Privacy Policy

9. Your Privacy Rights

GDPR Rights (EU/EEA)

Under the General Data Protection Regulation (GDPR), you have:

• Access: Copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Delete your data (right to be forgotten)
• Restrict Processing: Limit how we use data
• Data Portability: Receive data in portable format
• Object: Object to processing for marketing/profiling
• Lodge Complaint: File complaint with supervisory authority

CCPA Rights (California)

Under the California Consumer Privacy Act (CCPA), you have:

• Right to Know: Categories and specific data collected
• Right to Delete: Request deletion of data
• Right to Opt-Out: Opt out of sale/sharing (we don’t sell data)
• Right to Correct: Correct inaccurate information
• Non-Discrimination: No penalties for exercising rights

To exercise rights, email privacy@upmos.com. We respond within 30 days (GDPR) or 45 days (CCPA).

10. Data Subject Access Request (DSAR) Process

Fast track: Email privacy@upmos.com with subject “DSAR Request” and include your account email, request scope (all data or specific systems), and preferred format (CSV/JSON/PDF).

How to Submit a DSAR

1. Email privacy@upmos.com with subject line “DSAR Request”
2. Provide: Full name, email address, account details, specific data requested
3. Identity verification required (government ID or account authentication)
4. We respond within 30 days (GDPR) or 45 days (CCPA), may extend 30-60 days if complex

What You’ll Receive

• Copy of personal data in portable format (CSV, JSON, PDF)
• Categories of data collected
• Sources of data
• Purposes of processing
• Third parties with whom data is shared

Fees & Limitations

First request is free. Manifestly unfounded or excessive requests may incur reasonable administrative fees. We may refuse requests that jeopardize others’ rights or are legally prohibited.

11. Data Deletion Request Process

Right to Erasure

You may request deletion of your personal data under GDPR Article 17, CCPA Section 1798.105, and similar laws.

How to Request Deletion

1. Email privacy@upmos.com with subject “Deletion Request”
2. Verify your identity
3. Specify data to be deleted (or request full account deletion)
4. We process within 30 days and confirm via email

Exceptions to Deletion

We may retain data when necessary for:

• Completing transactions or providing requested services
• Legal compliance (tax, accounting, regulatory requirements)
• Fraud prevention and security purposes
• Exercising free speech or research purposes
• Internal operations (debugging, improving services)

Deleted data is securely erased within 90 days from all production systems and backups.

12. Automated Decision Making & Profiling

Automated Processing Activities

We use automated decision-making and profiling for:

• Fraud Detection: Algorithms analyze transactions for fraud patterns (affects order approval)
• Product Recommendations: Machine learning suggests products based on browsing history
• Dynamic Pricing: Algorithms may adjust prices based on demand, inventory, user behavior
• Credit/Risk Assessment: Automated scoring for payment plans or financing options

Your Rights (GDPR Article 22)

• Right to human review of automated decisions
• Right to contest automated decisions
• Right to express your point of view
• Right to obtain explanation of decision

To request human review of an automated decision, contact privacy@upmos.com within 30 days.

13. Special Categories of Data

GDPR Article 9 Sensitive Data

We generally do NOT collect special categories of personal data (racial/ethnic origin, political opinions, religious beliefs, health data, biometric data, genetic data, sexual orientation). If collection is necessary:

• We obtain explicit consent
• Process only when legally permitted
• Apply enhanced security measures
• Limit access to authorized personnel only

Health & Biometric Data

If you voluntarily provide health information (e.g., for product recommendations or accommodations), we:

• Process only with explicit consent
• Encrypt data at rest and in transit
• Restrict access to need-to-know basis
• Retain only as long as necessary

14. Cookies & Tracking Technologies

Types of Cookies

Your Choices

Manage cookies via browser settings or our cookie consent banner. Disabling cookies may affect functionality.

Do Not Track

We honor Do Not Track (DNT) signals where technically feasible.

