable to your data, please contact us using the details in Section 12.
Who We Share Your Data With
We do not sell, rent, or trade your personal data to any third party. We may share your data in the following limited circumstances:
- Service Providers: Trusted third-party vendors who help us operate our Websites and deliver our services — such as email delivery platforms, CRM tools, analytics providers (Google Analytics), and web hosting. These providers process data only on our behalf, under contractual data processing agreements, and are not permitted to use your data for their own purposes.
- Professional Advisors: Lawyers, accountants, auditors, and insurers, where necessary in connection with our business operations.
- Legal & Regulatory Authorities: Where we are required to disclose information by law, court order, or regulatory authority — for example, to comply with anti-money laundering regulations or respond to a lawful government request.
- Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal data may be transferred as part of that transaction. We will notify affected individuals and ensure any new data controller is bound by appropriate obligations.
International Data Transfers
DNA Growth operates globally, with team members and service providers in multiple countries including the United States, India, the United Kingdom, and others. This means that your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not have the same level of data protection laws as your home jurisdiction.
Where we transfer personal data from the EU, UK, or EEA to countries that have not received an adequacy decision from the European Commission (or the UK Secretary of State), we ensure appropriate safeguards are in place, including:
- EU Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs)
- Transfers to countries covered by an adequacy decision
- Binding corporate rules, where applicable
You may request details of the specific safeguards we apply to your data transfers by contacting us at hello@dnagrowth.com.
How Long We Retain Your Data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:
| Data Type | Retention Period |
|---|---|
| Contact form submissions | Up to 3 years from last contact |
| Client engagement records | 7 years (legal / financial obligation) |
| Blog comments | Indefinitely, or until deletion is requested |
| Analytics data (Google Analytics) | 26 months (GA4 default) |
| Cookie consent preferences | 12 months from your choice |
| Security and access logs | Up to 12 months |
When data is no longer required, we securely delete or anonymise it. Where deletion is not immediately possible (for example, because data is stored in backup archives), we will isolate the data and protect it from further processing until deletion is feasible.
Your Privacy Rights
Rights Under GDPR (EU, UK & EEA Residents)
If you are located in the EU, UK, or EEA, you have the following rights under the GDPR and UK GDPR:
- Right of Access (Article 15): Request a copy of the personal data we hold about you.
- Right to Rectification (Article 16): Request that we correct inaccurate or incomplete data.
- Right to Erasure / 'Right to be Forgotten' (Article 17): Request deletion of your personal data, subject to our legal retention obligations.
- Right to Restriction of Processing (Article 18): Request that we limit how we use your data in certain circumstances.
- Right to Data Portability (Article 20): Receive a structured, machine-readable copy of data you provided to us, where technically feasible.
- Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing purposes.
- Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
- Right to Lodge a Complaint: File a complaint with your local data protection authority — for example, the UK Information Commissioner's Office (ICO) at ico.org.uk, or your EU member state's supervisory authority.
Rights Under CCPA / CPRA (California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:
- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties with whom it is shared.
- Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
- Right to Correct: Request correction of inaccurate personal information we maintain about you.
- Right to Opt-Out of Sale or Sharing: DNA Growth does not sell personal information. We do not share personal information for cross-context behavioural advertising without consent.
- Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined under CPRA (such as financial account details, government IDs, or precise geolocation) except where necessary to deliver contracted services.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
To exercise your CCPA/CPRA rights, contact us at hello@dnagrowth.com with the subject line “California Privacy Request”. We will respond within 45 days as required by law.
Rights for All Users (General)
Regardless of your location, you may at any time:
- Request access to, correction of, or deletion of your personal data
- Opt out of marketing communications by clicking the unsubscribe link in any email we send, or by emailing us directly
- Update or withdraw your cookie consent preferences via the consent banner or footer link
To submit any privacy request, email us at hello@dnagrowth.com with sufficient information to identify your request. We will respond within 30 days (or within the timeframe required by applicable law).
How We Protect Your Data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:
- HTTPS encryption across all our Websites
- Access controls limiting data access to authorised personnel only
- Regular security assessments and software updates
- Contractual data security obligations on all third-party service providers
No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. In the event of a data breach that is likely to pose a risk to your rights and freedoms, we will notify the relevant supervisory authorities and, where required, affected individuals, in accordance with applicable law.
Children's Privacy
Our Websites and services are directed exclusively at business professionals and organisations. They are not intended for, and we do not knowingly collect personal data from, individuals under the age of 16 (or 13 in jurisdictions where a lower age threshold applies, such as the United States under COPPA).
If you believe that a child under 16 has submitted personal data to us, please contact us immediately at hello@dnagrowth.com and we will take steps to delete that information promptly.
Third-Party Websites & Links
Our Websites may contain links to third-party websites, resources, or tools. These links are provided for your convenience only. Once you click a link and leave our Website, this Privacy Policy no longer applies. We have no control over the content, privacy practices, or security of third-party websites and accept no responsibility for them. We encourage you to review the privacy policy of any third-party site you visit.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the “Last Updated” date at the top of this page. For significant changes, we may also provide a more prominent notice (such as an on-site banner or an email notification to users who have provided contact details).
We encourage you to review this policy periodically. Your continued use of our Websites after any changes constitutes your acknowledgement of the updated policy.
Contact Us & Data Protection Enquiries
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data — including requests to exercise your rights — please contact us:
For EU/UK residents: if you are not satisfied with our response to a privacy request, you have the right to lodge a complaint with your local supervisory authority — for example, the UK Information Commissioner’s Office (ico.org.uk) or your EU member state’s data protection authority via edpb.europa.eu.