Website privacy notice

1. Website engagement measurement

As of 3 November 2026, optional click, scroll and video-event collection on this website is disabled and the measurement popup has been removed. Previous choices are cleared on your next visit. Historical daily aggregate reports may remain for up to 180 days. Cookieless Cloudflare traffic statistics remain as described below.

2. Scope of this notice

This notice explains how Flow HQ Ltd uses personal data when you visit flowbenefits.gr, request a demonstration or contact us about Flow. It covers this employer-facing website, related enquiry correspondence, and optional advertising measurement on the company signup page at flow-greece-production.onrender.com/employer-signup. Employee accounts, payroll information, identity checks and payment processing are separate activities and are not covered by this website notice. Please do not submit employee records, bank details or sensitive personal information through the enquiry form.

3. Who is responsible for your data?

Flow HQ Ltd is the controller of personal data covered by this notice. We are a private company limited by shares registered in England and Wales, company number 17370799. For privacy questions or requests, email sam@flowbenefits.gr. References to data protection rights include the UK GDPR and EU GDPR where applicable.

4. Information you provide

The enquiry form collects your name, work email, company, employee headcount, industry and, optionally, your time-and-attendance or payroll system. We also record the form language, submission time, enquiry reference and the version of the notice associated with your agreement. If you contact us by email, we receive your email address, message and any attachments you choose to send. We obtain these details directly from you, or from a colleague contacting us on your organisation’s behalf.

5. Technical information and abuse prevention

Our hosting and email providers may process technical information such as IP addresses, browser or device details, request times, delivery information and error or security logs to deliver and protect their services. The enquiry form uses submission counters and a time-limited identifier derived from your email address to limit repeated requests. It also uses a hidden anti-spam field. These checks are for service protection, not advertising profiles.

6. Why we use your information and our lawful bases

We use your form details to respond to your enquiry, arrange a demonstration and discuss your requirements, relying on the consent you give when submitting the form. For other business correspondence, relationship administration and responding to requests from your organisation, we rely on our legitimate interest in communicating with prospective customers. We rely on our legitimate interests in operating a reliable website, preventing misuse and protecting our business for security records and abuse prevention. We may retain relevant records to comply with a specific legal obligation or to establish, exercise or defend legal claims. Where processing is necessary to take steps at your request towards a contract with you personally, the contractual basis may apply; an employer enquiry does not itself create a contract.

7. Your choice and marketing

Providing information is voluntary. The required form fields let us understand and answer your request; without them the form cannot be submitted. The payroll-system field is optional. You can contact us by email instead. Submitting the form does not subscribe you to a newsletter. We use it to follow up on your enquiry, not to enrol you in unrelated marketing. If we seek consent for a separate marketing purpose, we will ask separately. You may withdraw enquiry consent at any time by emailing us; this does not affect processing that was lawful before withdrawal.

8. Where enquiries go and who receives them

Enquiries are saved in a database connected to the website and displayed in an access-controlled inbox. An email notification containing the enquiry details is sent through Resend to our business mailbox. The database record remains available if email delivery fails. Service providers involved include OpenAI Sites for the website platform, Cloudflare for hosting and database infrastructure, Resend for email notifications, and our business email hosting provider for correspondence. Authorised people handling enquiries can access the records. Professional advisers, authorities or parties involved in a business transfer may receive relevant information where necessary and legally permitted. We do not sell enquiry data.

9. International processing

Flow HQ Ltd is based in the United Kingdom. Our service providers operate internationally, so website and enquiry information may be processed outside your country, including in the UK, the EEA and the United States. Applicable transfer rules depend on the provider, destination and processing arrangement. Transfers that require protection must use a recognised adequacy decision or appropriate safeguards, such as applicable standard contractual clauses and, where required, supplementary measures. Contact sam@flowbenefits.gr for details of the arrangements relevant to your data and to request information about applicable safeguards. This notice does not represent that all data is stored exclusively in Greece or the EEA.

10. How long we keep information

Retention depends on the purpose and type of record. For enquiries and related emails, we consider whether the request remains open, whether there is an ongoing business discussion, when we last had meaningful contact, and whether a complaint, legal obligation or legal claim requires retention. Once information is no longer needed for those purposes, it should be deleted or anonymised from the enquiry database and relevant correspondence. A withdrawal or erasure request prompts a review of both copies; limited information may still be retained where another lawful ground requires it. Abuse-prevention counters are short-lived and old buckets are removed during subsequent form processing. Provider logs and backup copies follow the relevant provider’s retention arrangements and may not disappear immediately when an active record is deleted.

