Information We Collect
When you respond to surveys hosted by the Network, we may collect information from you (“Response Data”), as further described below:
When you engage with a survey on the Network, you are granting Upwave permission to transfer and store your survey responses. If we collect self declared gender, or age, it is for the purpose of statistical analysis. We do not build or retain consumer profiles. We do not attempt to obtain real identification of consumers. These responses may be provided and/or sold to 3rd parties, such as Upwave’s Customers.
Survey Response Metadata
You also grant Company permission to transfer and store the “metadata” of your survey, including but not limited to: your operating system, your web browser, the time you completed each question of the survey, the amount of time it took you to complete each question of the survey, and the geographic location from which you engaged with the survey. All Survey Response Metadata may be provided to the Company’s customers.
We do not collect any Personally Identifiable Information from you. Your IP address is used to determine approximate geographic location and to ensure survey accuracy (avoiding bot attacks and for anti-fraud purposes). We do not store your IP address in raw form after your session completes. We do not run surveys across our Network that ask for any Personally Identifiable Information via a survey question. Company is not responsible for any special handling of Personally Identifiable Information that you submit unsolicited via a “free response” survey question on the Network.
Additionally, Upwave and its partners may collect data through owned and operated mobile applications using a pseudonymized identifier, for each mobile device, known as a mobile advertising ID (“MAID”). Each MAID allows us to identify a unique mobile device, although the User can reset their MAID at any given time resulting in the delinking of device and MAID. These MAIDs perform a similar role to cookies on our network, except within the context of mobile apps, rather than websites.
Our Disclosure Of Your Response Data And Other Information
Below are some circumstances in which we may share your Response Data with certain third parties who are not our customers, without further notice to you.
As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution or similar event, Response Data may be part of the transferred assets.
Agents, Consultants, And Related Third Parties
Company, like many businesses, sometimes hires other companies to perform certain business-related functions. When we employ another company to perform a function of this nature, we only provide them with the information that they need to perform their specific function.
Company may provide Response Data to our business partners in connection with the use and operation of the Company Services and other aspects of the Company business.
Company may disclose your Response Data if required to do so by law or in the good-faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of Company, (iii) act in urgent circumstances to protect the personal safety of users of the Network or the public, or (iv) protect against legal liability.
Relationships With Other Websites
Company takes reasonable steps to protect the Response Data provided to us from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or e-mail transmission or form of electronic storage is ever fully secure or error free. Please keep this in mind when disclosing any Response Data to Company.
Scope: This Policy applies to Personal Data that is transferred to Upwave in the U.S. from the EU.
Our Services: We provide a platform and tools (“Services”) that allow customers (“Customers”) to, among other things, follow standard industry practices to create consumer surveys. We power a network of publishers, including blogs, online magazines or video sites (“Network”) where consumers (“Survey Respondents”) can take surveys in exchange for access to premium content on the Network (for example, e-books, videos, downloads). We conduct consumer surveys on behalf of our Customers, who design the surveys and determine how the survey responses and any other data about Survey Respondents are used.
Types of Personal Data Collected: Personal Data means any information that can be used to identify an individual that is received from the EU and is recorded in any form.
When Survey Respondents engage with a survey on the Network, we collect certain data about Survey Respondents on behalf of our Customers, including:
- Survey responses: We collect and store the survey responses provided by Survey Respondents.
- Demographic Data: We collect demographics about Survey Respondents, such as gender and age range.
- Usage data: We collect data about how Survey Respondents and Survey Respondents’ device interact with the Network, including but not limited to: Survey Respondents’ operating system, web browser, device type, the time Survey Respondents completed each question of the survey, the amount of time it took Survey Respondents to complete each question of the survey, the IP address and the geographic location from which Survey Respondents engaged with the survey.
We also collect Personal Data that Customers provide to us when they register for an account on our website www.upwave.com (“Site”). The information we may collect includes Customers’ name, company name, location, email address, phone number, and account password (“Customer Data”).
For Survey Respondents:In operating the Network, we may use a technology called “cookies.” A cookie is a piece of information that the computers that host the Network gives to your browser when you access the Network. Our cookies help provide additional functionality to the Network and help us analyze Network usage more accurately. For instance, the Network may set a cookie on your browser that allows you to bypass engaging with a survey due to your previous completion of a survey. On most web browsers, you will find a “help” section on the toolbar. Please refer to this section for information on how to receive notification when you are receiving a new cookie and how to turn cookies off. We recommend that you leave cookies turned on because they allow you to take advantage of some of the Network’s features.
