Who we are
Flows360 LTD ("Flows360", "we", "us" or "our") provides a cloud-based integration and workflow automation platform.
Legal entity: Flows360 LTD
Registered address: 86-90 Paul Street, London, EC2A 4NE, United Kingdom
Company number: 17112747
Privacy contact: compliance@flows360.net
This Privacy Policy explains how we collect, use and protect personal data when you use our website, communicate with us, become a customer, or use the Flows360 platform.
Our role
When we process information about our own website visitors, prospects, customers, users, suppliers and business contacts, Flows360 generally acts as a data controller.
When a customer uses Flows360 to connect systems, execute workflows or process information on the customer's instructions, Flows360 generally acts as a data processor. Where we act as processor, processing is governed by our Data Processing Agreement and the customer's instructions.
Information we collect
We may collect account and business contact information; commercial enquiries and communications; platform activity, configuration, support and diagnostic information; website/device/cookie information where permitted; professional B2B prospect information; and customer-controlled data processed through connected applications.
How we use personal data
| Purpose | Typical lawful basis |
|---|---|
| Providing/administering Flows360 | Contract |
| Accounts and customer support | Contract and legitimate interests |
| Enquiries and demos | Legitimate interests and pre-contract steps |
| Security and troubleshooting | Legitimate interests |
| Fraud/misuse prevention | Legitimate interests and legal obligations |
| Billing/accounting | Contract and legal obligations |
| Service improvement | Legitimate interests and consent where required |
| Relevant B2B marketing | Legitimate interests where permitted |
| Legal/regulatory compliance | Legal obligation |
| Non-essential cookies/analytics | Consent where required |
Where we rely on legitimate interests, we consider our interests against the rights and interests of affected individuals.
Business marketing and prospect information
Flows360 is a B2B service. We may use professional business contact information from professional networking sources, public company/professional information, business data and enrichment providers, referrals, or information provided directly to us.
You may object to direct marketing at any time. We honour valid opt-outs and may retain limited suppression information to avoid contacting you again inadvertently.
Customer workflow data
Customers may configure Flows360 to process data through workflows, mappings, integrations and operational queries. Flows360 does not claim ownership of customer data.
Customers are responsible for determining what they process and ensuring appropriate authority, permissions and lawful basis. Flows360 processes customer-controlled data to provide the service, follow customer instructions, maintain security or meet legal obligations. We do not use it for our own independent marketing.
Service providers and subprocessors
We use third-party providers where necessary to operate and secure Flows360. Appropriate contractual and data-protection safeguards are required where they process personal data on our behalf.
Our current customer-data subprocessors are maintained at flows360.co/subprocessors. We do not sell personal data.
Lovable and underlying platform services
Parts of Flows360 may be developed or operated using Lovable and other infrastructure providers. Where they process personal data on our behalf, they act under applicable contractual arrangements. Flows360 remains responsible for appropriately configuring and operating its application and meeting its own legal obligations.
International transfers
Where personal data is transferred internationally and safeguards are required, we use legally recognised mechanisms such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, EU Standard Contractual Clauses where applicable, or another legally permitted safeguard.
Security
We use technical and organisational measures designed to protect personal data. Depending on architecture these may include access controls, authentication, infrastructure security, security monitoring, encrypted communications, tenant controls and provider platform protections.
No online system can be guaranteed completely secure. Customers are responsible for securing their accounts, credentials, connected applications and workflow configurations.
Sensitive information
Customers must not process information through Flows360 where doing so would breach law, contractual restrictions or underlying-provider restrictions. Certain sensitive categories, including protected health information, may require a specific plan, deployment arrangement or written agreement. Contact Flows360 before configuring such workflows.
Retention
We retain personal data only as long as reasonably necessary for its purpose. Periods vary according to contractual, legal, security, support and service requirements. Some information may remain temporarily in backup or disaster-recovery systems until normal deletion cycles complete.
Your rights
Depending on applicable law and circumstances, you may have rights to access, correction, deletion, restriction, objection, portability, withdrawal of consent and objection to direct marketing.
Where Flows360 processes information solely for a customer, we may refer your request to that customer.
Requests: compliance@flows360.net. You may also complain to the UK Information Commissioner's Office.
Cookies
We use necessary cookies and similar technologies. Optional analytics or similar technologies are used only where permitted and, where required, after consent. Preferences can be managed through our cookie controls.
Children's data
Flows360 is a business service and is not intended for direct use by children.
Changes
We may update this policy. The latest version and update date will be published here, with material changes communicated where appropriate.