Privacy Policy

Ullass ("we", "us" or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit https://ullass.com or interact with our team and services.

By using our website or providing your information to us, you consent to the practices described in this policy. If you do not agree with these practices, please do not use our website or provide your personal information to us.

We will update this policy from time to time. The "Last updated" date at the top of this page indicates when the most recent changes were made.

We collect information in three ways: information you provide directly, information collected automatically, and information from public or third-party sources.

• Contact details you share when reaching out, such as name, email address, company name and phone number.
• Project information you provide when discussing potential work, including briefs, requirements and any files you choose to share.
• Usage data collected automatically, such as IP address, browser type, device information, pages visited, referring URL and time spent.
• Communication history, including emails and messages exchanged with our team.

We use the information we collect to operate our business, respond to inquiries, deliver services, and improve our website and communications.

• To respond to your inquiries and provide information about our services.
• To evaluate, plan and deliver the projects and services you engage us for.
• To send administrative messages, invoices and service-related communications.
• To analyse website usage and improve our content, design and user experience.
• To send occasional marketing communications, where you have opted in and have not unsubscribed.
• To comply with legal obligations and protect our rights and the rights of others.

Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases for processing personal data:

• Consent — where you have given clear consent for us to process your personal data for a specific purpose.
• Contract — where processing is necessary for the performance of a contract with you, such as a project agreement.
• Legitimate interests — where processing is necessary for our legitimate business interests, such as responding to inquiries, preventing fraud and improving our services, provided your interests and rights do not override those interests.
• Legal obligation — where processing is necessary to comply with a legal obligation to which we are subject.

We use cookies and similar technologies to make our website work, understand how visitors use the site, and improve your experience. Some cookies are strictly necessary; others help us with analytics and preferences.

You can control and manage cookies through your browser settings. Please refer to our Cookie Policy for full details on the categories of cookies we use and how to control them.

We do not sell, rent or trade your personal information. We only share information in the circumstances described below:

• With trusted service providers who help us operate our business (such as hosting, email, analytics and payment providers), under contracts that require them to protect your data.
• With professional advisers such as lawyers and accountants, where necessary.
• Where required to do so by law, regulation, legal process or governmental request.
• To protect the rights, property or safety of Ullass, our users or the public.
• In connection with a merger, acquisition or sale of assets, where your data may be transferred as part of that transaction.

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, to comply with our legal obligations, and to resolve disputes and enforce our agreements.

Inquiry and project records are generally retained for the duration of an engagement plus a reasonable period afterward (typically up to seven years for accounting and tax purposes).

Analytics data is retained in aggregate or de-identified form where possible, and individual-level analytics records are deleted on a periodic basis.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure or destruction. These include encrypted connections (TLS), access controls, and restricted staff access to personal data on a need-to-know basis.

While we take reasonable precautions, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information.

Depending on your location, you may have the following rights regarding your personal information:

• The right to access the personal information we hold about you.
• The right to request correction of inaccurate or incomplete information.
• The right to request deletion of your personal information.
• The right to restrict or object to certain processing activities.
• The right to data portability.
• The right to withdraw consent at any time, where processing is based on consent.
• The right to lodge a complaint with a supervisory authority.

We serve clients worldwide and may use service providers located in different countries. Where personal data is transferred outside your country of residence, including outside the EEA or the UK, we take steps to ensure it receives an adequate level of protection, for example through standard contractual clauses or equivalent safeguards.

Our website and services are directed at business professionals and are not intended for children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

This section applies to visitors and customers resident in the State of California. It supplements the sections above and is provided to meet the disclosure requirements of the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA" or "CPRA").

In the twelve (12) months preceding the date this policy was last updated, we have not sold personal information, disclosed personal information for money, or shared the personal information of anyone under 16 years of age for cross-context behavioural advertising.

• Categories collected: identifiers; commercial information; internet and other electronic network activity; professional information supplied in business inquiries; and geolocation inferred from an IP address.
• Sources: information you provide directly, information collected automatically when you use our website, and information from our service providers.
• Purposes: responding to inquiries, providing and operating our services, securing our systems, and communicating with you.
• No sensitive personal information is collected, used or disclosed for the purpose of inferring characteristics about you.
• Retention: personal information is retained only as long as necessary for the purposes described above, and we delete or anonymise it thereafter.
• Your rights: the right to know, the right to delete, the right to correct, the right to opt out of sale or sharing, the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising any of these rights.
• How to exercise your rights: email privacy@ullass.com from the address associated with your account. We do not require you to create an account to make a request, and we verify requests using the information we already hold rather than asking you for additional identification.
• Complaints: if you believe we have not complied, you may contact us or lodge a complaint with the California Privacy Protection Agency at cppa.ca.gov.

If you have any questions about this Privacy Policy, the data we hold about you, or wish to exercise any of your privacy rights, please contact us. Requests can be sent to the Data Protection & Privacy Desk using the address below.

• Privacy and data rights: privacy@ullass.com
• General support: support@ullass.com
• Legal entity and registered office details: legal@ullass.com
• We aim to respond to verified privacy requests within thirty (30) days, as required by the GDPR and the CCPA.