Privacy Policy

This Policy explains how Percepta Growth handles personal data in a manner designed to be lawful, fair, transparent and proportionate. It applies to our public website, business development, client relationships, service delivery, events, supplier and expert relationships, and related communications.

Our core commitment: We collect only what is reasonably needed, use it for defined purposes, restrict access to authorised people, apply contractual and technical safeguards, and provide meaningful choices and rights.

This Policy is written for a global audience. Regional rights apply only where the relevant law covers the individual or processing. If a client contract, data processing agreement or project notice provides stronger protections, the stronger term will apply to that engagement.

Percepta Growth is a global growth and performance marketing firm operated by Percepta Advisory & Strategy Ltd. This Privacy Policy describes how we collect, use, disclose, store, transfer and protect information relating to an identified or identifiable person, referred to in this Policy as personal data or personal information.

This Policy applies when you:

This Policy does not govern third-party websites, advertising platforms, social networks or services that publish their own privacy notices. It also does not replace a client's own privacy notice when the client determines why and how personal data is used.

2.1 Controller for our own operations. Percepta Advisory & Strategy Ltd, operating the Percepta Growth brand, is the controller when it determines the purposes and means of processing for our website, business administration, marketing, client relationship management, supplier management and expert network operations.

2.2 Processor or service provider for client work. In many client engagements, the client determines the purpose of a campaign, audience, customer journey, analytics environment or customer relationship. In those cases, we process relevant personal data only on documented client instructions and act as a processor, service provider or contractor as those terms are defined by applicable law.

When we act for a client, requests concerning that client's data should normally be directed to the client. We will support the client as required by contract and law, including with rights requests, security incidents, deletion, return, audits and subprocessor controls.

2.3 Independent platforms. Advertising, analytics, commerce, communications and scheduling platforms may act as independent controllers for parts of their processing. Their terms and privacy notices govern those activities. We select and configure platforms with due regard to privacy, but we do not control every independent use by those providers.

The data we handle depends on how you interact with us. We may process the categories below.

Sensitive and regulated information. Our public website and qualification forms are not designed to collect special category, sensitive or highly regulated information, such as government identifiers, precise financial account credentials, health information, biometric identifiers, information about race or ethnicity, religious or philosophical beliefs, sexual orientation, or criminal records.

Do not send such information through a general inquiry form. Where a regulated engagement genuinely requires sensitive information, we will define the purpose, lawful basis, access controls, retention, contract terms and any required impact assessment before processing begins. For financial-services work, we do not use client data to make credit, insurance, employment or other eligibility decisions unless expressly authorised, legally permitted and subject to appropriate governance.

We use personal data only when we have a defined purpose and an applicable legal basis. The bases below apply where the relevant law uses these concepts. More than one basis may apply to the same processing in different circumstances.

6.1 Legitimate interests. Where we rely on legitimate interests, we assess the purpose, necessity and likely impact on individuals, including the context, reasonable expectations, safeguards and available choices. We do not rely on legitimate interests where an individual's rights and freedoms override our interests.

6.2 Consent. Where consent is required, it will be specific, informed and capable of being withdrawn. Withdrawal does not affect processing already carried out lawfully. Refusing optional cookies or marketing does not prevent access to core website content, although some optional functionality may be unavailable.

6.3 Contract and legal obligations. Some information is necessary to enter into or perform a contract, process payments, maintain records, respond to regulators or comply with tax, accounting, sanctions, anti-fraud, court or law-enforcement obligations. If required data is not provided, we may be unable to begin or continue the relevant relationship.

Our services may span growth strategy, paid media, demand generation, conversion, creative systems, analytics and performance intelligence across multiple industries. The data design for each engagement is determined by the objective, channel, client instructions, risk profile and applicable law — not by a single sector or platform.

7.1 Data roles are defined at engagement level. Before material client-data processing begins, we seek to document the parties' roles, permitted purposes, data categories, security measures, retention, subprocessors, transfer safeguards and assistance obligations. Where required, these terms are included in a data processing agreement or equivalent service-provider terms.

7.2 Audience, conversion and attribution data. Depending on the engagement, we may work with audience criteria, campaign identifiers, pseudonymous cookie or device IDs, server-side events, hashed contact lists, CRM conversion statuses, lead stages, commerce events and platform-reported metrics. We use such data to build, operate, test, measure and improve authorised campaigns and customer journeys.

