Privacy Policy

1. Data controller

The data controller for this website is FlowCraft BV, a company incorporated under Belgian law with company number BE1035.606.345, registered at Onze Lieve Vrouwestraat 20, 2240 Zandhoven, Belgium.

You can contact us at info@flowcraft.be for any privacy-related question or request.

2. What data we collect

We collect personal data in two contexts.

Through the consultation form: we collect your email address (required), and optionally your name, company name, and a message. We also record a consent timestamp. Form submissions are sent to our internal lead-management dashboard for follow-up.

Through the waitlist: we collect your email address and, optionally, your name and company name. These are forwarded to our email provider for waitlist communication.

For analytics, and only if you accept it in the cookie banner, we use Umami, an open-source analytics tool that we host ourselves on our servers in the EU. It records which page you visit (its address, including campaign codes such as utm_source, and its title) and which website you came from. It also records your browser, operating system, device type, screen size and language, your country, region and city (derived from your IP address, which is not stored), how long a page is in view, and whether a waitlist or consultation form was sent, without its content. Visits are grouped with an identifier calculated from the website, your IP address and your browser details together with a value that changes every month, so visits cannot be linked across months. No user profiles are built and nothing is shared with third parties.

For abuse prevention: your IP address is processed transiently in server memory to enforce rate limits on form submissions. It is never written to disk or retained beyond the request.

3. Legal basis

We rely on the following legal bases under the General Data Protection Regulation (GDPR):

Consent (Art. 6(1)(a) GDPR): for consultation form submissions and waitlist sign-ups. You provide explicit consent before submitting either form, and you may withdraw that consent at any time by contacting us.

Legitimate interests (Art. 6(1)(f) GDPR): for in-memory rate limiting on form submissions (preventing abuse of our contact forms).

Consent (Art. 6(1)(a) GDPR) also covers our website analytics: it only starts after you accept it in the cookie banner, and you can withdraw that consent at any time via ‘Cookie settings’ at the bottom of every page.

4. Sub-processors and recipients

We share data with the following third parties to operate the service:

Our internal dashboard: receives consultation form submissions (email, optional name/company/message, consent timestamp) for lead handling and follow-up.

ConvertKit (now Kit): our email provider for waitlist management. ConvertKit is a US-based service. Data transfers to the United States are carried out under appropriate safeguards, including Standard Contractual Clauses (SCCs) as required by GDPR Chapter V. You may unsubscribe from waitlist communications at any time.

Website analytics: we run Umami ourselves on our hosting at Hetzner (see below). No analytics provider receives your data.

Hetzner Cloud: our hosting provider, operating data centres in the European Union (Germany). Server infrastructure and in-transit data are hosted within the EU.

5. Retention

Waitlist email addresses are retained until you unsubscribe. You can do so at any time by clicking the unsubscribe link in any email we send or by contacting us directly.

Consultation details (email, name, company, message) are retained for the duration of the business engagement and for a reasonable follow-up period thereafter.

Website analytics data (Umami) is kept for 6 months and then deleted.

In-memory IP data used for rate limiting is not persisted and is discarded at the end of the request cycle.

6. Cookies

This website uses one first-party cookie, fc_consent, which stores your choice in the cookie banner (accepted or refused) for 180 days. It is strictly necessary to remember that choice.

Only if you accept analytics does the website load Umami. Umami itself sets no cookies. To remember that you refused, your browser also keeps a local setting (umami.disabled). You can change your choice at any time via ‘Cookie settings’ at the bottom of every page, or by deleting the cookie in your browser.

Separately, our own server counts page views anonymously for every visitor: which page was opened, the name of the site you came from (for example linkedin.com) and whether it was a desktop or mobile device. It stores no IP address, sets no cookie and reads nothing from your browser, so it cannot identify you.

7. Your rights

Under the GDPR you have the following rights with respect to your personal data:

Right of access: you may request a copy of the data we hold about you.

Right to rectification: you may ask us to correct inaccurate or incomplete data.

Right to erasure: you may ask us to delete your data, subject to legal obligations that require us to retain it.

Right to restriction of processing: you may ask us to limit how we use your data in certain circumstances.

Right to data portability: you may request your data in a structured, machine-readable format.

Right to object: you may object to processing based on legitimate interests.

Social media connections: where we connect FlowCraft's own social media accounts (for example Instagram or LinkedIn) to our internal marketing dashboard, the data obtained through those connections relates solely to FlowCraft's own business accounts and to content we publish ourselves. We do not obtain or store personal data of other users of those platforms. Such data is deleted on request via the contact address below, and access can be revoked at any time from the account settings of the platform concerned.

To exercise any of these rights, please contact us at info@flowcraft.be. We will respond without undue delay and in any event within one month of receipt. Where a request is particularly complex or where we receive a number of requests, we may extend this period by two further months, in which case we will inform you within one month of receipt and explain the reason for the delay.

You also have the right to lodge a complaint with the Belgian supervisory authority: the Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.

8. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The date at the top of this page indicates when the policy was last revised.

We encourage you to review this page periodically. Continued use of the website after any update constitutes your acknowledgement of the revised policy.

9. Contact

For any questions or requests relating to this Privacy Policy, please contact:

FlowCraft BV Onze Lieve Vrouwestraat 20, 2240 Zandhoven, Belgium info@flowcraft.be