This Privacy Policy explains how GroundUp ("we", "us", or "our") collects, uses, stores, and shares your personal data when you use the GroundUp platform at groundup.app (the "Platform").
We are committed to protecting your personal information and your right to privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
GroundUp is the data controller for personal data collected through the Platform. If you have any questions about this policy or how we handle your data, please contact us at Groundupsponsors@gmail.com.
2. Data We Collect
2.1 Account Information
- Name, email address, and password when you register
- Profile information including organisation name, type, location, and description
- Logo and cover images you upload
2.2 Club and Sponsor Profile Data
- Membership numbers, funding targets, sponsorship goals, and offered assets
- Budget ranges, preferred sponsorship categories, and desired returns
- Social media reach and website URLs
2.3 Communications Data
- Messages sent through our secure in-platform messaging system
- Discovery call scheduling data including proposed times and meeting notes
- Deal room communications and negotiation records
2.4 Transaction and Payment Data
- Sponsorship deal values and agreed terms
- Payment processing data handled by Stripe Connect (we do not store card details directly)
- Transaction history and completed deal records
2.5 Technical and Usage Data
- IP address, browser type, and device information
- Pages visited, features used, and time spent on the Platform
- Cookie and tracking data (see our Cookie Policy)
2.6 AI Matching Data
Our AI compatibility engine processes profile data — including location, budget, category preferences, and sponsorship objectives — to generate match scores and recommendations. This processing is automated but you retain the right to request human review of any significant automated decision.
3. How We Use Your Data
- To provide the Platform: creating and managing your account, generating AI-powered matches, enabling messaging and deal management
- To process payments: facilitating secure transactions via Stripe Connect
- To improve the Platform: analysing usage patterns to improve features and fix issues
- To communicate with you: sending service notifications, updates, and support responses
- To comply with legal obligations: maintaining records required by law and responding to lawful requests
- To prevent fraud and misuse: monitoring for abuse of the Platform
4. Legal Basis for Processing
Under UK GDPR, we rely on the following legal bases:
- Contract performance: to deliver the services you have signed up for
- Legitimate interests: to improve our Platform, prevent fraud, and send relevant service communications
- Legal obligation: where processing is required to comply with applicable law
- Consent: for optional marketing communications and non-essential cookies
5. Data Sharing
We do not sell your personal data. We may share it with:
- Other users: your public profile information is visible to relevant clubs or sponsors on the Platform
- Stripe: for payment processing under their own privacy policy
- Infrastructure providers: hosting and database services that process data on our behalf under data processing agreements
- AI service providers: where third-party AI services assist with matching (subject to confidentiality obligations)
- Legal authorities: where required by law, court order, or to protect our legal rights
6. Data Retention
We retain your data for as long as your account is active, or as needed to provide our services. After account deletion:
- Profile data is deleted within 30 days
- Transaction and deal records are retained for 7 years for legal and accounting purposes
- Communications may be retained for up to 12 months after deal completion
7. Your Rights
Under UK GDPR, you have the right to:
- Access: request a copy of the personal data we hold about you
- Rectification: ask us to correct inaccurate or incomplete data
- Erasure: request deletion of your data ("right to be forgotten"), subject to legal obligations
- Restriction: ask us to limit how we use your data in certain circumstances
- Portability: receive your data in a structured, machine-readable format
- Object: object to processing based on legitimate interests
- Automated decisions: request human review of any significant automated decision made about you
To exercise any of these rights, contact us at Groundupsponsors@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
8. International Transfers
Where we transfer data outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions recognised by the UK government.
9. Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.
10. Children
GroundUp is not intended for use by individuals under the age of 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or via an in-platform notification. Continued use of the Platform after changes constitutes acceptance of the updated policy.
12. Contact Us
For any privacy-related questions or to exercise your rights, please contact:
GroundUp
Email: Groundupsponsors@gmail.com