1. Introduction
This Privacy Policy explains how Therapist Grow ("we", "us", "our") collects, uses, stores, transfers, and protects the personal data of visitors, subscribers, members of our community, and (in the future) customers ("you", "your") from across Europe.
We are a Belgian-established business serving an international audience. We are committed to processing your personal data in a transparent, lawful, and ethical manner, in accordance with all applicable laws, including:

Regulation (EU) 2016/679 of 27 April 2016 (the "EU GDPR");
The Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data;
The Belgian Act of 13 June 2005 on electronic communications and applicable national implementations of the ePrivacy Directive 2002/58/EC;
For visitors, subscribers, or customers located in the United Kingdom, the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018;
For visitors, subscribers, or customers located in Switzerland, the revised Swiss Federal Act on Data Protection of 25 September 2020 (the "revised FADP", in force since 1 September 2023);
For visitors, subscribers, or customers located elsewhere in the European Economic Area ("EEA"), the relevant national implementations of the GDPR.

Because our audience is composed of helping professionals who themselves operate under strict confidentiality and data protection standards, we hold ourselves to a high standard of care.

2. Data Controller
The data controller responsible for your personal data is:

Therapist Grow
Rue du Parc 33, 4020 Liège, Belgium
dylan@therapistgrow.com

We have not appointed a Data Protection Officer (DPO) as we are not legally required to do so under Article 37 GDPR. You may contact us directly at the email above for any data protection question.
Lead Supervisory Authority: Because we are established in Belgium and process personal data of individuals across the EU, our lead supervisory authority under the GDPR's "one-stop-shop" mechanism is the Belgian Data Protection Authority (see Section 14).
EU/UK Representative: Not applicable. We are established in the EU; under Article 27 GDPR, no EU representative is required. We have not appointed a UK representative under Article 27 UK GDPR as our processing of UK residents' data is currently limited and we do not believe it triggers a representative requirement under the ICO's guidance. We will reassess this position when we expand our paid services to the UK market.
Swiss Representative: Not applicable at this time. Should our processing of personal data of individuals in Switzerland reach a level requiring representation under Article 14 of the revised FADP, we will appoint a representative and update this Policy accordingly.

3. Geographic Scope
This Policy applies to personal data we process about individuals located anywhere, with specific safeguards for individuals in:

The European Union and EEA (the 27 EU Member States plus Iceland, Liechtenstein, and Norway), in particular France, Germany, the Netherlands, Spain, Ireland, Italy, Luxembourg, Belgium, and our planned future markets;
The United Kingdom;
Switzerland.

Where you are located in a different country, we still apply the protections of this Policy as a baseline.

4. Scope of this Policy
This Policy applies to personal data we collect when you:

Visit our website [TO CONFIRM: insert domain, e.g. www.therapistgrow.com] or any of its subdomains;
Subscribe to a newsletter, lead magnet, free training, masterclass, or any other free resource;
Join our free Facebook group "Therapist Café" (in respect of data we control — see Section 7);
Communicate with us by email, contact form, or social media;
Interact with our content, ads, or tracking technologies on platforms where we have a presence;
(In the future) purchase one of our paid programs, products, or services.

This Policy does not apply to third-party platforms (e.g. Meta/Facebook, Instagram, YouTube, Google, LinkedIn), which operate under their own privacy policies. We encourage you to review them.

5. Categories of Personal Data We Collect
We only collect data that is necessary, relevant, and proportionate to the purposes described below.

5.1 Data you provide directly

Identification data: first name, last name (when provided);
Contact data: email address, occasionally telephone number;
Country of residence / professional practice (for relevant tailoring of content and, in the future, VAT and consumer rights determination);
Professional data (if voluntarily shared): profession, modality, type of clientele, professional body memberships;
Communication content: messages, replies, questions, feedback;
Marketing preferences and engagement signals: topics of interest, lead magnets downloaded, links clicked, replies sent.

5.2 Data collected automatically
When you visit our website, we may automatically collect:

Technical data: IP address (anonymised where possible), browser type and version, operating system, device type, language settings, time zone;
Usage data: pages visited, time spent, click paths, referring URL, date/time;
Cookie and tracking data: see our Cookie Policy in Section 11.

5.3 Data we will collect in the future (when paid services launch)
When you purchase a paid program or service, we will additionally collect:

Billing and tax data: billing name, billing address, country of residence (for VAT determination), VAT number (for B2B customers), professional status (consumer or professional);
Payment data: processed by our payment processor (we do not store full card details);
Order history, invoices, and access credentials to the program platform.

