PRIVACY POLICY

1) SCOPE OF APPLICATION

This policy applies to the use of UPCELLIA as a SaaS platform (CRM, sales, omnichannel messaging, and marketing), its website, and associated products and integrations, including, among others, integrations with Meta's WhatsApp Cloud API, Facebook/Instagram Messaging, and email.

2) COLLECTED DATA

We may collect the following categories of personal data:

• Personal identification data: name, surname, identity document (DNI, NIE, or passport), job title.
• Company identification data: organization name, employee range, city.
• Contact data: email, mobile phone number, and WhatsApp number.
• Professional data: curriculum vitae (CV), LinkedIn profile, portfolio, and videos requested as part of recruitment processes.
• Technical data: IP address, browser type, navigation data (cookies), activity logs, device identifiers, and usage information.
• Account and billing data: name and surname, company, Tax ID, address, email, phone, country, payment method.
• Communications: messages sent through the Upcellia support chat.
• Meeting recordings: meetings held through videoconferencing tools for support to advanced plan clients.

3) PURPOSE OF DATA PROCESSING

Personal data is processed for the following purposes:

• Manage internship or job applications.
• Attend to requests for information or demonstrations of the Upcellia platform.
• Improve the user experience on the website.
• Comply with legal, tax, and accounting obligations.
• Manage the commercial relationship with clients and users.
• Send service-related communications.
• Provide, maintain, and improve the Upcellia platform (CRM, messaging, and marketing).
• Manage integrations with third parties (e.g., WhatsApp Cloud API, Facebook, and Instagram).
• Customer service, technical support, and operational communications.
• Usage analytics and continuous service improvement.
• Regulatory compliance and defense against claims.

4) META INTEGRATIONS (WHATSAPP / FACEBOOK / INSTAGRAM)

Upcellia may connect with WhatsApp Cloud API and other Meta products when the client expressly enables it. In these cases, the data necessary for sending and receiving messages is processed, including contacts, identifiers, message content and metadata, templates, and delivery statuses. Messages sent from the Upcellia platform are routed through Meta's official API, according to the configuration made by the client. Upcellia clients are responsible for ensuring they have the necessary legal basis to communicate with their contacts and, if using templates, for complying with WhatsApp Business Messaging Policies and other applicable Meta policies. By activating these integrations, the client declares they know and accept Meta's and WhatsApp's conditions and policies.

5) LEGAL BASIS FOR PROCESSING

The legal basis for the processing of personal data is:

• Consent of the data subject (Art. 6.1.a GDPR): for commercial communications and the use of certain cookies or similar technologies.
• Execution of a contract (Art. 6.1.b GDPR): for the provision of the SaaS service, support, account management, and billing.
• Compliance with legal obligations (Art. 6.1.c GDPR): tax, accounting, and legal obligations.
• Legitimate interest (Art. 6.1.f GDPR): platform security, fraud or abuse prevention, product improvement, and aggregated analytics.

6) DATA PROCESSING OF CLIENTS LOCATED IN PERU

When Upcellia platform services are contracted by clients located in the Republic of Peru, the processing of personal data will be carried out, in addition to complying with Regulation (EU) 2016/679 (GDPR) when applicable, in accordance with current Peruvian regulations on personal data protection, in particular Law No. 29733 – Personal Data Protection Law, and its Regulations approved by Supreme Decree No. 003-2013-JUS. In these cases, the entity responsible for processing personal data will be Consultia Digital S.A.C., identified with RUC No. 20614694557, without prejudice to certain processing activities being carried out jointly or as a data processor by Consultia Digital Europa S.L., within the framework of the provision of the Upcellia SaaS service. The personal data processed will be used exclusively for the purposes described in this Privacy Policy and will not be processed for distinct or incompatible purposes. Data subjects located in Peru may exercise their rights of access, rectification, cancellation, and opposition (ARCO rights), as well as other rights recognized by Peruvian regulations, by communication directed to the following email: [email protected]

7) DATA RETENTION

Personal data will be retained in Upcellia's systems and corresponding servers while a commercial or employment relationship exists, or for the time necessary to comply with applicable legal obligations.

8) CONVERSATION RETENTION

Conversation history managed through the Upcellia platform will be retained depending on the plan contracted by the client. Depending on said plan, the history may be retained for a period of 2, 24, 36, or 48 months, with the sole purpose of allowing consultation, monitoring, and management of communications made through the platform. Once the corresponding retention period has ended, conversations will be securely deleted, unless there is a legal obligation requiring their retention for a longer period.