Privacy Policy

Introduction

This Privacy Policy describes how Cyberarcmsp Consulting Services ("we", "us" or "our"), which develops and maintains FlowCRM, processes personal information that we collect through flowcrm.si and any other website or service that links to this Privacy Policy (the "Service"), and through our sales, marketing and support activities.

It also explains your choices and rights. Region-specific information for India (DPDPA), the EU and UK (GDPR), the United States and Australia is summarised below and set out in full on our data protection and compliance page.

Our role: website visitors and FlowCRM customers

For personal information you give us directly (for example a demo, migration or privacy request) and information we collect when you browse this website, we decide why and how it is used. We act as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDPA) and as a controller under the GDPR and UK GDPR.

For the records our customers store in FlowCRM (contacts, companies, deals, notes and files), the customer decides how that data is used and we process it on the customer's behalf, as a Data Processor under the DPDPA and a processor under the GDPR. That processing is governed by our agreement with the customer, including the Data Processing Addendum. If you are a contact in a customer's CRM, please contact that organisation about your data; we will help it respond.

Personal information we collect

Information you provide to us:

• Contact data, such as your name, work email address, company name and country.
• Request data, such as team size, current CRM, data volume, desired migration date and anything you write in a message field.
• Privacy request data, such as the type of request, your country and the details you provide.
• Account data, if you become a customer, such as sign-in details, role and seat type.
• Communications data, such as the emails you send us and our replies.

Information we collect automatically

Our hosting provider and font provider receive standard technical data when you load a page, such as your IP address, browser type and the page requested.

If you accept analytics in our cookie banner, Google Analytics collects device and online-activity data, such as pages viewed, time on page, the referring site, approximate location derived from your IP address, and browser and device type. Google states that Google Analytics 4 does not log or store IP addresses. Without your consent, Google Analytics does not load at all. See our Cookie Policy.

How we use your personal information

We do not sell personal information, we do not use it for advertising profiles, and we do not use the information you submit through this website to train AI models.

• Service delivery and operations: to reply to your requests, arrange demos, plan migrations, provide and support the Service, and send service-related messages.
• Service improvement and analytics: with your consent, to understand which pages are useful and how visitors move around the website, so we can improve it.
• Direct communication: to send information you asked for. We do not add you to marketing lists without your consent, and you can opt out of marketing emails at any time.
• Compliance, fraud prevention and safety: to keep the Service secure (for example detecting abuse of our forms), enforce our terms, and meet legal obligations.
• Aggregated and de-identified data: we may create statistics that do not identify you, and we will not attempt to re-identify them.

Legal bases (GDPR) and consent (DPDPA)

• Consent: when you tick the consent box on a form, and when you accept analytics. You can withdraw consent at any time, as easily as you gave it, through the privacy request form or the "Cookie settings" link in the footer.
• To take steps you ask for before a contract, and to perform a contract with our customers.
• Legitimate interests (GDPR only): running a secure website and responding to business enquiries, balanced against your rights.
• Legal obligation: where the law requires us to keep or disclose information.

How we share your personal information

We share personal information only as described here:

• Service providers that process it on our behalf: Formspree (delivers website form submissions), Google (Google Analytics, only with your consent; Google Fonts, which serves this website's fonts) and our website hosting provider.
• Professional advisors, such as lawyers and accountants, where needed.
• Authorities, where required by law or to protect rights, safety and security.
• Business transfers, if we are involved in a merger, acquisition or sale of assets, subject to this Privacy Policy.
• Others, with your consent or at your direction.

Retention

We keep personal information for as long as we need it for the purpose it was collected, including to meet legal, accounting or reporting requirements, to establish or defend legal claims, or to prevent fraud. To decide how long, we consider the amount, nature and sensitivity of the information, the risk of harm from unauthorised use, our purposes and whether we can achieve them another way, and legal requirements. Enquiry data is deleted or anonymised once it is no longer needed; you can ask us to delete it sooner. Customer records in the product are kept and deleted on the customer's instructions.

International transfers

Our service providers may process personal information outside your country, including in the United States. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses for transfers from the EU and UK. India-region hosting for customer data is on our roadmap.

Security

We use reasonable technical and organisational measures to protect personal information, including encrypted connections (HTTPS), access controls and an isolated database for each FlowCRM customer. No method of transmission or storage is completely secure. See our security page. We do not claim certifications we have not obtained.

Your choices

• Analytics: accept or reject Google Analytics in the cookie banner, and change your mind at any time with "Cookie settings" in the footer.
• Marketing emails: unsubscribe from any marketing email, or tell us through the privacy request form.
• Declining to provide information: some forms need certain details for us to reply; without them we may not be able to help.
• Do Not Track: our website does not respond to browser "Do Not Track" signals, but analytics never run without your consent.

Your rights

Depending on where you live, you can ask to access, correct, update or erase your personal information, withdraw consent, restrict or object to processing, and receive a copy in a portable format. Under the DPDPA you can also seek grievance redressal from our Grievance Officer and nominate someone to exercise your rights. EU and UK residents can complain to a supervisory authority. US residents can ask to know, correct and delete their information; we do not sell or share it for cross-context behavioural advertising. Australian residents can complain to the Office of the Australian Information Commissioner.

Use the privacy request form. We may need to confirm your identity, and we will reply within the time the applicable law allows. We will not discriminate against you for exercising your rights.

Children

FlowCRM is a business service. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, tell us and we will delete it.

Other sites and services

Our website links to other sites, such as Google's privacy pages. Their privacy practices are their own; please read their policies.

Changes to this Privacy Policy

We may update this Privacy Policy. We will post the new version here with its effective date, and highlight significant changes on the website or tell customers directly.

How to contact us

FlowCRM is a product developed and maintained by Cyberarcmsp Consulting Services. Questions about this document or how we handle personal information can be sent through the privacy request form. Sales questions can go to [sales@flowcrm.si](mailto:sales@flowcrm.si).