Utonomy B.V. · Version 1.2 · June 2026
1. Why this privacy statement exists
At Upod by Utonomy, everything revolves around your data and especially your control over it. This statement explains what data we process, why that is necessary, and what your rights are.
You are the data controller of all data stored in your data store. Utonomy processes that data solely on your instruction and on your behalf.
2. Who we are
Utonomy B.V., Lange Viestraat 2b, 3511 BK Utrecht, the Netherlands, Chamber of Commerce 98255207. Questions? Email privacy@utonomy.eu.
3. What data we process
3.1 Account data
To create and manage your account, we process:
- email address
- password (stored encrypted)
- technical link between your account and the WebID of your data store
3.2 Profile data (provided by you)
When using Upod, you can add data to your profile. For example in your basic profile:
- gender
- date of birth (we store the derived age category, not the raw date)
- place of residence
These data are stored in your data store at SNDK (Stichting Nederlandse Datakluis – Dutch Data Store Foundation). Utonomy accesses this data solely to process and make it available on your instruction. You can view these data in the Upod Data Manager, where they are organised by topic — such as shopping, travel, food, and lifestyle.
3.3 Consent data
Your settings — which websites, apps, or services you grant access to which profiles, and for which purposes — are also stored in your data store.
3.4 Technical data
For the operation and security of the service, we process:
- IP address and login times (security log)
- device type and browser (technical troubleshooting)
3.5 Upod Cookie Consent Assistant
The Upod Cookie Consent Assistant processes your consent on cookies and tracking automatically based on the settings you store in your cookie preferences. This either works through a direct connection to the website you visit or through a browser extension. The browser extension detects cookie banners on websites you visit and fills them in automatically based on your cookie preferences. When the extension is used, the website is not involved directly. When reporting an unrecognised cookie banner, the domain name of the website is sent to Utonomy for analysis and improvement of banner coverage. This domain name is not linked to your account.
4. Why we process your data
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Performance of contract (Art. 6(1)(b) GDPR) |
| Profile building and data store management | Performance of contract (Art. 6(1)(b) GDPR) |
| Executing your permissions towards third parties by only showing data for specific purposes | Consent (Art. 6(1)(a) GDPR) |
| Automatically handling cookie consent on your behalf | Performance of contract (Art. 6(1)(b) GDPR) |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f) GDPR) |
| Anonymous usage statistics | Legitimate interest (Art. 6(1)(f) GDPR) |
5. Who can see your data
Your profile data is only accessible to:
- yourself
- parties to whom you have explicitly given permission via Upod — and only for the purpose and duration you have set
- SNDK, which hosts your data store but cannot view its contents
We never sell your data. We never share it with third parties without your consent. Parties that receive your data are contractually required to use it solely for the purpose for which you gave consent — and may not store or pass it on.
If you make your cookie preferences available to a website via Upod, that website passes your preferences to its consent management platform (CMP). The CMP stores your consent in order to demonstrate that permission was granted. This is required by law. The stored consent relates solely to the ‘cookie’ consent decision, not to any other profile data.
6. Your role as data controller
You are the data controller of the data in your data store. Utonomy acts as the technical executor of your instructions and as your contractual representative towards connected parties. This is set out in our General Terms and Conditions (Art. 5.1 and 5.2).
Utonomy is an independent data controller for your account data (Art. 3.1) and technical data (Art. 3.4).
7. How long we retain your data
- Account data: for as long as you have an active account, plus a maximum of 30 days after deletion.
- Profile data in your data store: for as long as your data store exists. Upon deletion, it is permanently erased.
- Security logs: maximum 90 days.
8. Your rights
Under the GDPR, you have the right to:
- access your data (Art. 15),
- have incorrect data corrected (Art. 16),
- have your data deleted (Art. 17),
- restrict processing (Art. 18),
- transfer your data to another provider (Art. 20),
- object to processing based on legitimate interest (Art. 21),
- withdraw previously given consent (Art. 7(3)) — you can do this directly in the Upod app.
Most of these rights you can exercise directly in your own Upod. For a request you cannot exercise yourself, you can contact us at privacy@utonomy.eu, we’ll respond within 30 days.
9. Security
We use encryption, strict access controls, and secure servers in Europe. We regularly test our security. In the event of a data breach, we report it to the Dutch Data Protection Authority and inform you if the breach affects you.
10. Complaints
Do you disagree with how we process your data? Contact us at privacy@utonomy.eu. You also always have the right to file a complaint with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl).
11. Changes
If we update this statement, we will let you know via the Upod app or by email. The date of the most recent change is always shown at the top.