This Privacy Policy describes how we collect, use, process, and disclose your information, including personal information, in conjunction with your access to and use of the Flow Platform.
When this policy mentions “Flow,” “we,” “us,” or “our,” it refers to the Flow company that is responsible for your information under this Privacy Policy (the “Data Controller”).
Please see Section 10 for contact details of the Data Controllers.
“Customer Data” means any Personal Data that Flow processes on behalf of Customer as a Data Processor in the course of providing Services, as more particularly described our DPA.
“Data Protection Laws” means all data protection and privacy laws applicable to the processing of Personal Data under this Privacy Policy, Terms of Service, and DPA, including, where applicable, EU Data Protection Law.
“Data Controller” means an entity that determines the purposes and means of the processing of Personal Data.
“Data Processor” means an entity that processes Personal Data on behalf of a Data Controller.
“EEA” means, for the purposes of this Privacy Policy, the European Economic Area, United Kingdom and Switzerland.
“Processing” has the meaning given to it in the GDPR and “process” , “processes” and “processed” shall be interpreted accordingly.
“Services” means any product or service provided by Flow to Customer pursuant to this Privacy Policy, Terms of Service, and DPA.
There are three general categories of information we collect:
1.1.1 Information that is Necessary for the Use of the Flow Platform
We ask for and collect the following personal information about you when you use the Floe Platform. This information is necessary for the adequate performance of the contract between you and us and to allow us to comply with our legal obligations. Without it, we may not be able to provide you with all the requested services.
1.1.2 Information You Choose to Give Us
You may choose to provide us with additional personal information in order to obtain a better user experience when using Flow Platform. This additional information will be processed based on your consent.
When you use the Flow Platform, we automatically collect information, including personal information, about the services you use and how you use them. This information is necessary for the adequate performance of the contract between you and us, to enable us to comply with legal obligations and given our legitimate interest in being able to provide and improve the functionalities of the Flow Platform and Payment Services.
Flow may collect information, including personal information, that others provide about you when they use the Flow Platform and the Payment Services, or obtain information from other sources and combine that with information we collect through the Flow Platform and the Payment Services. We do not control, supervise or respond for how the third parties providing your information process your personal data, and any information request regarding the disclosure of your personal information to us should be directed to such third parties.
We use, store, and process information, including personal information, about you to provide, understand, improve, and develop the Flow Platform, create and maintain a trusted and safer environment and comply with our legal obligations.
We process this information given our legitimate interest in improving the Flow Platform and our Users’ experience with it, and where it is necessary for the adequate performance of the contract with you.
We process this information given our legitimate interest in protecting the Flow Platform, to measure the adequate performance of our contract with you, and to comply with applicable laws.
We will process your personal information for the purposes listed in this section given our legitimate interest in undertaking marketing activities to offer you products or services that may be of your interest. You can opt-out of receiving marketing communications from us by following the unsubscribe instructions included in our marketing communications or changing your notification settings within your Flow Account.
The Payments Data Controller processes this information given its legitimate interest in improving the Payment Services and its users’ experience with it, and where it is necessary for the adequate performance of the contract with you and to comply with applicable laws.
Where you have provided consent, we share your information, including personal information, as described at the time of consent, such as when you authorize a third party application or website to access your Flow Account or when you participate in promotional activities conducted by Flow partners or third parties.
Flow may disclose your information, including personal information, to courts, law enforcement or governmental authorities, or authorized third parties, if and to the extent we are required or permitted to do so by law or if such disclosure is reasonably necessary: (i) comply with our legal obligations, (ii) to comply with legal process and to respond to claims asserted against Flow, (iii) to respond to verified requests relating to a criminal investigation or alleged or suspected illegal activity or any other activity that may expose us, you, or any other of our users to legal liability, (iv) to enforce and administer our Terms of Service, or other agreements with Users, or (v) to protect the rights, property or personal safety of Flow, its employees, its Users, or members of the public.
