Privacy Policy
Version 1.2 | Effective from 1 November 2026
This is a translation of the Czech original. In the event of any discrepancy between language versions, the Czech version prevails.
This document describes how we process personal data in the role of controller, that is, data collected in the operation of the flowlogis.com website, during registration and in the administration of the contractual relationship.
Distinction of roles: For data that a customer organisation enters into the flowlogis platform — data about its employees, suppliers and contacts — we act solely as a processor. The controller in such cases is the organisation concerned, and the conditions of processing are set out in the Data Processing Agreement. If you are an employee of such an organisation and wish to exercise your rights in respect of that data, please contact your employer.
The same applies to carriers that a customer organisation contacts in the Transport module: the carrier's contact details in the customer's directory, inquiries, bids, orders, messages and attachments are processed by us as a processor for that organisation. Please address requests concerning this data to the organisation that contacted you. As a controller, we process only the data described in Articles 3.5, 3.9 and 3.10.
1. Controller
| Item | Value |
|---|---|
| Controller | Jan Prokop |
| Registered address | Lomená 668, 294 04 Dolní Bousov, Czech Republic |
| Company ID (IČO) | 01680188 |
| info@flowlogis.com | |
| Telephone | +420 603 500 591 |
| Data box ID | i3bkn8h |
Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Coll., on personal data processing.
No data protection officer has been appointed, as the conditions of Article 37 GDPR are not met. Please direct enquiries to the e-mail address above.
2. Categories of data subjects
- visitors to the
flowlogis.comwebsite; - prospective customers who contact us;
- administrators and users with a platform account, including persons invited by an organisation administrator;
- contact and billing persons of customer organisations;
- carriers and their contact persons who access the platform through a link sent by e-mail or from a carrier account, request a carrier card or are listed in the central carrier directory.
3. Purposes, data categories and legal bases
3.1 Registration and operation of a user account
| Data | first and last name, work e-mail, telephone, job position, role within the organisation, organisation name, language and display settings, registration date |
| Purpose | creation and administration of the account, authentication, assignment of modules and permissions, operational communication |
| Legal basis | performance of a contract under Article 6(1)(b) GDPR for the administrator concluding the contract; legitimate interest under Article 6(1)(f) GDPR for users invited by the organisation, consisting in the provision of the ordered service to the customer |
| Retention | for the lifetime of the account, followed by the read-only period of twelve months and a further thirty days for data export in accordance with the Terms of Service |
3.2 Invitations to an organisation
| Data | invitee's e-mail, name, identification of the inviting organisation, invitation token, validity |
| Purpose | delivery of the invitation and provision of access |
| Legal basis | legitimate interest under Article 6(1)(f) GDPR; the inviting organisation is responsible for the legal basis for providing the contact details |
| Retention | until the invitation is accepted, no longer than 30 days from dispatch |
3.3 Invoicing and accounting
| Data | business name, registered address, company ID, VAT ID, billing e-mail, contact person's name, details of ordered modules, payment history |
| Purpose | issuing and recording tax documents, bookkeeping |
| Legal basis | compliance with a legal obligation under Article 6(1)(c) GDPR, in particular under Act No. 563/1991 Coll., on accounting |
| Retention | 10 years from the end of the accounting period to which the document relates |
3.4 Customer support
| Data | content of enquiries and e-mails, sender's contact details, communication metadata |
| Purpose | handling the enquiry and keeping records of resolved cases |
| Legal basis | performance of a contract or legitimate interest under Article 6(1)(b) and (f) GDPR |
| Retention | 3 years from the last communication |
3.5 Security and operational records
| Data | IP address, user identifier, session identifier (including a carrier session opened from an e-mail link), browser type, time and type of operation, error states, request rate counters, browser reports of content security policy violations (page address without parameters and type of blocked resource) |
| Purpose | securing the platform, protection against overload and abuse, error diagnostics |
| Legal basis | legitimate interest under Article 6(1)(f) GDPR, consisting in ensuring network and information security |
| Retention | rate-limit counters 60 seconds to 1 hour with automatic expiry; operational logs to the extent provided by the platform providers' plans, a matter of days |
3.6 Commercial communications
| Data | e-mail, name, organisation name |
| Purpose | information about news, modules and changes to the service |
| Legal basis | for existing customers, legitimate interest under Article 6(1)(f) GDPR in conjunction with Section 7(3) of Act No. 480/2004 Coll.; otherwise consent under Article 6(1)(a) GDPR |
| Retention | until consent is withdrawn or an objection is raised, no longer than 3 years from the last interaction |
You may unsubscribe using the link in every commercial communication or by writing to info@flowlogis.com.
