This Policy is drawn up pursuant to Art. 13 of EU Regulation 2016/679 (GDPR) and Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018. UpVentures respects your privacy and is committed to protecting your personal data.
Art. 1
Data Controller
The Controller of personal data is:
UpVentures
Operating address: Turin (TO), Italy
E-mail: privacy@upventures.io
Website: upventures.vercel.app
For any matters relating to the processing of personal data, please contact the Controller at the e-mail address above.
Art. 2
Categories of data collected
UpVentures collects the following personal data:
- Contact data: first name, last name, e-mail address, phone number (if voluntarily provided via the contact form or call booking).
- Company data: company or project name, industry, project stage (voluntarily provided in the form or during the call).
- Navigation data: IP address, browser type, operating system, pages visited, session duration, referring URL — collected automatically via server logs and analytics tools.
- Communication data: content of messages sent by e-mail or via the website contact form.
- Contractual data: in the event of a commercial relationship, tax and billing data as required by law.
We do not collect special categories of data (Art. 9 GDPR) or data relating to criminal convictions.
Art. 3
Purposes and legal basis for processing
Data is processed for the following purposes:
- Responding to contact requests (Art. 6.1.b GDPR — performance of pre-contractual measures): handling enquiries, quotes, and call bookings.
- Contract performance (Art. 6.1.b GDPR): delivery of venture building, strategic consulting, product development, and related services agreed with the client.
- Legal and fiscal obligations (Art. 6.1.c GDPR): invoicing, accounting, tax compliance, and statutory requirements.
- Legitimate interest (Art. 6.1.f GDPR): improving the website, aggregate analysis of service usage, IT security.
- Commercial communications (Art. 6.1.a GDPR — consent): sending newsletters, service updates, or informational content, only with explicit and revocable consent.
Art. 4
Processing methods
Data is processed using IT and electronic tools, adopting technical and organisational security measures adequate to prevent unauthorised access, loss, destruction or unlawful disclosure, in accordance with Arts. 25 and 32 of the GDPR.
Data is processed exclusively by personnel authorised by the Controller or by third parties acting as Data Processors (Art. 28 GDPR), duly appointed and bound by confidentiality and data protection agreements.
Art. 5
Data retention
Personal data is retained for the period strictly necessary for the purposes for which it was collected:
- Contact data and pre-contractual requests: 24 months from receipt of the request, unless a contractual relationship is established.
- Contractual and billing data: 10 years from the conclusion of the contract, in compliance with statutory fiscal and civil obligations.
- Navigation data: 12 months in aggregated and anonymised form.
- Data for commercial communications: until consent is withdrawn.
Upon expiry of retention periods, data is deleted or irreversibly anonymised.
Art. 6
Disclosure and dissemination
Personal data is not disclosed to third parties for their own commercial purposes. It may be communicated to:
- Collaborators and freelancers acting as Data Processors for service delivery (developers, designers, consultants).
- IT and cloud service providers (hosting, e-mail, CRM), bound by GDPR-compliant agreements.
- Public authorities where required by law.
- Google LLC, to the extent that Google Calendar is used for call bookings and Google Analytics for site analytics (see Art. 8).
Art. 7
International data transfers
Some service providers (e.g. Google LLC) are based in the United States. Data transfers take place in accordance with EU Regulation 2016/679, on the basis of European Commission adequacy decisions or Standard Contractual Clauses (SCCs) adopted by the Commission.
For Google services, the Google Cloud Data Processing Addendum applies, available on the Google website.
Art. 8
Cookies and tracking technologies
The site upventures.vercel.app uses exclusively:
- Essential technical cookies: necessary for the site to function (e.g. browsing session). No consent required.
- Third-party cookies: the site integrates Google Calendar functionality (for call bookings), subject to Google's Privacy Policy (policies.google.com/privacy).
We do not use profiling cookies or advertising tools. The site does not track user behaviour for commercial purposes.
Art. 9
Data subject rights
Under Arts. 15–22 of the GDPR, you have the right to:
- Access (Art. 15): obtain confirmation of processing and a copy of your personal data.
- Rectification (Art. 16): correct inaccurate or incomplete data.
- Erasure (Art. 17): request deletion of your data (right to be forgotten), subject to legal obligations.
- Restriction (Art. 18): restrict processing in certain circumstances.
- Portability (Art. 20): receive your data in a structured, machine-readable format.
- Objection (Art. 21): object to processing based on legitimate interest or for direct marketing purposes.
- Withdrawal of consent (Art. 7): withdraw consent at any time, without affecting the lawfulness of prior processing.
To exercise your rights, write to privacy@upventures.io. We will respond within 30 days of receiving your request.
You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Art. 10
Changes to this policy
UpVentures reserves the right to update this Policy at any time, particularly following regulatory changes or evolution of the services offered. The updated version will be published on this page with the revision date indicated.
In the event of material changes that affect data subjects' rights, registered users will be notified by e-mail.