FlowMind Privacy Policy

This policy explains how FlowMind Technology Sp. z o.o. (“FlowMind”, “we”) processes personal data about visitors to flowmind.technology and www.flowmind.technology, people contacting us, representatives of our customers and partners, and users of our products. It covers FlowMind Sales Agent, including the Customer Care Agent (“CCA”), and R‑TAPS, which includes advanced production planning and scheduling (APS), manufacturing execution (MES) and quality management (QMS).

Not every module or integration described here is necessarily active in a particular deployment. Processing associated with a module concerns you only where that module is available and used in your organisation. This policy does not mean that every installation is hosted in the cloud or that FlowMind receives all data held in a customer's system.

For data processed on a customer's behalf, this document explains FlowMind's role and the service's general operation. It does not replace the privacy information that customers provide to their employees, business contacts and other individuals. It is neither consent to marketing nor a data processing agreement.

The controller for the purposes that FlowMind determines for itself, as described in this policy, is FlowMind Technology Sp. z o.o., pl. Jana Pawła II 19 lok. 48, 50-136 Wrocław, Poland, KRS 0001223592, NIP 8971967134, REGON 543996884.

For privacy questions and requests to exercise your rights, contact kontakt@flowmind.technology. You can also write to the company's registered address above. Our office and business contact address is Wrocławski Park Technologiczny, BETA building, ul. Klecińska 125, 54-413 Wrocław, Poland.

We handle data protection matters through the email address above. If we appoint a data protection officer, we will publish their contact details here.

As a controller, we determine the purposes and means of processing needed to operate our website, handle enquiries and our contractual relationships, manage accounts and access to services, administer billing and our own marketing, protect our services and deal with legal claims. We respond directly to data protection requests concerning these activities.

When we provide or support Sales Agent for a customer, we generally process that customer's prospect, business partner, contact, correspondence, calendar and CRM data on its documented instructions. The customer determines the purposes of its business activities and is the controller of those data. The same principle applies to production, quality, workforce and operational data entrusted to us when supporting R‑TAPS. If the customer itself acts for another controller, FlowMind may act as a subprocessor.

Access, instructions, subprocessors, security, assistance with rights, and the return and deletion of data are governed by a data processing agreement under Article 28 GDPR and the documentation for that deployment. Buying a licence or installing software locally does not automatically give FlowMind access to data. Access may arise, for example, through agreed hosting, remote support, an integration or diagnostic materials supplied to us.

Roles depend on actual activities, not merely the title of a contract. Any use of entrusted data for a separate purpose of our own would require a separate assessment of its lawful basis and appropriate information for the individuals concerned.

Website, enquiries and demonstrations: contact details, name, company, job title, email address, telephone number, message content, and information provided in forms, calculators or demonstrations. This may include plant size, employee and machine numbers or business requirements where the information can be linked to an individual.

Accounts and customer support: user and organisation identifiers, roles and permissions, authentication data, selected language and settings, records of document acceptance and consent, support requests and associated communications. For billing, we process purchaser and representative details, invoicing information, payment and subscription identifiers, transaction status and accounting documents.

Website and service use: IP address, event dates and times, browser and device information, session identifiers, visited URLs, and error and security logs. For cookies, we record the user's choice, decision identifier, time, version of the information shown and evidence of the choice made. Identifiers and technical hashes are not treated as anonymous where they can be linked to a person.

We receive data directly from you, from your organisation or an authorised user, from connected systems, and through use of the service. Sales Agent may also obtain data from public company websites, registers, industry directories, search results and data providers used in a particular deployment. The product data involved are described below. Sole trader information may be personal data even when it appears under a business name.

Enquiries, demonstrations and entering into contracts: we answer messages, arrange demonstrations and prepare proposals. Article 6(1)(b) GDPR applies when acting at the request of a person who is or may become a party to a contract. For representatives of organisations and other correspondence, we rely on Article 6(1)(f): our legitimate interest in communication and managing business relationships.

Service delivery and support: we provide accounts, access, licences, configuration, support handling and service communications. We rely on Article 6(1)(b) for an individual who is a party to the contract, and Article 6(1)(f) for authorised users and customer representatives: our interest in performing the contract with their organisation and properly supporting the service.

Billing and legal duties: issuing and retaining documents and complying with tax, accounting and invoicing requirements, including the Polish National e-Invoicing System (KSeF) where applicable, are based on Article 6(1)(c). Payment and subscription administration also relies on Article 6(1)(b) or (f), as appropriate to our relationship with the person concerned.

