Privacy Policy

UpTerra Corp. · www.upterra.co · Effective date: 25 September 2026 · Version 3.1, 25 September 2026

1. Who we are and how to contact us
UpTerra Corp. ("UpTerra", "we", "us") is the controller of the personal data described in this policy. We are a United States company at 20 Liberty Ship Way, Suite 250, Sausalito, CA 94965, United States. Email contact@upterra.co or call +1 (707) 878-3772. We have not appointed a Data Protection Officer; privacy questions go to the email above and are handled by our Chief Financial Officer.
United Kingdom. We do not currently offer products or services in the UK and do not monitor the behavior of people in the UK, so we have not appointed a UK representative under UK GDPR Article 27. If that changes we will update this policy and name one. UK visitors still have the rights in section 10.

2. What this policy covers
It covers personal data we collect through www.upterra.co, the forms on it, email you exchange with us, events we attend and the marketing we send. It does not cover other websites we link to, which have their own policies. It applies to visitors and contacts wherever they are. It is written to the UK standard, the strictest we work to, and sections 10 to 12 add the rights that apply in the UK and EU, in Canada, and in California and the rest of the United States.

3. The personal data we collect and where it comes from

Contact details. Name, email address, phone number, company or farm, state and country. Source: you, through a form, email, call or event badge scan.
Farm details you choose to share. Crops, acreage, irrigation type, water source, the content of your message. Source: you.
Marketing preferences. Whether you agreed to marketing email, and when. Source: you, and our records of it.
Technical and usage data. IP address, approximate location derived from it, browser and device, pages visited, time on page, referring page, cookie identifiers. Source: collected automatically when you use the site, subject to your cookie choices.
Event data. Registration and badge-scan details. Source: you or the event organizer, with your agreement at the event.

We do not buy lists of personal data, we do not collect special category data (such as health or ethnicity), and we do not make decisions about you by automated means.

4. Why we use your data and our lawful basis
UK and EU law requires a lawful basis for each use. This is what we do and why we are allowed to.

Answer your inquiry, arrange a call or site visit, prepare a quotation. Data used: contact and farm details. Lawful basis: steps you ask us to take before a contract (Art. 6(1)(b)); otherwise our legitimate interest in responding to people who contact us.
Send information you asked for, such as a report or event details. Data used: contact details. Lawful basis: your request (legitimate interest in fulfilling it).
Send marketing email about UpTerra. Data used: contact details, marketing preferences. Lawful basis: your consent, or, for business contacts and existing customers, our legitimate interest in telling you about similar products, always with an unsubscribe (see section 5).
Run the website, keep it secure, prevent misuse. Data used: technical data. Lawful basis: legitimate interest in a working, secure site.
Understand how the site is used and improve it (analytics). Data used: technical and usage data. Lawful basis: your consent, given through the cookie banner.
Measure and target our advertising on Google and Meta platforms. Data used: technical and usage data. Lawful basis: your consent, given through the cookie banner.
Keep records we are required to keep, and defend legal claims. Data used: any of the above. Lawful basis: legal obligation; legitimate interest in protecting our rights.

Where we rely on legitimate interests we have checked that our interest is not outweighed by your rights, and you can object at any time (section 10). Where we rely on consent you can withdraw it at any time without affecting what was done before.

5. Marketing email

If you are an individual (including a sole trader or a partnership), we send marketing email only with your consent, given by ticking an unticked box, or where you gave us your details while buying or asking about our products and did not opt out at the time.
If you are a business contact at a company, UK law lets us email you about our products without prior consent; we still only do so where we think it is relevant to your work.
We do not currently market to Canada. If you are in Canada and hear from us, we send commercial email only with your express consent (an unticked box you ticked) or where Canada's anti-spam law allows it, such as an existing business relationship within the last two years, and every message identifies us, gives our postal address and has an unsubscribe that we honor within ten business days.
Every marketing email says who it is from, carries our postal address and has an unsubscribe link that works with one click. We act on unsubscribes within ten business days, usually the same day.
Replies to your inquiries and service messages are not marketing and do not carry an unsubscribe link.
We do not currently send marketing text messages.

6. Cookies and similar technologies
When you first visit, only essential cookies are set. Analytics, advertising and functional cookies are set only after you choose Accept in the cookie banner, and you can change or withdraw that choice at any time through the Cookie settings link in the footer. We ask again after twelve months.

