GDPR Compliance

When your agency uses WingGrow to handle customer leads, claims, or communications, you act as the data controller and WingGrow acts as the data processor. For our own business operations (billing, account management, marketing), WingGrow is the controller.

We rely on the following lawful bases: performance of a contract (to deliver the Services), legitimate interests (security, analytics, product improvement), consent (for marketing communications and optional cookies), and legal obligations (tax, accounting, regulatory).

Under GDPR, data subjects have the right to:

• access their personal data,
• rectify inaccurate data,
• erase data (“right to be forgotten”),
• restrict or object to processing,
• data portability,
• withdraw consent at any time,
• lodge a complaint with a supervisory authority.

If you are an end customer of a WingGrow-powered agency, please contact that agency directly. WingGrow will support the agency in fulfilling your request.

We offer a GDPR-compliant Data Processing Agreement that incorporates the EU Standard Contractual Clauses. Request a copy at dpa@wingrow.io. The DPA is automatically applicable to all paid plans.

We maintain a current list of sub-processors, including the services they provide and the regions they operate from. We notify customers before adding new sub-processors and allow reasonable objection windows.

When personal data is transferred outside the EEA/UK, we rely on adequacy decisions where available and on the EU Standard Contractual Clauses (2021/914) combined with supplementary measures such as encryption in transit and at rest.

Our technical and organizational measures include TLS 1.2+ in transit, AES-256 at rest, role-based access control, SSO and MFA, continuous monitoring, audit logs, vulnerability scanning, regular penetration testing, and an incident response process.

In the event of a personal data breach affecting customer data, WingGrow will notify affected controllers without undue delay and in any case within 72 hours of becoming aware, in accordance with Article 33 GDPR.

Customer content is retained per your workspace configuration and deleted within 90 days of account closure. Backups are cycled out within an additional 35 days.

Data Protection Officer: dpo@wingrow.io. EU Representative under Article 27 GDPR: eu-rep@wingrow.io.

You may lodge a complaint with your local data protection authority. A full list is maintained by the European Data Protection Board.