Privacy Policy

Last updated: 29 September 2026

1. Who We Are

FlowFicient Ltd ("FlowFicient", "we", "us", "our") is a private limited company registered in England and Wales under company number 17091726. Our registered office is 10 Clydesdale Court, Luton, LU4 0NQ. We are registered with the Information Commissioner's Office (ICO) under registration number ZC256661.

For the personal data described in this policy, we are the controller. When we build or run systems that handle our clients' own customer data, such as a CRM, booking system or automation, we act as a processor on our client's behalf. In that case, the Data Processing Agreement with that client governs how the data is handled, and the client's own privacy notice applies to their customers.

Contact for data protection matters: enquiries@flowficient.net

2. Information We Collect

We collect and process the following categories of personal data:

• Identity data: first name, last name, job title, company name
• Contact data: business email address, telephone number, postal address
• Technical data: IP address, browser type and version, time zone, operating system
• Usage data: how you use our website, collected only if you accept analytics cookies (see section 11)
• Advertising data: whether you reached our website from one of our ads, and what you did there afterwards, collected only if you accept advertising cookies (see section 11)
• Communications data: your preferences for receiving communications from us, and your communication history with us
• Prospect data: business contact details of companies we may contact about our services. This includes names, job titles, business email addresses, phone numbers and company information, taken from publicly available sources.
• Project data: information you share with us while we deliver our services. This may include business data, your customers' data, or system credentials needed to complete your project. Credentials are handled as described in section 7.

3. How We Collect Your Data

We collect data through:

• Direct interactions: when you book a call, subscribe to our newsletter, or contact us by email or phone
• Automated technologies: strictly necessary storage that makes the website work, and analytics and advertising cookies only if you accept them (see section 11)
• Publicly available sources: Companies House, business listings such as Google Business Profiles, and company websites, used to identify businesses that may benefit from our services

4. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we process your personal data on the following lawful bases:

• Contract: where processing is necessary to perform a contract with you, or to take steps you have asked for before entering into one, such as preparing a proposal or a free mock-up
• Legitimate interests: where processing is necessary for our legitimate interests and those interests are not overridden by your rights. Our legitimate interests are responding to enquiries, keeping our website secure and working properly, improving our services, and contacting businesses (limited companies and LLPs) about services relevant to them. You can object to processing based on legitimate interests at any time by emailing enquiries@flowficient.net. If you object to being contacted about our services, we will stop and add you to a suppression list so you are not contacted again.
• Consent: where you have given clear consent for a specific purpose, such as newsletter subscriptions, analytics cookies and advertising cookies. You can withdraw consent at any time.
• Legal obligation: where processing is necessary to comply with a legal or regulatory obligation, such as keeping financial records

5. How We Use Your Data

We use your personal data for the following purposes:

• To deliver and manage our services to you, including website design, Customer Relationship Management (CRM) integration, and workflow automation projects
• To process and confirm booking requests and appointments
• To send you newsletters, updates, and marketing communications where you have consented to receive them
• To respond to enquiries and provide customer support
• To improve our website and service offerings
• To comply with legal and regulatory obligations

6. AI Tools and Automated Processing

AI in our services. We use AI-assisted tools when delivering our agentic workflow and automation services. Where we process personal data using AI systems, a person keeps appropriate oversight of the results. We only use AI providers whose terms prevent them from using the data we submit to train their models. We carry out Data Protection Impact Assessments (DPIAs) where required under Article 35 of UK GDPR.

The chat assistant on our website. The chat assistant on our website is an automated assistant, not a person. It answers from a fixed set of pre-written answers about our services and does not use AI. It runs entirely in your browser: the messages you type are not sent to us or to anyone else, and they are not stored. They are cleared when you close or reload the page. Because nobody reads the chat, it cannot be used to contact us or to make a request about your personal data; please email enquiries@flowficient.net or book a call instead. The assistant cannot make decisions about you.

Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected:

• Client project data: 7 years after the project is completed, in line with UK limitation periods. This does not include credentials or your customers' data (see below).
• System credentials: stored in an encrypted password manager, used only for your project, and deleted, or revoked at our request, when the project is handed over or the engagement ends
• Your customers' data processed on your behalf: returned or deleted at the end of the engagement, as set out in our Data Processing Agreement with you
• Files you send us: deleted on request, unless we need to keep them to meet a legal obligation
• Booking records: 2 years from the date of the booking
• Newsletter subscriber data: until you unsubscribe or withdraw consent
• Website enquiries: 3 years from the date of your last contact
• Messages typed into the chat assistant on our website: not kept. They stay in your browser and are cleared when you close or reload the page.
• Prospect data: deleted 12 months after our last contact if you have not become a client. If you ask us not to contact you, we keep your name and email address on a suppression list only so we can honour that request.
• Analytics data: 2 months, the retention period set in Google Analytics
• Advertising cookies on our website: up to 90 days (see section 11). Google and Meta keep the data they receive under their own retention policies.

8. Sharing Your Data

We do not sell your personal data. We share it only where necessary, with:

• Service providers who support our business, each bound by data processing terms:
  • Vercel (website and CRM hosting)
  • Google Workspace (email, calendar, call bookings, newsletter delivery, and record storage in Google Sheets)
  • Google Analytics (website analytics, only if you accept analytics cookies)
  • Google Ads (measuring our Google ads and showing them to people who have visited our website, only if you accept advertising cookies)
  • Meta Platforms (measuring our Facebook and Instagram ads and showing them to people who have visited our website, only if you accept advertising cookies, and only while we advertise on those platforms)
  • Anthropic (Claude) (AI-assisted service delivery, and drafting and sending our emails)
  • Make.com (workflow automation)
  • Monzo Business (payments)
• Professional advisers, including lawyers and accountants, who have obligations of confidentiality
• Regulators and authorities, where the law requires it

We do not allow our service providers to use your data for their own purposes.

9. International Data Transfers

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including adequacy decisions, standard contractual clauses (SCCs), or other lawful transfer mechanisms recognised under UK GDPR and the International Data Transfer Agreement (IDTA) framework.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your data in certain circumstances
• Right to restrict processing: request that we limit how we use your data
• Right to data portability: request transfer of your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests or for direct marketing
• Rights in relation to automated decision-making: not be subject to solely automated decisions that produce legal or significant effects

To exercise any of these rights, please contact us at Enquiries@flowficient.net. We will respond within one month of receiving your request. If a request is complex, we may extend this by up to two further months, and we will tell you if we do. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Cookies

We use three types of storage on our website.

Strictly necessary. A small amount of local storage remembers your cookie choice. This is needed for the site to work, so it doesn't require consent.

Analytics (optional). If you click "Accept all" or "Analytics only", we use Google Analytics to understand how visitors use the site, such as which pages are viewed and how people arrive. Google Analytics sets cookies named _ga and _ga_VQT83835R8, which last up to 2 years.

Advertising (optional). If you click "Accept all", we also use advertising cookies to see which of our ads bring people to the site, and to show our ads to people who have visited before. These come from Google Ads and, while we advertise on Facebook or Instagram, from Meta. On our website they can include Google's _gcl_au and Meta's _fbp and _fbc, which last up to 90 days. Google and Meta may also set cookies on their own domains, and they use the data they receive under their own privacy policies.

These cookies are only set if you accept them. If you choose "Analytics only", no advertising cookies are set. If you choose "Reject optional", no analytics or advertising cookies are set.

You can change your choice at any time using the Cookie settings link at the bottom of every page.

12. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure. These include encrypted data transmission (HTTPS), access controls, and regular security reviews. In the event of a personal data breach, we will notify the ICO and affected individuals in accordance with our obligations under UK GDPR.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on our website with an updated date. Continued use of our services after changes take effect constitutes acceptance of the revised policy.

14. Contact Us

For any privacy-related questions or to exercise your data rights, contact us at enquiries@flowficient.net, or write to FlowFicient Ltd, 10 Clydesdale Court, Luton, LU4 0NQ.