Essential. Set by Wix, our website platform, so that pages, forms and security work. No consent needed.
Analytics. HubSpot's tracking code links your visits to your record once you have filled in a form (legal.hubspot.com/privacy-policy). Google Analytics 4 shows us which pages are visited and how visitors move through the site (policies.google.com/privacy; opt-out add-on at tools.google.com/dlpage/gaoptout).
Advertising. Google Ads and the Meta Pixel (Meta Platforms, Inc.) record that you visited so we can measure our advertising and show relevant ads on Google, Facebook and Instagram (facebook.com/privacy/policy). Manage ad personalization at adssettings.google.com and in your Facebook settings, or through youronlinechoices.eu and optout.aboutads.info.
Functional. Remember choices such as the banner itself and embedded video settings.

If your browser sends a Global Privacy Control signal we treat it as a refusal of advertising cookies. We do not respond to Do Not Track signals, as there is no agreed standard for them.

7. Who we share your data with

Service providers who process data for us, under contracts that restrict them to our instructions: Wix (website hosting and forms), HubSpot (customer records and email), Google (analytics and advertising), Meta (advertising).
Event organizers, only where you agree at the event.
Professional advisers (lawyers, accountants, insurers) under confidentiality.
Authorities and courts where the law requires it or to protect our rights, our customers or the public.
A buyer or successor if UpTerra is sold or merged, under this policy.

We do not sell personal data. Advertising cookies can count as "sharing" under California law; see section 11.

8. International transfers
UpTerra is in the United States and your data is stored and processed there, including by the providers in section 7. If you are in the UK, the EEA or Switzerland, this means your data leaves your country. Our providers protect it under recognized safeguards: the EU-US Data Privacy Framework and its UK Extension where the provider is certified, and otherwise the UK International Data Transfer Agreement or the EU Standard Contractual Clauses. You can ask us for details of the safeguards used.

9. How long we keep your data
We keep personal data only as long as we need it for the purposes in section 4, then delete or anonymize it. Our standard periods:

Inquiries and leads that do not become customers: kept 24 months after our last contact with you, then deleted. Why: long enough for a normal buying cycle in agriculture; the common practice for business marketing records.
Customers, quotations and commercial correspondence: kept the life of the relationship plus 6 years. Why: the limitation period for contract claims in England and Wales; financial records are kept by our finance team under US tax rules (7 years).
Marketing consent and unsubscribe records: kept while you are subscribed, and 6 years after you unsubscribe. Why: to prove consent and to honor your opt-out.
Website analytics (Google Analytics): kept 14 months. Why: google Analytics' maximum standard retention.
Cookie consent record: kept 12 months, then we ask again. Why: regulator guidance to refresh consent regularly.
Security and access logs: kept 12 months. Why: investigating misuse.

10. Your rights
Wherever you are, you can unsubscribe from email with the link in any message, change cookie choices with the footer link, and email contact@upterra.co to ask what we hold about you or to have it corrected or deleted.

If you are in the UK, the EEA or Switzerland
You have the right to access your data, to have it corrected or erased, to restrict or object to its use (including an absolute right to object to direct marketing), to receive it in a portable form, to withdraw consent at any time, and not to be subject to decisions made solely by automated means. Email contact@upterra.co; we will confirm your identity, respond within one month and never charge a fee unless a request is clearly unfounded or excessive. If you are unhappy with our answer you can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF) or to the data protection authority in your country.

11. Canada
We do not currently market or sell in Canada, so this section applies only if you contact us from Canada. If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector apply. We collect your data with your knowledge and consent for the purposes in section 4, store and process it in the United States, where it is subject to US law, and keep it only as long as section 9 says. You may ask to see and correct the personal information we hold, withdraw your consent (subject to legal or contractual limits, which we will explain), and ask how we have used it; email contact@upterra.co and we respond within 30 days. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376) or, in Quebec, to the Commission d'accès à l'information.

12. California and other US states
UpTerra is below the thresholds at which the California Consumer Privacy Act applies, and we honor its rights anyway: to know what we collect, to delete it, to correct it, to opt out of sharing for targeted advertising (through the cookie banner or the Global Privacy Control signal), and not to be treated differently for exercising these rights. Categories collected in the last 12 months: identifiers, contact details, commercial and professional information you provide, internet activity and approximate location. We do not collect sensitive personal information as defined by California law and we do not sell personal information. Requests: contact@upterra.co; we respond within 45 days. Residents of other US states with privacy laws (such as Colorado, Connecticut, Virginia and Texas) have similar rights and the same contact route.

13. Security
We use reasonable technical and organizational measures, including access controls, encrypted connections and the security programs of the providers in section 7, to protect personal data. No method of transmission or storage is completely secure, so we cannot promise absolute security. If a breach puts your rights at risk we will tell you and the relevant regulator as the law requires.

14. Children
Our site and services are for businesses and adults. We do not knowingly collect personal data from anyone under 16 (under 13 in the UK for online services). If you believe a child has given us data, email contact@upterra.co and we will delete it.