Security, reliability and legal claims: preventing misuse, managing access, diagnosis, investigating incidents, and establishing, exercising or defending legal claims serve our legitimate interests under Article 6(1)(f). We limit the data to what the particular purpose requires. Records demonstrating required consent and compliance with legal duties are based on Article 6(1)(c) in conjunction with the relevant obligation; separately preserving evidence for legal claims is based on Article 6(1)(f).

Our own marketing and business contact: the basis may be consent under Article 6(1)(a), or, where its conditions are met, a legitimate interest under Article 6(1)(f) in presenting our own offering to relevant business contacts. Regardless of the GDPR basis, we obtain prior consent for the communication method where required by Article 398 of Poland's Electronic Communications Law or other applicable law. An objection to marketing ends processing for that purpose.

Optional analytics, advertising and consent-based features: we rely on Article 6(1)(a) and the cookie rules below. Basic use of the website is not conditional on consent to marketing. A separate new processing purpose requires an assessment of its lawfulness and appropriate information before that processing begins.

A customer's workspace may contain company names, domains, sectors, locations and sources, together with contact names, professional roles, business email addresses and telephone numbers, qualification statuses, fit scores, notes, sales opportunities and communication history. Matching uses the customer's saved criteria, such as industry, geographic area and contact roles. Assessing a company does not always concern an individual; evaluating a contact may constitute profiling.

When email or a calendar is connected, the service may process integration account details, access tokens, senders and recipients, message subjects and content, attachments, and event, attendee and availability information, within the permissions and functions enabled by the customer. An integration can be disconnected and permissions can also be revoked with the account provider. This does not automatically delete information already lawfully recorded in CRM, accounting documents or data retained by the email provider.

Automation may prepare drafts, organise tasks and, in appropriately enabled modes, perform actions on the customer's instructions. A public email address, a high fit score or a user's declaration in the application does not replace a required lawful basis, communication consent or the duty to respect objections. Minimal opt-out data may remain on a suppression list to prevent further messages to the same person.

CCA uses messages supplied in the conversation within the service and the context made available to it in the relevant workspace, such as saved settings, Targeting, integration status and diagnostic information. Its purpose is to answer questions and help users operate the system. For entrusted data, we act within the customer's instructions; handling our own support relationship follows section 5.

AI features may send the material needed for a specific task to a model provider, in particular OpenAI API: a question, relevant conversation excerpts, selected context, company or contact data, text to be prepared and diagnostic results. API use does not give CCA access to private conversations in ChatGPT accounts, other accounts' histories or our development conversations. A user's own conversation with CCA within the product is a separate dataset.

For a company or market question, CCA may submit a limited query to a search service, including Brave Search API, and read a public page supplied by the user or found in search results. The search provider receives the query and technical connection data; the website being read receives a server request. Confidential documents, full conversations and data unnecessary for the search should not be included in a public search query.

AI output may be incorrect. You may request an explanation, correction of data and human assistance. We do not use this policy as consent to train general-purpose models on your messages, CRM or production data. The scope of disclosure, provider retention and any use for model improvement must be specified in the applicable integration terms and data processing agreement before activation. This policy does not promise zero data retention by every AI provider.

Depending on the deployed modules, R‑TAPS may process user and operator data, identifiers, roles, qualifications, availability, work assignments, completed operations, start and end times, quality events, decision authors, action owners and change history. Quality documents and photographs may contain information about individuals. Connections to ERP, HR, time-recording and other systems may expand this scope according to the customer's configuration.

R‑TAPS supports planning, recording execution, quality analysis and work organisation. The customer determines the workforce data needed, lawful bases, recipient permissions and retention periods. Where absence, medical examination or other information reveals health or another special category of data, an appropriate condition under Article 9 GDPR is also required. Availability or work-eligibility information should be used in preference to diagnoses and unnecessary medical records.

Reports, forecasts, resource assignments and recommendations may support organisational decisions. A process or machine outcome should not automatically be equated with an assessment of an employee. Using the system for decisions on employment, pay or other significant personal matters requires a separate legal assessment by the controller, appropriate information and safeguards, including meaningful human involvement where required. This policy does not authorise such use.

If FlowMind obtains your data from someone other than you for its own purposes, we provide the required information, including the categories and specific source of the data and whether it is publicly accessible. We do so within a reasonable period, no later than one month, or, if earlier, by our first communication with you or the first disclosure to another recipient, unless a documented legal exception applies. Merely publishing this policy does not replace the individual information duty under Article 14 GDPR.

When collection occurs in a customer's workspace, the relevant controller provides the notice and FlowMind assists under the data processing agreement. The contact in section 2 can also be used to report an incorrect source or inaccurate data.

