1. Introduction

UpTheStreet ("we", "our", or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, process, and safeguard your information when you use our local services directory website and related services (the "Service").

We are the data controller for the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws in the European Union and the United Kingdom.

2. Information We Collect

2.1 Information You Provide

• Contact information (name, email address, phone number)
• Search queries and preferences
• Reviews and ratings you submit
• Account registration information
• Communications with our support team

2.2 Information We Collect Automatically

• IP address and location data
• Browser type and version
• Device information
• Usage patterns and interactions with our Service
• Cookies and similar tracking technologies

2.3 Information from Third Parties

• Publicly available business information
• Social media platforms (with your consent)
• Analytics and advertising partners

3. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Consent: When you explicitly agree to processing (e.g., marketing communications)
• Contract: To provide our services and fulfill our obligations to you
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Legal Obligation: To comply with applicable laws and regulations

4. How We Use Your Information

• Provide and improve our local services directory
• Process and respond to your inquiries
• Send you relevant updates and communications (with consent)
• Analyze usage patterns to enhance user experience
• Ensure the security and integrity of our Service
• Comply with legal obligations
• Prevent fraud and abuse

5. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third-party vendors who assist in operating our Service
• Business Partners: Local businesses featured in our directory (limited information only)
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In case of merger, acquisition, or asset sale

We do not sell your personal data to third parties. Any data sharing is governed by strict contractual agreements ensuring appropriate data protection measures.

6. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA). We ensure adequate protection through:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules
• Other appropriate safeguards under GDPR

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: Request copies of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for consent-based processing

To exercise these rights, contact us at [email protected]. We will respond within one month of receiving your request.

8. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy or as required by law. Retention periods vary based on:

• The type of data collected
• The purpose for processing
• Legal and regulatory requirements
• Your account activity and preferences

9. Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience. You can manage your cookie preferences through your browser settings or our cookie consent tool.

For detailed information about our cookie usage, please see our Cookie Policy.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication
• Staff training on data protection
• Incident response procedures

11. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected such information, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or through our Service. Your continued use constitutes acceptance of the updated policy.

13. Contact Information

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with your local data protection authority.

14. Supervisory Authority

For EU residents, you can contact your local data protection authority. For UK residents, you can contact the Information Commissioner's Office (ICO) atico.org.uk.