5.4 Data we do not intentionally collect
We do not intentionally collect special categories of personal data under Article 9 GDPR (such as health data, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, biometric or genetic data). Please do not share such information with us through forms, emails, or our Facebook group.
If you choose to disclose such information voluntarily, we will treat it with appropriate care but strongly discourage you from doing so.

6. Purposes and Legal Bases for Processing
Under Article 6 GDPR (and equivalent provisions of the UK GDPR and the revised FADP), we process your personal data only when we have a lawful basis. The table below sets out the purposes and corresponding legal bases:
PurposeCategories of dataLegal basis (Art. 6 GDPR)Delivering the lead magnet or free resource you requestedEmail, name (if provided), countryPre-contractual / contractual measure (Art. 6(1)(b)) and/or your consent (Art. 6(1)(a))Sending educational emails, newsletters, and marketing communications about Therapist GrowEmail, name, preferences, engagementYour consent (Art. 6(1)(a)), freely given when you subscribedResponding to your enquiries and providing supportEmail, name, communication contentLegitimate interest (Art. 6(1)(f)) and/or pre-contractual measures (Art. 6(1)(b))Operating, securing, and improving our websiteTechnical and usage dataLegitimate interest (Art. 6(1)(f))Analysing audience and improving content (analytics)Usage and cookie dataYour consent (Art. 6(1)(a)) for non-essential cookiesRunning and measuring advertising campaigns (e.g. Meta, Google, LinkedIn Ads)Cookie/pixel data, audience signalsYour consent (Art. 6(1)(a)) for non-essential cookies and trackingProcessing future purchases, orders, and customer supportIdentification, contact, billing, paymentPerformance of a contract (Art. 6(1)(b))Issuing invoices, complying with tax, accounting, and consumer-law obligationsBilling, contact, order dataLegal obligation (Art. 6(1)(c))Establishing, exercising, or defending legal claimsAny relevant dataLegitimate interest (Art. 6(1)(f)) and/or legal obligation
You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. See Section 12.

7. Joint Controllership — Facebook Group "Therapist Café"
If you join our free Facebook group "Therapist Café":

The group is hosted by Meta Platforms Ireland Limited ("Meta"), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Meta and Therapist Grow act as joint controllers for certain processing within the group, in particular for "Page Insights" and aggregated analytics, in line with the Wirtschaftsakademie judgment of the Court of Justice of the European Union (Case C-210/16) and Meta's Page Controller Addendum.
Meta processes a significant amount of data about you (including via cookies, pixels, and platform telemetry) under its own policies, which we cannot control.
We can see public profile data of group members, content posted in the group, and aggregated insights provided by Meta.
We use this data only to moderate the group, foster community, and improve our content. We do not export or sell this data.

We strongly encourage you to review:

Meta's Privacy Policy: https://www.facebook.com/policy.php
Meta's Page Controller Addendum: https://www.facebook.com/legal/terms/page_controller_addendum

For requests relating exclusively to Meta's processing, please contact Meta directly. For requests relating to our role as joint controller, contact us at the email in Section 2.

8. Recipients and Sharing of Your Data
We do not sell your personal data. We do not rent your contact list to third parties.
8.1 Processors acting on our behalf
We use carefully selected service providers ("data processors") who process personal data only on our documented instructions, under written agreements compliant with Article 28 GDPR. These include:

Website and funnel platform (hosting, landing pages, lead capture forms, and, in the future, checkout pages): Etison, LLC dba ClickFunnels, [TO CONFIRM exact address from your ClickFunnels account — typically 3443 W Bavaria St, Eagle, Idaho 83616, USA], United States. ClickFunnels processes personal data only on our documented instructions, under its Data Processing Addendum available at https://www.clickfunnels.com/dpa, which incorporates the European Commission's Standard Contractual Clauses and, where applicable, the UK Addendum;
Email marketing platform: [TO CONFIRM: e.g. Kit / ConvertKit / MailerLite / ActiveCampaign — name + country];
Analytics provider: [TO CONFIRM: e.g. Google Analytics 4, Plausible, Fathom, Matomo];
Advertising platforms (where we run ads): Meta Platforms Ireland Limited, [TO CONFIRM: Google, LinkedIn, etc.];
Form and lead capture tools: [TO CONFIRM];
Customer support / CRM tools: [TO CONFIRM];
Payment processors (when paid offers launch): [TO CONFIRM: e.g. Stripe Payments Europe Ltd. (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)];
Course delivery platform (when paid offers launch): [TO CONFIRM: e.g. Kajabi, Teachable, Thrivecart, Circle, Skool].

