Privacy Policy

Last updated: 20 July 2026

This Privacy Policy explains how Upheave technologies d.o.o. ("Upheave", "we", "us") collects and uses personal data when you visit upheave.tech, contact us, or book a call with us.

We only collect data we actually need, we tell you why, and we never sell it. If anything here is unclear, or you want to exercise your rights, contact us at office@upheave.tech.

1. Who we are (Data Controller)

Upheave technologies d.o.o.
Petračićeva ulica 6, 10000 Zagreb, Croatia
OIB: 61900348525
Email: office@upheave.tech

We are the data controller for personal data processed through this website. We have not appointed a Data Protection Officer, as we are not legally required to; privacy questions go directly to the address above.

2. What this policy covers

This policy applies to personal data we process through upheave.tech and directly related interactions (contact forms and call booking). It does not cover third-party websites we link to, or the software we build for clients under separate agreements.

3. What we collect, why, and on what legal basis

3.1 Contact and quote requests

When you use our contact form, we collect your full name, company/organization, business email, inquiry type ("I need a quote" / "general question"), and — if you provide them — your project description and budget range. We may also receive basic technical metadata (such as IP address and timestamp) when the form is submitted.

• Purpose: to respond to you, scope your request, and prepare a quote or proposal.
• Legal basis: taking steps at your request prior to entering a contract (GDPR Art. 6(1)(b)) and/or our legitimate interest in responding to business inquiries (Art. 6(1)(f)).
• Processor: Mailgun (email delivery); the submission itself is stored in our own content management system.
• Retention: for the duration of our correspondence and up to 24 months afterwards, unless a client relationship begins, in which case the data is retained under that engagement.

3.2 Booking a call

When you book a strategy call through our scheduling link, we collect your name, email, and any details you add to the booking. The scheduling is handled by Google (Appointment Scheduling / Calendar).

• Purpose: to schedule, confirm, and hold the call.
• Legal basis: steps prior to a contract at your request (Art. 6(1)(b)) and/or legitimate interest (Art. 6(1)(f)).
• Processor: Google.
• Retention: kept as part of our calendar records for as long as needed to manage the meeting and any follow-up.

3.3 Website analytics

To understand how the site is used and improve it, we process IP address (truncated/anonymized), device and browser information, pages visited, interactions, and approximate location.

• Purpose: to measure and improve website performance and usability.
• Legal basis: your consent for cookie-based analytics (Art. 6(1)(a)); our legitimate interest for aggregated, cookieless analytics (Art. 6(1)(f)).
• Processors: Google Analytics and Microsoft Clarity (both use cookies and run only after you consent; Clarity also records anonymized session interactions — clicks, scrolls, and mouse movement — to build heatmaps and session replays), and Vercel Analytics (cookieless, aggregated, and non-identifying).
• Retention: Google Analytics data for 14 months; Microsoft Clarity retains session recordings for 30 days and heatmaps (with a small sample of recordings) for up to 9 months; Vercel Analytics is aggregated and not tied to an individual.

3.4 Hosting and security logs

Our hosting provider automatically processes standard server data such as IP address, request metadata, and user-agent to serve the site and keep it secure.

• Purpose: to deliver the website, prevent abuse, and maintain security.
• Legal basis: our legitimate interest in a secure, functioning website (Art. 6(1)(f)).
• Processor: Vercel.
• Retention: kept only as long as needed for operational and security purposes, typically a short period.

4. Cookies

We use two categories of cookies:

• Necessary cookies — required for the site to function. These do not require consent and do not identify you.
• Statistics cookies — set by Google Analytics and Microsoft Clarity to measure site usage. These run only after you consent via our cookie banner. Vercel Analytics does not use cookies.

You can accept or reject non-essential cookies when you first visit the site, and change your choice at any time via the "Cookie settings" link in the footer. You can also block or delete cookies in your browser, though parts of the site may then not work as intended.

The specific cookies we use are:

5. Who we share your data with

We share personal data only with service providers ("processors") who act on our instructions under a data processing agreement, and only as needed for the purposes above:

• Mailgun (Sinch) — transactional email delivery for contact form notifications
• Google — call scheduling and website analytics
• Microsoft — website analytics and session insights (Clarity)
• Vercel — website hosting and cookieless analytics

We do not sell your personal data, and we do not share it for third-party advertising. We may disclose data where legally required (e.g. a valid request from a public authority).

6. International data transfers

Some of our processors (e.g. Google, Microsoft, Vercel, and Mailgun) are based in, or may process data in, the United States or other countries outside the EEA. Where data is transferred outside the EEA, we rely on an appropriate safeguard — an EU adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses — so that your data keeps an equivalent level of protection. Google, Microsoft, Vercel, and Mailgun are certified under the EU–US Data Privacy Framework and additionally rely on Standard Contractual Clauses.

7. How long we keep your data

We keep personal data only as long as necessary for the purpose it was collected for, as set out in Section 3, and then delete or anonymize it. Where the law requires a longer retention period (e.g. accounting records), we keep the data for that period.

8. How we protect your data

We apply appropriate technical and organizational measures to protect personal data against loss, misuse, and unauthorized access. Access is limited to people who need it, and we review our measures periodically. No method of transmission over the internet is fully secure, so we cannot guarantee absolute security.

9. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict or object to processing;
• data portability — receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent (this does not affect processing done before withdrawal).

To exercise any of these, email office@upheave.tech. We will respond within one month. Please identify yourself clearly so we don't act on the wrong person's data.

10. Complaints

If you believe we've handled your data improperly, you can lodge a complaint with the Croatian supervisory authority:

Agencija za zaštitu osobnih podataka (AZOP)
Ulica Metela Ožegovića 16, 10000 Zagreb
Email: azop@azop.hr
Web: https://azop.hr

You may also complain to the supervisory authority in your country of residence.

11. Third-party links

Our website may link to third-party sites (e.g. Clutch, LinkedIn). This policy does not apply to them, and we are not responsible for how they handle your data. Review their privacy policies before using them.

12. Changes to this policy

We may update this policy from time to time. The latest version always lives on this page, with the "Last updated" date at the top. Material changes will be communicated where reasonably possible.

13. Contact

Upheave technologies d.o.o.
Petračićeva ulica 6, 10000 Zagreb, Croatia
Email: office@upheave.tech
Website: https://upheave.tech