Privacy Policy

Scale Up Local ("Scale Up Local," "we," "us," or "our") is committed to protecting your privacy and handling your personal data responsibly. Scale Up Local is a marketing services provider based in the Netherlands that provides digital marketing services to local businesses.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have. It applies to our website, our services, and our communications with you. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Dutch data protection law.

1. Who We Are (Data Controller)

Scale Up Local is the controller responsible for the personal data described in this Policy. If you have any questions or wish to exercise your rights, contact us at:

Scale Up Local
Email: support@scaleuplocal.com

Where we process personal data on behalf of a business client as part of delivering our services (for example, data about that client's own customers), we act as a processor and the client is the controller. In that case, we process such data under our agreement with that client and their instructions.

2. Personal Data We Collect

We collect the following categories of personal data:

Information you provide directly

• Contact and identity data: name, business name, email address, phone number, and role.
• Account data: login credentials and preferences.
• Communications: messages, requests, and information you share with us by email, forms, chat, or our AI chat and voice assistants.
• Billing data: billing name, billing address, and transaction records. Payment card details are collected and processed directly by our payment processor (Stripe); we do not store full card numbers or card security codes.

Information we collect automatically when you use our website

• Technical and usage data: IP address, device and browser type, operating system, pages viewed, referring pages, and interactions with our site.
• Cookies and similar technologies: see Section 8.

Information from third parties

• Where you authorize us to manage your marketing, we may access data from advertising, analytics, listing, and business platforms (such as Google and Meta) connected to your accounts, in order to provide the services.

We do not intentionally collect special categories of personal data. Please do not send us sensitive personal data unless it is necessary and we have asked for it.

3. How We Use Your Data and Our Legal Bases

We use personal data for the purposes below. Under the GDPR, we rely on one or more of the following legal bases for each purpose:

Purpose	Legal basis
To respond to inquiries, provide quotes, and communicate with you	Performance of a contract, or our legitimate interest in responding to prospects, or your consent
To provide, operate, and deliver our services	Performance of a contract
To process payments, billing, and manage subscriptions	Performance of a contract; compliance with a legal obligation
To operate, secure, and improve our website and services	Legitimate interests (running and safeguarding our business)
To send service-related and administrative communications	Performance of a contract; legitimate interests
To send marketing communications	Your consent, or legitimate interests where permitted by law (with the ability to opt out)
To comply with legal, tax, and accounting obligations	Compliance with a legal obligation
To establish, exercise, or defend legal claims	Legitimate interests; compliance with a legal obligation

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You can ask us for more information about this balancing at any time.

Where we rely on consent (for example, for certain marketing or non-essential cookies), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

4. How We Share Your Data

We do not sell your personal data. We share personal data only as described below:

• Service providers and processors who help us operate, including:
  • Stripe — payment processing and billing.
  • Cloudflare and our hosting providers — website hosting, content delivery, and security.
  • Google and Meta (Facebook) — advertising, analytics, and campaign management carried out for you or for our own marketing.
  • AI and communication tools — providers that power our chat and voice assistants, email, analytics, and reporting.
• Professional advisors such as accountants, auditors, and lawyers, where necessary.
• Authorities and others where required to comply with the law, enforce our terms, or protect our rights, property, or safety, or those of others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality safeguards.

We require our processors to protect personal data and to process it only on our instructions and in line with applicable law, under a written data processing agreement.

5. International Data Transfers

We are based in the Netherlands. Some of our service providers are located in, or process data in, countries outside the European Economic Area (EEA), including the United States. Many of our clients and their end customers are also located in the United States.

Where we transfer personal data outside the EEA to a country that has not been recognized by the European Commission as providing an adequate level of protection, we put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses (SCCs), supplemented by additional measures where needed. You can request a copy of the safeguards we use by contacting us at support@scaleuplocal.com.

6. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, tax, accounting, or reporting requirements, and to establish or defend legal claims. In general:

• Prospect and inquiry data: kept while we are in contact and for a reasonable period afterward, then deleted or anonymized if no engagement follows.
• Client and account data: kept for the duration of our relationship and for a reasonable period afterward.
• Billing and transaction records: kept for the period required by applicable tax and accounting law (in the Netherlands, generally seven years).
• Website and usage data: kept for a limited period consistent with the purposes in Section 3 and our cookie settings.

When we no longer need personal data, we securely delete or anonymize it.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access — to obtain confirmation of whether we process your data and a copy of it.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have your data deleted in certain circumstances ("right to be forgotten").
• Restriction — to limit how we process your data in certain circumstances.
• Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Data portability — to receive certain data in a structured, commonly used, machine-readable format and to have it transferred to another controller where technically feasible.
• Withdraw consent — where we rely on your consent, to withdraw it at any time.
• Not to be subject to solely automated decisions that produce legal or similarly significant effects, except as permitted by law.

To exercise any of these rights, contact us at support@scaleuplocal.com. We will respond within the timeframe required by law (generally one month, which may be extended for complex requests). We may need to verify your identity before acting on a request. These rights are subject to conditions and exceptions under applicable law.

If we process your personal data on behalf of a business client (as a processor), please direct your request to that client; we will assist them as required.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies to make the site work, remember your preferences, measure performance, and support our marketing.

• Strictly necessary cookies are required for the site to function and do not require consent.
• Analytics, functional, and advertising cookies are used only with your consent where required by law.

Where required, we ask for your consent through a cookie banner and you can change or withdraw your preferences at any time. You can also control cookies through your browser settings; blocking some cookies may affect how the site works. For advertising and analytics, we may use tools from providers such as Google and Meta, which may set their own cookies subject to their privacy policies.

9. Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where required by law.

10. Children's Privacy

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us at support@scaleuplocal.com and we will delete it.

11. Third-Party Links

Our website and communications may contain links to third-party websites and services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. We encourage you to review this Policy periodically.

13. Contact and Complaints

If you have any questions, requests, or concerns about this Privacy Policy or how we handle your personal data, contact us at:

Scale Up Local
Email: support@scaleuplocal.com

If you are not satisfied with our response, you have the right to lodge a complaint with a data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), https://www.autoriteitpersoonsgegevens.nl. You may also contact the supervisory authority in your country of residence or place of work.