Version: v2026-11a
Effective Date: November 2026

This Privacy Policy describes how e2grow d.o.o. (“e2grow”, “we”, “us”, or “our”) collects, uses, stores, and protects your personal information when you visit our website, use our software-as-a-service platform, or otherwise interact with us.
We are committed to protecting your privacy and processing your data in accordance with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the ISO 27001 Information Security Standard, and other applicable laws and standards.

1. Overview and Scope

This Privacy Policy applies to:

• Website visitors, marketing contacts and event participants – individuals visiting our website, subscribing to communications, or attending webinars and other e2grow events.
• e2grow users not belonging to an organization – individuals using e2grow independently.
• Organizational users – employees or members of an organization that provides them with access to e2grow.

The e2grow service covered by this Privacy Policy includes the e2grow web and mobile apps, the e2grow - Strengths at Work app for Microsoft Teams and Microsoft 365 (including its agent for Microsoft 365 Copilot), the e2grow add-in for Microsoft Outlook, and e2grow connectors for other AI assistants.

If your organization provides you with access to e2grow, your organization acts as the data controller for the data you enter or that is created in your use of the Service. Please direct privacy inquiries or data-rights requests to your organization’s administrator.

For information on how e2grow processes customer and user data as a data processor, see our Data Processing Agreement (DPA) at https://www.e2grow.com/home/dpa/1.

For account administration, billing, security logs and aggregated usage analytics, e2grow acts as an independent controller. We use usage analytics only to operate, secure and improve the Service.

The Service is not directed to individuals under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@e2grow.com and we will promptly delete it.

2. What Information We Collect

2.1 Information You Provide to Us

We collect personal information that you voluntarily provide when interacting with our Service or contacting us, including:

• Contact details (name, email address, phone number, language preference).
• Employment-related details (organization, title, department, role).
• Account credentials and profile information.
• Feedback, reflections and content you enter into e2grow.
• Communications between you and e2grow (support requests, feedback, messages).
• Data imported from integrations such as Microsoft 365 or HR systems (if enabled by your organization).
• Billing or subscription information (for paying customers).

2.2 Information Collected Automatically

When you visit our websites or use our applications, we automatically collect certain information to ensure functionality and security, such as:

• Device, browser and operating system information.
• IP address and general location (city/country).
• Log data (access times, feature usage, system performance).
• Cookie data and session identifiers (see our Cookie Policy for details).

You can control cookies through your browser settings and opt out of non-essential cookies at any time.

3. How We Use Your Personal Information

We process your personal information to:

• Provide, maintain and improve the e2grow platform.
• Manage accounts, authentication and access control.
• Deliver feedback, insights and team analytics to users and organizations.
• Provide customer support and respond to inquiries.
• Send service-related notifications (e.g. updates, outages, security alerts).
• Analyze usage and improve user experience.
• Detect, prevent and investigate security incidents or misuse.
• Send marketing communications (only with your consent).
• Comply with legal obligations or enforce our Terms of Service.

We never sell personal data and do not engage in automated decision-making that produces legal or similarly significant effects. We will not discriminate against you for exercising your CCPA/CPRA rights (e.g. denying services, charging different prices, or providing a different level or quality of services).

4. Legal Bases for Processing

Under Article 6 GDPR, we process personal data based on:

• Contract performance – to deliver and support the Service.
• Legitimate interests – to ensure security, prevent abuse and improve our platform.
• Consent – for marketing communications or optional AI features.
• Legal obligation – where required by law.

You may withdraw your consent at any time by contacting privacy@e2grow.com.

5. Data Sharing and Subprocessors

We share data only as necessary to operate the Service and under appropriate safeguards:

• Service providers and subprocessors – hosting, analytics, email delivery, customer support, IT infrastructure and AI model providers (see Section 8).
• Third-party integrations (e.g. Microsoft 365) – data flow controlled by your organization’s settings.
• Legal authorities – where disclosure is required by law.

All subprocessors operate under written data-protection agreements compliant with Article 28 GDPR.
A current list is available in our Data Processing Agreement (DPA).

6. Data Retention

Data are retained according to our Data Processing Agreement (DPA).

You may request deletion at any time via privacy@e2grow.com.

Archived versions of this Privacy Policy and data-retention records are maintained in accordance with ISO 27001 requirements.

