Legal

Privacy Policy

Last updated: July 26, 2026 · Effective date: July 26, 2026

This Privacy Policy explains how SCALEUP Group, s.r.o. collects, uses, stores, and protects your personal data in connection with SCALEUP.report, in accordance with Regulation (EU) 2016/679 (GDPR), Czech Act No. 110/2019 Coll. on the Processing of Personal Data, and other applicable legislation.

Data Controller

1. Personal Data We Collect

We collect personal data only to the extent necessary for the purposes described in this Policy. The categories of personal data we process include:

• Contact & identification data: first name, last name, work email address, phone number, company or firm name, job title or role, and company website.
• Inquiry data: information you provide when requesting an assessment, including your primary use case, decision timing, and details about the company, stage, and questions relevant to the report.
• Communication data: the content of messages sent through contact forms, email, or other channels.
• Technical data: IP address, browser type and version, operating system, referral source, pages visited, and time and date of access.
• Cookies and similar technologies: see Section 8 below.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6(1) GDPR:

• Consent (Art. 6(1)(a)): where you have given clear consent for a specific purpose.
• Contract performance (Art. 6(1)(b)): where processing is necessary to take steps at your request prior to entering into a contract, or to perform an agreed engagement.
• Legitimate interests (Art. 6(1)(f)): where processing supports our legitimate interests, such as responding to inquiries, improving our services, website analytics, and fraud prevention, provided these interests are not overridden by your fundamental rights.
• Legal obligation (Art. 6(1)(c)): where processing is necessary for compliance with Czech or EU legal obligations (e.g., tax, accounting).

3. Purposes of Processing

We use your personal data to: respond to assessment inquiries submitted through the website; scope and deliver SCALEUP.report engagements; send relevant communications about our services (with consent or based on legitimate interest for existing clients); perform website analytics and performance optimization; and comply with legal and regulatory obligations under Czech and EU law.

4. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Inquiry and contact data are retained for 2 years from the date of last communication; client and engagement data are retained for the duration of the contractual relationship plus 5 years in accordance with Czech Act No. 563/1991 Coll. on Accounting and Act No. 235/2004 Coll. on VAT; website analytics data are retained for up to 260 months.

5. Data Sharing & Transfers

We do not sell your personal data. We may share personal data with: SCALEUP Group affiliated entities and brands for coordinated service delivery; trusted service providers who process data on our behalf (hosting, email, analytics, CRM) under appropriate Data Processing Agreements (Art. 28 GDPR); professional advisors (legal, accounting, audit) under confidentiality obligations; and public authorities where required by Czech or EU law.

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914, or an adequacy decision by the European Commission.

6. Your Rights

Under the GDPR and Czech data protection law, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing (Art. 21), withdrawal of consent at any time (Art. 7(3)), and the right not to be subject to automated decision-making (Art. 22).

To exercise any of these rights, please contact us at privacy@scaleup.report. We will respond within 30 days as required by Art. 12(3) GDPR. If you are not satisfied with our response, you have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ)

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, in accordance with Art. 32 GDPR. These measures include encryption of data in transit (TLS/SSL), access controls and authentication, regular security assessments, and staff training on data protection.

8. Cookies & Tracking Technologies

This website uses cookies and similar technologies in accordance with Directive 2002/58/EC (ePrivacy Directive) as implemented by Czech Act No. 127/2005 Coll. on Electronic Communications. Strictly necessary cookies are used without consent as they are essential for website functionality. Analytics cookies (such as Google Analytics) are activated only with your consent. We do not use advertising or third-party tracking cookies. You can manage your cookie preferences through your browser settings at any time.

9. Children's Data

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. In accordance with Art. 8 GDPR and Czech law, if we become aware that we have collected data from a child under 16 without parental consent, we will take steps to delete such data promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any material changes will be posted on this page with an updated effective date. We encourage you to review this Policy periodically.

11. Contact

For any questions regarding this Privacy Policy or your personal data, please contact SCALEUP Group, s.r.o. at privacy@scaleup.report, Prague, Czech Republic.