15. Data Security

Security Measures

• TLS/SSL encryption for data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication (MFA)
• Regular security audits and penetration testing
• Employee training on data protection
• Access controls and principle of least privilege
• Incident response and disaster recovery plans

Data Breach Notification

In case of breach affecting your data, we notify you and authorities within 72 hours (GDPR) via email or website notice.

16. Marketing & Communications Preferences

Email Marketing

We send marketing emails only with your consent. Opt out via unsubscribe link or email preferences@upmos.com.

SMS/Push Notifications

Opt in required. Manage via account settings or reply STOP to SMS.

Preference Management

Control all communication preferences at upmos.com/preferences or privacy@upmos.com.

Transactional emails (order confirmations, account notices) are not affected by marketing opt-out.

17. Third-Party Links & External Sites

Our Services may contain links to third-party websites, plugins, or applications. We are not responsible for privacy practices of third parties.

Disclaimer: Clicking external links takes you to sites governed by their own privacy policies. Review third-party policies before providing information.

We do not endorse or assume liability for content, products, or practices of linked sites.

18. Privacy by Design & Default

We implement privacy-first principles in all Services:

• Data Minimization: Collect only necessary data
• Purpose Limitation: Use data only for stated purposes
• Encryption by Default: Encrypt all sensitive data
• Privacy Impact Assessments: Conduct PIAs for high-risk processing
• Secure by Default: Strongest privacy settings enabled by default
• Transparency: Clear communication about data practices

19. Complaints & Grievance Procedures

Internal Complaints

File complaints at privacy@upmos.com. We respond within 30 days with resolution or action plan.

Supervisory Authorities

EU/EEA residents may lodge complaints with local Data Protection Authority:

• Find your DPA: European Data Protection Board Directory
• UK residents: ICO (Information Commissioner’s Office)
• California residents: California Attorney General

20. Children's Privacy

Services are not directed to children under 13 (or equivalent minimum age) in compliance with COPPA (Children’s Online Privacy Protection Act). We do not knowingly collect data from children.

If we discover child data collected without parental consent, we delete it immediately. Contact privacy@upmos.com if you believe we have child data.

Users 13-18: Enhanced protections apply per COPPA and applicable laws.

21. Age, Minors, and Minor Logins

Account Eligibility: 18+ to create an account and transact. Minors 13-17 may use Services only under a parent/guardian account with supervised payment methods.

Age-Restricted Products: Age verification is required at checkout and delivery; government ID may be requested where permitted by law.

Parental Controls: Parents can manage spending limits, approvals, and notifications; contact privacy@upmos.com for support.

22. AI Products, Social Logins, and Google API Limited Use

AI Products: We use vetted AI service providers (e.g., OpenAI) for automation/analysis with contractual safeguards. Do not submit unnecessary personal data in free-form inputs.

Social Logins: If you sign in with social platforms, we receive the profile fields you permit (e.g., name, email, avatar). You can revoke permissions in the social platform at any time.

Google API Limited Use: Any Google user data obtained via Google APIs is handled per Google API Services User Data Policy (Limited Use). We do not transfer it for advertising or allow human reading except with consent, security needs, or legal requirements.

23. Do-Not-Track (DNT) and Global Privacy Control (GPC)

We process browser Global Privacy Control (GPC) signals to honor opt-outs from sale/share/targeted advertising where required. DNT standards are not yet uniform; we will align with recognized standards as they are finalized.

24. Financial Incentives & Loyalty Programs

If we offer price or service differences, loyalty programs, or incentives, we will disclose the material terms, categories of data involved, valuation method, and opt-out/withdrawal method. Participation is voluntary.

25. Authorized Agents & Verification

You may appoint an authorized agent (e.g., under CCPA/CPRA). We require proof of authorization and identity verification and may contact you to confirm the request. Verification can include matching account details or government ID.

