Who we are
This policy explains how Upwell Growth Ltd (“Upwell”, “we”, “us”) collects and uses personal data when you visit this website, contact us, apply for a role or work with us. We are a company registered in England and Wales, and our registered office is 3rd floor, 28 Turnmill Yard, Clerkenwell, London EC1M 5RT.
For the personal data described here, we are the controller: we decide why and how it is used. When we run advertising or analytics for a client, we usually handle their customers’ data as a processor on the client’s instructions. In that case the client’s own privacy notice applies, and our contract with them sets out how we look after that data.
If you have a question about this policy or how we handle your data, email hello@upwell.agency or write to us at the address above, marked for the attention of the Data Protection Lead.
What we collect
Information you give us
- Enquiries: your name, work email, company website, monthly media spend range, the services you are interested in and anything you write in your message.
- Calls and meetings: notes we take, and recordings only if we ask first and you agree.
- Clients and suppliers: business contact details, billing details and the correspondence needed to deliver and pay for work.
- Job applications: your CV, portfolio, cover note, references and anything else you choose to send.
Information collected automatically
Our hosting provider records standard server logs when pages are requested: your IP address, browser type, the page requested and the time. We use these only to keep the site running and secure.
Information from others
If someone refers you to us, or you are named as a contact by your employer, we receive your business contact details from them. We may also look at publicly available company information, such as your website and Companies House records, before a first call.
We do not ask for special category data (such as health, ethnicity or religious beliefs). Please do not send it to us unless we specifically ask, for example to make adjustments for an interview.
How we use it, and why we are allowed to
UK data protection law requires a lawful basis for each use of personal data. These are ours:
| What we do | Data used | Lawful basis |
|---|---|---|
| Reply to an enquiry or audit request | Contact details, website, spend range, message | Legitimate interests (answering people who contact us), and steps before a contract |
| Deliver work for clients and send invoices | Business contact and billing details, correspondence | Contract |
| Keep financial and tax records | Billing details, invoices | Legal obligation |
| Consider job applications | CV, portfolio, references, interview notes | Legitimate interests, and steps before a contract |
| Record a call | Voice, video, what is said | Consent, asked for at the start of the call |
| Keep the site secure and working | Server logs | Legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against yours and only proceed where they are not outweighed. You can ask us for details of that assessment.
We do not use your data for automated decision-making that has legal or similarly significant effects on you, and we do not sell personal data to anyone.
International transfers
Some of our service providers store or access data outside the UK. When that happens we make sure the transfer is protected: either the country has UK adequacy regulations, or we use the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any extra safeguards needed. You can ask us for a copy of the relevant safeguards.
How long we keep it
We keep personal data only for as long as we need it for the purpose it was collected, then delete or anonymise it:
| Data | How long we keep it |
|---|---|
| Enquiries that do not lead to work | 24 months from our last contact |
| Client and supplier records | The length of the relationship, then six years for legal and tax purposes |
| Job applications | Six months after the role is filled, or twelve months if you ask us to keep you in mind |
| Call recordings | 90 days, unless you ask us to delete them sooner |
| Server logs | 30 days |
Your rights
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectification: have inaccurate data corrected and incomplete data completed.
- Erasure: ask us to delete your data where there is no good reason for us to keep it.
- Restriction: ask us to pause using your data, for example while a correction is checked.
- Portability: receive data you gave us in a structured, machine-readable format, or have it sent to another organisation.
- Object to our use of your data where we rely on legitimate interests, and to direct marketing at any time.
- Withdraw consent where we rely on it, such as for a call recording, without affecting anything done before.
- Not be subject to decisions made solely by automated means that significantly affect you. We do not make any.
To use any of these rights, email hello@upwell.agency. We may need to confirm your identity first. We will respond within one month, and there is no charge unless a request is clearly unfounded or excessive.
Cookies and similar technologies
Cookies are small files a website stores on your device. Some are essential, others track what you do across sites. This site does not set advertising or analytics cookies, and no third-party trackers load when you browse it.
We use one small item of browser storage to make the site work as you would expect:
| Name | What it does | How long |
|---|---|---|
upwell-audit | Carries the website and spend range you enter on the home page into the contact form, so you do not type them twice. Stored in session storage on your device and never sent to us until you submit the form. | Until you close the tab |
Because it is strictly necessary for a feature you ask for, it does not need consent. If we ever add analytics or other non-essential cookies, we will ask first with a choice that makes refusing as easy as accepting, and list each one here.
Links to other services, such as “Open in Maps” on our contact page, take you to sites with their own cookie and privacy policies.
Keeping it safe
We use appropriate technical and organisational measures to protect personal data, including encrypted connections, two-factor authentication on business systems, access limited to the people who need it, and staff training. No system is perfectly secure, so if we ever suffer a breach that puts your data at risk we will tell you and the Information Commissioner’s Office where required.
Children
Our services are for businesses. This site is not aimed at children, and we do not knowingly collect personal data from anyone under 16.
Changes to this policy
We review this policy at least once a year and when the way we handle data changes. The date at the top shows when it was last updated. If a change materially affects how we use data we already hold about you, we will tell you directly.
Contact and complaints
Questions, requests and concerns go to our Data Protection Lead at hello@upwell.agency, or by post to Upwell Growth Ltd, 3rd floor, 28 Turnmill Yard, Clerkenwell, London EC1M 5RT. We would like the chance to put things right first.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection: visit ico.org.uk/make-a-complaint or call 0303 123 1113.