UpScale Privacy Policy  

Introduction

 
This Privacy Policy outlines UpScale (" we ", " our " or " the Company ") practices with respect to information collected from users who access our website at www.upscale.lat (" Site "), or otherwise share personal information with us (collectively: " Users "). 

Privacy Policy
Last updated: March 30th, 2026

Who We Are

UpScale is a recruitment agency registered in Spain. We act as a data controller in respect of the personal data we collect and process.

Contact details:
Company name: UpScale
Registered address: Maiquez 38, Madrid, Spain. 28009
Email: privacy@upscale.lat
Data Protection contact: manuel@upscale.lat

If you are located in the EU, you have the right to lodge a complaint with your local supervisory authority. A full list of EU supervisory authorities is available at edpb.europa.eu.


What Personal Data We Collect

We collect and process the following categories of personal data about candidates:

  • Full name, email address, phone number, and postal address
  • CV, work history, educational qualifications, and professional certifications
  • Skills, languages, and areas of expertise
  • Right to work status and nationality (where required by law or a client)
  • References provided by you or on your behalf
  • Notes and records from interviews or communications with us
  • Data provided voluntarily in this website: when registering for our newsletter, in our Contact page, and in our Talent Network page.

We collect this data directly from you (e.g. when you submit your CV or contact us), from third parties such as job boards, or from publicly available sources such as LinkedIn.


Why We Process Your Data and Our Legal Basis

We process your personal data for the following purposes, relying on the legal bases set out under Article 6 of the GDPR.

We match you with suitable job opportunities and communicate with you about your job search on the basis of our legitimate interests (Article 6(1)(f)). We have assessed that these interests do not override your rights and freedoms as a data subject.

Where we submit your profile to a prospective employer, we do so on the basis of either your consent or our legitimate interests, depending on the context and the nature of the role.

Where required by law — for example, carrying out right to work checks — we process your data to comply with a legal obligation (Article 6(1)(c)). We also retain records of placements on this basis, as well as on the basis of our legitimate interests.

Where we rely on consent as our legal basis, you may withdraw it at any time by contacting us at privacy@upscale.lat

Withdrawing consent does not affect the lawfulness of any processing that took place before the withdrawal.


Who We Share Your Data With

We may share your personal data with:

  • Prospective employers and client companies – only with your knowledge and for the purpose of pursuing a role you are interested in
  • IT and software service providers – such as our CRM or applicant tracking system, who act as data processors under contract
  • Professional advisers – such as legal or compliance consultants, under strict confidentiality obligations
  • Regulatory or public authorities – where required by law
We do not sell your personal data to third parties.


How Long We Keep Your Data

We retain your personal data for as long as is necessary for the purposes described in this policy:

  • Active candidates: We retain your data for up to 2 years from your last interaction with us, so we can contact you about relevant opportunities.
  • Placed candidates: We retain your data for 5 years following a placement to comply with legal and contractual obligations.
  • After these periods, your data is securely deleted or anonymized.
You may ask us to delete your data at any time (see Section 7).


Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

  • Right of access – to obtain a copy of the personal data we hold about you
  • Right to rectification – to correct inaccurate or incomplete data
  • Right to erasure – to request deletion of your data ("right to be forgotten")
  • Right to restrict processing – to ask us to pause processing in certain circumstances
  • Right to data portability – to receive your data in a structured, machine-readable format
  • Right to object – to processing based on legitimate interests
  • Right to withdraw consent – at any time, where processing is based on consent

To exercise any of these rights, please contact us at privacy@upscale.lat

We will respond within one month of receiving your request. This period may be extended by a further two months for complex or numerous requests, in which case we will notify you.

You also have the right to lodge a complaint with your national supervisory authority if you believe we have not handled your data in accordance with GDPR.


Cookies

Our website may use cookies. Please refer to our Cookies section for full details. You may manage your cookie preferences at any time via your cookie settings or with our consent banner.


Security

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or disclosure. These include: encrypted data storage, access controls, staff training on data protection, among others.