26. Anonymized Data & Research

We may share de-identified or aggregated data for analytics or research. We do not attempt to re-identify such data and contractually prohibit recipients from doing so.

27. Australia & New Zealand Supplement

This section applies to residents of Australia and New Zealand and supplements the rights described elsewhere in this Policy.

Australia — Privacy Act 1988

We handle personal information in line with the 13 Australian Privacy Principles (APPs). Australian residents have rights to:

• Access personal information we hold about you (APP 12)
• Correction of inaccurate, out-of-date, incomplete, irrelevant or misleading information (APP 13)
• Anonymity / pseudonymity where lawful and practicable (APP 2)
• Opt out of direct marketing (APP 7)
• Notification of eligible data breaches under the Notifiable Data Breaches scheme

Cross-border disclosures of Australian personal information are made under written contractual safeguards consistent with APP 8. Complaints can be lodged with the Office of the Australian Information Commissioner (OAIC) after first contacting privacy@upmos.com.

New Zealand — Privacy Act 2020

We follow the 13 Information Privacy Principles (IPPs). New Zealand residents have rights to:

• Access personal information about themselves (IPP 6)
• Correction of personal information (IPP 7)
• Notification of notifiable privacy breaches under Part 6
• Complaint to the Privacy Commissioner if we fail to address concerns

Where personal information is sent outside New Zealand, we use providers in countries with comparable privacy safeguards or contractual protections consistent with IPP 12. File complaints with the Office of the Privacy Commissioner (NZ).

How to Exercise These Rights

Email privacy@upmos.com with the subject line “AU Privacy Request” or “NZ Privacy Request”. We will acknowledge within 10 business days and respond within 30 days (extendable by a further 30 days for complex requests with notice).

28. California Supplement (CCPA/CPRA)

California Consumer Privacy Act Rights

Right to Know: Request categories and specific pieces of data collected in past 12 months.

Right to Delete: Request deletion of personal information (subject to exceptions).

Right to Opt-Out of Sale: We do NOT sell personal information. No opt-out needed.

Right to Correct: Request correction of inaccurate information.

Right to Limit Use of Sensitive Personal Information: Limit use of sensitive data.

Shine the Light Law

California residents may request information about disclosure of personal information to third parties for direct marketing (once per year). Email privacy@upmos.com.

Do Not Sell or Share

We do NOT sell or share personal information for cross-context behavioral advertising.

Authorized Agent

California residents may designate authorized agents to submit requests. Agent must provide written authorization.

Non-Discrimination

We will NOT discriminate against you for exercising CCPA rights (deny services, charge different prices, provide different quality).

29. Virginia Supplement (VCDPA)

Virginia Consumer Data Protection Act (effective Jan 1, 2023) grants Virginia residents:

• Right to Access: Confirm and access personal data
• Right to Correct: Correct inaccuracies
• Right to Delete: Delete personal data
• Right to Data Portability: Obtain copy in portable format
• Right to Opt Out: Opt out of targeted advertising, sale, profiling
• Appeal Rights: Appeal denials; if denied again, you may contact the Virginia Attorney General.
• GPC: We honor Global Privacy Control signals as an opt-out request.

Exercise Virginia rights at privacy@upmos.com. Appeals: privacy-appeals@upmos.com. Virginia Attorney General: File a Complaint

30. Colorado Supplement (CPA)

Colorado Privacy Act (effective July 1, 2023) grants Colorado residents:

• Access & Portability: Access and obtain copy of data
• Correction: Correct inaccurate data
• Deletion: Delete personal data
• Opt Out: Opt out of targeted advertising, sale, profiling for significant decisions
• Appeal Window: 45 days to respond; you may appeal within 45 days of a denial.

Colorado residents may appeal decisions at privacy-appeals@upmos.com within 15 days.

