01Who processes your data
Flowdesk is the controller for the personal data collected through this website and in your contact with us. Our details:
- Company
- Flowdesk V.O.F., registered in Utrecht, the Netherlands
- Company register
- Chamber of Commerce number
- info@flowdeskagency.com
- +31 6 17347782
We have not appointed a data protection officer, and we are not legally required to. Privacy questions come in at the email address above and are handled by us directly.
02Two roles: controller and processor
For privacy purposes the difference between these two roles matters, because which party you need to approach depends on which data it concerns.
- Controller. For visitors to this website, for people who contact us and for our own client administration, we decide ourselves why and how data is used. That is what this statement is about.
- Processor. As soon as we handle customer service and disputes for an online store, we work with data belonging to that store's customers: order details, emails, addresses, payment disputes. For that data the store is the controller and we are the processor. We use it solely on instruction, under the data processing agreement that comes with every engagement.
Are you a customer of a store that uses Flowdesk, and do you want to know what happens to your data or have it deleted? Address your request to that store. We are not allowed to act on such requests independently and will forward them to the store, which is responsible for handling them.
03Which data and why
We collect no more than we need. For each type of data, below is what we use it for and on which legal basis.
- Website usage
- Pages visited, button clicks, device and browser type, and your approximate country or region. Purpose: to see which pages and which buttons work, so we can improve the site. Legal basis: your consent, given through the cookie notice. Decline and we do not measure you.
- Contact requests
- Your name, email address, phone number and the content of your message, when you email us or reach out on WhatsApp. Purpose: to answer your question and, where relevant, prepare a working relationship. Legal basis: performance of a contract or steps taken prior to it, and otherwise our legitimate interest in replying to messages.
- Intro call
- Name, email address and the time slot you pick when booking a call through our scheduling link. Purpose: holding the call. Legal basis: performance of a contract or steps taken prior to it.
- Client administration
- Company and contact details, invoices and correspondence from clients. Purpose: delivering the engagement, invoicing and keeping our books. Legal basis: performance of the contract and the statutory retention obligation that applies to business records.
- Technical logs
- IP address, timestamp and page requested, recorded by our hosting and security providers. Purpose: keeping the site up and secure, fending off abuse and attacks, and tracing faults. Legal basis: legitimate interest in an available and secure website.
We do not process special categories of personal data through this website, such as data on health, religion or political opinion. So please do not ask about them in a message to us and do not send them to us unprompted.
This website is not aimed at children under sixteen. We do not approach them and we do not knowingly collect their data.
04Cookies and local storage
Cookies are small files a website places on your device. We use very few, and none for advertising. We do not sell data on.
- fd-cookies
- Not a cookie but local storage in your browser, holding nothing but your own choice of "accepted" or "declined". Without it we would show the cookie notice again on every visit. Functional, so no consent is needed. It stays until you clear it or change your choice.
- _ga and _ga_*
- Google Analytics cookies that recognise you as the same returning visitor on a later visit, so we do not count every session as a new person. They are only placed after you click Accept. Retention: two years at most.
Until the moment you give consent, Google Analytics runs in the mode where no cookies are placed and only a signal without recognition is sent. Click Decline and it stays that way. We have also set IP addresses to be processed in truncated form.
Changed your mind? You can change your choice here at any time. The notice will then appear again.
05Who receives your data
We use a small number of service providers. They may use the data only on our behalf and not for their own purposes. With parties acting as processors we have a data processing agreement in place.
- Google Analytics
- Measures how the website is used. Only active after your consent. Provider: Google Ireland Limited.
- Google Fonts
- The typefaces on this site are loaded from Google's servers. That passes your IP address to Google, even if you give no consent for statistics, because the page cannot render without its typefaces. Provider: Google Ireland Limited.
- Hosting and security
- Our website runs at a hosting provider and passes through a security and acceleration service that absorbs attacks. Both process technical logs containing your IP address.
- Email and ticketing system
- Messages to us arrive in our email environment. For client engagements we work in a ticketing system. Which systems those are per engagement is set out in the data processing agreement with that client.
- Scheduling tool and WhatsApp
- If you book a call or send a WhatsApp message you leave our site, and that party's terms apply as well. As long as you do not click, no data is shared through these buttons.
- Accounting and advice
- Our bookkeeper and, where it comes up, a lawyer or accountant may have sight of invoices and correspondence. They are bound by confidentiality.
Beyond that we only provide data to third parties where the law requires us to, for example on the order of a competent authority.
06Transfers outside the EEA
Some of the parties above are American or have servers there. As a result, data can end up outside the European Economic Area. That is only permitted with appropriate safeguards. We rely on the adequacy decision for the EU-US Data Privacy Framework and, where that does not apply, on the standard contractual clauses adopted by the European Commission.
If you would like a copy of the safeguards that apply to a specific party, ask for it at info@flowdeskagency.com.
07How long we keep data
We keep nothing longer than we need it for the purpose it was collected for.
- Statistics
- Fourteen months, after which Google Analytics deletes the event data automatically.
- Contact requests
- Up to twenty-four months after the last contact, unless it leads to a working relationship. The data then moves into the client administration.
- Client administration
- Seven years after the end of the financial year, because that is how long we are required to keep our records for tax purposes.
- Data processed for clients
- As agreed in the data processing agreement. When the engagement ends we return or delete it, unless a legal obligation says otherwise.
- Technical logs
- Briefly, at our hosting and security providers, and only for as long as security and fault tracing require.
08How we secure data
We take appropriate technical and organisational measures. Traffic to this website is encrypted over https. System access is personal and protected with strong passwords and two-factor authentication wherever possible. Staff only get access to what their work requires and are bound by confidentiality.
If you suspect a breach or spot a vulnerability, report it to info@flowdeskagency.com. We treat such a report as a priority. If it is a data breach that poses a risk to individuals, we report it within seventy-two hours to the Dutch Data Protection Authority and, where required, to the people concerned.
09Your rights
Under the GDPR you have a number of rights. You can exercise them by emailing info@flowdeskagency.com.
- Access. Request which data we hold about you.
- Rectification. Have incorrect data corrected or completed.
- Erasure. Have your data deleted, unless we are legally required to keep it.
- Restriction. Have processing paused temporarily, for example while a correction is pending.
- Objection. Object to processing based on our legitimate interest.
- Portability. Receive the data you provided yourself in a common file format.
- Withdraw consent. Withdraw your consent for statistics at any time, using the button in section 04. It takes effect from the moment you withdraw and does not affect what was measured before.
We respond within one month. If your request is complex we may extend that by two months, and we will tell you within the first month if we do. To avoid handing data to the wrong person, we may ask for additional information proving that it is you.
If your request concerns data we process on behalf of an online store, see section 02: you need to file it with that store.
10Filing a complaint
If you disagree with how we handle your data, tell us first. We usually resolve it together. If we cannot, you have the right to lodge a complaint with the supervisory authority, the Dutch Data Protection Authority, at autoriteitpersoonsgegevens.nl.
11No profiling or automated decisions
We do not take decisions about people based solely on automated processing that have legal or similarly significant effects. We do not build profiles of website visitors and we do not use the statistics to track individuals; they exist to show which pages and buttons work.
12Changes to this statement
If our services or the way we process data change, we update this statement. The version number and the date of the last change are shown at the top. For a substantial change we notify our clients directly.
This statement is about the processing of personal data. The arrangements for our services are governed by the terms and conditions.
A question about your data?
Go ahead and ask. We would rather explain what we do than leave you guessing.