Despite our efforts, no data transmission over the internet is completely secure. If you have reason to believe that your data has been compromised, please contact us immediately.

Cookies

We and our trusted partners use cookies and other technologies in our related services, including when you visit our Site or access our services. 

A "cookie" is a small piece of information that a website assign to your device while you are viewing a website. Cookies are very helpful and can be used for various different purposes. These purposes include allowing you to navigate between pages efficiently, enable automatic activation of certain features, remembering your preferences and making the interaction between you and our Services quicker and easier. Cookies are also used to help ensure that the advertisements you see are relevant to you and your interests and to compile statistical data on your use of our Services. 

The Site uses the following types of cookies:

a. 'session cookies' which are stored only temporarily during a browsing session in order to allow normal use of the system and are deleted from your device when the browser is closed; 

b. 'persistent cookies ' which are read only by the Site, saved on your computer for a fixed period and are not deleted when the browser is closed. Such cookies are used where we need to know who you are for repeat visits, for example to allow us to store your preferences for the next sign-in; 

c. 'third party cookies' which are set by other online services who run content on the page you are viewing, for example by third party analytics companies who monitor and analyze our web access.

Cookies do not contain any information that personally identifies you, but Personal Information that we store about you may be linked, by us, to the information stored in and obtained from cookies. You may remove the cookies by following the instructions of your device preferences; however, if you choose to disable cookies, some features of our Site may not operate properly and your online experience may be limited.

We also use a tool called “Google Analytics” to collect information about your use of the Site. Google Analytics collects information such as how often users access the Site, what pages they visit when they do so, etc. We use the information we get from Google Analytics only to improve our Site and services. Google Analytics collects the IP address assigned to you on the date you visit sites, rather than your name or other identifying information. We do not combine the information collected through the use of Google Analytics with personally identifiable information. Google’s ability to use and share information collected by Google Analytics about your visits to this Site is restricted by the Google Analytics Terms of Use and the Google Privacy Policy.

Third party collection of information

Our policy only addresses the use and disclosure of information we collect from you. To the extent you disclose your information to other parties or sites throughout the internet, different rules may apply to their use or disclosure of the information you disclose to them. Accordingly, we encourage you to read the terms and conditions and privacy policy of each third party that you choose to disclose information to. 

This Privacy Policy does not apply to the practices of companies that we do not own or control, or to individuals whom we do not employ or manage, including any of the third parties which we may disclose information as set forth in this Privacy Policy. 

Transfer of data outside the EEA 

Please note that some data recipients may be located outside the EEA. In such cases we will transfer your data only to such countries as approved by the European Commission as providing adequate level of data protection, or enter into legal agreements ensuring an adequate level of data protection.

Marketing

We may use your Personal Information, such as your name, email address, telephone number, etc. ourselves or by using our third party subcontractors for the purpose of providing you with promotional materials, concerning our services, which we believe may interest you.  

Out of respect to your right to privacy we provide you within such marketing materials with means to decline receiving further marketing offers from us. If you unsubscribe we will remove your email address or telephone number from our marketing distribution lists. 

Please note that even if you have unsubscribed from receiving marketing emails from us, we may send you other types of important e-mail communications without offering you the opportunity to opt out of receiving them. These may include customer service announcements or administrative notices.

Corporate transaction

We may share information in the event of a corporate transaction (e.g. sale of a substantial part of our business, merger, consolidation or asset sale). In the event of the above, the transferee or acquiring company will assume the rights and obligations as described in this Privacy Policy.

Updates or amendments to this Privacy Policy

 We reserve the right to periodically amend or revise the Privacy Policy; material changes will be effective immediately upon the display of the revised Privacy policy. The last revision will be reflected in the "Last modified" section. Your continued use of the Platform, following the notification of such amendments on our website, constitutes your acknowledgment and consent of such amendments to the Privacy Policy and your agreement to be bound by the terms of such amendments.


Contact Us

For any questions, requests, or concerns relating to this privacy policy or the way we handle your data, please contact:
UpScale
Maiquez 38, Madrid, Spain. 28009
privacy@upscale.lat