Where appropriate, we may notify Users about legal requests unless: (i) providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law, or (ii) we believe that providing notice would be futile, ineffective, create a risk of injury or bodily harm to an individual or group, or create or increase a risk of fraud upon Flow’s property, its Users and the Flow Platform. In instances where we comply with legal requests without notice for these reasons, we will attempt to notify that User about the request after the fact where appropriate and where we determine in good faith that we are no longer prevented from doing so.
Flow uses a variety of third party service providers to help us provide services related to the Flow Platform and the Payment Services. Service providers may be located inside or outside of the European Economic Area (“EEA”). In particular, our service providers are based in Europe, Asia and North America.
For example, service providers may help us: (i) fraud prevention, and risk assessment, (ii) perform product development, maintenance and debugging, (iii) allow the provision of the Flow Services through third party platforms and software tools (e.g. through the integration with our APIs), or (iv) provide customer service, advertising, or payments services. These providers have limited access to your information to perform these tasks on our behalf, and are contractually bound to protect and to use it only for the purposes for which it was disclosed and consistent with this Privacy Policy.
Flow will need to share your information, including personal information, in order to ensure the adequate performance of our contract with you.
To enable or support us in providing the Flow Platform, we may share your information, including personal information, within our corporate family of companies that are related by common ownership or control.
Additionally, we share your information, including personal information, with our corporate affiliates in order to support and integrate, promote, and to improve the Flow Platform and our affiliates’ services.
Where permissible according to applicable law we may use certain limited personal information about you, such as your email address, to hash it and to share it with social media platforms, such as Facebook or Google, to generate leads, drive traffic to our websites or otherwise promote our products and services or the Flow Platform. These processing activities are based on our legitimate interest in undertaking marketing activities to offer you products or services that may be if your interest.
The social media platforms with which we may share your personal data are not controlled or supervised by Flow. Therefore, any questions regarding how your social media platform service provider processes your personal data should be directed to such provider.
Please note that you may, at any time ask Flow to cease processing your data for these direct marketing purposes by sending an e-mail to dpo@Flowapp.com.
We may also share aggregated information (information about our users that we combine together so that it no longer identifies or references an individual user) and other anonymized information for regulatory compliance, industry and market analysis, demographic profiling, marketing and advertising, and other business purposes.
We may review, scan, or analyze your communications on the Flow Platform for fraud prevention, risk assessment, regulatory compliance, investigation, product development, research, and customer support purposes. For example, as part of our fraud prevention efforts, we scan and analyze messages to mask contact information and references to other websites. In some cases, we may also scan, review, or analyze messages to debug, improve, and expand product offerings. We use automated methods where reasonably possible. However, occasionally we may need to manually review some communications, such as for fraud investigations and customer support, or to assess and improve the functionality of these automated tools. We will not review, scan, or analyze your communications to send third party marketing messages to you, and we will not sell reviews or analyses of these communications.
These activities are carried out based on Flow’s legitimate interest in ensuring compliance with applicable laws and our Terms of Service, preventing fraud, promoting safety, and improving and ensuring the adequate performance of our services.
The Flow Platform may contain links to third party websites or services, such as third party integrations, co-branded services, or third party-branded services (“Third Party Partners”). Flow doesn’t own or control these Third Party Partners and when you interact with them, you may be providing information directly to the Third Party Partner, Flow, or both. These Third Party Partners will have their own rules about the collection, use, and disclosure of information. We encourage you to review the privacy policies of the other websites you visit.
You may exercise any of the rights described in this section by sending an email to dpo@flowapp.com. Please note that we may ask you to verify your identity before taking further action on your request.
You may access and update some of your information through your Account settings. If you have chosen to connect your Flow Account to a third-party application, like Facebook or Google, you can change your settings and remove permission for the app by changing your Account settings. You are responsible for keeping your personal information up-to-date.
You have the right to ask us to correct inaccurate or incomplete personal information concerning you (and which you cannot update yourself within your Flow Account).
