Impact Up acts as data controller for personal data processed through the Impact Flows platform, except where it acts strictly on behalf of a customer under a separate contract or data processing agreement.
1. Data categories
We may process identity data, contact details, association information, billing and payment context, KYC documents, support requests, security logs, and technical usage data necessary to operate the service.
2. Purposes and legal bases
- Service delivery and account management: contract performance.
- Fraud prevention, platform security, and regulatory controls: legal obligation and legitimate interests.
- Analytics or marketing technologies: consent where required.
- Support, incident response, and service improvement: legitimate interests.
3. Retention
Personal data is retained only for the period necessary to provide the service, satisfy legal or accounting obligations, enforce rights, and manage disputes or security investigations.
4. Recipients
Data may be disclosed to authorized internal staff and vetted subprocessors involved in hosting, payments, communications, identity verification, and technical operations, strictly on a need-to-know basis.
5. International transfers
Where personal data is transferred outside the European Economic Area, Impact Up applies appropriate safeguards such as standard contractual clauses or equivalent lawful transfer mechanisms.
6. Your rights
Subject to applicable law, you may request access, rectification, deletion, restriction, portability, or object to certain processing. You may also withdraw consent at any time where processing relies on consent.
7. Security measures
Impact Up implements technical and organizational measures designed to protect confidentiality, integrity, and availability, including access controls, audit logging, environment segregation, and security monitoring.
8. Data Processing Agreement (DPA)
Where Impact Up processes personal data on behalf of a customer acting as data controller, the relationship may be governed by a Data Processing Agreement describing subject matter, duration, security commitments, subprocessors, and assistance obligations.
The current DPA can be accessed here: Impact Flows DPA (PDF).
9. Contact and complaints
For privacy-related requests, contact legal@impactup.io. You may also lodge a complaint with the competent supervisory authority, including the CNIL in France.
Full details are available in the Privacy Policy (PDF).