Our policy regarding what information we collect at Flow, how we use it, and what choices you have.Effective: January 1, 2020
What is Personal Information?
Information We Collect And Receive
Flow may collect and receive Customer Data and other information (“Other Information”) in a variety of ways:
- Customer Data. Customers or individuals granted access to an Organization by a Customer (“Authorized Users”) routinely submit Customer Data to Flow when using the Services.
Other Information. Flow also collects, generates and/or receives Other Information:
- Organization, Team and Account Information. To create or update an account, you or your Company (e.g., your employer) supply Flow with an email address, password, job title, company size, industry, and/or similar account details. In addition, Customers that purchase a paid version of the Services provide Flow (or its payment processors) with billing details such as credit card information, banking information and/or a billing address.
- Services Metadata. When an Authorized User interacts with the Services, metadata is generated that provides additional context about the way Authorized Users work. For example, Flow logs the projects, tasks, people, features, links, files, and Third Party Services you interact with (if any).
- Log data. As with most websites and technology services delivered over the Internet, our servers automatically collect information when you access or use our Websites or Services and record it in log files. This log data may include the Internet Protocol (IP) address, the address of the web page visited before using the Website or Services, browser type and settings, the date and time the Services were used, information about browser configuration and plugins, language preferences and cookie data.
- Device information. Flow collects information about devices accessing the Services, including type of device, what operating system is used, device settings, application IDs, unique device identifiers and crash data. Whether we collect some or all of this Other Information often depends on the type of device used and its settings.
- Third Party Data. Flow may receive data about organizations, industries, lists of companies that are customers, Website visitors, marketing campaigns and other matters related to our business from parent corporation(s), affiliates and subsidiaries, our partners, or others that we use to make our own information better or more useful.
Generally, no one is under a statutory or contractual obligation to provide any Customer Data or Other Information (collectively, “Information”). However, certain Information is collected automatically and, if some Information, such as Organization setup details, is not provided, we may be unable to provide the Services.
In most cases, and subject to legal and contractual restrictions, you are free to refuse or withdraw your consent at any time upon reasonable advance notice. It should be noted that there may be certain portions of the Sites or Services that will only be made available to you if you provide specific Personal Information to us. Consequently, if you choose not provide us with any required Personal Information, we may not be able to make available to you such portions of the Sites or Services. We will endeavour to inform you of the consequences of the any such refusal or withdrawal of consent.
Why We May Collect Personal Information
We may collect Personal Information from you when you voluntarily provide it to us in order to: provide the Sites and Services to you and other persons in accordance with your settings of the Sites and Services; improve the Sites and Services; process payments relating to the Sites and Services; provide you with information relating to the Sites and Services, including, without limitation, products, services, promotional offerings and contests (including direct marketing); provide you with support in respect of the Sites and Services; conduct surveys and customer research; meet legal and regulatory requirements; or such other purposes consistent with the foregoing purposes.
How We Collect and Use Personal Information
The legal bases for our processing of Personal Information are primarily that the processing is necessary for providing the Services and that the processing is carried out in our legitimate interests. For example, we may collect Personal Information when you: fill in forms, register or configure accounts or services (including third party services available through the Sites or Services) participate in surveys, tests, or assessments; purchase products or services; submit content or communications, including, through forums, blogs, chatrooms, messaging services, personal web pages or other services available through the Sites or Services (including third party services); select advertisements or content, navigate the Sites or Services, or otherwise interact with the Sites or Services (including third party services); or otherwise participate in the Sites or Services (including third party services).
When We May Disclose Your Personal Information
In certain circumstances, we may disclose certain information that we collect from you:
- to individuals or organizations who are involved in:
- providing the Sites or Services, or information relating to the Sites and Services (including, without limitation, products, services, promotional offerings and contests or other products, services, promotional offerings or contests), on our behalf;
- maintaining, reviewing or developing our business systems, procedures or infrastructure, including, without limitation, testing or upgrading of our computer systems;
- a transfer of all or part of the assets or business of Flow or a corporate re-organization of Flow; or
- for any other purpose to which you consent.
Please note that there are circumstances where the use and/or disclosure of Personal Information may be justified or permitted or where we are obliged to disclose Personal Information without consent. Such circumstances may include:
- where required by law or by order or requirement of a court, administrative or law enforcement agency or governmental entity;
- where we believe, upon reasonable grounds, that it is necessary to protect the rights, privacy, safety or property of Flow, or its licensors, affiliates, users or other third parties;
- where it is necessary to establish or collect monies owing to us, our licensors or affiliates;
- where required to identify, contact, communicate or take action against an individual who is suspected of violating the Terms of Service; or
- where the information is publicly available.
Where obliged or permitted to disclose your Personal Information without consent, we will disclose no more Personal Information than is reasonably required.
