This Privacy Policy explains how UP Cocreate LLC ("UP Cocreate," "we," "us," or "our") collects, uses, and shares information about you when you visit upcocreate.com or engage with our professional services (collectively, the "Services"). By using the Services, you agree to the practices described here.
1. Who We Are
UP Cocreate is a professional services firm specializing in AI automation, data analytics, branding, strategic communications, and digital marketing. We work primarily with organizations — including NGOs, international development bodies, enterprises, and social enterprises — across the United States and internationally.
UP Cocreate
1550 Wilson Blvd, Suite 700 PMP 513
Arlington, VA 22209
United States
Email: hello@upcocreate.com
Phone (US): 929-356-4450
Phone (Costa Rica): +(506) 8660-0110
For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, UP Cocreate is the data controller of personal data collected through this website. For personal data processed in the context of our client engagements, the applicable role (controller or processor) is defined by the relevant client contract.
2. Data We Collect
2.1 Information You Provide
- Contact forms: Name, organization, job title, email address, phone number, and the content of your message when you submit an inquiry.
- Email correspondence: Any personal data contained in emails you send us.
- Client onboarding: Business contact information, organizational details, and other information necessary to establish a professional engagement.
2.2 Information Collected Automatically
- Usage data: Pages visited, time on page, clicks, referring URL, and navigation path.
- Device & browser data: Browser type and version, operating system, screen resolution, and language settings.
- IP address: Used for approximate geolocation (country/region), security, and analytics.
- Cookies & tracking technologies: See Section 11 and our Cookie Policy.
2.3 Information from Third Parties
- GoHighLevel (GHL): Our CRM and contact management platform. When you submit a form, your data is stored and managed in GHL under their Privacy Policy.
- Referrals: If a third party refers you to us, we may receive your name and contact information from that party.
3. How We Use Your Data
- Respond to inquiries: To follow up on contact form submissions and email inquiries.
- Deliver professional services: To communicate with you and manage our consulting engagement with your organization.
- Marketing communications: To send updates, thought leadership, and service announcements. You can opt out at any time.
- Analytics & site improvement: To understand how visitors use our website and to improve user experience.
- Security & fraud prevention: To detect and prevent unauthorized access and abuse.
- Legal compliance: To comply with applicable laws, regulations, and valid legal process.
We do not sell your personal data. We do not use it for automated decision-making that produces legal effects on you.
4. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases under Article 6 GDPR:
- Legitimate interests (Art. 6(1)(f)): Responding to business inquiries, maintaining client relationships, website analytics, and security. Our legitimate interests do not override your fundamental rights.
- Contractual necessity (Art. 6(1)(b)): Processing necessary to deliver professional services you or your organization have engaged us to provide.
- Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
- Legal obligation (Art. 6(1)(c)): Where processing is required to comply with applicable law.
5. Data Sharing
We share personal data only as necessary:
- Service providers: Third-party vendors who help us operate our business (CRM, hosting, analytics, email delivery). They are contractually bound to process data only for permitted purposes.
- GoHighLevel: Processes contact and inquiry data on our behalf as a service provider.
- Professional advisors: Lawyers, accountants, and auditors, subject to confidentiality obligations.
- Legal requirements: Where required by law, regulation, court order, or to protect our rights, safety, or property.
- Business transfers: In connection with a merger, acquisition, or asset sale, with prior notice where legally required.
We do not sell, rent, or trade personal data to third parties for their own marketing purposes.
6. International Data Transfers
We are based in the United States and have operations in Costa Rica. If you are located outside the US, your personal data may be transferred to and processed in the United States.
For transfers from the EEA or UK to the US, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission; and/or
- The EU-U.S. Data Privacy Framework and/or UK Extension, where our sub-processors are certified.
You may request a copy of the applicable transfer safeguards by contacting us at hello@upcocreate.com.
7. Data Retention
- Contact inquiries: Retained for up to 24 months after last contact, or until you request deletion.
- Client engagement data: For the duration of the engagement plus up to 7 years thereafter, as required for legal and financial record-keeping obligations.
- Server and access logs: Up to 90 days, then deleted or anonymized.
- Marketing opt-in lists: Until you unsubscribe or request removal.
When retention periods expire, data is securely deleted or irreversibly anonymized.
8. Your Rights
Depending on your location, you have some or all of the following rights:
Request a copy of personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion of your data in certain circumstances.
Ask us to restrict processing while a complaint is resolved.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests or for direct marketing.
Withdraw consent where processing is consent-based.
Complain to your local data protection authority.
To exercise any right, email hello@upcocreate.com with "Privacy Request" in the subject. We respond within 30 days and may verify your identity first.
To unsubscribe from marketing emails, click "Unsubscribe" in any email or contact us directly.
9. California Residents — CCPA / CPRA
California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
Categories of personal information collected
- Identifiers (name, email, phone, IP address)
- Professional or employment-related information (job title, organization)
- Internet or other network activity (website browsing behavior)
- Geolocation data (approximate, from IP address)
Your CCPA rights
- Right to Know: Details about data collected, used, and disclosed.
- Right to Delete: Request deletion, subject to exceptions.
- Right to Correct: Request correction of inaccurate data.
- Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for behavioral advertising.
- Right to Non-Discrimination: We will not discriminate for exercising CCPA rights.
Submit requests to hello@upcocreate.com with "CCPA Request" in the subject line. We have not sold or shared personal information in the preceding 12 months.
10. Children's Privacy
Our website and services are directed at professionals and organizations, not children. We do not knowingly collect personal data from children under 13. If you believe a child has submitted data to us, please contact us at hello@upcocreate.com and we will promptly delete it.
11. Cookies & Tracking Technologies
We use cookies and similar technologies on our website. For full details, please see our Cookie Policy. In summary:
- Strictly necessary: Site functionality. No consent required.
- Analytics: Aggregate usage data to improve the site. Requires consent where applicable.
- Marketing / CRM: GoHighLevel tracking to connect form submissions to web visits. Requires consent where applicable.
12. Security
We implement industry-standard technical and organizational security measures including:
- TLS/HTTPS encryption for all data in transit
- Access controls restricting data to authorized personnel
- Regular reviews of our systems and service providers
No transmission or storage method is 100% secure. If you become aware of a security issue involving your data, please notify us immediately at hello@upcocreate.com. In the event of a breach likely to affect your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by law.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date and, for material changes, notify you by email where we have your contact details. Continued use of the Services after changes constitutes acceptance of the updated policy.
14. Contact Us
For questions, requests, or concerns about this policy or your personal data:
UP Cocreate — Privacy
1550 Wilson Blvd, Suite 700 PMP 513
Arlington, VA 22209 · USA
hello@upcocreate.com
If you are in the EEA or UK and are not satisfied with our response, you have the right to complain to your local data protection authority. EEA supervisory authorities: edpb.europa.eu. UK: ico.org.uk.