GDPR Policy

Last Updated: July 1, 2026

1. Data Controller Information

For the purposes of GDPR, the data controller is:

• Company Name: Local Growth Labs AI
• Address: Narayanganj, Dhaka Division, Bangladesh
• Email: [email protected]
• Website: www.localgrowthlab.ai

If you are located in the EEA or UK and wish to raise a GDPR-related concern, please contact us at the above email address. We aim to respond to all GDPR requests within 30 days.

2. Legal Basis for Processing Personal Data

We process personal data on the following legal bases under Article 6 of the GDPR:

Legal Basis	Purpose
Contract	Providing services, managing accounts, issuing invoices
Legitimate Interests	Website analytics, fraud prevention, service improvement
Consent	Marketing emails, newsletters, optional cookies
Legal Obligation	Compliance with accounting, tax, and regulatory requirements

3. Categories of Personal Data We Process

We may process the following categories of personal data about EEA/UK individuals:

• Identity Data: Name, job title, company name
• Contact Data: Email address, phone number, business address
• Financial Data: Invoice and payment information (processed via secure payment processors)
• Technical Data: IP address, browser type, cookies, device information
• Usage Data: Website interaction data, page views, session duration
• Marketing Preferences: Communication opt-ins and opt-outs

We do not knowingly process special categories of personal data (as defined in Article 9 of the GDPR).

4. Your Rights Under GDPR

If you are located in the EEA or UK, you have the following rights regarding your personal data:

To exercise any of these rights, please email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

5. International Data Transfers

As a Bangladesh-based company, any transfer of EEA/UK personal data outside the EEA/UK is conducted with appropriate safeguards in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements (DPAs) with all third-party processors
• Use of GDPR-compliant third-party services (Google Workspace, cloud platforms, etc.)

6. Data Retention Under GDPR

We retain personal data only for as long as necessary for the purpose it was collected and in accordance with our legal obligations. Specifically:

• Client service data: Duration of engagement + 5 years
• Contractual records: 7 years for legal and accounting purposes
• Consent records: Until consent is withdrawn + 3 years
• Anonymised analytics: Retained indefinitely

7. Data Breach Procedures

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Inform affected individuals without undue delay where the breach is likely to result in high risk
• Document all breaches in our internal breach register, regardless of whether notification is required

8. Third-Party Data Processors

We work with third-party data processors to deliver our services. All processors are assessed for GDPR compliance and bound by Data Processing Agreements. Key processors include:

• Cloud hosting and storage providers
• Email and communication platforms
• Payment processing services
• Analytics and reporting tools (e.g., Google Analytics)
• Advertising platforms (Google, Meta)