8.2 Other recipients

Professional advisors: lawyers, accountants, auditors, where strictly necessary and bound by confidentiality;
Public authorities: where required by law (e.g. tax authorities, courts, regulators in the EU, UK, or Switzerland);
Successors: in the event of a merger, acquisition, or business transfer, your data may be transferred to the acquirer, subject to the same protections as set out here.


9. International Data Transfers
Some of our processors may be located outside the EEA, in particular in the United States, the United Kingdom, or other third countries.
When personal data is transferred outside the EEA, we ensure appropriate safeguards under Articles 44–49 GDPR, including one or more of the following:

Adequacy decisions of the European Commission (e.g. EU–U.S. Data Privacy Framework where the recipient is certified, UK adequacy decision, Swiss adequacy decision);
Standard Contractual Clauses ("SCCs") adopted by the European Commission, supplemented where necessary by additional technical and organisational measures (encryption, pseudonymisation, access controls);
Your explicit consent, where appropriate and after being informed of the possible risks (Art. 49(1)(a) GDPR).

For transfers from the United Kingdom, we use the UK International Data Transfer Agreement ("IDTA") or the UK Addendum to the EU SCCs.
For transfers from Switzerland, we rely on the Swiss FDPIC-recognised SCCs (with the "Swiss amendments") or the Swiss–U.S. Data Privacy Framework where applicable.
Specific notice — ClickFunnels (United States). Our website and lead capture pages are hosted by Etison, LLC dba ClickFunnels, a U.S.-based provider. This means that when you visit our pages or submit a form, certain personal data (e.g. IP address, browser data, form submissions) is transferred to and processed in the United States. We rely on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) incorporated into ClickFunnels' Data Processing Addendum (https://www.clickfunnels.com/dpa), supplemented by appropriate technical and organisational measures (HTTPS/TLS encryption in transit, access controls, contractual restrictions on onward transfers). For data of UK or Swiss residents, we additionally rely on the UK Addendum to the EU SCCs and the Swiss amendments respectively. You may request a copy of the safeguards in place at any time.
You may request a copy of the safeguards in place by contacting us at the email in Section 2.

10. Data Retention
We retain personal data only as long as necessary for the purposes for which it was collected, or to comply with legal obligations.
Type of dataRetention periodNewsletter / marketing email subscribersWhile you remain subscribed, plus up to 3 years of inactivity (no opens / no clicks)Lead magnet email capturesSame as aboveEmail correspondenceUp to 3 years after the last interaction, unless a longer period is requiredWebsite analytics (cookie-based)Generally up to 13 months for non-essential analytics cookies, in line with EDPB guidance and CNIL recommendationsCustomer / order data (when paid offers launch)For the duration of the contract, plus up to 5 years for civil liability claims (Art. 2262bis Belgian Civil Code)Accounting and tax records (when paid offers launch)7 years under Belgian tax law (Art. 315 CIR/WIB), or longer where required by the customer's country (e.g. 10 years in some jurisdictions)Data needed to defend legal claimsUntil the relevant statute of limitations expires
After these periods, data is securely deleted or irreversibly anonymised.

11. Cookies and Tracking Technologies
11.1 What are cookies?
Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device, store preferences, and collect statistical or behavioural information.
11.2 Categories of cookies we may use

Strictly necessary cookies — required for the website to function (session, security, load balancing). These do not require your consent.
Functional cookies — remember preferences (language, display). Set with your consent.
Analytics cookies — measure traffic and usage. Set only with your consent.
Marketing / advertising cookies — including Meta Pixel, Google Ads tags, LinkedIn Insight Tag, and similar technologies. Set only with your consent.

11.3 Your control over cookies
When you first visit our website, a cookie banner allows you to accept, refuse, or customise cookies. You can change your preferences at any time via the "Cookie settings" link in the footer.
You can also block or delete cookies through your browser settings. Disabling strictly necessary cookies may impair the functionality of the website.
For per-cookie details (name, purpose, duration, provider), please consult our cookie banner / settings panel.

12. Your Rights as a Data Subject
Under the GDPR, the UK GDPR, and the revised Swiss FADP, you have the following rights:

Right of access (Art. 15 GDPR / Art. 25 FADP);
Right to rectification (Art. 16 GDPR / Art. 32 FADP);
Right to erasure / "right to be forgotten" (Art. 17 GDPR);
Right to restriction of processing (Art. 18 GDPR);
Right to data portability (Art. 20 GDPR / Art. 28 FADP);
Right to object (Art. 21 GDPR), including an absolute right to object to direct marketing;
Right to withdraw consent at any time (Art. 7(3) GDPR), without affecting prior lawfulness;
Right not to be subject to automated decision-making with legal or similarly significant effects (Art. 22 GDPR / Art. 21 FADP);
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR — see Section 14).