7. Data Security

We maintain a comprehensive information-security management system certified to ISO/IEC 27001, including:

• Encryption of data in transit and at rest.
• Role-based access controls and multi-factor authentication.
• Continuous monitoring and vulnerability management.
• Formal incident and breach-response procedures.

In the event of a personal data breach, e2grow will notify affected customers without undue delay and provide the information required by Article 33(3) GDPR.

Upon reasonable request and under NDA, we can provide certificates evidencing our ISO 27001 certification and key security controls.

8. AI and Automated Features

The e2grow platform may include AI-assisted features that help users reflect, give feedback or identify patterns in team dynamics.
These features are advisory only and do not produce legal or significant personal effects.

e2grow never uses Customer Content to train, fine-tune or otherwise improve any AI or machine learning models, whether our own or those of third parties.

Where AI-assisted features generate insights within the platform, only the minimum necessary data is processed: pseudonymized strengths profiles, without names, email addresses or other direct identifiers. This processing is carried out through OpenRouter, Inc., using OpenAI and Anthropic models, under contractual commitments that prohibit model training and ensure zero data retention. These providers are listed in Annex F of the DPA.

9. Microsoft 365, Copilot and Other AI Assistants

e2grow - Strengths at Work is e2grow’s app for Microsoft Teams and Microsoft 365. Users sign in with their Microsoft work account (Microsoft Entra ID), and we receive their identifiers and basic profile to match them to their e2grow account. The app shows e2grow data inside Microsoft 365 and does not read users’ emails, chats, calendars or files.

The e2grow agent for Microsoft 365 Copilot. When a user asks Copilot about a colleague or a workplace situation, Copilot calls the e2grow service on the user’s behalf. For every request, e2grow:

• identifies the user from their Microsoft sign-in and checks that their organization is an active e2grow customer;
• checks whether the colleague has shared their profile with the user, and returns no profile data if not;
• returns only the data needed for the answer: talent theme names, self-descriptions, relationship context and e2grow guidance for the situation;
• records the request (user, person requested, time and outcome) in a security and audit log.

e2grow data is read live and is not copied into Microsoft 365, Microsoft Graph or the Copilot index. e2grow receives only the request Copilot sends, such as a colleague’s name and a short description of the situation. Copilot conversations, including the answers Copilot writes, are processed and stored by Microsoft under the organization’s Microsoft 365 agreement and retention settings.

Other AI assistants. If an organization enables an e2grow connector in another AI assistant, such as Claude, the same rules apply: sign-in, a permission check on every request, minimal data and audit logging. Conversations in that assistant are processed by its provider under the organization’s agreement with that provider.

e2grow performs no AI processing when answering requests from Microsoft 365 Copilot or other AI assistants. Guidance for each situation is written and reviewed in advance.

10. International Data Transfers

Customer Content is hosted in data centers located in the European Union.

If data is transferred outside the EEA or UK (e.g. for support services), such transfers are protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission, and/or
• EU-U.S. Data Privacy Framework, for certified U.S. entities.

11. Your Rights

You have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict processing under Article 18 GDPR.
• Port your data to another provider (where technically feasible).
• Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time.

Requests may be sent to privacy@e2grow.com.
We may need to verify your identity before acting on a request. We respond within 30 days, complex requests may be extended by up to 60 additional days as permitted by law.
After deletion, data may remain temporarily in encrypted backups as described in Section 6.

You have the right to lodge a complaint with your local supervisory authority. In Slovenia, this is the Information Commissioner (gp.ip@ip-rs.si, www.ip-rs.si).

12. California Consumer Privacy Act (CCPA)

For California residents: e2grow does not sell personal information to third parties.
We may share limited data with service providers for analytics or advertising as per this Policy.

Residents may:

• Request details about personal data collected or shared.
• Request deletion of personal data.
• Opt out of any sharing that constitutes a “sale.”

To exercise rights, email privacy@e2grow.com. We verify and process requests as required by law.

13. Cookies and Tracking

We use cookies and similar technologies to:

• Maintain session functionality,
• Understand usage patterns,
• Improve performance and personalize experience.

14. Contact Information

Data Controller:
e2grow d.o.o.
Tehnološki park 20
SI-1000 Ljubljana, Slovenia

Data Protection Officer (DPO):
privacy@e2grow.com

Privacy Contact:
privacy@e2grow.com
support@e2grow.com

15. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.
If we make material changes, we will notify you by email or in-Service message at least 30 days before the new policy takes effect.

Previous versions will be archived and made available upon request.