The Accuracy and Retention of Personal Information
We endeavour to ensure that any Personal Information in our possession is as accurate, current and complete as necessary for the purposes for which we use and/or disclose such Personal Information. If we become aware that your Personal Information in our possession is inaccurate, out-of-date or incomplete, we will endeavour to revise such Personal Information accordingly. We will retain your Personal Information only for so long as it is required for the purposes it was collected or as required by applicable laws, regulations, or government orders. This period may extend beyond the end of your relationship with us, but it will be only for so long as it is reasonably necessary for us to have sufficient information to respond to any issues that may arise after the end of your relationship with us. When your Personal Information is no longer required, we will destroy, delete or convert it into an anonymous form.
Protection of Personal Information
We endeavour to maintain appropriate physical, procedural and technical safeguards with respect to our offices and information storage facilities in order to prevent any loss, misuse, or unauthorized access, disclosure, or modification of Personal Information. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. We cannot ensure or warrant the security of any information you transmit to us or store on the Services, and you do so at your own risk. We also cannot guarantee that such information may not be accessed, disclosed, altered, or destroyed by breach of any of our physical, procedural, or technical safeguards. If you believe your Personal Information has been compromised, please contact us as set forth in the “Contact Us” section. If we learn of a security systems breach, we will inform you and the authorities of the occurrence of the breach in accordance with applicable law.
Rights Regarding Your Personal Information
On written request and subject to proof of identity, you may access the Personal Information that we hold, used or communicated and ask that any necessary corrections be made, where applicable, as authorized or required by law.
Under the GDPR, you may be entitled to additional rights, including: (i) the right to withdraw consent to processing where consent is the basis of processing; (ii) the right to access your Personal Information and certain other supplementary information, under certain conditions; (iii) the right to object to unlawful data processing, under certain conditions; (iv) the right to erasure of Personal Information about you, under certain conditions; (v) the right to demand that we restrict processing of your Personal Information, under certain conditions, if you believe we have exceeded the legitimate basis for processing, processing is no longer necessary, are processing, or believe your Personal Information is inaccurate; (vi) the right to data portability of Personal Information concerning you that you provided us in a structured, commonly used, and machine-readable format, under certain conditions; (vii) the right object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you, under certain conditions; (viii) the right to lodge a complaint with data protection authorities. If you want to learn more about your rights under the GDPR, you can visit the European Commission’s page on Data Protection at: http://ec.europa.eu/justice/da...
How We Gather Data By Automatic Means
We may use cookie technology, web beacons and other similar devices on or with the Sites or Services to enhance functionality and navigation for our users. Information tracked through these mechanisms includes, but is not limited to: (i) user IP address; (ii) the type of web browser and operating system being used; (iii) the pages of the website a user visits; (iv) other websites a user visited before visiting the Sites or Services; and (v) session information. If you wish to disable cookies, refer to your web browser instruction manual or help facilities. Please note that if you disable cookies, you may be unable to access some of the features of the Sites or Services. Cookies that we use in association with the Sites or Services do not collect or contain your Personal Information.
Internet tags, graphic tags and similar web beacon type functions allow us to count the number of users who have visited a particular web page or to access certain cookies. We may use web beacons on or with the Sites or Services to count users and to recognize users by accessing our cookies. Being able to access our cookies allows us to personalize the Sites and Services and improve your experience with the Sites and Services. We may also include web beacons in HTML-formatted e-mail messages that we send to determine which e-mail messages were opened. Like cookies, the web beacons used by us in association with the Sites and Services do not collect or contain your Personal Information.
Third Party Websites and Services
The Sites or Services may provide features that permit you to share information with other persons (for example, chat rooms, message boards, forums, messages and other user communications). You should be aware that when you voluntarily disclose your Personal Information using any of these features, your Personal Information may be collected, used or disclosed by such persons without restriction. This may result in unsolicited messages from third parties, identity theft and other harm to you. Any Personal Information that you disclose to such persons is entirely at your own risk. Flow assumes no responsibility or liability as to any harm that you may suffer as a result of such activities
The Services are not directed to children under the age of 16, and we do not knowingly collect Personal Information from children under the age of 16 without obtaining parental consent. If you are under 16 years of age, then please do not use or access the Services at any time or in any manner. If we learn that Personal Information has been collected on the Services from persons under 16 years of age and without verifiable parental consent, then we will take the appropriate steps to delete this information. If you are a parent or guardian and discover that your child under 16 years of age has provided Personal Information, then you may alert us as set forth in the “Contact Us” section and request that we delete the child’s Personal Information from our systems.
California Privacy Rights
This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act or “CCPA.”
For more details about the personal information we have collected over the last 12 months, including the categories of sources, please see the “Information We Collect and Receive” section above. We collect this information for the business and commercial purposes described in the “How We Collect and Use Personal Information” section above. Flow does not sell (as such term is defined in the CCPA) the personal information we collect (and will not sell it without providing a right to opt out). Please note that we do use third-party cookies for our advertising purposes as further described in the “How We Gather Data By Automatic Means” section.
Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this information), to delete their personal information, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights. California consumers may make a request pursuant to their rights under the CCPA by contacting us at firstname.lastname@example.org. We will verify your request using the information associated with your account, including email address. Consumers can also designate an authorized agent to exercise these rights on their behalf.