Data Protection and Compliance

Our approach

FlowCRM is sold worldwide, so we design for the strictest common requirements: collect only what is needed, use it only for the stated purpose, be clear about who processes it, and make rights easy to exercise. FlowCRM is developed and maintained by Cyberarcmsp Consulting Services. We describe what we do, and do not claim certifications we have not obtained.

India: Digital Personal Data Protection Act, 2023 (DPDPA)

For personal data collected on this website we act as a Data Fiduciary: we give notice of what we collect and why (see the Privacy Policy), process it on the basis of your consent, and let you withdraw consent as easily as you gave it.

For personal data your organisation stores in FlowCRM, your organisation is the Data Fiduciary and we act as its Data Processor, under our Data Processing Addendum.

You can ask for a summary of the personal data we hold about you, have it corrected, completed, updated or erased, nominate another person to exercise your rights, and raise a grievance. Our Grievance Officer handles requests submitted through the form below.

India-region hosting for customer data is on our roadmap. Each customer's data already sits in its own isolated database.

European Union and United Kingdom: GDPR and UK GDPR

We are the controller for website enquiry and analytics data, and a processor for customer content in the product, under our Data Processing Addendum with standard contractual clauses for international transfers. Individuals can request access, rectification, erasure, restriction, portability and objection, and can complain to their supervisory authority.

United States: state privacy laws (including CCPA/CPRA)

You can ask to know what personal information we hold about you and to correct or delete it. We do not sell personal information or share it for cross-context behavioural advertising, and we will not treat you differently for exercising your rights.

Australia: Privacy Act 1988

We handle personal information in line with the Australian Privacy Principles, including openness about what we collect, use only for the stated purpose, and access and correction on request. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner.

Cookies and analytics

Google Analytics runs only after you accept it in the cookie banner, using Google Consent Mode with advertising consent always denied. See the Cookie Policy.

Security in the product

Email and password sign-in and single sign-on via OIDC are live on every plan. Approvals, SAML and SCIM, and an audit log (30 days on Team, 1 year on Business, 7 years on Enterprise) are in build. See security and enterprise controls.

Make a privacy request or raise a grievance

Use the form below to access, correct, update or erase your data, withdraw consent, nominate someone to act for you, or raise a grievance with our Grievance Officer. If your request concerns data your organisation stores in FlowCRM, we will pass it to your organisation, which decides how to respond, and help it do so.