7.3 Client responsibilities. Clients are responsible for the lawfulness of the data and instructions they provide, including appropriate privacy notices, cookie or tracking consent, marketing permissions, suppression lists, platform permissions and data accuracy, unless the engagement expressly assigns a responsibility to us. We may pause or decline an instruction that appears unlawful, deceptive, discriminatory, unsafe or inconsistent with contract terms.

7.4 Regulated and high-impact sectors. For financial services, fintech, healthcare-adjacent, employment, housing, education, legal or other regulated work, we apply enhanced scoping appropriate to the activity. This may include restricted audience criteria, platform-policy review, approval gates, human review, additional vendor diligence, geographic restrictions, documented claims substantiation and limits on sensitive data. Marketing performance goals do not override legal, ethical or platform obligations.

Percepta Growth assembles engagement teams from vetted specialists selected for the capabilities, sector context and seniority required by the brief. Experts may include strategists, media specialists, conversion practitioners, analysts, creatives, developers and other professionals.

Expert access is governed by the engagement and is designed around least privilege. Experts receive only the information reasonably necessary for their assigned work, are subject to confidentiality and data-protection obligations, and must follow client restrictions, approved tools, secure access requirements, retention instructions and incident-reporting procedures. Expert access is removed when it is no longer required.

Our website may use cookies, local storage, pixels, tags, software development kits, server logs and similar technologies. When required by law, non-essential technologies are disabled until you make a choice through the consent tool displayed on the website.

Cookie names, providers, purposes and durations should be shown in the live preference centre or cookie notice because they may change as the website configuration changes. Non-essential cookie lifetimes should be proportionate and generally should not exceed 13 months without a documented reason.

You can adjust the website preference tool when available and may also use browser controls. Blocking cookies may affect optional functionality. Where legally required, we recognise supported browser-based opt-out signals, including Global Privacy Control, for the browser and device that send the signal.

We may send relevant business communications to existing clients, people who request information and selected professional contacts whose roles indicate a reasonable interest in our services. We may use information supplied directly, obtained from public professional sources or received from reputable B2B providers.

We may use approved artificial intelligence and automation tools to support research, drafting, campaign analysis, creative exploration, workflow automation, quality assurance and reporting. These tools are used as aids to professional judgment, not as a substitute for accountable human oversight.

We disclose personal data only where reasonably necessary for the stated purpose, permitted by law and subject to appropriate safeguards. Recipient categories may include:

We do not sell personal information for money. If optional advertising or analytics technologies are enabled in a way that constitutes sale, sharing or targeted advertising under an applicable US state law, we provide the required notice and opt-out mechanism and honour legally required opt-out signals.

We use service providers selected for capability, reliability, privacy and security. Depending on the processing, we seek written terms covering confidentiality, documented instructions, security, incident notification, subprocessor controls, rights assistance, deletion or return, audits and international transfers. A client-specific subprocessor list may be provided under the relevant contract.

Percepta Growth serves clients and works with experts and providers across multiple countries. Personal data may therefore be accessed or stored outside the country where it was collected. Privacy laws and government access rules may differ in those locations.

Where a restricted transfer requires a safeguard, we use an appropriate mechanism, which may include:

You may request information about the transfer safeguards relevant to your data by contacting us. We may redact commercially sensitive or security information from copies where permitted.

We retain data for the shortest period reasonably necessary for the purpose, taking account of contract requirements, client instructions, legal limitation periods, tax and accounting rules, security needs, dispute resolution and the ability to demonstrate compliance. Typical periods are below unless a contract, law or documented assessment requires a different period.

At the end of the applicable period, data is deleted, securely destroyed, returned to the client or de-identified so it is no longer reasonably linkable to an individual. Backups may persist for a limited cycle and remain protected until overwritten.

We use a risk-based security programme designed to protect personal data from unauthorised access, loss, misuse, alteration or disclosure. Safeguards are selected according to sensitivity, volume, context, threat level and available technology and may include:

No transmission or storage system is completely secure. If we confirm a personal-data breach, we will act without undue delay, support affected clients and notify individuals or authorities where required by law.

Depending on where you live and the law that applies, you may have the right to:

17.1 How to exercise a right. Email hello@perceptagrowth.com with the subject line Privacy Request. Describe the right you wish to exercise and the relationship or interaction involved. We may ask for information reasonably necessary to verify identity, authority and the scope of the request. Do not send identity documents unless we specifically request a secure method.

