Privacy Policy
Prolarys CommV, trading as ScaleUP Security ("ScaleUP Security", "we", "us" or "our") is a cybersecurity and compliance consulting company. We help startups and growing SaaS businesses achieve, maintain and grow security certifications and compliance programs such as SOC 2, ISO 27001, PCI DSS, GDPR and similar frameworks. We have prepared this Privacy Policy ("Policy") to summarize our online data protection practices. This Policy explains why we gather information, what types of information we collect, and how we use it.
We collect personal information when:
- you visit our website at scaleupsec.com;
- you contact ScaleUP Security by any means, such as sending an email or booking a call through our scheduling tool.
This Policy explains how the information you provide through our website is used, how you, as a data subject, can control the use of your personal data, and how to communicate with us on this subject if needed. It also explains why our website does not use cookies.
- We kindly recommend that you read this Policy before you start using our website. Your data will be processed only in the ways described in this Policy.
- Our website is not intended to be used by children under the age of 16, and we do not knowingly collect the personal data of children in this age group.
- This Policy is an inherent part of our website's Terms of Use. It may be updated at any time, so you should reread it and check for updates periodically.
- If you have any questions or comments about this Policy, please contact us at hello@scaleupsec.com.
WHO WE ARE AND WHO IS RESPONSIBLE FOR YOUR DATA
ScaleUP Security operates through two legal entities:
- ScaleUP Security Inc., incorporated in Canada (corporation number 2016433100), 1228 Berkley Drive NW, Calgary, Alberta T3K 1S9, Canada, which delivers our services to clients outside the European Union and is subject to Canada’s Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation;
- Prolarys CommV, a Belgian limited partnership (commanditaire vennootschap) with enterprise number BE 1014.428.077, Monteerderslaan 53, 9140 Temse, Belgium, which operates this website and is subject to the EU General Data Protection Regulation ("GDPR").
Prolarys CommV is the controller of the personal data processed through this website and of your communications with us — that is, the entity that determines the purposes and means of the processing. Where we pass your inquiry to ScaleUP Security Inc. so that it can serve you, ScaleUP Security Inc. becomes the controller of the data it receives and handles it in accordance with PIPEDA.
You may contact either entity on any privacy-related matter at hello@scaleupsec.com.
WHAT TYPES OF DATA ABOUT YOU DO WE COLLECT?
Data minimization. As a cybersecurity and compliance company, we apply the principle of data minimization to our own website. We collect only the limited personal data that is genuinely necessary to operate the website, respond to your inquiries and meet our legal obligations — and nothing more. We do not sell your personal data, and we do not use it for purposes that are incompatible with those described in this Policy. Please note that, under the GDPR, "personal data" is broad and includes online identifiers such as IP addresses and device identifiers; where we collect such data, we treat it as personal data and handle it in accordance with this Policy.
Subject to the above, we may collect the information described below, and we use it only to the extent set out in this Policy.
Information you provide to us
If you contact us by email, you provide personal data such as your name, email address, the content of your message and any information you choose to include. If you book a call through our scheduling tool (Calendly), you provide your name, email address, the time you choose and any answers to the optional booking questions, such as your company, what prompted the call and your deadline.
Information we obtain when you use and visit our website
When you visit our website, the following limited information is processed:
- Technical data that your browser sends with every request, such as your IP address, browser type and version, operating system and the page requested. Our hosting provider, Cloudflare, processes this data to deliver the website and to protect it against attacks, and keeps it only as long as needed for these purposes.
- Aggregated usage statistics collected with Umami, a privacy-friendly analytics tool that uses no cookies and does not identify you personally: for example, which pages are viewed, the referring website, the type of device and browser, the country, and clicks on buttons such as "Book a free call".
- No cookies. Our website does not place cookies on your device. See "DO WE USE COOKIES?" below.
WHY DO WE PROCESS YOUR PERSONAL INFORMATION?
We process your data only where we have a legal basis to do so. The legal basis depends on the reasons for which we collected your personal data and on the need to use it. Your personal data may be processed for the following purposes:
- you have agreed to a request on our website to use your personal data;
- processing is necessary to take steps at your request before entering into a contract, or to perform a contract;
- processing is necessary for our legitimate business interests;
- processing is necessary to comply with a legal obligation.
More specifically, the personal data you submit through this website, and the personal information we collect from you, will be used on the following legal grounds.
Communications — based on steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR, and our legitimate interest in responding to inquiries, Art. 6(1)(f) GDPR:
If you have contacted us through our website, your data may be processed to enable us to answer your questions and to arrange a call, meeting, video conference or other communication. Please note that such communications may be recorded and stored by a ScaleUP Security representative in our corporate systems.
Website analytics — based on our legitimate interest, Art. 6(1)(f) GDPR:
We use aggregated, cookieless statistics to understand how visitors use our website and to improve its content. These statistics do not identify you, and we do not use them for advertising or profiling.
Business relations— based on ScaleUP Security's legitimate interest, Art. 6(1)(f) GDPR:
As a representative of a current or potential client, business partner or vendor, your personal data may be processed for the following purposes:
- obtaining approvals;
- promoting our new products, work and services;
- confirming the level of our work and services;
- sending you invitations to meetings and events that we organize;
- signing and documenting contracts, invoices, acts or other contractual documents;
- complying with economic sanctions and export-control screening, fraud prevention and anti-money-laundering requirements, regulators' requirements, and other requirements relating to anti-corruption and industry standards.