15. Links to other sites
We link to other websites, including our social media pages. We are not responsible for their content or privacy practices.

16. Changes to this policy
When we change this policy we update the version and date at the top. For material changes we also post a notice on the website, and where we rely on your consent we ask for it again.

17. Contact us
Email contact@upterra.co, call +1 (707) 878-3772, or write to UpTerra Corp., 20 Liberty Ship Way, Suite 250, Sausalito, CA 94965, United States.

Contact details. Name, email address, phone number, company or farm, state and country. Source: you, through a form, email, call or event badge scan.

Farm details you choose to share. Crops, acreage, irrigation type, water source, the content of your message. Source: you.

Marketing preferences. Whether you agreed to marketing email, and when. Source: you, and our records of it.

Technical and usage data. IP address, approximate location derived from it, browser and device, pages visited, time on page, referring page, cookie identifiers. Source: collected automatically when you use the site, subject to your cookie choices.

Event data. Registration and badge-scan details. Source: you or the event organizer, with your agreement at the event.

Answer your inquiry, arrange a call or site visit, prepare a quotation. Data used: contact and farm details. Lawful basis: steps you ask us to take before a contract (Art. 6(1)(b)); otherwise our legitimate interest in responding to people who contact us.

Send information you asked for, such as a report or event details. Data used: contact details. Lawful basis: your request (legitimate interest in fulfilling it).

Send marketing email about UpTerra. Data used: contact details, marketing preferences. Lawful basis: your consent, or, for business contacts and existing customers, our legitimate interest in telling you about similar products, always with an unsubscribe (see section 5).

Run the website, keep it secure, prevent misuse. Data used: technical data. Lawful basis: legitimate interest in a working, secure site.

Understand how the site is used and improve it (analytics). Data used: technical and usage data. Lawful basis: your consent, given through the cookie banner.

Measure and target our advertising on Google and Meta platforms. Data used: technical and usage data. Lawful basis: your consent, given through the cookie banner.

Keep records we are required to keep, and defend legal claims. Data used: any of the above. Lawful basis: legal obligation; legitimate interest in protecting our rights.

Where we rely on legitimate interests we have checked that our interest is not outweighed by your rights, and you can object at any time (section 10). Where we rely on consent you can withdraw it at any time without affecting what was done before. 5. Marketing email

If you are an individual (including a sole trader or a partnership), we send marketing email only with your consent, given by ticking an unticked box, or where you gave us your details while buying or asking about our products and did not opt out at the time.

If you are a business contact at a company, UK law lets us email you about our products without prior consent; we still only do so where we think it is relevant to your work.

Every marketing email says who it is from, carries our postal address and has an unsubscribe link that works with one click. We act on unsubscribes within ten business days, usually the same day.

Replies to your inquiries and service messages are not marketing and do not carry an unsubscribe link.

We do not currently send marketing text messages.

Essential. Set by Wix, our website platform, so that pages, forms and security work. No consent needed.

Functional. Remember choices such as the banner itself and embedded video settings.

If your browser sends a Global Privacy Control signal we treat it as a refusal of advertising cookies. We do not respond to Do Not Track signals, as there is no agreed standard for them. 7. Who we share your data with

Service providers who process data for us, under contracts that restrict them to our instructions: Wix (website hosting and forms), HubSpot (customer records and email), Google (analytics and advertising), Meta (advertising).

Event organizers, only where you agree at the event.

Professional advisers (lawyers, accountants, insurers) under confidentiality.

Authorities and courts where the law requires it or to protect our rights, our customers or the public.

A buyer or successor if UpTerra is sold or merged, under this policy.

Inquiries and leads that do not become customers: kept 24 months after our last contact with you, then deleted. Why: long enough for a normal buying cycle in agriculture; the common practice for business marketing records.

Customers, quotations and commercial correspondence: kept the life of the relationship plus 6 years. Why: the limitation period for contract claims in England and Wales; financial records are kept by our finance team under US tax rules (7 years).

Marketing consent and unsubscribe records: kept while you are subscribed, and 6 years after you unsubscribe. Why: to prove consent and to honor your opt-out.

Website analytics (Google Analytics): kept 14 months. Why: google Analytics' maximum standard retention.

Cookie consent record: kept 12 months, then we ask again. Why: regulator guidance to refresh consent regularly.

Security and access logs: kept 12 months. Why: investigating misuse.

Where we rely on legitimate interests we have checked that our interest is not outweighed by your rights, and you can object at any time (section 10). Where we rely on consent you can withdraw it at any time without affecting what was done before.

5. Marketing email

If your browser sends a Global Privacy Control signal we treat it as a refusal of advertising cookies. We do not respond to Do Not Track signals, as there is no agreed standard for them.

7. Who we share your data with