Standard fit scores and recommendations support work rather than enable FlowMind to make decisions about you that are based solely on automated processing and produce legal or similarly significant effects. Form security may automatically assess spam risk and restrict a submission; you can then use our email address. If a deployment is to involve decisions governed by Article 22 GDPR, its controller must first explain the logic, significance and consequences and provide an appropriate lawful basis and safeguards for the individual. Calling a feature “AI” does not itself determine whether Article 22 applies.

Data may be accessed by authorised FlowMind staff and contractors; infrastructure, hosting, database, email, security and support providers; and accounting, advisory and legal service providers, as needed for the relevant task. Recipients also include competent authorities where required by law and people authorised by the customer within its organisation.

The website uses Vercel for hosting, Supabase for cookie-choice records, Resend for delivering form submissions, and Google services, including Google Analytics, Google Ads, Google Tag Manager and reCAPTCHA, subject to the cookie rules. The presence of a tag manager does not itself constitute consent to every service it deploys.

For products, data may be received by the provider of an active integration: OpenAI for AI functions, Brave for search, Google or Microsoft for email and calendars, another customer-selected SMTP/IMAP provider, Stripe for payment processing, and KSeF and the relevant authorities for invoicing. These services are not all active in every environment. Application hosting providers are identified for the particular deployment; hosting of the marketing website does not determine where product data are held.

Providers acting on our instructions are subject to appropriate processing terms. Some recipients, including banks, payment providers and user-selected account providers, may act in part as separate controllers; their policies describe those activities. The deployment's subprocessor list and information about changes are supplied to the customer under the data processing agreement. Information about recipients of your own data can be requested through section 2. We do not sell customers' contact databases.

We use cookies, localStorage and similar technologies. Necessary technologies support sessions, security, recording cookie choices and functions expressly requested by the user. They do not require additional consent within the exemption in Article 399(3) of Poland's Electronic Communications Law. Where they process personal data, the relevant basis in section 5 applies.

Optional technologies include additional functions such as reCAPTCHA, Google Analytics visitor analytics and Google Ads advertising measurement. The configuration envisaged in this policy requires activation after the relevant consent has been given. This also applies to transmitting analytics or advertising data without storing cookies: “cookieless” does not, by itself, mean anonymous or exempt from consent requirements.

The “Cookie settings” panel allows you to accept or reject optional categories and change your choice. You can withdraw consent at any time without affecting the lawfulness of earlier processing. Analytics or advertising consent is not a condition of entering into a contract. The contact form should remain available with basic anti-spam protection when reCAPTCHA consent is refused; email contact is an alternative.

The website's flowmind_cookie_consent and flowmind_consent_id localStorage keys record the choice and its identifier. They remain in the browser until removed or replaced. Other technology names, providers, purposes and lifetimes must be available in the current cookie declaration in the settings panel before consent is given. A cookie's lifetime on a device is separate from server-side data retention.

You can also delete or block storage through browser settings. Removing necessary session data may log you out or remove preferences. External sites opened through links apply their own privacy rules.

International providers may process data outside the European Economic Area, particularly in the United States. A transfer can also involve access by support staff in a third country even if the server is in Europe. A local installation does not rule out transfers when an external integration is enabled.

A transfer requires an appropriate basis under Chapter V GDPR. This may be a European Commission adequacy decision where it covers the recipient and transfer, or standard contractual clauses accompanied by an assessment of the transfer conditions and additional safeguards where needed. We do not assume that every US provider is covered by an adequacy decision. Otherwise, only an applicable mechanism permitted by the GDPR can be used.

You can request information about processing countries, the basis for a particular transfer and how to obtain a copy of relevant safeguards at kontakt@flowmind.technology. For entrusted data, these arrangements form part of the deployment and subprocessing documentation made available to the customer before the relevant processing is activated.

Retention depends on the dataset and purpose. We do not retain all account data simply because one document is required for accounting or evidence. Once a purpose ends, we delete or irreversibly anonymise the data unless there is a separate basis for further retention.

Enquiries and support: for the handling of the matter and necessary follow-up. Where materials evidence contractual performance or a dispute, we retain only the necessary scope until the relevant limitation period expires or the matter is finally resolved. The period depends, among other things, on the type of claim and events affecting the limitation period.

Accounts and entrusted data: for service delivery and the agreed handling of termination. When processing on behalf of a controller ends, we return or delete data according to its choice and the agreement, except where the law requires retention. The deployment documentation specifies the export deadline, deletion of active data and expiry of backups. Backups support disaster recovery rather than extending routine use of deleted data.

