Privacy Policy

1. About this policy

This Privacy Policy explains how Flowtor Limited processes personal data when you visit flowtor.com, contact us, book a conversation or subscribe to our newsletter.

References to “Flowtor”, “we”, “us” and “our” mean Flowtor Limited.

This policy covers our public website and related business communications. Processing within the Flowtor application, including customer accounts, purchase orders, supplier communications, documents and AI-assisted functions, requires additional service-specific privacy information and, where applicable, a customer data processing agreement.

2. Who is responsible for your data?

The business responsible for the processing described in this policy is:

Flowtor Limited
Unit 2A, 17/F, Glenealy Tower
No. 1 Glenealy
Central, Hong Kong
Email: hello@flowtor.com

You can contact us at this address for privacy enquiries and requests concerning your personal data.

3. Visiting our website

When you visit our website, our hosting provider processes technical information necessary to deliver the website and maintain its security. This may include:

• Your IP address.
• The date and time of your request.
• Pages and files requested.
• Browser and operating-system information.
• The referring website.
• Technical error and security information.

We use this information to display the website, diagnose problems, prevent misuse and maintain reliable operation.

Where the General Data Protection Regulation (“GDPR”) applies, our legal basis is our legitimate interest in providing and protecting a functioning website under Article 6(1)(f) GDPR.

Hosting provider: our website is built and hosted with Base44. Content is delivered through Cloudflare’s network.

Fonts used on this website are stored on our own web server. Loading them does not involve a request to Google or another font provider.

4. Contacting us

When you contact us by email, we process the information you provide. This may include your name, email address, company, telephone number and the contents of your message.

We use this information to respond to your enquiry, understand your requirements, discuss potential services and manage our business relationship.

Where the GDPR applies:

• Processing necessary to take steps at your request before entering into a contract with you, or to perform that contract, is based on Article 6(1)(b) GDPR.
• Other business communications, including communications with representatives of organisations, are based on our legitimate interest in responding to enquiries and maintaining business relationships under Article 6(1)(f) GDPR.
• Processing required to meet a legal obligation is based on Article 6(1)(c) GDPR.

Providing information is voluntary. However, without sufficient contact information or details of your request, we may be unable to respond or provide the requested assistance.

Email provider: our email, including hello@flowtor.com, is hosted on Microsoft 365. Our website does not use a contact form.

Retention: we keep enquiries as long as needed to handle them and to manage the resulting business relationship. Records subject to statutory retention obligations may be retained longer.

5. Booking a conversation

Our website links to Calendly so you can arrange a conversation with us.

If you follow a Calendly booking link, you leave our website and interact with Calendly. We receive the booking information you submit, which may include your name, email address, appointment time and information about your business requirements.

We use this information to arrange, prepare for and conduct the conversation and handle related follow-up communications.

Where the GDPR applies, the legal bases are Article 6(1)(b) or Article 6(1)(f), as described in the section on contacting us.

Providing booking information is voluntary. Information marked as required is necessary to arrange the appointment.

Calendly provider: Calendly LLC, United States.

Retention: we keep appointment records held by Flowtor as long as needed to arrange and follow up the conversation and to manage the resulting business relationship.

Information about Calendly’s processing is available at calendly.com/legal/privacy-notice.

6. WhatsApp

Our website shows a WhatsApp button. It is a plain link: no WhatsApp or Meta code is loaded on our website, and no data is sent to WhatsApp unless you click it.

If you click the button, the WhatsApp app or website opens with a prepared message that names the page you came from. If you send a message, WhatsApp (Meta) and we process your phone number, profile name and the content of your messages. We use them to answer your question.

Where the GDPR applies, the legal bases are Article 6(1)(b) or Article 6(1)(f), as described in the section on contacting us. Sending a message is voluntary.

Information about WhatsApp’s processing is available at whatsapp.com/legal/privacy-policy-eea.

Retention: we keep messages as long as needed to answer your question and to manage the resulting business relationship.

7. Newsletter

If you subscribe to our newsletter, we use your email address to send occasional updates about international order management, Flowtor, Mailtor and related research.

We use a confirmation email to verify your subscription (double opt-in). We record when you signed up, the language and page of sign-up, and when you confirmed, to document your choice.

Subscription is voluntary. Where the GDPR applies, sending the newsletter is based on your consent under Article 6(1)(a) GDPR.

You can unsubscribe at any time through the unsubscribe link in our emails or by emailing hello@flowtor.com. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

Newsletter providers: the subscriber list is stored in our website’s database at Base44. Confirmation and newsletter emails are sent through Resend (Resend, Inc., United States).

Retention: We retain your subscription details until you unsubscribe. Unconfirmed sign-ups are not added to the list. After withdrawal, we retain your email address and the dates of sign-up, confirmation and unsubscription where necessary to document consent, comply with legal obligations or ensure that your opt-out is respected.

Where the GDPR applies, retaining limited evidence of consent and opt-out records is based on applicable legal obligations or our legitimate interest in demonstrating compliance and respecting your preferences.

8. Google Analytics

With your consent, we use Google Analytics 4 to understand how visitors find and use our website and identify ways to improve its content and usability.