An authorised agent may submit a request where permitted, but we may require proof of authority and direct verification with the individual. We will respond within the period required by applicable law, explain any lawful limitation and provide appeal instructions where required. We will not discriminate against you for exercising a privacy right.

17.2 Requests involving client-controlled data. If your request concerns data we process only for a client, we will normally refer the request to that client or notify the client so it can respond as controller. We will not independently alter client-controlled data unless authorised or legally required.

17.3 Direct marketing and cookie choices. You may unsubscribe from marketing at any time. You may also change optional cookie settings through the live preference tool when available. An opt-out may take a reasonable period to propagate across systems, but we will retain only the minimum suppression information needed to honour it.

The following provisions supplement the general Policy. They apply only where the relevant law covers the processing and should be read together with the rest of this document.

18.1 European Economic Area and United Kingdom. Where the EU GDPR or UK GDPR applies, we rely on the legal bases described in section 6 and provide the rights described in section 17. You may complain to the supervisory authority in the country where you live or work or where you believe an infringement occurred. Restricted transfers are addressed through the safeguards in section 14. Where required, we appoint an EU or UK representative and make the representative's contact details available to affected individuals.

Non-essential cookies and similar technologies are used only after valid consent where required by applicable e-privacy rules. Consent may be withdrawn as easily as it was given.

18.2 California and other United States privacy laws. For California residents, the categories described in section 4 correspond generally to identifiers; commercial information; internet or other electronic network activity; professional or employment-related information; geolocation at an approximate level; inferences; and, only where necessary, sensitive personal information. We collect, use, retain and disclose these categories for the business and commercial purposes described in sections 6 through 12.

We do not sell personal information for money and do not use sensitive personal information to infer characteristics about individuals. If optional advertising technology constitutes selling, sharing or targeted advertising under an applicable law, you may opt out through the displayed preference or opt-out mechanism, by sending a privacy request, or through a supported Global Privacy Control signal where legally required.

California and certain other US residents may request access, correction or deletion and may opt out of certain sale, sharing, targeted advertising or profiling. Some states provide an appeal right. Applicable exemptions may include business-to-business, employment, regulated financial, health or de-identified data, depending on the law.

18.3 Canada. Where Canadian privacy law applies, we process personal information for purposes a reasonable person would consider appropriate, obtain meaningful consent where required, limit collection and retention, protect data with safeguards appropriate to sensitivity and provide access and correction rights. Commercial electronic messages are sent in accordance with applicable consent, identification and unsubscribe requirements, including Canada's Anti-Spam Legislation where it applies.

18.4 Nigeria. Where the Nigeria Data Protection Act 2023 and related regulatory instruments apply, we process personal data on a recognised lawful basis, apply the principles of fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation and security, and support applicable data-subject rights. Complaints may be made to the Nigeria Data Protection Commission after contacting us where appropriate.

18.5 Other jurisdictions. Additional national, state or provincial rights may apply. We will honour those rights where legally required and may issue a supplemental notice for a specific service, client programme, campaign or jurisdiction.

Our website and services are directed to organisations and business professionals and are not intended for children under 16. We do not knowingly collect personal data from children through the website. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action. A higher local age threshold will apply where required.

Our website or communications may link to or embed third-party sites and services, including scheduling, social, advertising, analytics, commerce or payment platforms. Those providers may collect data under their own notices and controls. Review their terms before providing personal data. A link does not mean we are responsible for the third party's independent practices.

We may create and use aggregated or de-identified information for benchmarking, service improvement, planning, research and reporting where it cannot reasonably be linked to an individual. We maintain de-identified data in that form and do not attempt to re-identify it except where permitted to test whether de-identification controls remain effective.

We may update this Policy to reflect changes in services, technology, vendors, legal requirements or data practices. The effective and last-updated dates appear on the cover and live website. If a change materially affects how we use personal data, we will provide additional notice or seek consent where required.

Questions, rights requests and privacy complaints may be sent to the contact below. We review complaints fairly and without undue delay.

This appendix summarises the operating controls that should be reflected in client scopes, data processing agreements and internal delivery procedures. Contract terms govern if there is any conflict.

Copyright 2026 Percepta Advisory & Strategy Ltd. All rights reserved.