Privacy Policy
What we collect, why we collect it, how long we keep it, and what you can ask us to do with it. Written to be read rather than to be impenetrable.
Who we are
GrowAx Enterprises ("GrowAx", "we", "us") is a software house and digital growth agency registered in Lahore, Pakistan in July 2026.
- Johar Town office: 95 J-1, Block J1, Block J 1 Phase 2, Johar Town, Lahore 54600, Pakistan
- Lahore Cantt office: Office No. 1, near UBL Bank, Manzoor Colony, Harbanspura, Lahore Cantt, Pakistan
- Email: [email protected]
What we collect
We collect only what we need to answer you or deliver work you have asked for.
| Data | When | Why |
|---|---|---|
| Name, email, selected service, message | When you submit an enquiry form on this site | To respond to your enquiry and keep a record of the conversation |
| Email content and attachments | When you email us directly | To respond and to maintain a project record |
| Technical data (IP address, browser, approximate location) | Automatically, when a form is submitted | Spam prevention and rate limiting on our enquiry endpoint |
| Project data | During a client engagement | To deliver the work you have contracted us for |
We do not currently run third-party advertising or behavioural tracking scripts on this website. If that changes, this page and the cookie policy will be updated before those scripts go live.
How enquiry data is handled
Enquiries submitted through this site are sent to a serverless endpoint that validates and rate-limits the submission, then stores it in a database hosted on Supabase. Access to that database is restricted to authorised GrowAx staff and protected by row-level security policies.
Submitting an enquiry also triggers a notification to our internal admin application so that a person sees it promptly. Notification delivery uses standard web push services operated by the browser vendor.
If the enquiry endpoint is unavailable, the form falls back to composing an email in your own email client. In that case nothing is transmitted to us until you choose to send it.
Why we are allowed to process it
- To take steps at your request before entering a contract — answering an enquiry you sent us.
- To perform a contract — delivering work you have engaged us for.
- Our legitimate interests — preventing spam and abuse of our forms, and keeping business records.
- Legal obligation — where record-keeping or tax law requires it.
Where UK or EU data protection law applies to a client engagement, we will normally be acting as a data processor on your behalf, and we will enter a written data processing agreement setting out the scope, duration and security measures.
Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing.
We use a small number of service providers to operate the business, and data may be processed by them strictly to provide that service:
- Supabase — database and serverless functions hosting the enquiry endpoint.
- Email providers — for correspondence with you.
- Hosting and delivery providers — to serve this website.
- Push notification services — operated by browser vendors, to alert us to new enquiries.
We may also disclose data where we are legally required to do so.
International transfers
GrowAx is based in Pakistan. Some of the service providers listed above operate infrastructure outside Pakistan. Where we handle personal data on behalf of a client subject to UK or EU data protection law, transfer safeguards are addressed in the data processing agreement for that engagement.
How long we keep it
- Enquiries that do not become projects — retained for up to 24 months, then deleted.
- Client project records — retained for the duration of the engagement and for up to 7 years afterwards, where business and tax record-keeping requires it.
- Technical spam-prevention data — retained for a short period only, typically measured in days.
- Client project data we process on your behalf — retained and deleted according to the terms of your engagement.
Your rights
You can ask us to:
- Tell you what personal data we hold about you.
- Correct anything that is inaccurate.
- Delete your data, where we are not required to keep it.
- Stop using your data for a particular purpose.
- Provide a copy of data you gave us, in a portable format.
Email [email protected] with your request. We will respond within 30 days. We may ask you to confirm your identity first, so that we do not disclose someone else's data to the wrong person.
Security
We take reasonable technical and organisational measures to protect personal data: encrypted connections, access restricted to staff who need it, database-level access policies, and no storage of credentials or payment card details on this website.
No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and any relevant authority as required.
Children
This website and our services are intended for businesses. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.
Changes to this policy
We update this page when our practices change. The date at the top of the page shows when it was last revised. Material changes affecting existing clients will be communicated directly rather than only posted here.
Questions about this policy: [email protected].
Question about any of this?
Email us and a person will answer — these pages are meant to be readable, not defensive.