LEAD CAPTURE CONSENT REFERENCE

Version: v1.0.0

Effective Date: May 4, 2026

LANGUAGE NOTICE: English is the legally binding version.

PURPOSE

This document defines the exact consent language, UX requirements, and data handling rules for GrowGRC's free tool lead capture forms. It ensures CAN-SPAM, GDPR, CASL, and LGPD compliance when collecting user data for commercial communications.

CONSENT ARCHITECTURE

GrowGRC free tools use a dual-consent model — required by GDPR and best practice globally:

```

[Form Fields: email, industry, country, company size]

☑ REQUIRED: I have read and agree to the GrowGRC Terms of Service

and Privacy Policy.

☐ OPTIONAL: I agree to receive commercial communications from

GrowGRC, including product updates, offers, and GRC

resources. I can unsubscribe at any time.

```

Critical rules:

• These two checkboxes MUST be separate
• The marketing checkbox MUST be unchecked by default (GDPR pre-ticked boxes are invalid)
• Both are visible before the user submits the form
• User cannot pre-check marketing by default
• The ToS checkbox IS required to use the tool

CONSENT TEXT (Exact Copy for Implementation)

Terms / Privacy (Required)

*"I have read and agree to GrowGRC's [Terms of Service] and [Privacy Policy]."*

Marketing Opt-In (Optional – Default: Unchecked)

*"I agree to receive commercial communications from GrowGRC, including product updates, promotional offers, and GRC educational resources. I understand I can unsubscribe at any time by clicking the unsubscribe link in any email or contacting legal@growgrc.app."*

DATA RECORDED IN `plg_leads`

UNSUBSCRIBE REQUIREMENTS

Implementation requirement: Every commercial email sent to PLG leads MUST include:

1. GrowGRC physical mailing address (CAN-SPAM requirement)

2. Unsubscribe link that sets `unsubscribed_at` in `plg_leads`

3. Once `unsubscribed_at` is set, that email address must never receive commercial emails

WHAT YOU CAN DO WITH PLG DATA (with marketing_consent = TRUE)

✅ Send product update emails

✅ Send promotional offers and discounts

✅ Send GRC educational content

✅ Invite to webinars / demos

✅ Retargeting (with cookie consent for EU users)

✅ CRM enrichment and lead scoring

WHAT YOU CANNOT DO (regardless of consent)

❌ Sell email addresses to third parties

❌ Share with data brokers

❌ Use for purposes not disclosed in the consent text

❌ Send emails after `unsubscribed_at` is set

❌ Use for political or discriminatory campaigns

GDPR-SPECIFIC RULES FOR EU LEADS

For leads with EU IP addresses:

• Marketing consent is REQUIRED (legitimate interest does not apply for direct marketing to individuals under GDPR)
• Consent must be granular (no bundling with ToS)
• Consent record must include: who consented, when, what they consented to, how consent was obtained
• All consent records in `plg_leads` satisfy this requirement when populated correctly

*© 2026 Global Modern Services. All rights reserved. Internal reference document.*