Privacy Policy

The controller of your personal data is Olaf Nieliwodzki, ul. Warmińska 8, 12-130 Pasym, Poland (NIP 7451860369, REGON 525684696).

Write to us about your data at the address in the Contact section. We have not appointed a data protection officer.

• Your account: name, e-mail address, profile photo, phone number if you add one, account type and your password — stored only as a salted hash, never readable.
• A company's profile and billing: the company's name, website, logo and description, its invoice details (legal name, address, VAT number, invoice e-mail), its credits and payments, and — for auto top-up — a saved card's brand, last four digits and expiry. The full card number goes to our payment provider and never reaches us.
• A rep's profile: country and city, headline, years and situation in sales, typical deal size and biggest win, industries, territories, languages, skills, roles, network, the products you sell, your availability (hours per week) and the lowest commission you would consider — so companies can judge your applications.
• Listings, applications and messages between companies and reps — the marketplace itself.
• Reviews you write and the ones written about you.
• Verification: the documents and evidence you send to get verified, the time and link of a screening call and the invitations we send for it, and the call's report (its length and our notes).
• A rep's CV, when you add one: a PDF only our staff see — and the companies you applied to, if you allow it in your profile.
• Reports and flags about you or your listings, our staff's decisions on them and their notes.
• An audit log of every decision our staff take (who decided what, and when), kept for good as the record of how the marketplace is moderated.
• Your notification settings and the e-mails we send you (e-mail confirmation, password-reset and undo links, decisions, new messages, digests).
• Technical records: IP addresses and request logs, to keep the service secure and to find faults.

• To run your account and the marketplace — profiles, listings, applications, messages, reviews and the e-mails they need: to perform our agreement with you (GDPR art. 6(1)(b)).
• To take payments, issue invoices and keep accounting records: our legal obligations under tax and accounting law (art. 6(1)(c)).
• To verify accounts, moderate content, handle reports, keep the audit log, prevent fraud and keep the service secure: our legitimate interest in an honest and safe marketplace (art. 6(1)(f)).
• To send digests and new-opportunity e-mails: our agreement with you and our legitimate interest in telling you about matching work. You can switch each kind off in your notification settings.
• To establish, pursue or defend legal claims: our legitimate interest (art. 6(1)(f)).

Giving your data is voluntary, but without the details a form marks as required we cannot open an account or take an application. We do not sell your data or use it for advertising.

No decision with legal or similarly significant effect is made about you by automated means alone: matching only compares a listing's criteria with a rep's profile, and a person at the company decides on every application.

• Anyone can see a published listing's terms; the company's name and the full listing are shown to signed-in reps who confirmed their e-mail.
• The companies you apply to see your rep profile and your application — and, on a Screened-tier application, your screening report; after they accept it, both sides see the conversation.
• Once a company accepts an application, the rep and the company see each other's contact e-mail — and phone number, if one was added in Settings — to arrange a meeting: the company sees the rep's, the rep sees the address of the team member who accepted (or an owner's).
• Reps see the company's name only — never which member of its team wrote a message.
• Published reviews and the rating they add up to are shown on the reviewed rep's or company's profile and listings.
• Our staff can open a conversation to review a report about it or to look into a breach of the terms.
• Verification documents are seen only by our staff. We ask you to cover an ID document's number and your personal ID number before you upload it — or to show the document on your screening call instead, where nothing is recorded or kept. Our staff see what they need to verify accounts, review reports and keep the marketplace honest.

• Deleting your account can be undone for 14 days. After that it is purged: your name, e-mail address and profile are removed.
• A rep's messages stay in the company's conversation history after the rep's account is purged, shown under “Deleted user”: they are part of the company's records too.
• What a rep sends with an application — its note, and the reason given for withdrawing it — stays with the company that received it after the rep's account is purged, as their messages do.
• Reviews are removed when the account that wrote them, or the one they are about, is purged.
• A deleted company keeps only its name and verification status; its unused credits are forfeited, and only the record of its payments and credits is kept.
• Payments, credits and invoices are kept for as long as Polish tax and accounting law requires — five years from the end of the year in which the tax on the payment fell due.
• Team invitations keep the invited address for up to 30 days after they expire or are revoked; an accepted one is deleted when the membership ends.
• Verification documents are deleted 90 days after our decision on them.
• A CV is kept until you remove or replace it — the old file is deleted at once — or until your account is deleted.
• Request logs and error traces are kept for up to 30 days, and backups are overwritten within 30 days.

These providers process data on our behalf to run Upside Reps:

• Hetzner Online GmbH (Germany) — the servers Upside Reps runs on, in the European Union.
• Supabase, Inc. (USA) — the database, hosted in Frankfurt, Germany.
• Cloudflare, Inc. (USA) — our domain's name service, file storage and delivery (photos, logos, documents), and forwarding of e-mail sent to our addresses.
• Amazon Web Services EMEA SARL (Luxembourg) — sending our e-mails (Amazon SES), from Frankfurt, Germany.
• Google Ireland Limited (Ireland) — the Gmail mailbox where e-mail sent to our addresses is read, and Google Meet, used for screening calls.
• Stripe Payments Europe, Limited (Ireland) — payments. Card details go to Stripe and never reach us; Stripe also uses payment data as a controller for its own purposes, such as preventing fraud, under its own privacy policy.

Some of these providers, or their parent companies, are based outside the European Economic Area. Where your data may be accessed from there, it is protected by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Besides them, we disclose data to courts, the police and other authorities only when the law requires it.

Upside Reps uses only cookies it needs to work: to keep you signed in (session cookies), to send you to the right area after signing in, and to remember your language and time zone. Your browser also keeps an unsent message draft and a dismissed hint. There are no analytics, advertising or third-party cookies, so there is nothing to consent to.

Passwords are stored only as salted hashes. Every connection is encrypted (HTTPS); our servers sit on a private network that only the people who run Upside Reps can reach; verification documents are kept in private storage only our staff can open; and every staff decision is recorded in the audit log.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on our legitimate interest you can object at any time, and we then stop unless we have compelling grounds or need the data for legal claims. You can also complain to the supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

Much of this you can do yourself: correct your details in your profile and settings, and delete your account in its settings. For anything else, write to the contact address from your account's e-mail address; we may ask you to confirm the account is yours. We answer within one month — for a complex request we may take two more months and will tell you why.

Upside Reps is not for anyone under 18, and we do not knowingly collect their data.

When we change this policy we publish the new version here with its date. If a change affects how we use your data, we also e-mail account holders before it applies.

Write to us at support@upsidereps.com.