Last updated: 15 October 2026
1. Who we are
This Privacy and Cookie Policy explains how Up& Consulting (“Up&”, “we”, “us”) collects and uses personal data when you visit upandconsulting.com (the “Website”), fill in a form on it, or receive our emails.
We are the data controller for this processing.
- Company: Up and Consulting Limited, trading as Up& Consulting
- Company number: 12611474
- Address: 1 Fore Street Avenue, London, EC2Y 9DT, United Kingdom
- Privacy contact: contact@upandconsulting.com
- Phone: +44 (0) 20 3787 9207
2. What data we collect through the Website
When you browse the Website, we collect technical and usage data: your IP address, browser and device type, the pages you visit, how long you stay, the page that referred you, and the date and time of each visit.
When you submit a form, such as our contact form or newsletter sign-up, we collect the details you enter: typically your first and last name, business email address and any message you send. If you have accepted analytics cookies, we link the form submission to your earlier browsing on the Website.
We identify the companies that visit the Website from their IP address (see section 4). This shows us an organisation’s name and public business details, not who you are as an individual.
We do not knowingly collect special categories of personal data through the Website.
3. HubSpot
We use HubSpot, a CRM and marketing platform provided by HubSpot, Inc. (Cambridge, MA, USA), to run our forms, email communication and website analytics. HubSpot processes this data on our behalf, as our processor, under its Data Processing Agreement.
The HubSpot tracking code on the Website sets cookies in your browser. Only the strictly necessary ones load before you choose. The analytics cookies (__hstc, hubspotutk, __hssc, __hssrc) load only after you accept them in our cookie banner. With your consent, they let us:
- count visits and sessions and see which pages are viewed;
- recognise a returning browser;
- link your browsing on the Website to your contact record once you submit a form or click a link in one of our emails, so that we see which pages you visited before and after you got in touch.
If you receive our emails, HubSpot records whether you open them and which links you click, so we can measure interest and avoid sending irrelevant content. You can unsubscribe at any time through the link in every email.
The full list of HubSpot cookies is in section 10. More information: HubSpot Privacy Policy.
4. Leadinfo
To understand which businesses visit the Website, we use Leadinfo, a service of Leadinfo B.V. (Rotterdam, the Netherlands). Leadinfo matches the IP address of a visit against a database of business IP addresses and shows us the company name, its public business details and the pages visited from that company’s network. Leadinfo acts as our processor under a Data Processing Agreement.
Leadinfo is designed to identify organisations, not individuals. If you visit from a home or mobile connection, the IP address will normally not match a company and no business profile is shown to us.
We run Leadinfo in cookieless mode. It does not place cookies or similar identifiers in your browser.
You can object to this processing at any time by emailing contact@upandconsulting.com. You can also opt out directly with Leadinfo through the opt-out link on leadinfo.com.
5. Why we use your data and on what legal basis
We are based in the United Kingdom and also operate from Greece, so we apply both the UK GDPR and the EU General Data Protection Regulation (“GDPR”). The article numbers below are the same in both.
Purpose | Data | Legal basis |
|---|---|---|
Run the Website securely and remember your cookie choice | IP address, strictly necessary cookies | Legitimate interest, art. 6(1)(f); no consent is needed for strictly necessary cookies |
Website analytics and linking visits to form submissions (HubSpot) | Analytics cookies, pages viewed, form data | Consent, art. 6(1)(a) |
Measure our advertising and website use (Google Ads, Google Analytics) | Advertising and analytics cookies, pages viewed | Consent, art. 6(1)(a) |
Identify visiting companies (Leadinfo) | IP address, pages viewed | Legitimate interest, art. 6(1)(f): understanding business interest in our services |
Answer your enquiry or request a proposal | Form data | Steps before a contract at your request, art. 6(1)(b), or legitimate interest, art. 6(1)(f) |
Send newsletters and insights by email, measure opens and clicks | Email address, name, email engagement | Consent, art. 6(1)(a); for existing clients, our legitimate interest under reg. 22 PECR (UK) and art. 11 of Greek Law 3471/2006 |
Comply with legal obligations | Records we must keep | Legal obligation, art. 6(1)(c) |
Where we rely on legitimate interest, we have weighed our interest against your rights. You can ask us for this assessment and object at any time (section 9).