How to exercise your rights
Email us at [TO CONFIRM: privacy@therapistgrow.com]. We respond within one (1) month under the GDPR/UK GDPR (extendable by two months for complex requests, Art. 12(3) GDPR), and within 30 days under the revised Swiss FADP.
We may need to verify your identity. There is no fee unless requests are manifestly unfounded or excessive (Art. 12(5) GDPR).
Easy unsubscribe
You can unsubscribe from any marketing email at any time via the link at the bottom of every email. This immediately stops all marketing communications.

13. Security of Your Personal Data
We implement appropriate technical and organisational measures to protect your personal data (Art. 32 GDPR), including:

HTTPS encryption on our website;
Strong passwords and two-factor authentication on internal systems;
Limited and role-based access to personal data;
Carefully selected processors with documented security practices;
Regular review of our data handling practices.

In the unlikely event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority within 72 hours (Art. 33 GDPR) and, where required, the affected individuals (Art. 34 GDPR). Where the breach concerns UK residents, we will also notify the ICO, and where it concerns Swiss residents, the FDPIC as soon as possible (Art. 24 revised FADP).

14. Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority. Our lead authority under the GDPR one-stop-shop is the Belgian DPA. You may also complain to the authority of your country of residence, your place of work, or the place of the alleged infringement.
Lead authority — Belgium:

Autorité de Protection des Données / Gegevensbeschermingsautoriteit (APD/GBA)
Rue de la Presse 35, 1000 Brussels, Belgium
Tel.: +32 (0)2 274 48 00 — Email: contact@apd-gba.be — Web: https://www.dataprotectionauthority.be

Other authorities for our main markets:

France: Commission Nationale de l'Informatique et des Libertés (CNIL) — https://www.cnil.fr
Germany: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI) and the relevant Land DPAs — https://www.bfdi.bund.de
Netherlands: Autoriteit Persoonsgegevens (AP) — https://autoriteitpersoonsgegevens.nl
Spain: Agencia Española de Protección de Datos (AEPD) — https://www.aepd.es
Ireland: Data Protection Commission (DPC) — https://www.dataprotection.ie
Italy: Garante per la protezione dei dati personali — https://www.garanteprivacy.it
Luxembourg: Commission nationale pour la protection des données (CNPD) — https://cnpd.public.lu
United Kingdom: Information Commissioner's Office (ICO) — https://ico.org.uk
Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — https://www.edoeb.admin.ch

We do, however, encourage you to contact us first so we can try to resolve any concern directly.

15. Children
Our website, content, and services are intended exclusively for professionals aged 18 and over. We do not knowingly collect personal data from children under 16 (or under 13 in the UK; under 16 in Switzerland for the revised FADP). If you believe a child has provided us with personal data, please contact us so we can delete it.

16. Specific Information for UK Residents (UK GDPR)
If you are located in the UK, the UK GDPR applies to our processing of your personal data. Our practices described in this Policy reflect both the EU GDPR and the UK GDPR, which are substantively similar. The terms "supervisory authority" should be read as referring to the Information Commissioner's Office (ICO) for UK-related complaints. References to EU-level mechanisms (e.g. EU SCCs) are read in conjunction with their UK counterparts (e.g. the IDTA or UK Addendum) where applicable.

17. Specific Information for Swiss Residents (revised FADP)
If you are located in Switzerland, the revised Swiss FADP (in force since 1 September 2023) applies. Your rights are substantively similar to those under the GDPR but are exercised under Swiss procedural rules. Complaints may be addressed to the Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch. Cross-border transfers from Switzerland to third countries follow the FDPIC's list of countries with adequate protection and use Swiss-amended SCCs where adequacy is not granted.

18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other reasons. The "Last updated" date at the top will indicate when the policy was last revised.
For material changes, we will provide reasonable notice (e.g. by email or a banner on the website) before the changes take effect.

19. Language
This Privacy Policy is published in English. We may publish translations into French, Dutch, German, Spanish, Italian, or other languages for the convenience of our European audience. In the event of a conflict of interpretation, [TO CONFIRM: the English version / the French version] shall prevail, except where mandatory local law requires the local-language version to prevail (in which case, that version shall apply for residents of the relevant jurisdiction).

20. Contact
For any question, concern, or request regarding this Privacy Policy or your personal data:

Therapist Grow
Rue du Parc 33, 4020 Liege, Belgium
Email: dylan@therapistgrow.com

We aim to respond to all data protection enquiries promptly and respectfully.

​This Privacy Policy is governed by Belgian law, without prejudice to the mandatory protections of the law of your country of residence within the EU/EEA, the UK, or Switzerland.