Billing: tax, accounting and invoice records are kept for the periods required by applicable law, calculated from the events specified there, such as a year-end or tax payment deadline. Account deletion does not override those duties. Retention by KSeF or another separate controller is governed by its obligations, not the closure date of a FlowMind account.

Marketing: until consent is withdrawn, an objection is made, the purpose ends or the data are found to be outdated, according to the lawful basis and the earlier relevant event. We may retain minimal objection or opt-out information for as long as necessary to prevent renewed contact effectively and demonstrate compliance with the request.

Logs and consent evidence: security and diagnostic logs are kept for the period necessary to detect and investigate errors and incidents; afterwards, only separately identified evidence for a particular matter is kept where justified. Website cookie-choice records are retained for three years from the decision, and longer only to the extent necessary for a specific legal obligation or ongoing matter. Analytics retention settings and cookie lifetimes are defined in the relevant service configuration and cookie declaration.

You can ask us for the retention period or criteria for a specific dataset. For entrusted data, we coordinate the response with the controller.

Subject to the GDPR's conditions, you can request access and a copy of your data, rectification, erasure and restriction of processing. Portability applies to data you have provided that are processed by automated means on the basis of consent or a contract; it does not automatically cover every analysis or assessment generated by the system.

You can object to direct marketing at any time, including related profiling, and we will stop processing for that purpose. You can object to processing based on legitimate interests on grounds relating to your particular situation; we assess that objection under Article 21 GDPR. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

In cases governed by Article 22 GDPR, you have protection against decisions based solely on automated processing that have legal or similarly significant effects, together with applicable safeguards, including the ability to challenge a decision, express your view and obtain human intervention where the law provides for it.

Send requests to kontakt@flowmind.technology. If we have reasonable doubts about identity, we may request additional information needed for verification; we do not automatically require a complete copy of an identity document. Normally, we respond without undue delay and within one month. Complex or numerous requests may require up to two additional months; we will notify you and explain why within the first month. Requests are generally free; exceptions allowing a fee or refusal are governed by Article 12(5) GDPR.

If data are processed on behalf of your employer or another customer, you can contact that controller. If we receive the request, we help identify the controller and fulfil our obligations under the data processing agreement. You may complain to the President of Poland's Personal Data Protection Office (uodo.gov.pl) or another competent supervisory authority, particularly in the EU/EEA country of your habitual residence, workplace or the alleged infringement. You do not have to contact us before lodging a complaint.

At registration, we distinguish acceptance of the terms of service from privacy information and voluntary consent. We provide this policy before collecting data. Any acknowledgement of having read it is not consent to unrestricted processing. Processing necessary for service delivery or compliance with legal duties relies on the appropriate lawful basis, while consent for optional purposes is collected separately. Authorisation for an integration and a data processing agreement do not replace any required consent from the individuals concerned.

Providing data is generally voluntary. However, information marked as required during registration, an enquiry or an order is needed to handle that activity. Without it, we may be unable to create an account, reply or provide the service. Certain billing details are legally required. Optional fields may be left blank.

Refusing optional cookies or marketing does not remove access to the basic service. Disconnecting email, a calendar or an AI provider limits the functions that require that integration. For a customer's employees, their employer or other relevant controller explains mandatory data requirements and the consequences of not supplying them.

We select technical and organisational measures according to risk and the deployment model. Within FlowMind's responsibilities, these include permission management, confidentiality obligations, protection of connections and authentication information, event logging, updates, backup procedures and incident response. No system can guarantee absolute security. The contract defines each party's responsibilities for local or hosted installations.

Do not submit passwords, API keys, complete payment-card details or unnecessary sensitive information to CCA or open forms. Enter integration secrets only through the designated configuration mechanisms. Special-category and criminal conviction data are outside the standard prospecting scope; processing them requires separate legal justification and an agreed scope.

Our products are intended for business users, not children. If we discover unnecessary data about a child, we will take steps to restrict processing and delete the data, subject to legal duties.

We publish the current policy on our website with its version and update date. We notify users of material changes affecting an active service in a manner appropriate to their significance, for example in the application or by email. If a change requires new consent, we obtain it before the relevant processing begins. Continued website use does not constitute consent to new marketing purposes or optional cookies.

This policy is prepared in Polish, English, Spanish and Traditional Chinese (zh-TW). The versions are intended to convey the same information. You can report discrepancies to kontakt@flowmind.technology. No language version restricts rights arising under mandatory law applicable to the individual and the processing concerned.