Privacy Policy

Data controller

SPASU UpGrowth Connect, a single-shareholder simplified joint-stock company, Coopérative Hadjam Mohamed, Lot 19, Birkhadem, 16029 Algiers, Algeria

Identification

RC 25B1205167 · NIF 002516120516763 · NIS 002516120222168 · AI 16127017189 · Capital 100,000 DZD

Email

contact@upgrowth.dz

Phone

+213 550 34 01 79

Data protection officer

reachable at contact@upgrowth.dz, subject "Personal data" (Law 25-11, Art. 41 bis)

• Contact and application forms: name, company, phone, email, wilaya or country, requested service, message and form answers, page of origin, the artificial intelligence assistant that referred you to us where one did (for example ChatGPT), and, where present, advertising campaign parameters.
• Exchanges with our team: call notes and history, messages and emails about your request, status of your file.
• Setting up or changing your company, if you entrust it to us: the contact's name, phone and email; company name, legal form, capital, business activity, registered office and wilaya; name, role and share of each partner; numbers obtained (trade register, tax article, the manager's CASNOS membership, NIF, NIS); nature and date of the changes; progress of each file and its filings.
• Scanned copies of the documents handed over for the filings (identity papers, birth certificate, residence certificate, photos and specimen signature of the manager, a foreign partner's residence card, articles of association, lease and receipts): they may be stored in our console, encrypted, and only the company set-up team, management and the data protection officer can open them. The criminal record extract of a new manager is handed over in the original and never scanned.
• Personal tracking link, if we send you one: the page shows only the progress of your file (steps and dates, documents still expected from you, numbers obtained for the company, a message written for you by the person handling your file, and that person's first name). UpGrowth can deactivate the link at any time, and each opening of the page is logged.
• Platform account: identity, email, phone, password (stored only as a one-way hash), professional profile (education, experience, skills), consultants' supporting documents, projects and messages exchanged on the platform. Audio and video calls are not recorded.
• Online company creation order (UpGrowth Connect): legal form, number of shareholders, proposed names, main activity, registered address, amount and payment method, with your name, phone and email. It then opens your company's file.
• Data API, if you subscribe: client name (person or company), contact email, country, plan and billing currency, follow-up notes, dates of creation and of the end of the subscription. For each key: its beginning (the first 12 characters), its one-way hash, its daily limit and dates, and the number of calls per day. The key itself is never stored: it is shown once, when it is created.
• Data API without a key (free tier): no data about you is kept. Calls are counted in the server's memory, per IP address or, for assistants connected through MCP, per session, for the current day only. The address or session appears there only as a fingerprint that changes every day, and nothing is written to the database or to a file. The server logs described in the Browsing line below apply as for any visit.
• Payments: transaction reference and status. Card numbers are typed on the SATIM payment page and never reach UpGrowth.
• Browsing: IP address and technical details in server logs, audience statistics (section 8).

We never ask for sensitive data as defined by the law (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health). Please do not include any in your messages.

Law 18-07 (Art. 7) allows processing with your express consent or when it is necessary for one of the reasons it lists. Our processing rests on the following:

Answering and following up your requests

pre-contractual steps taken at your request

Providing the platform (account, matching, messaging, payments)

performance of the contract accepted at sign-up

Setting up or changing your company, handling the filings on your behalf and showing you their progress

performance of the service contract signed with you

Providing, metering and billing access to the data API (keys, call counters)

performance of the subscription contract concluded with you (Law 18-07, Art. 7)

Securing the services, logging operations on data

legal obligations (Law 18-07, Art. 38; Law 25-11, Art. 41 bis 3) and legitimate interest

Measuring site audience

legitimate interest, with a one-click right to object (section 8)

Sending you offers by email

your prior consent; for existing clients, similar services only, with a way to refuse at collection and in every message (Art. 37)

Bookkeeping and answering authorities

legal obligations

No decision producing legal effects for you is made solely on the basis of automated processing.

• Authorized UpGrowth staff, each according to their role. Every employee signs a confidentiality pledge and remains bound by professional secrecy, even after leaving (Art. 40).
• Our technical providers, acting on our instructions (Art. 39): Icosnet (server and mailbox hosting, in Algiers), FormSubmit (delivery of forms by email), Google (Gmail, Google Analytics, reCAPTCHA on some payment and project pages, the Gemini AI assistant), Anthropic (the Claude assistant, which drafts our replies to your requests, reviewed by our team before anything is sent), Meta Platforms (WhatsApp Business Platform, which carries the messages you write to UpGrowth's WhatsApp Business number and those our team sends you), OpenRouter, Groq, Google Gemini and Cerebras (AI services that write the site assistant's answers), SATIM (card payments).
• When we set up or change a company, and only for the filing concerned: the notary, the National Trade Register Centre (CNRC), CASNOS, the tax administration (tax inspection and tax centre), the National Statistics Office (ONS) and the bank you choose. For a change, the notice is also published in the Official Bulletin of Legal Notices (BOAL) and in a national daily newspaper.
• Other platform users, for the profile elements you choose to make visible.
• Public authorities, only where the law requires it.

