Last updated: 27 September 2026
This notice explains how Flowless collects, uses, shares and protects personal data, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who we are
Flowless, a company registered in the Netherlands, Agora 4, 8934 CJ Leeuwarden, the Netherlands (with an office at Irsal Street, Ramallah, Palestine).
Contact for all privacy matters, including our Data Protection Officer: info@flowless.co · +31 6 57462526.
2. Our role
- Controller — for personal data we process for our own purposes: website visitors, people who contact us, and our client business contacts.
- Processor — when we provide our water-analytics platform to utility clients. The client is the controller of that data and we process it only on their documented instructions. If you are an end-user of one of our clients, please contact that client first; we will forward any request we receive and help them respond.
3. What we collect
Contact data: Name, email, phone, organisation — when you fill in our contact form or email us.
Account & identity data: Name, organisation, role, user ID — for platform users
Authentication & access data: Single sign-on identifiers, MFA metadata, login and audit logs
Operational data: Water-network telemetry, which in limited cases can relate to an identifiable person
Technical & website data: IP address, browser and device information, cookies (see section 9)
We do not intentionally process special categories of data (such as health or biometric data).
4. Why we use it and our legal basis
Providing our platform and services to clients. Legal basis: contract
Securing accounts and systems (authentication, access control, audit logs, monitoring). Legal basis: legitimate interests
Responding to your enquiries and supporting clients. Legal basis: legitimate interests
Account administration and billing. Legal basis: contract
Meeting legal obligations (e.g. breach notification, record-keeping, handling your rights). Legal basis: legal obligation
Non-essential website analytics and marketing cookies. Legal basis: your consent — you can withdraw it at any time
Our analytics features, including AI-assisted insights, are decision-support only. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who we share it with
We share personal data only with vetted service providers under data processing agreements, and only as needed to deliver our services: cloud hosting, identity/single sign-on, AI analytics (personal data is masked before it is processed), and monitoring tools. We may also disclose data where required by law. We do not sell personal data.
6. International transfers
Where personal data is transferred outside the European Economic Area, we use a lawful safeguard: an EU adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission’s Standard Contractual Clauses. For EU clients we keep data in the EU wherever possible.
7. How long we keep it
Contact-form and enquiry data: Up to 2 years after the last contact, unless we enter a contract
Platform account data: Duration of the client contract + 30 days
Authentication/session data: 90 days
Security audit logs: 12 months
Client operational data: As set in the client contract; deleted within 30 days of termination
Records of privacy requests: 3 years
Backups: Overwritten within 35 days
8. Your rights
You can ask us to: access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Where processing is based on consent, you can withdraw consent at any time.
Send requests to info@flowless.co. We will verify your identity and reply within one month (we may extend this by up to two months for complex requests, and will tell you if so).
You also have the right to complain to a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) — or the authority where you live or work.
9. Cookies
We use strictly necessary cookies to run the website. Analytics and marketing cookies are used only with your consent, which you give or refuse through our cookie banner. You can change your choice at any time via the cookie settings link on every page.
10. Security
We protect personal data with encryption in transit and at rest, multi-factor authentication, role-based access control, tenant isolation, and masking of personal data before analytics and AI processing.
11. Changes
We may update this notice. The “Last updated” date shows the latest version; material changes will be highlighted on this page.
