Privacy policy

1.1. Who we are.

1.2. What this document is.

1.3. To whom and when it applies.

1.4. Through which channels we receive data.

1.5. How this Policy relates to other gro.now documents.

• The User Agreement;
• The Cookie Policy;
• separate consents for data processing.

If documents conflict regarding the processing of your data, a simple principle applies:

1. special consents and the rules of a specific activity take precedence;
2. then this Policy;
3. for all other matters of service use, the User Agreement applies.

1.6. Where and for whom this Policy applies.

1.7. What is not covered here.

1.8. Current version.

2.1. To avoid confusion, below we briefly explain the key terms found in the Policy and activity rules:

• Respondent — you, the individual participating in activities on gro.now.
• Activity – any participation scenario on the gro.now platform (survey, research, test, contest, prize draw, game, referral mechanic, etc.) that includes a description of conditions, deadlines, and, if applicable, reward rules. Activities may be online or include offline steps (e.g., a visit to a point of sale) if specified in the rules.
• Platform (gro.now) – our website, personal account, chatbots, forms, e-mail newsletters, and other technical tools through which you participate in activities.
• Account - your user account on gro.now. Through it, we know it's you and can credit rewards/points, send status updates, and assist with support.
• Reward – what you can receive for participation: money, certificates, gifts, mobile top-ups, discount codes, etc. The specific type is indicated in the activity rules. Cash payments may require your identification and accounting for legal purposes.
• Points - an internal accounting unit on gro.now. They are not money. The rules for their accrual, expiration, and exchange (if provided) are specified in the User Agreement.
• Verification — a request for additional data/documents from you (e.g., IIN, photo ID) if needed for payments, security, or by law. We only request what is genuinely necessary.

2.2. Data and technologies (what we are talking about)

• Personal Data (PD) — any information about you as a person that allows for your identification (e.g., email address, survey answers linked to your account, payment details, etc.).
• Anonymized Data – data from which identifiers have been removed (it's impossible to tell that it's you).
• Aggregated Data — summary statistics about groups of users (e.g., "70% of participants chose option A").
• Cookies and SDKs – small files and software modules that help the platform work more stably, faster, and more conveniently. More details are in the Cookie Policy.

2.3. Roles in data processing (who is responsible for what)

• Data Controller — the organization that decides "why" and "how" your personal data is processed. By default, the controller for the Platform's operation is LLP "Gro.now" (gro.now).
• Partner - the company that commissions a study or conducts an activity jointly with us (sometimes called the "Client" or "Sponsor").
• Activity Organizer – the one responsible for a specific activity. This can be us (gro.now) or a Partner (client/research commissioner). The organizer is always specified in the activity card or rules.
• If the organizer is gro.now, we act as the data controller for that activity.
• If the organizer is a Partner, the Partner may have its own role as a controller—in that case, gro.now processes data on the Partner's instructions as a processor. This is explicitly stated in the activity rules.
• Processor - a company that processes data on behalf of the controller (e.g., gro.now for a Partner, cloud hosting, newsletter service, anti-fraud service).
• Sub-processor – a processor's assistant (e.g., data center, email service). We engage them only when necessary and with protection for your data.
• Payment Partner – a bank, payment provider/aggregator, mobile operator, etc., through which payments or rewards are issued.
• Tax Agent – who by law withholds and/or reports taxes on cash payments (sometimes it's us, sometimes a payment partner; details are in the activity rules).

3.1. Who is responsible for your data

3.2. When the Partner is the controller

• The Partner is the controller of your data for that activity;
• gro.now is the processor and operates strictly according to the Partner's instructions;

In the activity card/rules, we explicitly state who the controller is and how to contact them.

3.3. Our assistants (processors and sub-processors)

3.4. Where these rules apply (applicable law)

3.5. Language of the document

3.6. How to contact us about data matters

4.1. On what basis we process data.

• performance of the User Agreement/activity rules;
• your consent;
• compliance with legal requirements (accounting, taxes, AML at payment partners);
• our legitimate interest (ensuring security, anti-fraud, protecting the rights and the service) - within the limits permitted by applicable law.

4.2. When explicit consent is required.

• marketing communications;
• non-essential cookies/SDKs;
• processing of special categories of data (if requested);
• cases directly specified in the activity interface.

In all other permissible cases, the Respondent's participation and actions are considered as providing the Consent necessary for conducting the activity and providing the service.

4.3. How we obtain consent.

• Web/application: checking a checkbox/toggle or clicking "Agree/Accept/Participate/Continue"; submitting a form/questionnaire; authorization/registration; continuing to use after displaying a notification with a link to the Policy and a clear phrase about consent.
• Messengers/bots: clicking "Start/Accept/Participate/Rate/Leave feedback"; sending the first message/reply after a bot message containing a link to the Policy and a brief consent formula; selecting a button within a scenario.
• QR/email/other channels: scanning a QR code and sending the first reply/form; following a personal link and submitting replies; confirming via a code in an e-mail/SMS.

4.4. Logging of consents.

4.5. Form of confirmation.

4.6. Minimizing bureaucracy.

5.1. General principle.

5.2. What operations we perform with data:

• collection (obtaining and systematizing);
• storage;
• alteration/amendment (updating, correction);
• use (application for participation/payments/support);
• dissemination (provision to a limited circle of recipients – partners/payment providers/contractors – only when necessary and on the basis of a contract/law);
• anonymization (removal of identifiers for analytics);
• blocking (temporary suspension of operations, e.g., during a dispute/incident check);
• destruction (irreversible deletion after expiration of terms or by legal requirements).

5.3. Account and identification data.

6.1. Who is considered a minor

7.1. Basic principles

• We only transfer what is essential for the service or a specific activity to function.
• By default, the partner-organizer receives anonymized/aggregated statistics. Personal data is transferred only if it is explicitly stated in the activity rules and on a legal basis (usually by contract/your consent).
• We enter into data protection agreements with all contractors and verify their security measures.

8.1. Why transfer abroad may be necessary

9.1. What they are

10.1. Our approach to data protection.

11.1. Your rights

• Access and copy. To find out if we process your data, get a list of it, and a copy in an intelligible form.
• Correction. To ask to correct inaccurate or incomplete data.
• Deletion. To ask to delete data if it is no longer needed for the purposes of processing, you have withdrawn consent, you object to processing on the basis of "legitimate interest," or the processing was unlawful.
• Restriction. To temporarily "freeze" some operations (except storage), for example, while we verify the accuracy of the data or the lawfulness of the processing.
• Objection. To object to processing based on "legitimate interest" (e.g., certain analytics/anti-fraud metrics, if applicable to your case).
• Portability. To receive the data you provided to us in a machine-readable format and/or transfer it to another controller—if it is technically feasible and does not violate the rights of others.
• Withdrawal of consent. To withdraw consent at any time (e.g., for marketing communications or non-essential cookies/SDKs). The withdrawal is effective for the future.
• Communication settings. To unsubscribe from marketing messages (via a link in the email/in your account), leaving only transactional notifications.
• Complaint. To file a complaint with us and/or the authorized body for the protection of personal data, as well as in court.

12.1. Types of messages

• Transactional – the service won't work without them: login/confirmation codes, participation and accrual/payment statuses, important security messages, critical changes to terms, system notifications about technical work. Basis: performance of the user agreement.
• Operational service-related — useful reminders related to an activity (e.g., "you haven't finished the survey") and messages about available account functions. Basis: performance of the user agreement.
• Marketing — news about activities, programs, referral mechanics. We send them only with your consent (opt-in) and with the option to unsubscribe instantly.

13.1. Why and when we update