Privacy statement

Upward Technologies B.V. is the controller for everything described on this page. We have not appointed a data protection officer: we are not a public body, our core activity is not large-scale monitoring, and we do not process special categories of data at scale, so none of the three grounds in Article 37 applies. Questions about this statement reach a person, not a ticket queue.

Write to info@upwardtech.nl

• The contact form

  Your name, your email address, the company you mention, and the message itself. The form writes to no database. It is emailed to us through Amazon SES (see below) and after that exists only as an email, which is the same thing that would have happened if you had written to us directly.

  Legal basis

  Article 6(1)(f), our legitimate interest in answering people who ask us something. What goes in the message field is your decision.

  Retention

  Kept as business correspondence while the conversation is live, then two years. Ask us to delete it sooner and we will.

• Booking a call

  If you book a call through our Calendly page, Calendly records your name, your email address, the time you pick, and anything you type into the booking form. Calendly sends you the confirmation and reminder emails, and the booking appears in our calendar. Calendly's own page sets its own cookies; nothing from Calendly loads on upwardtech.nl itself, because we link to it rather than embed it.

  Legal basis

  Article 6(1)(b), steps you asked us to take before a possible agreement, or Article 6(1)(f), our legitimate interest in talking to people who ask for a call.

  Retention

  Deleted from Calendly twelve months after the call, unless it leads to an agreement, in which case it is kept as business correspondence as described below.

• The ERIS data room

  If you request access to the ERIS data room we store your name, your work email, your firm if you give it, and your signature on the NDA: the name you typed, the time, your IP address and which revision you signed. A signed copy is kept with your request. Once you have access we log each sign-in and each document you open or download, with the time and your IP address, and every document we serve carries your email address and firm as a watermark. A session cookie keeps you signed in until your access ends, three days after approval; it holds a random token, not your details. All of it sits in files on our own server in the Netherlands.

  Legal basis

  Article 6(1)(b), administering the access and the confidentiality terms you accepted, and Article 6(1)(f), our legitimate interest in knowing who has seen confidential documents.

  Retention

  The access log three years. Your request and signed NDA three years after your access ends, which is how long the NDA runs; a request that was not approved, two years after it came in. All of it is deleted automatically at the end of that period. Ask us to delete it sooner and we will, unless a dispute about the NDA is open.

• Registering interest in ERIS

  If you register interest in ERIS as a design partner or a client, we store your name, your email address, your company, the message you add and the language you used, in the same files on our own server. We email ourselves a notification. You are not added to a mailing list.

  Legal basis

  Article 6(1)(f), our legitimate interest in following up on a request you made, or Article 6(1)(b) once it becomes a conversation about an agreement.

  Retention

  Two years after you registered, then deleted automatically. Ask us to delete it sooner and we will.

• Email the website sends

  Mail from the website, such as contact form notifications and data room confirmations, access links and decisions, is sent through Amazon Simple Email Service in the Frankfurt region. Amazon handles the recipient address, the message and the delivery result. If an address bounces or its owner marks our mail as spam, Amazon keeps that address on a suppression list so it is never mailed again, and we receive a report about it.

  Legal basis

  The same basis as the feature that sends the message.

  Retention

  An address stays on the suppression list until we remove it, which we do on request. Delivery reports are kept as correspondence, for two years.

• Email you send us

  Our mail runs on Microsoft 365. What you send sits in that mailbox, and Microsoft Ireland Operations Limited processes it on our instructions.

  Legal basis

  Article 6(1)(f), the same interest in being reachable, or Article 6(1)(b) once there is a contract to perform.

  Retention

  Seven years for anything bearing on an agreement or an invoice, because Dutch tax law requires it. Everything else, two years.

• Web server logs

  Every request to this site is logged: IP address, timestamp, the URL requested, the response code, and the browser's user agent. This is how a site gets debugged and how an attack gets noticed at all. The logs are joined to nothing else and are not used to build a profile.

  Legal basis

  Article 6(1)(f), our legitimate interest in keeping the service working and secure.

  Retention

  Fourteen days, then rotation deletes the file. Not a policy on paper: it is how the server is configured.

• Analytics, only if you accept

  Google Analytics 4, loaded only after you click accept on the cookie banner. Before that nothing is fetched from Google at all: no script, no pixel, no request. Your IP address is truncated before it reaches Google's logs, and we have not switched on advertising features.

  Legal basis

  Article 6(1)(a), your consent, which you can withdraw at any time by clearing this site's data in your browser.

  Retention

  Fourteen months in Google Analytics.

Five parties, each under contract, each doing one job. We sell nothing, we have no advertising partners, and nobody receives your details for their own purposes.

• Microsoft Ireland Operations Limited

  Microsoft 365 mail. The data stays inside the European Union.

• Amazon Web Services EMEA SARL

  Email sent from the website, through Amazon Simple Email Service in the Frankfurt region, processed on our instructions under the AWS GDPR Data Processing Addendum.

• Google Ireland Limited

  Google Analytics 4, and only for visitors who accepted. Governed by the Data Processing Terms attached to the Analytics agreement.

• Calendly LLC

  Call bookings, and only for visitors who choose to book one. Calendly processes the booking on our instructions under its data processing agreement.

• Upward Technologies

  The site itself, and the data room and ERIS records. They run on our own server in the Netherlands rather than on a cloud platform, which is why the retention periods above are facts we can state instead of vendor settings we have to take on trust.

Mail, the site itself and the data room stay inside the European Union. There are two exceptions. Google Analytics: Google Ireland may involve Google LLC in the United States, relying on the EU-US Data Privacy Framework and the standard contractual clauses. If that sits badly with you, decline the banner; declining costs you nothing and gives you exactly the same site. Calendly: Calendly LLC is based in the United States and relies on the EU-US Data Privacy Framework and the standard contractual clauses in its data processing agreement. If you would rather not use it, email us and we will find a time that way.

TLS on every connection, HSTS, a content security policy, and an ISO 27001-shaped management system that is being built rather than certified. We say that plainly elsewhere on this site and we are not going to dress it up here.

Under the GDPR you can ask us to:

• Tell you what we hold about you, and give you a copy of it.
• Correct it where it is wrong.
• Delete it, unless we are legally required to keep it.
• Restrict what we do with it while a dispute is open.
• Hand it to you, or to another supplier, in a portable format.
• Stop processing that rests on legitimate interest, by objecting to it.
• Withdraw your consent to analytics, which is as easy as giving it.

Write to the address above. We answer within a month, and we will not ask for more proof of identity than we need to be sure we are not handing your data to somebody else.

If we get it wrong you can complain to the Autoriteit Persoonsgegevens, the Dutch supervisory authority, at autoriteitpersoonsgegevens.nl. We would rather hear it from you first, but it is your right either way.

When we build or run a system for a client, the personal data inside it belongs to that client's relationship with their own customers. There we are the processor and they are the controller: we act on their documented instructions, under an Article 28 agreement, with sub-processors disclosed and breach notification agreed in writing. This statement does not govern that data. Their privacy statement does.

This statement sits in version control with the rest of the site, so every change to it carries a date and an author. When something material changes we will say so here rather than quietly reissue the page.

Cookie statement