For all visitors of our Site:
Purposes of Data Processing: We process information, including Personal Data, about Survey Respondents that we collect for the purpose of providing the Services to Customers. We use Customer Data for the purpose of creating and maintaining Customers’ account; providing the Services to Customers; responding to and communicating with customers about Customers’ inquiries and requests; notifying Customers about offers, new services or other promotions.
YOUR PRIVACY CHOICES AND RIGHTS
You may have certain rights with respect to your Personal Information, in addition to any rights discussed elsewhere in this Policy. Please note your rights and choices vary depending upon factors like your location, your country/state of residence, the type of Personal information at issue, and whether the Personal Information is a Customer Record or Upwave Record, among other factors.
How to Control Your Communications Preferences
We do not target survey respondents with correspondence. If you do receive communications from us, you can stop receiving promotional email communications from Upwave, a Customer, and/or an affiliated third party by clicking on the “unsubscribe” “do not sell my personal information” or similar link provided in such communications, by texting a reply of “STOP”, by adjusting your account settings to reflect your communications preferences, or by contacting us as described below. We make every effort to promptly process all unsubscribe requests.
Rights Pursuant to Applicable Data Privacy Laws
Depending on your state/country of residency and the Personal Information at issue, you may be able to exercise certain legally mandated rights related to your Personal Information. Please refer to the other Sections of this Policy to determine your eligibility or contact us using the information below.
ADDITIONAL INFORMATION FOR RESIDENTS OF CALIFORNIA, VIRGINIA, COLORADO, CONNECTICUT, AND UTAH
California law requires us to provide California residents with certain specific information regarding how we collect, use, and share “personal information” as such term is defined in the California Privacy Rights Act and its implementing regulations (“CPRA”, which amended the California Consumer Privacy Act (known as the “CCPA”)). Following California’s passage of the CCPA, other states have passed similar data privacy laws, including the Virginia Consumer Data Protection Act (“VCDPA”), effective January 1, 2023; the Colorado Privacy Act (“CPA”), effective July 1,2023; the Connecticut Data Privacy Act (“CDPA”), effective July 1, 2023; and the Utah Consumer Privacy Act (“UCPA”), effective December 31, 2023.
For clarity and ease of reference, we may refer to CPRA, VCDPA, CPA, CDPA, and UCPA collectively as “State Data Privacy Laws”. In the event that one or more State Data Privacy Laws offers more or enhanced rights, privacy, or protections than the State Data Privacy Law applicable to you, we will endeavor to provide you with those additional and/or enhanced rights, privacy, or protection, though we may not be legally obligated to do so.
Sale of Information
California “Shine the Light” Disclosure
The California “Shine the Light” law (Cal. Civ. Code §1798.83) gives residents of California the right under certain circumstances to opt out of the sharing of certain categories of personal information (as defined in the “Shine the Light” law) with third parties for their direct marketing purposes. Upwave does not share your personal information (as defined in the “Shine the Light” law) with third parties for their own direct marketing purposes.
How We Source, Use, Disclose and Retain Personal Information for Business Purposes
The chart below details the categories of Personal Information we collect, the sources of such Personal Information, and how we use, share and retain such information for Upwave’s business purposes.
Upwave.com does NOT sell your data to third parties.
Information We Collect
We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:
A. Personal Identifiers.
B. Network Identifiers
A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.
Internet Protocol address
C. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).
A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.
D. Protected classification characteristics under California or federal law.
Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
E. Commercial information.
Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
F. Biometric information.
Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.
G. Internet or other similar network activity.
Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.
H. Geolocation data.
Physical location or movements.
I. Sensory data.
Audio, electronic, visual, thermal, olfactory, or similar information.
J. Professional or employment-related information.
Current or past job history or performance evaluations.
K. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).
Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.
L. Inferences drawn from other personal information.
Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Personal information does not include:
- Publicly available information from government records.
- De-identified or aggregated consumer information.
- Information excluded from the CCPA’s scope, such as:
- Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
- personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.
We obtain the categories of personal information listed above from the following categories of sources:
- Directly from data subjects. For example, when people answer a survey.
- Indirectly from our clients or their agents. For example, through information we collect from our clients in the course of providing services to them.
- Directly and indirectly from activity on our website (upwave.com). For example, from submissions through our website portal or website usage details collected automatically.
