1.1 Information Provided Directly

‍

When a visitor submits the "Tell us what you need" enquiry form, the following information is collected:

‍

1. First name
2. Business name, where provided
3. Email address
4. A description of the enquiry or project, where provided
5. The nature of the service required
6. Preferred timescale
7. Preferred method of contact
   ‍

1.2 Information Collected Automatically

‍

When a visitor browses the Site, certain information may be collected automatically, including IP address, browser and device type, pages visited, referral source and general usage data gathered by cookies or similar technologies.
‍

1.3 Special Category Data

‍

We do not seek to collect special category data, including data relating to health, religion or biometric identifiers. Visitors are asked not to include such information in free text fields, including the project brief field.

Personal data collected through the Site is used to:

1. respond to enquiries submitted through the contact form and to follow up regarding prospective work;
2. operate, maintain and improve the Site;
3. analyse how visitors use the Site; and
4. comply with applicable legal, regulatory and accounting obligations.

Processing is carried out on one or more of the following legal bases under the UK GDPR: consent, where processing relates to non essential cookies or analytics; legitimate interests, where processing is necessary to respond to enquiries, operate the Site or conduct general business administration; and contract, where processing is necessary to perform a contract for services entered into with a client.

ThatFlow engages a limited number of third party providers in the operation of the Site and the handling of enquiries. Personal data submitted through the Site may be processed by the following:

‍

1. Webflow, providing website hosting, form handling and content management;
2. n8n, a self hosted automation platform used to route enquiry submissions to internal workflows;
3. Google Workspace, comprising Sheets and Gmail, used for the storage of lead records and the preparation of correspondence;
4. Mattermost, used for internal notification of new enquiries and not accessible to third parties;
5. analytics and cookie management tools, including Google Analytics or an equivalent provider, used to assess Site traffic and usage where enabled; and
6. search and generative engine visibility tools, used to monitor how the Site and its content appear in search results and AI generated outputs, which ordinarily rely on aggregated or publicly available data rather than data submitted by visitors.

Personal data is not sold to any third party. Each provider listed above is engaged solely for the purpose of providing services to ThatFlow and is contractually or technically restricted in its use of that data accordingly.

‍

Certain providers may process personal data outside the United Kingdom or the European Economic Area. Where this occurs, appropriate safeguards are relied upon, including Standard Contractual Clauses or the relevant provider's own adequacy arrangements.

The Site may use cookies or similar technologies to remember visitor preferences and to measure traffic. Cookies may be controlled or disabled through browser settings; disabling cookies may affect the functionality of the Site.

Contact form submissions and related correspondence are retained for as long as reasonably necessary to respond to the relevant enquiry. Where a working relationship is established, records are retained for the duration of that relationship and for a further period thereafter to satisfy legal, accounting or tax obligations, typically not exceeding six years. Analytics data is retained only for as long as required for the purpose for which it was collected, subject to the retention settings applied by the relevant provider.

Under the UK GDPR, individuals have the right to:

‍

1. request access to personal data held about them;
2. request correction of inaccurate personal data;
3. request erasure of personal data;
4. object to, or request restriction of, certain processing activities;
5. request that personal data be provided in a portable format; and
6. withdraw consent at any time, where processing is based on consent.

Requests to exercise any of the above rights should be sent to hello@thatflow.london. Individuals who consider that their personal data has been mishandled also have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.

Reasonable technical and organisational measures are maintained to protect personal data against unauthorised access, loss or misuse, proportionate to the nature and scale of the business.

The Site is not directed at children and personal data is not knowingly collected from any individual under the age of sixteen.

This Policy may be amended from time to time to reflect changes in practice or applicable law. The date at the top of this document indicates the version currently in effect.

ThatFlow Studio

Email: admin@thatflow.london
‍Website: thatflow.london