Privacy policy

Upstrat Lab AB ("us", "we" or "our") operates the upstrategylab.com website (the "website").

This page describes our policies on the collection, use and disclosure of personal data when you use the website, and the choices you have about that data.

We use your data to provide and improve the website. By using the website you agree to the collection and use of information under this policy. Terms used here that are not defined have the same meaning as in our terms and conditions, available from upstrategylab.com.

Definitions

Personal data. Data about a living individual who can be identified from that data, or from that data together with other information in our possession or likely to come into our possession.

Usage data. Data collected automatically, either generated by using the website or from the website's infrastructure itself, for example the duration of a page visit.

Cookies. Small pieces of data stored on a user's device.

Data controller. A person who, alone or jointly with others, determines the purposes and manner in which personal data is processed. For this policy, we are the data controller of your data.

Data processor. Any person, other than an employee of the data controller, who processes data on behalf of the data controller. We use a number of data processors to help us process your data.

Data subject. Any living individual who is the subject of personal data.

User. The individual using the website, who corresponds to the data subject.

Information we collect

We collect several types of information for different purposes, to provide and improve the website.

Personal data

While using the website we may ask you to provide personal data that can be used to contact or identify you, including but not limited to:

• Email address
• First name and last name
• Company name
• Phone number
• IP address, geographical location, browser type, referral source, length of visit and pages viewed
• Cookies and usage data

We may use your personal data to contact you with newsletters, marketing or promotional materials and other information that may interest you. You can opt out of any of these communications at any time using the unsubscribe link in the email, or by contacting us.

Usage data

We may also collect information on how the website is accessed and used, including your device's IP address, browser type and version, the pages you visit, the time and date of your visit, time spent on those pages, unique device identifiers and other diagnostic data.

Legal basis for processing

We process your personal data under the following legal bases:

• Consent: we process your email address for newsletters and marketing based on your consent (Article 6(1)(a) GDPR).
• Legitimate interests: we process usage data and cookies to improve the website and user experience based on our legitimate interests (Article 6(1)(f) GDPR).
• Contractual necessity: we process your contact details to respond to your enquiries, as part of pre-contractual measures or performance of a contract (Article 6(1)(b) GDPR).

Tracking and cookies data

We use cookies and similar tracking technologies to track activity on the website and hold certain information, alongside other tracking technologies such as beacons, tags and scripts, to collect and analyse information about how the website is used.

When you first visit the site, a consent banner lets you accept or decline cookies by category. You can update your preferences at any time.

Categories of cookies we use:

• Necessary: required for the site to function. Always active.
• Analytics: help us understand how visitors use the site, for example Google Analytics 4. Only active with your consent.
• Marketing: enable contact tracking and CRM functions, for example HubSpot. Only active with your consent.
• Functional: remember your preferences and settings. Only active with your consent.

How we use data

Upstrat Lab AB uses the data we collect for the following purposes:

• To provide and maintain the website
• To notify you about changes to the website
• To let you take part in interactive features of the website when you choose to
• To provide customer support
• To gather analysis so that we can improve the website
• To monitor use of the website
• To detect, prevent and address technical issues
• To tell you about news, offers and information about other services we offer that are similar to those you have already used or asked about, unless you have opted out

Retention of data

We retain your personal data only for as long as necessary for the purposes set out in this policy, and to the extent needed to meet our legal obligations, resolve disputes and enforce our agreements and policies.

Specific retention periods: contact form submissions, 2 years from last contact. Analytics data (GA4), 14 months. HubSpot CRM records, 3 years of inactivity, or until deletion is requested. Cookie consent record, 12 months.

Transfer of data

To run our operations we may transfer and access personal data from around the world, including the EU and the United States. This policy applies even where we transfer personal data to other countries.

Your consent to this policy, followed by your submission of information, represents your agreement to that transfer.

We take all steps reasonably necessary to keep your data secure and handled in line with this policy. We do not transfer personal data to an organisation or country without adequate safeguards in place, including Standard Contractual Clauses approved by the European Commission where applicable.

Legal requirements

We may disclose your personal data in the good faith belief that it is necessary to:

• Comply with a legal obligation
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing connected with the website
• Protect the personal safety of users of the website or the public
• Protect against legal liability

Security of data

The security of your data matters to us, but no method of transmission over the internet or electronic storage is completely secure. While we use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security.