Google Analytics may process:

• Pages visited and interactions with the website, such as clicks on booking, email, WhatsApp or sign-in links and newsletter sign-ups.
• Visit dates, times and session information.
• Referring websites and campaign information.
• Browser, operating-system and device information.
• Approximate geographic location derived from an IP address.
• Cookie identifiers used to distinguish visitors and sessions.

Google states that Google Analytics 4 does not log or store individual IP addresses.

We use the same Google Analytics property for flowtor.com and app.flowtor.com, so that a visit continuing from the website into the application can be recognised as one visit.

Google Analytics provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We activate Google Analytics only after you consent to analytics. If you reject analytics or have not made a choice, we do not activate Google Analytics or send analytics measurements to Google.

Where the GDPR applies, processing is based on your consent under Article 6(1)(a) GDPR. For storing or accessing analytics information on devices where German law applies, the legal basis is consent under Section 25(1) of the Telecommunications Digital Services Data Protection Act (“TDDDG”).

You can refuse analytics and continue using our website. You can withdraw consent at any time through Cookie settings in the website footer. Withdrawal stops future analytics collection in that browser, removes the Google Analytics cookies and does not affect the lawfulness of earlier processing.

Further information: how Google uses information from sites and apps that use its services and the Google Privacy Policy.

9. Cookies and similar technologies

Cookies are small files stored on your device. Similar technologies, such as browser local storage, can also store information or remember preferences.

We distinguish between necessary technologies and optional analytics technologies.

Necessary technologies

We use browser local storage and session storage to remember your privacy choice and to show the WhatsApp message prompt no more than once. These entries stay in your browser and are not sent to us.

Where German law applies, storing or accessing information that is strictly necessary to provide a digital service you expressly request is based on Section 25(2)(2) TDDDG. Any associated processing of personal data requires a separate applicable GDPR legal basis, such as our legitimate interest in managing privacy preferences.

Optional analytics technologies

Google Analytics cookies are used only after you consent.

Cookie and storage details

You can accept or reject analytics through our cookie banner and change your choice at any time through “Cookie settings” in the website footer.

Closing the banner or continuing to browse does not constitute consent. Optional analytics is disabled by default.

You can also delete cookies and stored data through your browser settings. Deleting the record of your preferences may cause the website to ask for your choice again.

10. Who receives your data?

For the purposes described in this policy, personal data may be processed by:

• Website hosting and technical infrastructure providers (Base44, Cloudflare).
• Email and business communication providers (Microsoft 365, WhatsApp).
• Appointment scheduling providers (Calendly).
• Newsletter delivery providers (Resend).
• Google, when you consent to Google Analytics.
• Professional advisers where necessary for legal, accounting or business advice.
• Authorities or other recipients where disclosure is required by law or necessary to establish, exercise or defend legal claims.

Providers acting on our behalf process personal data under appropriate contractual arrangements.

11. International processing and transfers

Flowtor Limited is established in Hong Kong.

Our team accesses the personal data described in this policy from Germany and Hong Kong.

Some providers may process personal data outside the European Economic Area.

Where a transfer is subject to the GDPR’s international-transfer requirements, we rely on the applicable transfer mechanism and safeguards.

You can contact hello@flowtor.com for further information about applicable transfer safeguards and how to obtain a copy.

12. How long we keep personal data

We retain personal data for the periods described in this policy or according to the specific retention criteria stated for each purpose.

Where information must be retained to comply with a legal obligation, we keep it for the applicable statutory period. Where necessary to handle a dispute or legal claim, relevant information may be retained for the period needed for that purpose.

When retention is no longer necessary, we delete the information or irreversibly anonymise it.

13. Security

We use technical and organisational measures appropriate to the nature of the personal data and the risks involved in its processing. These measures are intended to protect personal data against unauthorised access, accidental loss, alteration and disclosure.

14. Your rights

Under applicable Hong Kong data protection law, you may request access to and correction of your personal data.

Where the GDPR applies, and subject to its conditions, you may also have the right to:

• Obtain access to your personal data and a copy of it.
• Correct inaccurate or incomplete personal data.
• Request deletion.
• Request restriction of processing.
• Receive eligible data in a structured, commonly used and machine-readable format and request its transfer to another controller.
• Object, on grounds relating to your particular situation, to processing based on legitimate interests.
• Object at any time to processing for direct marketing, including related profiling.
• Withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, email hello@flowtor.com or write to Flowtor Limited at the address above. We may request information reasonably necessary to verify your identity before responding.

You may complain to a competent data protection authority. Where the GDPR applies, this includes an authority in the country of your habitual residence, place of work or the alleged infringement.

In Hong Kong, you may contact the Office of the Privacy Commissioner for Personal Data.

15. Automated decision-making

We do not use the personal data covered by this website policy to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

16. Changes to this policy

We may update this policy when our website, services, processing practices or legal obligations change. We will publish the current version on this page and update the date above. Where required, we will provide additional notice or obtain fresh consent before introducing relevant changes.

17. Contact

For questions about this policy or the use of your personal data, contact:

Flowtor Limited
Unit 2A, 17/F, Glenealy Tower
No. 1 Glenealy
Central, Hong Kong
Email: hello@flowtor.com