We never sell or rent your data.

Our servers and the contact@upgrowth.dz mailbox are hosted in Algeria. Some of the providers above are based outside Algeria:

• FormSubmit and Gmail: a copy of the forms sent on the site;
• Gmail: the emails the platform sends you (sign-up, notifications);
• Google Analytics: browsing statistics, with no name, email or phone;
• reCAPTCHA: technical signals that tell a human from a bot;
• Gemini: only the texts you submit to the AI assistant;
• OpenRouter, Groq, Google Gemini, Cerebras and the provider of the chosen model: the messages you type in the site assistant and the page you are on, to write its answer; these free services may use them to improve their products; the name and number you leave for a callback are not sent to them;
• Anthropic (Claude): your name, your request and your messages, to draft our reply, without your phone number or email address; the replies we send you may also serve as style examples for other drafts, without your name or contact details;
• Meta Platforms (WhatsApp Business Platform): your phone number, your WhatsApp profile name and the text of the messages you write to UpGrowth's WhatsApp Business number and that our team sends you, with their delivery status, including those written from the WhatsApp Business app on the same number.

The law makes transfers to a foreign State subject to the authorization of the National Authority for the Protection of Personal Data (ANPDP) and to an adequate level of protection (Art. 44), with exceptions, notably when the transfer is needed to perform a contract or pre-contractual steps taken at your request (Art. 45).

If you prefer your request not to go through these services, write directly to contact@upgrowth.dz or call us.

Your data is kept no longer than needed (Art. 9). After these periods it is erased automatically:

Requests that led nowhere

36 months after the last exchange

Clients

60 months after the last exchange; accounting records for as long as the law requires

Client companies and their files

60 months after the last update of the company and its files, when none is still in progress

Online creation orders

36 months if unpaid or cancelled; 60 months once paid

Data API clients and their keys

60 months after the end of the subscription, or at once on request once the subscription has ended; kept while it runs, to perform the contract

Data API call counts, per key and per day

24 months

Data API calls without a key (free tier)

nothing is kept: they are counted in memory for the day and never stored

Scanned copies of documents

12 months after the file is closed, and at once on erasure

Fake contacts, records, companies and files put in the trash

90 days

Platform account

while it is open; deleted on request

Access security log

400 days

Operations log and rights requests

36 months (after closure, for requests)

Audience statistics

the period set in Google Analytics (2 or 14 months)

• Encrypted connections (HTTPS) and hosting in Algeria.
• Named staff access with mandatory two-factor authentication, time-limited sessions closed after inactivity, lockout after repeated errors.
• Access limited to each role; contact details hidden from read-only profiles.
• Automated operations log: every collection, consultation, change, extraction, disclosure or erasure is recorded with its author, date and reason (Law 25-11, Art. 41 bis 3).
• Register of processing activities kept available to the ANPDP (Art. 41 bis 2).

If a data breach occurs, UpGrowth documents it, notifies the ANPDP no later than five days after becoming aware of it, and tells you in plain words if it is likely to create a high risk for your rights and freedoms (Art. 45 bis 8 to 45 bis 10).

The site uses Google Analytics to count visits and understand how it is used. Google Analytics sets cookies in your browser. No name, email or phone is sent to it, and nothing is measured on the staff-only areas.

You can object at any time (Art. 36). Your choice is kept in this browser:

The platform also uses cookies strictly needed to keep you signed in, and the site stores a few preferences in your browser (language, theme) that are not used to track you.

• To be informed of every collection (Art. 32).
• To access your data: know whether we hold any, get it in a readable form, with its origin (Art. 34).
• To have it corrected, updated, locked or erased, free of charge, within 10 days (Art. 35). Your heirs may exercise this right.
• To object to its processing on legitimate grounds, and to direct marketing without giving any reason (Art. 36).
• To withdraw your consent at any time (Art. 7).
• To receive no automated direct marketing (automatic calls, fax, email) without your prior consent (Art. 37).

To exercise a right, write to contact@upgrowth.dz (subject "Personal data"), send a letter to our address, or visit our office. We may ask you to prove your identity, only to check that the request comes from you. Every request is recorded and tracked until it is answered.

If we refuse or do not answer, you can refer the matter to the National Authority for the Protection of Personal Data (ANPDP, anpdp.dz) or to the competent court (Art. 35 and 52).

Our services are meant for adults and businesses. A child's data may only be processed with the consent of their legal representative or the authorization of a judge (Art. 8). If you believe a minor sent us data without that consent, write to us and we will erase it.

We update this policy when our processing changes. The date at the top shows the version in force. For significant changes, we will tell you on the platform or by email.