We secure the personal data you provide on servers in a controlled, secure environment. Where sensitive personal data is transmitted, it is protected using encryption such as TLS/SSL.

If you have questions about the security of your personal data, contact us at privacy@upstrategylab.com.

Your rights

Under GDPR you have the following rights:

• Access: request a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate data
• Erasure: request deletion of your data
• Restriction: ask us to limit how we process your data
• Data portability: receive your data in a commonly used electronic format
• Object: object to processing based on legitimate interest
• Withdraw consent: at any time, for any consent based processing

We may ask you to verify your identity before responding to such requests.

You also have the right to lodge a complaint with the Swedish supervisory authority: Integritetsskyddsmyndigheten (IMY), imy.se, +46 8 657 61 00.

Website providers

We use third party companies and individuals to help run the website ("website providers"), on our behalf, to perform website related tasks or to help us analyse how the website is used. These third parties only have access to your personal data to perform those tasks on our behalf, and are obligated not to disclose or use it for any other purpose.

Analytics and other services

We use the following third party services on the website:

• Google Analytics 4: to understand how visitors use the site, pages visited, time on site and traffic sources. Analytics cookies are only active with your consent. See policies.google.com/privacy.
• HubSpot: for CRM and marketing. HubSpot may store your browsing behaviour and contact details on its servers. HubSpot scripts are only active with your marketing consent. See legal.hubspot.com/privacy-policy.
• Calendly: if you book a meeting through the site, Calendly collects your name, email address and scheduling preferences. See calendly.com/privacy.
• Google Tag Manager: used to manage and deploy the tracking scripts above. Tag Manager itself does not collect personal data, and only loads the scripts listed here once you have given consent.

You can explore the website without providing any personal data. When you register through one of our forms, we ask that you provide the data described above.

Links to other sites

The website may contain links to other sites that we do not operate. If you click a third party link you will be directed to that site. We advise you to review the privacy policy of every site you visit; we have no control over and take no responsibility for the content or privacy practices of any third party site.

Children's privacy

The website does not address anyone under the age of 13. We do not knowingly collect personal data from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us, and we will take steps to remove it from our systems.

We never sell personal data

We will never sell your personal data to any third party.

Customer testimonials and comments

We post customer testimonials and comments on the website, which may contain personal data. We obtain each customer's consent by email before posting their name and testimonial.

Social media features

The website may include social media features and widgets. These may collect your IP address, which page you are visiting, and may set a cookie to work correctly. Social media features are either hosted by a third party or hosted directly on the website. This policy does not apply to these features; your interactions with them are governed by the policies of the companies providing them.

Public forums

Where the website offers publicly accessible message boards, blogs or forums, anything you disclose there may be collected and used by others. We will correct or delete information you have posted if you ask us to.

Changes to this policy

We may update this policy from time to time. We will post the new policy on this page and update the "last updated" date above. Where a change is material we will let you know by email and/or a prominent notice on the website before it takes effect. Please review this policy periodically.

Opting out and unsubscribing

On request we will tell you whether we hold any of your personal data. If you have provided us with personal data, you can ask us to:

• Review the information you have supplied to us
• Correct any errors, outdated information or omissions in it
• Stop using your information to contact you
• Remove your information from any solicitation list we use
• Delete your information from our records
• Opt you out of solicitation by us or third parties

To exercise any of these rights, contact us at privacy@upstrategylab.com, or by post to Upstrat Lab AB, Nordhemsgatan 56, 413 09 Goteborg, Sweden, attention Privacy. We will respond within a reasonable timeframe and tell you what action we have taken.

You can unsubscribe from marketing communications at any time using the unsubscribe link at the bottom of our emails, or by emailing privacy@upstrategylab.com. This does not apply to transactional emails related to your account with us.

Contact us

If you have questions about this privacy policy, contact us:

• By email: contact@upstrategylab.com or privacy@upstrategylab.com
• By post: UPSTRAT LAB AB, Org nr 559172-7218, Nordhemsgatan 56, 413 09 Goteborg, Sweden, attention Privacy