Privacy policy

Controller and scope

The controller is Upway Digital Sp. z o.o., ul. Hoża 86/410, 00-682 Warsaw, Poland. KRS: 0001212538; NIP: 7011291631; REGON: 54352693100000. For privacy questions or requests, email mirko@upway.is.

This notice covers the Upway company website and enquiries sent to us. Venture websites and other linked services have their own privacy notices.

Visiting the website

To deliver pages and protect the website, our server processes your IP address and technical request information. Access logs record the time, request method, page path and response status. They exclude query strings, referrers and browser identifiers. Error logs may contain additional technical details of failed requests.

The website code uses no analytics, advertising trackers, cookies, local storage or session storage. It reads your browser language preferences to choose a supported language, falling back to English. It does not store a language profile. Fonts, images and scripts are served locally.

Contacting us

The form collects your name, email address, enquiry topic and message; company is optional. We use these details to handle your enquiry and reply. Direct emails also contain the information and attachments you choose to send. You are not legally required to provide these details, but the required form fields are needed to use the form and receive a reply. Please do not include sensitive personal information that is unnecessary for the enquiry.

Messages are sent to mirko@upway.is through Namecheap Private Email. The application does not keep a separate message database. It briefly uses an IP address, request count and expiry time to limit abusive submissions. Sending an enquiry does not subscribe you to marketing.

Purposes and legal bases

We rely on Article 6(1)(f) GDPR for ordinary business enquiries and correspondence: our legitimate interest is understanding and responding to people who contact our company. Where you personally request steps towards a contract, Article 6(1)(b) applies to processing necessary for those steps.

Website delivery and proportionate abuse prevention rely on Article 6(1)(f), with the legitimate interest of operating a reliable and secure website. Records required by law are processed under Article 6(1)(c); relevant records needed to establish, exercise or defend legal claims may be retained under Article 6(1)(f).

Recipients and processing locations

The website is hosted by Hetzner Online GmbH in Germany; business email uses Namecheap Private Email. These services and their authorised subprocessors process the data needed to provide hosting, email delivery, storage and security. Access within Upway is limited to people handling the enquiry or operating the website. Professional advisers or competent authorities may receive relevant information where necessary for a legal obligation or claim. We do not sell enquiry data.

Namecheap, Inc., our email provider, is based in the United States. Email processing may involve countries outside the European Economic Area. Namecheap’s published data-processing agreement includes the European Commission’s standard contractual clauses for international transfers. You can contact mirko@upway.is for information about recipients and transfers or to request a copy of relevant safeguards. The German location of our website server does not mean that all email processing takes place in Germany.

Retention

Our policy is to delete ordinary enquiries and their associated correspondence within 12 months after the conversation closes. This allows reasonable follow-up without retaining enquiries indefinitely. If particular messages form part of a continuing business relationship, a statutory record or a specific legal claim, we retain only the necessary records for that purpose and the applicable period. This policy covers received messages, sent replies and attachments. Deletion must be carried out in Namecheap Private Email; it is not performed automatically by this website.

Application records used to limit abusive submissions expire after ten minutes and are removed within a further minute, or when the service restarts. Our policy is to rotate website access and error logs daily and keep fourteen archives, normally covering up to fifteen days. Specific records needed to investigate a security incident or establish, exercise or defend a legal claim may be kept for as long as necessary for that purpose.

Namecheap’s Private Email terms describe daily service backups retained for up to four weeks. Deleted messages may remain in those recovery copies until they expire. Our enquiry policy also covers copies under our control, including downloaded attachments and email-client exports. After restoring a backup, applicable deletions must be reapplied. Backups are for recovery, not for extending ordinary use of enquiry data.

Your rights

Depending on the legal basis and circumstances, you can request access, correction, erasure, restriction or portability of your data. You can object to processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Send requests to mirko@upway.is. We respond without undue delay and normally within one month. If a permitted extension is necessary due to complexity or the number of requests, we will explain it within that month. We may request proportionate information to verify identity where there is reasonable doubt.

You may complain to a data-protection authority, including the President of the Personal Data Protection Office (UODO) in Poland, or the authority in the country of your habitual residence, workplace or the alleged infringement.

Automated decisions and updates

This website does not profile visitors or make solely automated decisions producing legal or similarly significant effects. Automated checks only help prevent abusive form submissions. External sites apply their own practices once you follow a link.

We update this notice when the website or our processing changes. The date above identifies the latest revision.