Security — based on ScaleUP Security's legitimate interest, Art. 6(1)(f) GDPR:
As a visitor to this website, your personal data may be processed to keep the website secure, prevent fraud, protect the rights and interests of ScaleUP Security and third parties, and protect intellectual property rights.
WHO RECEIVES YOUR DATA?
We share your personal data only with service providers that help us run our website and our business, and only as far as they need it:
- Cloudflare (website hosting and protection);
- Umami (cookieless website statistics);
- Calendly (booking of calls);
- Google Workspace (email and business tools);
- ScaleUP Security Inc., our affiliated company in Canada, where it delivers services to you.
Some of these providers process data outside the European Economic Area, for example in the United States or Canada. In such cases we rely on an adequacy decision of the European Commission (such as for Canada, or for US companies certified under the EU–US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses.
Your personal information may also be disclosed:
- to the extent that we are required to do so by applicable law;
- in connection with any prospective or ongoing legal proceedings;
- to establish or defend our legal rights, including providing information to others for the purposes of fraud prevention and credit-risk reduction.
HOW CAN YOU CONTROL YOUR DATA?
As a data subject, you have the right to:
- ask whether your personal data is stored by us and, if so, what type of information it is, why we hold it and how we use it;
- request access to your data, so that you can receive a copy of the personal information we hold about you and verify that we are lawfully processing it;
- request that we correct the personal information we hold about you, so that any inaccurate or incomplete information can be fixed;
- request that your personal data be deleted where there is no good reason for us to continue holding it, or where you have exercised your right to object to processing (see below);
- object to the processing of your personal information where we rely on a legitimate interest (ours or a third party’s) and something about your particular situation makes you want to object, as well as where your data is processed for direct-marketing purposes;
- request that we restrict the processing of your personal data, for example so that we suspend processing while we verify whether we need to continue holding it;
- request the transfer of your personal data to you or to another party in a structured, commonly used electronic format;
- withdraw your consent to the transfer, collection or processing of your personal information for a specific purpose at any time. Once we receive notice that you wish to withdraw your consent, we will no longer process your data, unless we have another lawful basis to do so. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
- lodge a complaint with a supervisory authority. In Belgium, this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), www.dataprotectionauthority.be.
If you wish to discuss or exercise any of these rights, please contact us at hello@scaleupsec.com. We aim to respond to your request within one month.
We may need to request specific information from you to help us confirm your identity before granting access to your data or allowing you to exercise your other rights. This security measure ensures that your data is not disclosed to anyone who has no right to receive it.
HOW IS YOUR DATA RETAINED?
We take appropriate technical and organizational security measures to protect the personal information that we process, store or transmit. Your data is protected against accidental or unlawful destruction, access or alteration, unauthorized or unlawful disclosure, and loss. Your data is stored securely on our systems.
We will not retain your data for longer than is necessary for the purpose for which it is processed. To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal information, the purposes for which we process it and whether we can achieve those purposes by other means, and the periods for which we may need to retain the data to meet our legal obligations or to deal with complaints and queries, or to protect our legal rights in the event of a claim. When we no longer need your personal data, we will securely erase it.
As a guide: emails and booking details from prospective clients are kept for up to two years after our last contact, unless they become part of a client relationship. Website statistics are kept in aggregated form only.
Please note that the following information will be retained to the extent that we are required to do so by law, and where it is relevant to any prospective or ongoing legal proceedings:
- documents;
- electronic documents containing personal data.
This is done to establish, exercise or defend our legal rights, including providing information to others for the purposes of fraud prevention and credit-risk reduction.
DO WE USE COOKIES?
Cookies are small text files that websites place on your device. Our website does not use cookies: not for analytics, not for advertising and not for any other purpose. Our website statistics are collected without cookies (see above), which is why we do not show a cookie banner.
If you choose a language on our website, your browser may remember that choice locally on your device. This information is not sent to us, and you can clear it at any time in your browser settings. When you follow a link to an external service, such as Calendly or LinkedIn, that service’s own cookie and privacy policies apply.
YOUR PRIVACY RIGHTS IN CANADA (PIPEDA)
Where ScaleUP Security Inc., our Canadian company, handles your personal information, this is governed by Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and, where applicable, substantially similar provincial privacy legislation. In accordance with these laws:
- we collect, use and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and we identify those purposes at or before the time of collection;
- we obtain your consent to the collection, use and disclosure of your personal information, except where the law permits or requires otherwise. Consent may be express or implied, depending on the sensitivity of the information and the circumstances;
- you may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice;
- you have the right to access the personal information we hold about you and to request correction of inaccurate or incomplete information;
- we limit collection to what is necessary for the identified purposes, and we retain personal information only as long as necessary to fulfil those purposes or as required by law;
- we protect personal information with security safeguards appropriate to its sensitivity.
To exercise these rights, or to ask a question or make a complaint about how we handle your personal information, contact us at hello@scaleupsec.com. If you are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or to your applicable provincial privacy regulator.
DO YOU HAVE ANY QUESTIONS?
If you have any questions about this Privacy Policy, please contact us at any time at hello@scaleupsec.com.