Last updated: 15 October 2026
1. Who we are
Grow Your Impact SL, trading as Mosaico ("Mosaico", "we"), is the controller of the personal data described here.
- Address: Carrer de Roc Boronat, 138, 08018 Barcelona, Spain
- Contact: [email protected]
We have not appointed a Data Protection Officer, as we are not required to.
2. Scope
This policy applies when you visit mosaico.partners, contact us, work with us, are introduced to or by us, or are someone we contact about our services. Our clients are organisations, so the data we handle is mostly business contact details.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Contact | Name, title, organisation, business email, phone, messaging handle | You, your organisation, or whoever introduced you |
| Professional context | Role, mandate or product focus, meeting notes | You and our notes |
| Billing | Contract and invoice details of the contracting organisation | Your organisation |
| Communications | Emails, messages, call transcripts (only with notice at the start of the call) | You and us |
| Public professional data | Professional profiles, company websites, press, event speaker lists, governance forums | Public sources and B2B data providers |
| Website | IP address, browser, pages viewed | Your device |
Please don't send us sensitive data such as health information or identity documents. We make no decisions about you by automated means alone.
4. How we use it
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Answer enquiries and arrange calls | Pre-contract steps you request, or legitimate interest |
| Deliver our services | Contract with you, or legitimate interest where the contract is with your organisation |
| Make introductions (section 5) | Legitimate interest in connecting relevant businesses |
| Contact prospective clients and partners | Legitimate interest in developing our business |
| Send insights and updates | Consent, or legitimate interest for existing clients |
| Invoicing, accounting and tax | Legal obligation |
| Run and secure the website | Legitimate interest; consent for non-essential cookies |
| Handle legal claims and authority requests | Legal obligation or legitimate interest |
You can object to any processing based on legitimate interest (section 10). Giving us data is optional, but without it we may not be able to work with you.
5. Introductions
- We tell both parties who the other is and why, and share your details only once you agree.
- We share your name, role, organisation, business contact details and any context you approve. Call notes and confidential information stay with us unless you say otherwise.
- After an introduction, the other party handles your data under its own privacy policy.
6. Who we share data with
We never sell personal data. We share it only with:
| Recipient | Why | Location |
|---|---|---|
| Introduction counterparties | Introductions you agreed to | Varies |
| Email and documents [e.g. Google Workspace] | Day-to-day work | [EU / US] |
| CRM and prospecting [e.g. HubSpot, Clay] | Managing contacts | [US] |
| Calls and transcription [e.g. Google Meet, Fireflies] | Meetings and notes | [US] |
| Messaging [e.g. Telegram, Slack] | Client communication | [Varies] |
| Website hosting and analytics [provider] | Running the website | [EU / US] |
| Accountants and lawyers | Professional advice and compliance | Spain / EU |
| Authorities and courts | Where the law requires | Spain / EU |
Service providers act on our instructions under data processing agreements.
7. International transfers
Some providers are outside the European Economic Area, mainly in the US. We rely on the EU–US Data Privacy Framework where a provider is certified, and on the European Commission's Standard Contractual Clauses otherwise. Ask us for a copy of the safeguards.
8. Retention
| Data | Kept for |
|---|---|
| Client records and correspondence | Engagement plus [5] years |
| Invoices and accounting records | 6 years (Spanish Commercial Code, Art. 30) |
| Introduction records | [5] years after the introduction |
| Prospects with no engagement | [24] months after last contact, or until you ask us to delete |
| Call transcripts | [12] months, unless needed for an active engagement |
| Newsletter subscribers | Until you unsubscribe |
| Website analytics | [14] months |
After that, we delete or anonymise the data.
9. Security
We use multi-factor authentication, restrict access to those who need it, and use providers that encrypt data in storage and transit. If a breach puts your rights at risk, we notify the Spanish data protection authority (AEPD) within 72 hours and tell you promptly.
10. Your rights
You can ask us to access, correct, delete or restrict your data, receive a copy in a portable format, object to processing based on legitimate interest, and withdraw consent at any time.
Email [email protected]. We reply within one month, free of charge, and may ask you to confirm your identity. You can also complain to the AEPD (opens in a new tab) or the data protection authority where you live.
11. Cookies
[Option A] We use only cookies the website needs to work, and cookie-free analytics that does not identify you.
[Option B] We use necessary cookies and, with your consent, analytics cookies. You can change your choice at any time in [Cookie settings].
12. Marketing
We send updates only to subscribers and existing clients. Every email has an unsubscribe link, and we never share contact details for others' marketing.
13. Other
- Children. Our services are for businesses. We don't knowingly collect data from anyone under 18.
- Changes. The date at the top shows the current version. We tell clients directly about material changes.
- Contact. [email protected], or Carrer de Roc Boronat, 138, 08018 Barcelona, Spain.