In some jurisdictions, applicable law may entitle you to request copies of your personal information held by us. You may also be entitled to request copies of personal information that you have provided to us in a structured, commonly used, and machine-readable format and/or request us to transmit this information to another service provider (where technically feasible).
We generally retain your personal information for as long as is necessary for the performance of the contract between you and us and to comply with our legal obligations. If you no longer want us to use your information to provide the Flow Platform to you, you can request that we erase your personal information and close your Flow Account. Please note that if you request the erasure of your personal information:
Where you have provided your consent to the processing of your personal information by Flow you may withdraw your consent at any time by changing your Account settings or by sending a communication to dpo@flowapp.com specifying which consent you are withdrawing. Please note that the withdrawal of your consent does not affect the lawfulness of any processing activities based on such consent before its withdrawal. Additionally, in some jurisdictions, applicable law may give you the right to limit the ways in which we use your personal information, in particular where (i) you contest the accuracy of your personal information; (ii) the processing is unlawful and you oppose the erasure of your personal information; (iii) we no longer need your personal information for the purposes of the processing, but you require the information for the establishment, exercise or defence of legal claims; or (iv) you have objected to the processing pursuant to Section 6.6 and pending the verification whether the legitimate grounds of Flow override your own.
In some jurisdictions, applicable law may entitle you to requireFlow not to process your personal information for certain specific purposes (including profiling) where such processing is based on legitimate interest. If you object to such processing Flow will no longer process your personal information for these purposes unless we can demonstrate compelling legitimate grounds for such processing or such processing is required for the establishment, exercise or defence of legal claims.
Where your personal information is processed for direct marketing purposes, you may, at any time ask Flow to cease processing your data for these direct marketing purposes by opting out from your account settings.
You have the right to lodge complaints about the data processing activities carried out by Flow before the competent data protection authorities.
To facilitate our global operations Flow may transfer, store, and process your information within our family of companies or with service providers based in Europe, India, and North America. Laws in these countries may differ from the laws applicable to your Country of Residence. For example, information collected within the EEA may be transferred, stored, and processed outside of the EEA for the purposes described in this Privacy Policy. Where we transfer store, and process your personal information outside of the EEA we have ensured that appropriate safeguards are in place to ensure an adequate level of data protection.
If your information is shared with corporate affiliates or third party service providers outside the EEA, we have – prior to sharing your information with such corporate affiliate or third party service provider – established the necessary means to ensure an adequate level of data protection. This may be an adequacy decision of the European Commission confirming an adequate level of data protection in the respective non-EEA country or an agreement on the basis of the EU Model Clauses (a set of clauses issued by the European Commission).
7.2 California & Vermont Residents
Flow Payments will not share information it collects about you with its affiliates or third parties (both financial and non-financial), except as required or permitted by your state’s law.
California law permits Users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those third parties. See the “Contact” section for where to send such requests. Flow does not share personal information with third parties for their own direct marketing purposes without your prior consent. Accordingly, you can prevent disclosure of your personal information to third parties for their direct marketing purposes by withholding consent.
We are continuously implementing and updating administrative, technical, and physical security measures to help protect your information against unauthorized access, loss, destruction, or alteration. Some of the safeguards we use to protect your information are firewalls and data encryption, and information access controls. If you know or have reason to believe that your Flow Account credentials have been lost, stolen, misappropriated, or otherwise compromised or in case of any actual or suspected unauthorized use of your Flow Account, please contact us following the instructions in the Contact Us section below.
Flow reserves the right to modify this Privacy Policy at any time in accordance with this provision. If we make changes to this Privacy Policy, we will post the revised Privacy Policy on the Flow Platform and update the “Last Updated” date at the top of this Privacy Policy. If you disagree with the revised Privacy Policy, you may cancel your Account. If you do not cancel your Account before the date the revised Privacy Policy becomes effective, your continued access to or use of the Flow Platform will be subject to the revised Privacy Policy.
If you have any questions about this Privacy Policy please may email us at support@flowapp.com.