- From third-parties that interact with us in connection with the services we perform. For example, from customers that inform us of new workflows when launching new products and services.
Use of Personal Information
We may use or disclose the personal information we collect for one or more of the following business purposes:
- To fulfill or meet the reason for which the information is provided.
- To provide you with information, products or services that you request from us.
- To provide you with email alerts, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you.
- To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
- To improve our website and present its contents to you.
- For testing, research, analysis and product development.
- As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
- To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
- As described to you when collecting your personal information or as otherwise set forth in the CCPA.
- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Sharing Personal Information
We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.
In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:
Category A: Identifiers.
We disclose your personal information for a business purpose to the following categories of third parties:
- Our affiliates.
- Service providers.
- Third parties to whom you or your agents authorize us to disclose your personal information in connection with the products or services we provide to you.
In the preceding twelve (12) months, we have not sold any personal information.
Privacy Rights for Residents of California, Virginia, Connecticut, Colorado, Utah, and Residents subject to other State Data Privacy Laws.
If you are a resident of California, Virginia, Connecticut, Colorado, or Utah, applicable State Data Privacy Laws require us to provide you with some additional information about your rights with respect to your “personal information” (as defined in CPRA and similar State Data Privacy Laws). Specifically, CPRA, provides you with the right to:
o know what personal information we collected about you during certain periods, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we collected about you;
o delete personal information that we collected from you, subject to certain exceptions;
o correct inaccurate personal information that we maintain about you;
o opt-out of the sale or sharing of your personal information, to the extent we sell or share your personal information;
o limit the use or disclosure of sensitive personal information, to the extent we use such personal information beyond certain express uses, such as in furtherance of providing you our Platform and Services and ensuring their security and integrity;
o receive non-discriminatory treatment for the exercise of privacy rights conferred by CPRA, including an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of their rights described above or otherwise provided in CPRA.
One or more of the above rights may be available, in the same or substantially the same form, under one or more of the other State Data Privacy Laws in effect from time to time. Upwave respects the privacy of its candidates, its current and former employees, its Customers and their Applicants, and other users of the Platform and Services and will endeavor to honor the above requests regardless of state of residency.
If you would like further information regarding your legal rights under CPRA or any other State Data Privacy Law or would like to exercise any of the rights available under such laws, please contact us below.
We will honor the requests described above and otherwise available to you under applicable Data Privacy Laws, but these rights do not always apply, and exemptions exist that may be relied upon in denying or only partially fulfilling your request. We will usually, in response to a request, ask you to verify your identity and/or provide information that helps us to better understand your request. If we do not comply with your request, we will explain why. With regard to Customer Records, Applicants should direct requests to exercise applicable rights to the Customer on whose behalf we handle the subject Personal Information. If we receive a request from an Applicant directly in relation to Customer Records, we may refer that request to the appropriate Customer(s) and await each such entity’s instructions on how to process the request.
Requests Submitted by Authorized Representatives.
You may submit a request through someone holding a valid Power of Attorney or an authorized agent acting on your behalf. Authorized agents must have, and provide us with, written permission to make a request on your behalf and must provide necessary information to verify your own identity directly with us. We will require any purported authorized agent to submit proof of authorization to make requests on your behalf.
- ADDITIONAL INFORMATION FOR NEVADA RESIDENTS
Under Nevada law, certain Nevada residents may opt out of the “sale” of “covered information” (as such term is defined under Nevada law) for monetary consideration to a person for that person to license or sell such information to additional persons. “Covered information” includes first and last name, address, email address, phone number, Social Security Number, or an identifier that allows a specific person to be contacted either physically or online.
We do not engage in such activity; however, if you are a Nevada resident who has purchased or leased goods or services from us, you may submit a request to opt out of the sale of your covered information under Nevada law by emailing us below. Please note we will take reasonable steps to verify your identity and the authenticity of the request.
- ADDITIONAL INFORMATION FOR NON-U.S. RESIDENTS
Upwave only collects, processes, stores, and retains as much Personal Information as needed for the specific, identified purposes described in this Policy and/or our respective Customer’s privacy policies that may be applicable to your use of our Services. Upwave will not use your Personal Information in any way that is incompatible with the specific, identified purposes described in this Policy.
