1. Introduction

Flowshop Systems AB, hereinafter referred to as (“we” or "Flowshop"), cares about your privacy. We therefore strive to always protect the personal data we process in the best possible way and to comply with all applicable data protection laws and regulations at all times.

In this Privacy Policy, we provide you with information about how we, in our capacity as data controller, process personal data about you if you are or wish to become our customer, or if you are the contact person at a company that is or wishes to become our customer (the “Customer”).

2. What personal data do we process?

The personal data we process about you consists of the information that you, or the company for which you are listed as the contact person, have provided to us in connection with our provision of e-commerce solutions and related services and offers to you in your capacity as our Customer or the Customer’s contact person. This information generally consists of your name and contact details, as well as your IP address. We also process your company registration number, which may constitute personal data if you are a sole trader.

3. For what purposes do we process your personal data?

Administration of purchases and fulfilment of contractual obligations

We process your name, contact details and, where applicable, your company registration number in order to administer purchases of our e-commerce solutions and other services made by you or the company you represent. We also process this information to fulfil our obligations under our agreement with you or the company you represent concerning the provision of e-commerce services, trial offers, assistance in moving your online store to Flowshop  etc.

The legal basis for our processing is that it is necessary to fulfil our obligations under our agreement with you. If it is not you personally who has entered into an agreement with us, but rather the company you represent, the legal basis for the processing is our legitimate interest in being able to administer our agreement with the Customer and fulfil our obligations under the agreement. If the information is not provided to us, we will be unable to provide our e-commerce services, trial offers or migration assistance, as we cannot identify you as a Customer (where your company registration number constitutes personal data) or contact you or the company you represent directly in the manner necessary to fulfil the agreement.

Marketing, etc.

To ensure that you, as a Customer or the contact person for our Customer, receive information about us, our services and offers, we process your name and contact details in order to send you newsletters by email and contact you by telephone. The legal basis for this is our legitimate interest in communicating with you, as a Customer or the contact person for our Customer, for marketing purposes.

If you have registered to receive our newsletter via our website, we process your name and contact details for this purpose. In such cases, the legal basis for the processing is your consent.

Chat and contact forms

We process the personal data provided to us through our chat function and contact forms in order to provide you or the company you represent with the support and/or customer service you request through the chat or form, as well as to follow up on support measures taken and identify any recurring errors and deficiencies in our service. If the support and/or customer service concerns trial offers, migration assistance or e-commerce solutions provided by Flowshop to you or the company you represent, the legal basis for our processing is that it is necessary to fulfil our agreement to provide the services or offers. In other cases, the legal basis for the processing is our legitimate interest in being able to follow up on the questions you have asked via the chat or contact form, provide you with support and/or customer service, and subsequently follow up on the matter.

Protection of Flowshop’s website and e-commerce platform

When you visit our website or log in to the e-commerce solution, we will store your IP address. This allows us to perform appropriate security monitoring in order to trace potential fraud, hacking attacks, denial-of-service attacks and similar incidents, and, where applicable, report them to the police. The legal basis for the processing is our legitimate interest in providing a stable and secure web platform, maintaining the availability of the e-commerce solution and taking appropriate action when potential security threats or violations of the law occur.

Compliance with applicable laws and regulations, etc.

In addition to the processing of your personal data described above, we also carry out processing that is necessary to comply with applicable laws, regulations or decisions by public authorities. We will therefore retain your name, contact details and, where applicable, your company registration number to the extent necessary to comply with applicable accounting legislation.

4. How have we carried out our balancing of interests where the legal basis is our legitimate interest?

For certain purposes, we process your personal data on the basis of a balancing of interests as the legal basis for the processing. In conducting this balancing of interests, we have determined that our legitimate interest in carrying out the processing outweighs your interests and fundamental rights in not having your personal data processed. Our legitimate interests are set out above. If you would like to learn more about how we reached this determination, please feel free to contact us.

5. Who may access your personal data?

As a general rule, your data is processed only by us. However, we share your personal data with our partners and suppliers, such as our IT suppliers and suppliers that provide third-party services integrated with our e-commerce solutions. We only share your personal data with them to the extent necessary for them to fulfil their obligations to us.

If you would like more detailed information about who receives your personal data, please feel free to contact us.

6. Transfer of personal data to countries outside the EU/EEA

When Flowshop processes personal data as the data controller, we generally process the personal data within the EU/EEA. In certain cases, we use suppliers outside the EU/EEA, for example when we communicate with you by email and when you contact us via our chat. You can read more about where your personal data is stored on the page where we list our sub-processors.

