Privacy policy

1. Who we are

1.1 The controller is FlowFinds Solutions Kft., registered in Hungary, company registration number 13-09-242910.

1.2 Privacy enquiries go to [email protected]. We have not appointed a Data Protection Officer, because our processing does not meet the criteria in Article 37 GDPR that make one mandatory. The address above reaches the people who are accountable for this policy.

1.3 This policy covers our company surfaces, the FlowFinds application, its API and its documentation. Storefronts generated for customers are operated by those customers and carry their own privacy notices.

2. What we collect, why, and on what basis

Every category of personal data we hold about you is in this table, with the purpose it serves, the lawful basis for it, and how long it is kept.

The operational detail behind the retention column — where each store lives and how deletion actually runs — is on data handling and retention.

3. What we do not do

3.1 We do not sell personal data, and we do not share it for cross-context behavioural advertising.

3.2 We do not use advertising or analytics trackers on this site. The only cookies we set are the ones listed in the cookie policy, and they are strictly functional.

3.3 We do not use your storefront content, your buyers’ orders or your support email to train models.

3.4 We do not make decisions producing legal or similarly significant effects about you by automated means. The agent’s verdicts are recommendations shown to a person, and no account is suspended without human review.

4. Where the data comes from

4.1 Mostly from you: what you type, upload, configure and buy.

4.2 Some from your use of the service: usage counters, verdict state, and technical logs generated as requests are served.

4.3 Some from our payment provider: the confirmed status and reference of a transaction, which we read back rather than trusting a returning browser.

4.4 Some from a person who referred you: the fact that a link was opened, recorded against a session rather than against your identity.

5. Who receives it

5.1 Sub-processors. A small number of vendors process data on our instructions — payments, transactional and inbound email, network delivery, and the model provider behind the agent. Each is named with its role and location on sub-processors, and each is bound by the sub-processor terms.

5.2 Professional advisers. Accountants and lawyers, where they need it and under a duty of confidence.

5.3 Authorities. Where the law compels disclosure. We check that a request is valid and proportionate, disclose the minimum, and tell you unless we are prohibited from doing so.

5.4 A successor. If the business is sold or reorganised, under equivalent protection and with notice to you.

6. International transfers

6.1 Personal data is stored on infrastructure we operate in the European Union.

6.2 Some sub-processors are established outside the EEA. Where a transfer occurs, we rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision covering the recipient, and we assess whether additional safeguards are needed for that destination.

6.3 The country of establishment of each sub-processor, and the transfer mechanism relied on, are stated on sub-processors. Ask us at [email protected] for a copy of the clauses relied on for a particular transfer.

7. Security

7.1 Data is encrypted in transit, access is restricted to the people who need it, and payment credentials are held outside the application and never written into a generated store.

7.2 The measures we actually apply — and the certifications we do not hold — are set out plainly on security. We do not claim an audit we have not had.

7.3 Where a breach is likely to result in a risk to your rights, we notify the supervisory authority within 72 hours of becoming aware of it, and notify you without undue delay where the risk is high.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and receive a copy;
• rectify data that is inaccurate or incomplete;
• erase data where it is no longer needed, where you withdraw consent that was the basis for it, or where you successfully object;
• restrict processing while a dispute about accuracy or lawfulness is resolved;
• port the data you gave us, in a structured, machine-readable format;
• object to processing based on legitimate interests, on grounds relating to your situation;
• withdraw consent at any time, where consent was the basis, without affecting processing already carried out.

8.1 Erasure does not extend to records we are legally required to keep, principally accounting records of payments.

8.2 Where you are a buyer of a FlowFinds customer’s shop, your rights are exercised against that shop as controller. Contact them; if they cannot be reached, write to us and we will pass the request on.

9. How to exercise them

9.1 Email [email protected] from the address on the account, saying which right you are exercising. There is no form to complete.

9.2 We respond within one month. Where a request is complex we may extend by two further months and will tell you why within the first month.

9.3 Requests are free. We ask for proof of identity only where we genuinely cannot otherwise confirm it, and we ask for the minimum that settles the question.

9.4 If you are unhappy with how we handled a request, you may complain to the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), or to the supervisory authority of the EU member state where you live or work. We would rather you told us first.

10. Children

10.1 FlowFinds is not offered to people under 18, and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will delete it.

11. Changes to this policy

11.1 The date at the top of this page is the date of the last substantive revision.

11.2 Where a change materially affects how we use your data, we give at least 30 days’ notice by email before it takes effect. A previous version is available on request.