Privacy Policy · Upstart Bar

This policy explains what happens to personal information when you visit upstartbar.com, contact us through the site or subscribe to our newsletter. It is written for website visitors and general enquiries.

If you are a participant on one of our programs or a client contact, the handling of your training records is governed by our Data Protection & Privacy Policy, which sits alongside this one.

1. Who we are

Upstart Bar FZ-LLC is the controller of the personal information described here. We are based in the United Arab Emirates. You can reach us at info@upstartbar.com.

2. The short version

This is a static website. There is no user account, no login for the public site and no advertising.
We set no cookies for analytics or marketing unless you agree to them.
If you fill in a form, we receive what you typed so we can reply to you.
Our hosting provider keeps short-lived technical logs to serve pages and block attacks.
We do not sell personal information, and we do not share it for anyone else's marketing.

3. Information you give us

You only give us personal information when you choose to. The site collects it in three places.

Contact form: Your name, email address, organization and the message you write. We use it to answer your enquiry and, where it leads to work, to prepare a proposal.
Newsletter sign-up: Your email address, and your name if you give it. Used only to send the newsletter. Every edition carries an unsubscribe link and we act on it.
Client resource access: Where a client area or a protected workshop page is set up for an engagement, the email address or access code issued to you, and a record that the page was opened.

Please do not send confidential or sensitive information through a web form. Email us and we will agree a secure route.

4. Information collected automatically

Our website is served through Cloudflare, which acts as our host, content delivery network and security layer. To deliver a page and to protect the site from attack, Cloudflare processes technical information including your IP address, the page requested, the time of the request, your browser and device type, and the approximate region the request came from. This is standard server log data, it is retained for a short period, and we do not use it to build a profile of you.

Our forms are protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than an automated script. Turnstile is designed to work without tracking you across websites.

5. Analytics and cookies

No analytics or marketing cookie is set unless you accept one. When you first arrive you will see a short consent banner. Until you choose, only cookies strictly necessary for security and for remembering your consent choice are used.

Strictly necessary: Security and anti-abuse checks, and a small record of the consent choice you made so we do not ask again on every page. These cannot be switched off without breaking the site.
Analytics (optional): If you accept, we load Google Analytics 4 through Cloudflare Zaraz to understand which pages are read and how people arrive. IP addresses are truncated and we do not enable advertising features or cross-site tracking.

You can change or withdraw your choice at any time from the link in the site footer, and you can clear cookies in your browser at any point.

6. Why we use it, and on what basis

To answer your enquiry and to take steps at your request before entering a contract.
To send the newsletter, where you have consented, and to stop when you unsubscribe.
To keep the site available and secure, which is our legitimate interest and, in places, a legal requirement.
To understand how the site is used, where you have consented to analytics.
To meet legal, tax, accreditation and contractual record-keeping obligations.

Where the EU or UK GDPR applies to an interaction, these are the lawful bases we rely on. Where UAE law applies, we apply the equivalent requirement under the applicable UAE personal data framework.

7. Who processes it for us

We keep the number of third parties small and we do not appoint one without reviewing its privacy and security terms, its retention behavior and whether it uses customer data to train models.

Cloudflare: Hosting, content delivery, DNS, bot protection (Turnstile), consent-gated tag loading (Zaraz) and access control for client areas.
Google Analytics 4: Aggregate website statistics. Loaded only after you accept analytics cookies.
Resend: Delivery of the emails generated by our forms and the newsletter.
Google Workspace: Our business email and document storage, where your correspondence with us is held.

We will update this list if it changes. If a client engagement requires a different arrangement, the contract for that engagement takes precedence.

8. International transfers

Our providers operate globally, so your information may be processed outside the country you are in. Where a transfer is subject to the GDPR or to an equivalent UAE requirement, we rely on the transfer mechanism the provider offers, such as standard contractual clauses, and we keep a record of it.

9. How long we keep it

Enquiries that do not lead to work: kept while the conversation is live and deleted within twelve months.
Enquiries that become an engagement: kept for the life of the engagement and then under the retention rules in our Data Protection & Privacy Policy.
Newsletter subscriptions: kept until you unsubscribe or ask us to delete the record.
Server and security logs: kept for a short period, as configured by our hosting provider.
Analytics: aggregate reports only, with the retention window set to the shortest useful period.

10. Your rights

You can ask us what personal information we hold about you, ask us to correct it, ask us to delete it, object to a particular use, withdraw a consent you gave, or ask for a copy in a portable form. Write to info@upstartbar.com. We will verify the request and respond within the period the applicable law requires. There is no charge for a reasonable request.

If you are not satisfied with our response you can raise it with the relevant supervisory authority in your jurisdiction. We would rather you came to us first so we can put it right.

11. Security

The site is served over HTTPS. Protected areas sit behind access control rather than an unlisted URL. Internally we limit who can reach client and learner information to the people who need it for the work, and we do not put personal information or client confidential information into unapproved public AI tools. No system is perfectly secure, and if a breach affects you we will tell you and the relevant authority where the law requires it.

12. Children

This website and our programs are intended for adult professional learners. We do not knowingly collect personal information from anyone under eighteen. If you believe a child has given us information, contact us and we will delete it.

13. Changes

We update this policy when our practices or providers change. The version and date at the top of this page tell you which edition you are reading. Material changes are announced on this page.

14. Contact

Questions, requests or complaints about privacy: info@upstartbar.com.