Privacy Policy

Introduction

This Privacy Policy (“Policy”) describes the privacy practices for the App (as defined in the Terms and Conditions). References in this Policy to “Upstream” “we”, “us” or “our” relate to Upstream Mobile Commerce Limited, a limited company organized under the laws of England, with company number 9873874 and having its registered office at Marylebone House, 52 – 54 St John Street, London EC1M 4HF, United Kingdom. We control the ways your personal data is collected and the purposes for which your personal data is used by us, acting as the “data controller”  for the purposes of applicable European data protection legislation.

We are committed to respecting your privacy and complying with all applicable laws with respect to data protection. 

This Policy is effective as of 25 May, 2018, in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (“GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and other applicable data protection laws.

We recommend you to please read this Policy carefully to understand our policies and practices regarding your information and how we will treat it. This Policy is an integral part of the Terms of Use of our Website and Terms and Conditions and may be subject to modifications.

In the future our practices may change, and if appropriate, we will revise this Policy to reflect the changes. We’ll post the updated version here, and we’ll notify you if we think the changes will significantly impact the treatment of information you have already provided.

This Policy applies only to information we may collect or that you may provide when you purchase, download, install, register with, access or use the App, in e-mail, text and other electronic communications set through or in connection with this App and any other sources. This Policy does not apply to information that we collect offline or on any other Upstream apps or websites, including websites you may access through this App or you provide to or is collected by any third party. Our websites and apps and these third parties may have their own privacy policies, which we encourage you to read before providing information on or through them.

If you have any questions or concerns after reading this, please contact us at data.protection@upstreamsystems.com. 

Children under the age of 18

The App is not intended for children under 18 years of age, and we do not knowingly collect personal information from children under 18. 

If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at data.protection@upstreamsystems.com. 

Information we collect and how we collect it

We may collect information from and about users of the App directly from you when you provide it to us and/or automatically when you use the App. For example, when you get authenticated via mobile phone number (MSISDN) into our service. 

Information you provide to us

When you download, register with or use this App, we may ask you to provide information by which you may be personally identified, such as name, e-mail address, telephone number, geolocation, mobile device identification number, or any other identifier by which you may be contacted online or offline (“personal data” or “personal  information”), or that is about you but individually does not identify you.

This information includes: (i) Information that you provide by filling in forms on the App. This includes information provided at the time of using the App. We may also ask you for information when you report a problem with the App; (ii) records and copies of your correspondence (including e-mail addresses and phone numbers), if you contact us; (iii) Your responses to surveys that we might ask you to complete for research purposes; (iv) Other types of interaction that may be available via the App. 

By using the App you provide us with your phone number and you agree to receive text messages to that number from us. We may use your contact information to send you information about our App, to market to you, to help prevent spam, fraud, or abuse, and to help others find your account, including through third-party services and client applications. You may also unsubscribe from a notification by following the instructions contained within the notification or the instructions on our website.

Automatic information collection and tracking

When you download, access and use the App, it may use technology to automatically collect certain information, including but not limited to:

• Usage Details. When you access and use the App, we may automatically collect certain details of your access to and use of the App, including traffic data, logs and other communication data and the resources that you access and use on or through your device. These may include your IP address, browser type, operating system, the referring web page, pages visited, location, your mobile carrier, device information (including device and application IDs), search terms, or cookie information. 

•Device Information. We may collect information about your mobile device and internet connection, including the device’s unique device identifier, IP address, device manufacturer and model, operating system, internet browser type and version, mobile network information and the device’s telephone number. 

•Account status on the mobile network you are subscribed to. Account status may refer to telephone number (MSISDN), current credit balance and mobile network offerings you have opted-in to, including but not limited to, one-off or subscription-based, data bundles, call, SMS, data bundles, VAS services bundles and credit or data in advance bundles. It is the real-time information about user status. 

•Mobile Application Data. The App may access mobile applications downloaded and installed on your devide and collect information on each of these mobile applications, such as name, package Name, type (normal / system / hidden), last user access date/time, permissions requested and granted, aggregate data for a predefined period, data consumed, CPU time (foreground and background). We also collect aggregate information about the behaviour of such mobile applications on your device, such as types of information that is being collected on such other mobile applications.. The purpose of this is to better protect you from on-device malware and potentially unwanted programs (“PUP”)  and prevent fraudulent subscriptions.

•Malware and PUP Data. We collect data about the malware and PUPs that are detected by the App. We collect: The vendor name of the malware or PUP removed; An encrypted description of which database rule was used to remove the malware or PUP in question; Artifacts detected as malware, PUPs, or suspicious files; Information related to detected artifacts. The purpose of this is that we can track malware and PUP outbreaks and improve the efficacy of the App.

We also may use technologies to collect information about your usage of the App over time.

How we use your information

We use information that we collect about you or that you provide to us, including any personal information, to:

Provide you with the App, and any other information, products or services that you request from us.

Prevent fraud, allowing us to secure you against third-party fraudulent activity and PUPs.