Personal Data Transfers Outside of the EEA, the UK, and Singapore
Upwave operates globally and, to facilitate our global operations, we may transfer your Personal Information to, and store, process, and/or access your personal information in accordance with applicable law from, the various global locations in which Upwave and/or its personnel operate. This includes the United States. Non-EEA countries may not offer the same level of personal data protection as EEA countries.
If you are located in the EEA, UK, Singapore or other regions with Data Privacy Laws governing data collection and use that may differ from United States Data Privacy Law, please note that we will transfer information, including Personal Information, to a country and jurisdiction that does not have the same Data Privacy Laws and related rights and protections as your jurisdiction, and you consent to the transfer of information to the United States or any other country in which Upwave, its subprocessors and/or other service providers maintain facilities and the use and disclosure of information about you as described in this Policy.
When your Personal Information is transferred outside the EEA, we will put in place adequate safeguards to ensure that such transfer is carried out in compliance with applicable data protection rules. An adequate level of protection for your Personal Information and other data may be accomplished using various means, including, where appropriate:
o notwithstanding the decision of the Court of Justice of the European Union in Case C-311/18, adhering to the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce;
o relying on a formal decision by the European Commission that a certain country ensures an adequate level of protection for personal data (a full list of such decisions may be accessed online here:
o entering into appropriate data transfer agreements based on language approved by the European Commission, such as the Standard Contractual Clauses (2021/915/EU, 2010/87/EC and/or 2004/915/EC), or the ICO and UK Parliament, such as the international data transfer agreement (IDTA) and the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum), which are each available upon request;
o implementing appropriate physical, technical and organizational security measures to protect personal information against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing;
o taking other measures to provide an adequate level of data protection in accordance with applicable law.
BY CHOOSING TO USE THE PLATFORM OR ANY OF OUR SERVICES, YOU EXPRESSLY AGREE THAT ANY DISPUTE OVER PRIVACY OR THE TERMS CONTAINED IN THIS POLICY WILL BE GOVERNED BY THE LAWS OF THE STATE OF CALIFORNIA WITHOUT REGARDS TO ITS CONFLICT OF LAWS PRINCIPLES, AND THE ADJUDICATION OF ANY DISPUTES ARISING IN CONNECTION WITH UPWAVE OR ITS SERVICES WILL BE IN ACCORDANCE WITH THIS POLICY AND UPWAVE’S TERMS OF SERVICE.
Rights of Access, Portability, Rectification, Erasure, Withdrawal, and Restriction/Limitation.
You may have the right to inquire as to whether Upwave is processing Personal Information about you, request access to that Personal Information, request your information in a portable format, restrict or limit certain processing, and ask that we correct, amend, or delete your Personal Information where it is inaccurate. You may also have the right to withdraw your consent where we previously obtained your consent for certain processing/uses without this withdrawal affecting the lawfulness of any processing that took place prior to the effectiveness of your withdrawal.
You can exercise such rights by accessing, removing, supplementing, and/or correcting the relevant information in your account, submitting a request by emailing us or by submitting a privacy request here. Note that in some cases we may not be able to erase your Personal Information, in which case we will let you know if we are unable to do so and why.
Accessing and Modifying Your Personal Information.
You may view and modify your personal information through your account settings. You may also submit a data subject access request through our privacy request portal here[JN6] .
If at any time you believe that an item of Personal Information about you is inaccurate and it cannot be updated through account settings, please contact us as described above as soon as possible with a description of the inaccuracy and the desired correction. We are committed to helping to maintain the accuracy and integrity of Personal Information we hold about you and endeavor to respond to rectification requests in a reasonable timeframe. Note that we may not be able to modify your information in all circumstances. For example, information we collect in the course of providing the Services is shared with a Customer and we do not control that information once it has been shared with the Customer.
Exercise of Rights Generally.
We will honor the requests described above and otherwise available to you under applicable Data Privacy Laws, but these rights do not always apply, and exemptions exist that may be relied upon in denying or only partially fulfilling your request. We will usually, in response to a request, ask you to verify your identity and/or provide information that helps us to better understand your request. If we do not comply with your request, we will explain why.
If you are not satisfied with our response to any of your requests, you have the right to make a complaint to the data protection authority in the jurisdiction where you live or work, or in the place where you think an issue in relation to your data has arisen. The contact details of each Data Protection Authority can be found at the following website: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm.
Access To Information; Contacting Company
You may contact us as follows:
Telephone: +1 (415) 745–8833
Postal Mail: Upwave, 1160 Battery Street East, Suite 100, San Francisco, CA 94111