11. Cookies and analytics

The website stores your selected language locally in your browser under flow.website.language. You can remove this through your browser’s site-data settings. We use Cloudflare Web Analytics on flowbenefits.gr and video.flowbenefits.gr to understand aggregate page views, visits, referring websites, device/browser categories and website performance. This analytics service does not use cookies or local storage for measurement and does not fingerprint visitors. We do not send enquiry contents to it or use it for advertising, individual visitor profiles or video-completion tracking. Google Analytics has been removed. Previously set Google Analytics and analytics-choice cookies are cleared when you revisit. We use these statistics to operate and improve the website. Reports are available for up to six months. Hosting and security services may separately process technical information needed to deliver and protect the site. The private staff inbox has a separate sign-in process. See Cloudflare’s privacy policy at cloudflare.com/privacypolicy/ for details about its processing. External websites have their own privacy practices.

12. Demo bookings and optional advertising measurement

Booking takes place in Google Calendar, which collects your name, email, company and employee count to arrange the demo. You and Flow receive an email and a calendar invitation with Google Meet details. The final form field is optional: only an explicit YES or ΝΑΙ authorises Flow HQ Ltd to share the confirmed booking event, its time and a cryptographic hash of your normalised email with Meta Platforms Ireland Limited for advertising measurement and matching. A hash is not anonymous; Meta may match it to an account. Names, company details and employee counts are not sent for this purpose. Blank, NO or any other answer does not grant consent and does not affect booking. This permission does not enable website tracking, authorise earlier browsing events or subscribe you to marketing emails. The Meta booking integration is not yet active; no booking events are currently sent. Consent is recorded with your booking. You may withdraw at any time by emailing sam@flowbenefits.gr; withdrawal prevents future sharing but does not automatically erase previously shared events. Google and Meta apply their own privacy policies, including processing outside your country.

13. Optional employer advertising measurement

If you accept optional advertising measurement on our separate company signup page, we use Meta Pixel and Conversions API to measure page visits and completed company registrations and help assess our ads. Meta receives browser and device information (including the IP address for browser requests), cookie identifiers, an ad click identifier when available, the page address and event time. Successful company creation is sent from our server and may also be sent by the browser using a matching event identifier to avoid double counting. We do not send signup form contents, names, email addresses, company details, employee records, payroll, bank details or withdrawal activity to Meta through this integration. Automatic matching and automatic event collection are disabled. Measurement starts only after consent; rejecting it does not affect signup. The public landing page no longer loads Meta Pixel or carries advertising identifiers to signup. The separate signup service retains its own consent controls. Your choice is stored under flow.employer.marketing.v1 for up to 180 days. Advertising cookies _fbp and _fbc are set for up to 90 days. Use Cookie settings on the separate signup page to withdraw consent on that domain; this stops subsequent events and removes these cookies there. Previously shared events are not automatically deleted by withdrawing consent. Meta Platforms Ireland Limited is the recipient for this measurement; Meta's own privacy and business tools terms also apply, and its processing may involve other countries. Contact sam@flowbenefits.gr about this measurement or to exercise your rights.

14. Your rights

Depending on the applicable law and circumstances, you can request access to your personal data, correction of inaccuracies, erasure, restriction of processing and portability of data processed by automated means on the basis of consent or contract. You can withdraw consent at any time. Rights are subject to applicable conditions and exceptions. Email sam@flowbenefits.gr with your request. We may ask for proportionate information to verify identity. We normally respond within one month; if a lawful extension is needed, we will explain it. Requests are generally free of charge, subject to exceptions allowed by law.

15. Your right to object

You may object to processing based on legitimate interests for reasons related to your particular situation. You have an unconditional right to object to use of your personal data for direct marketing. Contact sam@flowbenefits.gr to exercise either right.

16. Security, automated decisions and children

The enquiry inbox is access-controlled and the form validates submissions and limits repeated requests. No internet service is completely risk-free; please avoid sending unnecessary confidential information. This website does not make solely automated decisions about you that have legal or similarly significant effects. Its calculators and employee screens are illustrative and do not assess eligibility or initiate payments. The website is intended for adult business contacts and is not directed at children.

17. Changes to this notice

We may update this notice when the website, our processing or applicable requirements change. The date at the top identifies the current version. Where required, we will draw material changes to your attention or seek fresh consent before using information for a new purpose.

Complaints

You can contact us with any concern. You may also complain directly to the relevant supervisory authority without contacting us first. In the UK, this is the Information Commissioner’s Office (ICO). In Greece, it is the Hellenic Data Protection Authority. In the EEA you may also contact the authority where you habitually live or work, or where the alleged infringement occurred.

Information Commissioner’s Office · Hellenic Data Protection Authority