Fulfill any other purpose for which you provide it.

Carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.

Notify you when App updates are available, and of changes to any products or services we offer or provide though it.

The usage information we collect helps us improve the App and deliver a customized experience by enabling us to:

-Estimate our audience size and usage patterns. 

-Identify you when you use the App.

-Research and Develop new functionalities on the App.

Legal Basis For Processing Your Personal Data

The law states that we can only process your personal data when there is a genuine reason to do so. 

We will have a lawful basis for processing your personal data when:

• We need to process your information in order to provide you with the App or to enter into a contract;

• You have consented to such processing;

• We have a legitimate interest for processing your data – e.g., for fraud prevention; network and information systems security; data analytics; enhancing, modifying or improving our services; identifying usage trends; and/or

• We are legally obliged to process it.

We collect your information for the following purposes:

PURPOSES	LEGAL BASIS
To provide you with the App, to respond to your requests and provide customer service	The processing is necessary for the performance of a contract or to take steps at the request of the data subject

Not providing your personal data may mean we are unable to provide you with the Service.

Disclosure Of Your Information

We may disclose aggregated and de-identified information about our users without restriction. In addition, we may disclose personal information that we collect or you provide:

• To our subsidiaries and affiliates

• To contractors, service providers, content providers, and other third parties we use to support our business, such as Google Analytics. We may share your private personal information with such service providers subject to obligations consistent with this Policy and any other appropriate confidentiality and security measures, and on the condition that the third parties use your private personal data only on our behalf and pursuant to our instructions.

• To fulfill the purpose for which you provide it.

• For any other purpose disclosed by us when you provide the information.

• With your consent.

• To comply with any court order, law or legal process, including to respond to any government or regulatory request.

• To enforce our rights arising from any contracts entered into between you and us, including the Terms of Use, this Policy.

• If we believe disclosure is necessary or appropriate to protect our rights, property, or safety or that of our customers, users, contractors or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction. 

Securing Personal Data

We have clearly defined Data Security Policies applied to the Service and the information we collect from it. These policies require the use of technologies and procedures that are fully compliant with global security standards, certifications and frameworks. These processes ensure data remain protected against:

• Accidental loss 

• Unauthorized access and processing of personal information

• Disaster (business continuity and recovery)

• Third-party risks or fraud attempts

Data Security Policies further apply when personal data are processed for privacy impact assessments and training of employees belonging to Upstream or partners.

The safety and security of your information also depends on you. We will never ask you to publicly expose personal information nor reveal personal communication details such as your phone number or your email address. 

You should not share your private information details (e.g. phone number) with anyone. The transmission of information via the Internet and mobile platforms is not completely secure. While we take reasonable precautions to protect your personal information, we cannot guarantee the security of your personal information. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures we provide.

Data Retention

In principle we will retain your information as long as required or permitted by applicable law to fulfill the purposes for which it was collected. We will retain and use your personal information as necessary to comply with our business requirements, legal obligations, resolve disputes, protect our assets, and enforce our agreements. Because these needs can vary for different data types in the context of different products or services, actual retention periods can vary significantly.. Afterwards, we will remove your personal data from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it.

Data Transfers 

Data may be transferred to outside of the country the App is available on within the group or to our business partners. In such case, we take measures to ensure it is protected to the same standards as on the country the Service is available on and always according to the GDPR requirements.  

Specifically, data may be transferred to secure data centers outside of the country the App is available on.  These data centers comply with global security standards and certifications. Processing of user data is done over encrypted secure connections, according to this Policy and the legal framework of the country the App is available on. Once data retention period is expired, a standardized data disposal process is applied, according to our GDPR compliant Data Disposal Policy.

Your Rights

Upstream respects the right of users to access and manage their data, according to the GDPR framework. 

As a Data Subject within the context of the GDPR, you are entitled to request:

• right of access: you have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed;

• right to rectification: you have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement;

• right to erasure: you have the right to obtain from the controller the erasure of personal data;

• right to restriction of processing: you have the right to request the restriction of processing your personal data;

• right to data portability: you have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit those personal data to another entity without hindrance from us;

• right to object: you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your Personal Data.

Contact Information

Privacy Concerns. If you have any concern or complaint about privacy on the App, please contact us at Upstream, Marylebone House, 52 – 54 St John Street, London EC1M 4HF, United Kingdom or email us at data.protection@upstreamsystems.com. We will do our best to respond to you in a timely and professional manner in order to answer your questions and resolve your concerns.

Permissions

	PERMISSIONS	HOW THEY ARE USED
1.	PACKAGE_USAGE_STATS	This permission is required for the app to be able to access data on the device/data usage of other apps in an aggregated manner in order to provide enhanced security against malware.
2.	INTERNET	Allows the application to access the Internet in order to retrieve and send information necessary for the malware detection process.
3.	WRITE_EXTERNAL_STORAGE	Allows the application to write/read information to external storage.
4.	REQUEST_DELETE_PACKAGES	Allows the application to request uninstallation of malware present on the device with the user’s consent.