31. Canadian Supplement (PIPEDA)

Personal Information Protection and Electronic Documents Act applies to Canadian residents:

Accountability & Consent

We are accountable for personal data in our possession. We obtain meaningful consent for collection, use, disclosure.

Cross-Border Transfers

Data may be processed in USA. We use contracts and safeguards to protect data transferred outside Canada.

Canadian Privacy Commissioner

File complaints with Office of the Privacy Commissioner of Canada

Quebec Law 25

Quebec residents have additional rights under Quebec’s modernized privacy law. Contact privacy@upmos.com for Quebec-specific requests.

32. UK GDPR Supplement

This section applies to residents of the United Kingdom and supplements the rights set out in §9 (Your Privacy Rights). The UK GDPR and the Data Protection Act 2018 (DPA 2018) govern our processing of UK personal data.

Your Rights Under UK GDPR

• Right of access — obtain a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure (“right to be forgotten”) — subject to legal-retention exceptions
• Right to restrict processing — pause certain uses pending verification
• Right to data portability — receive your data in a structured, commonly used, machine-readable format
• Right to object — including objection to direct marketing (absolute) and to profiling
• Rights related to automated decision-making — including a meaningful human review
• Right to withdraw consent — where processing is based on consent
• Right to lodge a complaint with the ICO

Lawful Bases for UK Processing

We rely on the same lawful bases described in §4 (Legal Basis for Processing): contract, legitimate interests, consent, legal obligation, vital interests, and public interest, as applicable.

International Transfers from the UK

Where we transfer UK personal data outside the UK, we use the ICO’s International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum, supplemented by Transfer Risk Assessments where required.

UK Representative & Data Protection Officer

UK-specific privacy requests, including subject access requests under Article 15 UK GDPR, may be sent to privacy-uk@upmos.com. We respond within one calendar month (extendable by up to two further months for complex or numerous requests, with notice).

Supervisory Authority

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · Online: ico.org.uk/make-a-complaint

33. Policy Updates & Amendments

How We Update

We may update this policy to reflect changes in practices, laws, or Services. Material changes will be communicated via:

• Email notification (if you have account)
• Prominent website notice
• Updated “Last Updated” date at top

Your Rights on Changes

Continued use after changes constitutes acceptance. If you disagree, discontinue use and request account deletion.

Changelog

• May 15, 2026 (v1.3): Unwrapped broken collapsible-disclosure containers on sections 27–32 so AU/NZ, California, Virginia, Colorado, Canada, and UK GDPR supplements render as full sections instead of collapsed empty pills. Removed stray empty contact-info container. Enriched AU/NZ and UK GDPR sections with rights enumerations, transfer mechanisms, and supervisory-authority details.
• May 13, 2026 (v1.2): Added Cloudflare IP geolocation disclosure for country/region/city derived from request headers; updated Cloudflare processor scope.
• May 12, 2026 (v1.1): Restored pill-chip navigation and In Plain English summary; rebuilt jump-bar into three categorized columns; readability hardening for light + dark mode.
• May 11, 2026 (v1.0): Initial publication under the Upmos Gold Standard policy format with accessibility chrome, JSON-LD schema, dark mode, reading progress, two-column TOC, jump-bar, and Department Directory.
• December 31, 2025: Pre-Gold-Standard refresh: added minors, AI, DNT/GPC, financial incentives, agent verification, anonymization, AU/NZ supplement.
• January 1, 2024: Prior comprehensive refresh and supplemental rights alignment.

34. Contact Us

Data Protection Officer
UPMOS Inc.
Email: privacy@upmos.com
Website: https://upmos.com
Response Time: 30 days

EU Representative (GDPR)
Email: gdpr@upmos.com

UK Representative (UK GDPR)
Email: privacy-uk@upmos.com

California Privacy Rights (CCPA)
Email: privacy@upmos.com
Toll-Free: 1-800-UPMOS-CA

Security & Responsible Disclosure
Email: security@upmos.com
PGP Key: Available at upmos.com/security