6. Who receives your data and international transfers
We do not sell your personal data. We share it only with service providers that process it on our behalf under written agreements, and with our own offices where needed to handle your enquiry:
- HubSpot, Inc. (USA) and its group companies: CRM, forms, email and analytics. Our HubSpot account is hosted in the EU. HubSpot is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and also uses Standard Contractual Clauses for transfers outside the UK and EEA.
- Leadinfo B.V. (the Netherlands): company identification. Where Leadinfo uses sub-processors outside the EEA, it relies on Standard Contractual Clauses.
- Google Ireland Ltd / Google LLC: advertising measurement and website analytics, only with your consent.
- Our website hosting and IT service providers.
- Up& Consulting offices in the UK, Greece and the USA, so that the right team can respond to you.
We may also disclose data to public authorities when the law requires it.
When data leaves the UK or EEA, we rely on adequacy decisions, the Data Privacy Framework or Standard Contractual Clauses (with the UK Addendum where relevant). You can ask us for a copy of these safeguards.
7. How long we keep your data
Data | Retention |
|---|---|
Cookies | As listed in section 10, from the end of the session up to 2 years |
Contact and form data in our CRM | For as long as we have an active business relationship or you remain subscribed, then 24 months after the last interaction, unless you ask for earlier deletion |
Company visit data from Leadinfo | Up to 12 months in our Leadinfo account. Leadinfo keeps IP addresses and linked business profiles for a maximum of three years |
Records required by law (e.g. invoices) | For the period the law requires |
When the period ends, we delete or anonymise the data.
8. Managing cookies and withdrawing consent
On your first visit, our cookie banner lets you accept all cookies, reject non-essential cookies, or choose by category. Non-essential cookies are not placed until you accept them.
You can change your choice at any time through the Manage consent link on the Website. Withdrawing consent does not affect processing that took place before.
You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, some parts of the Website may not work properly.
9. Your rights
Under the UK GDPR and the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted, where there is no legal reason for us to keep it;
- restrict our processing in certain cases;
- receive data you gave us in a portable format;
- object at any time to processing based on legitimate interest, including company identification through Leadinfo, and to direct marketing;
- withdraw your consent at any time, without affecting earlier processing.
To exercise any of these rights, email contact@upandconsulting.com. We will reply within one month. We may ask you to confirm your identity first.
If you believe we have not handled your data correctly, you can complain to:
- the Information Commissioner’s Office (UK), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk;
- the Hellenic Data Protection Authority (Greece), Kifisias 1-3, 115 23 Athens, www.dpa.gr;
- or the supervisory authority of the country where you live or work.
10. Cookies we use
Cookie | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
__hs_cookie_cat_pref | HubSpot | Strictly necessary | Stores which cookie categories you accepted | 6 months |
__hs_opt_out | HubSpot | Strictly necessary | Remembers that you rejected cookies, so you are not asked again | 6 months |
__hs_do_not_track | HubSpot | Strictly necessary | Stops the tracking code sending data to HubSpot | 6 months |
__hs_initial_opt_in | HubSpot | Strictly necessary | Prevents the consent prompt showing on every page in strict consent mode | 7 days |
__cf_bm | HubSpot (Cloudflare) | Strictly necessary | Bot protection | 30 minutes |
__cfruid, __cfuvid | HubSpot (Cloudflare) | Strictly necessary | Rate limiting | Session |
__hstc | HubSpot | Analytics | Main visitor cookie: first and last visit, number of sessions | 6 months |
hubspotutk | HubSpot | Analytics | Visitor identifier; links your visits to your contact record when you submit a form | 6 months |
__hssc | HubSpot | Analytics | Tracks sessions | 30 minutes |
__hssrc | HubSpot | Analytics | Detects a browser restart to count a new session | Session |
_ga | Analytics | Distinguishes visitors for Google Analytics | 2 years | |
ga[ID] | Analytics | Keeps session state for Google Analytics | 2 years | |
_gcl_au | Marketing | Measures conversions from Google Ads | 90 days |
Our consent banner may also set its own cookies to store your choice. These are strictly necessary.
11. Changes to this policy
We update this policy when we add tools to the Website or change how we use data. The date at the top shows the latest version. For significant changes, we will show a notice on the Website or ask for your consent again where required.
Questions about this policy: contact@upandconsulting.com, +44 (0) 20 3787 9207, 1 Fore Street Avenue, London, EC2Y 9DT, United Kingdom.
