Intodata Nederland B.V., trading as Flowmark ("Flowmark", "we", "us"), processes personal data in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act. This statement applies to the website flow-mark.ai, the customer portal and other Flowmark services for which Flowmark is the controller.
Where Flowmark processes personal data on behalf of a customer within the Flowmark platform, Flowmark is a processor and the customer is the controller. That processing is not covered here; see the Privacy Statement for End Users.
1. Controller and contact
Intodata Nederland B.V., trading as Flowmark, Rithmeesterpark 50-A1, 4838 GZ Breda, the Netherlands, Chamber of Commerce no. 71751793, is the controller.
Send questions about this statement or your rights to privacy@flow-mark.ai. Our Data Protection Officer (DPO) can be reached at dpo@cronos.be.
2. Whose data we process, and which data
| Data subject | Personal data | Source |
|---|---|---|
| Customers and their contacts | Name, job title, business e-mail, phone number, company details, invoicing and payment details, contract and communication history | You or your employer |
| Customer account administrators | Name, e-mail, login credentials, role, usage and log data of the admin account | You or your employer |
| Prospects | Name, job title, business contact details, company, interests you share with us | You, your employer or public business sources |
| Suppliers and partners | Name, job title, business contact details, invoicing and payment details, contract details | You or your employer |
| Website visitors | IP address, browser and device data, page visits via cookies; data from contact or demo forms | You |
| Job applicants | CV, cover letter, contact details, interview notes | You or a recruiter |
We do not ask for special categories of personal data, such as health, religion or ethnicity. Please do not provide them.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the Flowmark platform, account management, performing the contract, support | Performance of a contract |
| Invoicing and administration | Performance of a contract; legal obligation (tax retention) |
| Securing the platform and website, preventing misuse, logging | Legitimate interest: a secure and reliable service |
| Improving our services based on admin usage statistics | Legitimate interest: product development |
| Newsletters and product updates to existing customers | Legitimate interest: maintaining the customer relationship |
| Newsletters and marketing to prospects | Consent |
| Responding to contact and demo requests | Steps at your request prior to a contract; legitimate interest |
| Recruitment | Steps at your request prior to a contract; consent for extended retention |
| Analytics and marketing cookies | Consent |
| Establishing, exercising or defending legal claims | Legitimate interest |
Where we rely on legitimate interest, we balance our interest against your privacy. You can always object (see section 8).
Some data is required to conclude or perform a contract, such as contact and invoicing details. Without it, we cannot provide the service.
4. Sharing with third parties
We share personal data only where needed for the purposes above, with:
- processors acting on our behalf, such as hosting providers (OVHcloud and Microsoft Azure for the platform, Vercel for the website), AI service providers, and e-mail, support, accounting and analytics providers, under a data processing agreement. A current list of sub-processors is available on request via privacy@flow-mark.ai;
- companies within the group to which Intodata Nederland B.V. belongs, where needed for shared support functions such as the DPO role;
- advisers such as accountants and lawyers, who are bound by confidentiality;
- public authorities, where we are legally required to;
- an acquiring party in the event of a merger, acquisition or sale of (part of) our business.
We do not sell personal data.
5. Transfers outside the EEA
We store personal data in data centres within the European Economic Area (EEA). Some processors, such as Microsoft, Google, Vercel and AI service providers, are based in or provide support from the United States. Transfers outside the EEA only take place on the basis of an adequacy decision, such as the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses, with supplementary measures where needed.
6. Retention
| Data | Retention period |
|---|---|
| Customer and contract data | Term of the contract + 2 years |
| Invoices and administration | 7 years (tax retention obligation) |
| Admin account and log data | Term of the account; security logs 12 months |
| Prospects and contact requests | 2 years after last contact, or until consent is withdrawn |
| Newsletter | Until you unsubscribe |
| Job applicants | 4 weeks after the procedure ends; 1 year with consent |
| Cookies | See the Cookie Statement |
After the retention period we delete or anonymise the data, unless a legal obligation or ongoing dispute requires longer retention.
7. Security
We take appropriate technical and organisational measures, such as encryption in transit and at rest, role-based access control, multi-factor authentication and logging. Staff only have access to data they need for their work.
8. Your rights
You have the right to:
- access your personal data;
- rectification of inaccurate or incomplete data;
- erasure, in the cases set out in Art. 17 GDPR;
- restriction of processing;
- portability of data you provided, where processing is based on consent or contract;
- object to processing based on legitimate interest, and at any time to direct marketing;
- withdraw consent, without affecting processing before withdrawal.
Send your request to privacy@flow-mark.ai. We respond within one month; for complex requests we may extend this by two months. We may ask you to verify your identity. Do not send a copy of your ID unless we ask for it.
9. Complaints
We prefer to resolve complaints with you directly. Contact us at privacy@flow-mark.ai or our DPO at dpo@cronos.be. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl), or with the supervisory authority in the EU country where you live or work.
10. Automated decision-making
Flowmark does not make decisions based solely on automated processing that produce legal effects or similarly significant effects for you (Art. 22 GDPR).
11. Cookies
Without consent we only place strictly necessary and functional cookies. For analytics and marketing cookies, such as Google Analytics and Salesfeed, we ask for consent first via our cookie banner (CookieYes). We also measure visitor numbers with Vercel Web Analytics, without cookies. See the Cookie Statement.
12. Changes
We may update this statement. The current version is always available at flow-mark.ai. We actively inform customers of material changes.