When we transfer personal data to suppliers that process it outside the EU/EEA, we do so only if we have a legal basis for the transfer in accordance with applicable data protection legislation. In practice, this means that we ensure that transfers are made only to a country that the European Commission has determined provides an adequate level of protection for personal data or, if this is not the case, that the transfer is made using the EU’s Standard Contractual Clauses. This is done to ensure that your personal data receives protection equivalent to that provided when personal data is processed within the EU/EEA.

If you would like detailed information about transfers made outside the EU/EEA, you can contact us. Our contact details can be found on the first page of this policy. By contacting us, you can also obtain a copy of the appropriate safeguards.

7. How long do we retain your personal data?

The personal data that we process in order to administer purchases of our services and offers and fulfil our obligations under the agreement with you or the company you represent is not retained for longer than is necessary for these purposes, which is generally for as long as you or the company you represent remains a Customer.

We send you our newsletters and may contact you by telephone for direct marketing purposes for three years after you or the company you represent ceases to be our Customer. We will therefore retain your name and contact details during this period in order to send our newsletters and contact you by telephone. If you have consented to receiving newsletters from us, we will retain your personal data for this purpose until you unsubscribe or ask us to stop sending you newsletters.

We will not retain personal data that you have provided to us when using our chat function or contact form for longer than is necessary for us to provide and follow up on/review the support or customer service that you requested via the chat or form, as well as to identify any recurring errors and deficiencies in our service. The exact retention period depends on the nature of the matter. IP addresses are retained for 180 days solely for reporting incidents to the police or tracing potential fraud, hacking or denial-of-service attacks in order to protect the web platform.

Your personal data may be retained for longer to the extent that we are required to do so by law. For example, your name, contact details and, where applicable, your company registration number may be retained for seven years to the extent that we are required to retain the information for accounting purposes.

8. Your rights

You have certain rights regarding the processing of your personal data. A more detailed description of your rights is provided below. To exercise your rights, please feel free to contact us using the contact details provided at the beginning of this Privacy Policy.

Withdrawal of your consent

If you have consented to our processing of your personal data, you have the right to withdraw all or part of the consent you have given at any time. However, the withdrawal of your consent will not affect our processing of your personal data before the withdrawal took place.

Right of access

You have the right to obtain confirmation as to whether we process personal data concerning you and to access information about how the personal data is processed, such as the purposes of the processing and the categories of personal data concerned. You also have the right to obtain a copy of the personal data being processed.

Right to rectification

You have the right to have inaccurate personal data rectified without undue delay and to have incomplete personal data completed by providing additional information.

Right to erasure (right to be forgotten)

You have the right to request the erasure of your personal data if:

the personal data is no longer necessary for the purposes for which it was collected or processed;

you withdraw the consent on which the processing is based and there is no other legal basis for the processing;

you object to the processing and there are no legitimate grounds for continuing the processing that override your legitimate grounds for not continuing it;

the personal data has been processed unlawfully; or

the personal data must be erased to comply with a legal obligation to which Flowshop is subject.

Right to restriction of processing

You have the right to request that the processing of your personal data be restricted if:

you contest the accuracy of the data (but only for a period that allows us to verify its accuracy);

the processing is unlawful and you oppose the erasure of the personal data and instead request that its use be restricted;

we no longer need the personal data for the purposes of the processing, but you need the personal data to establish or defend legal claims; or

you have objected to the processing and we have not yet verified whether our legitimate interest in processing your personal data overrides your legitimate grounds for restricting the processing of your personal data.

Right to object to processing

You have the right to object at any time to the processing of your personal data based on a balancing of interests. If we cannot demonstrate overriding legitimate grounds for the processing, your personal data will no longer be processed for this purpose.

You also have the right to object to the processing of your personal data for marketing purposes. This means that you have the right to opt out of newsletters and other marketing communications from us. If you object to marketing, your personal data will no longer be processed for such purposes.

Right to lodge a complaint

You have the right to lodge a complaint with a competent supervisory authority (without prejudice to any other administrative or judicial remedy). Such a complaint should preferably be lodged with the authority in the EU/EEA Member State where you have your habitual residence, where you work or where an alleged infringement of applicable data protection laws and regulations occurred. The competent supervisory authority in Sweden is the Swedish Data Protection Authority.

Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another data controller (data portability) if:

the processing is based on your consent or on a contract; and

the processing is carried out by automated means.