Privacy Policy

1. Data controller

The data controller responsible for the processing of your personal data is [PENDING: company name, tax ID and registered address of the controller].

Contact email: hola@uppyverse.com [PENDING: confirm whether there is a data protection officer]

2. What data we collect

We only collect data that is strictly necessary:

• Website waitlist: your email address and whether you sign up as a family or a professional, to tell you about the launch and send you Uppyverse news if you confirm your subscription.
• App account data: name and email address.
• Child-related data: age, developmental needs and the universe-based guidance you choose (not a diagnosis).
• Session data: schedule, objectives and notes generated by the professional (always under professional secrecy).
• Payment data: we do not store card details; payments are processed securely by our payment provider.

Your child’s health data is special category data. We will only process it with your explicit consent.

3. Purpose and legal basis

We process your data for the following purposes:

• Waitlist and news: to tell you about the launch and send you news; you can unsubscribe from any email (legal basis: consent, confirmed by email).
• Contact and guidance: to answer your enquiry and help you find the right professional (legal basis: consent).
• Service provision: to coordinate sessions between families and professionals (legal basis: contract execution).
• Quality and safety: to verify professionals and resolve incidents (legal basis: legitimate interest).
• Legal compliance: to meet tax and administrative obligations (legal basis: legal obligation).

4. Recipients

Your data is only shared with:

• Authorised Uppyverse staff.
• The professional you book with, bound by professional secrecy and a confidentiality agreement.
• Hosting and payment providers acting as data processors.
• Brevo, the service that manages the waitlist and sends our news (data hosted in the European Union), as data processor.
• Public authorities, only when required by law.

We never sell your data to third parties for advertising or marketing purposes.

5. Data retention

We keep your data for as long as necessary to fulfil the purposes described above. Once the relationship ends, data is blocked for the legally required periods (usually 5 years for tax purposes) and then securely deleted.

6. Your rights

You have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request erasure (“right to be forgotten”).
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.

To exercise your rights, send an email to hola@uppyverse.com with the subject “Data Rights”.

7. Security measures

We implement appropriate technical and organisational measures: encryption in transit (HTTPS/TLS), restricted access, secure servers within the European Economic Area, and regular security reviews.

8. Minors

We process minors’ data only with the explicit consent of their parent or legal guardian. Professionals are required to maintain professional secrecy regarding all information obtained during sessions.

9. Cookies

We only use technical cookies strictly necessary for the operation of the website. We do not use third-party tracking cookies without your explicit consent.

10. Changes to this policy

We may update this policy to reflect legal or operational changes. We will notify you of any significant changes via email or a prominent notice on the website.