3.7 Website analytics
We do not use website analytics tools or analytics cookies. Should we wish to introduce them, we will do so only after amending this policy and only on the basis of your consent.
3.8 Establishment and defence of legal claims
| Data | contractual documentation, communications, operational records |
| Purpose | establishment, exercise or defence of legal claims |
| Legal basis | legitimate interest under Article 6(1)(f) GDPR |
| Retention | for the duration of the limitation period, normally 4 years from termination of the contract, or until a dispute is finally resolved |
3.9 Carrier cards and the central carrier directory
| Data | business name or name of the carrier, country, company ID, VAT ID, registered address, website, public contact e-mail and phone, vehicle types, coverage and specialisations, consent to inclusion in the central directory; for a carrier card request also the requester's name, organisation, note, decision and its reasons |
| Purpose | keeping a single carrier card per company ID or VAT ID, assigning the card to a carrier account, merging duplicates and making the public profile available to customer organisations in the central directory |
| Legal basis | for carriers with an account who requested or consented to inclusion, consent under Article 6(1)(a) GDPR and performance of a contract under point (b); for carriers listed by the provider from publicly available company information, legitimate interest under point (f), consisting in offering a carrier directory to customers |
| Retention | for as long as the carrier is listed and the card exists; consent may be withdrawn at any time in the carrier profile, removal may be requested at info@flowlogis.com |
3.10 Carrier access through an e-mail link
| Data | the e-mail address to which the customer organisation sent the link, invitation identifier, hash of the access token, session identifier and validity, chosen page language, time of opening and response |
| Purpose | secure access to a single document (inquiry, tender round or order) for a carrier without registration, and protection against misuse of the link |
| Legal basis | legitimate interest under Article 6(1)(f) GDPR, consisting in securing access; the content of the inquiry and the carrier's response are processed by us as a processor for the customer organisation |
| Retention | the link is valid until the document's deadline and usually 14 days thereafter; the session cookie expires with the link |
4. Sources of data
We obtain data directly from you at registration, when ordering or in communication; from your organisation if its administrator invited you; from the customer organisation that contacted you as a carrier; automatically during use of the platform under Articles 3.5 and 3.7; from public registers when verifying company details for invoicing; and from publicly available company information on carriers under Article 3.9.
5. Obligation to provide data
Providing the data under Articles 3.1 and 3.3 is a contractual requirement; without it an account cannot be created nor the service invoiced. Providing data for marketing purposes is voluntary.
6. Recipients of data
We do not sell personal data. We disclose it only to the following recipients:
| Recipient | Role | Purpose | Data location |
|---|---|---|---|
| Supabase, Inc. | processor | database, authentication, file storage, edge functions | AWS eu-west-1, Ireland |
| Vercel, Inc. | processor | hosting of the application and server functions | Dublin (dub1), Ireland |
| Resend | processor | sending transactional e-mails and invitations | eu-west-1, Ireland |
| Upstash, Inc. | processor | request rate limiting | AWS eu-west-1, Ireland |
| External accountant | processor | bookkeeping | Czech Republic |
| Customer organisations of the platform | separate controller | display of a carrier's public profile in the central carrier directory (Article 3.9) | EU |
| Public authorities | separate controller | compliance with legal obligations | Czech Republic |
Static website files are delivered via a global CDN. These files contain no personal data.
7. Transfers outside the European Union
Personal data is stored exclusively on servers within the European Union, specifically in Ireland.
Supabase, Inc., Vercel, Inc., Upstash, Inc. and Resend are established in the United States. Even where data is stored in the European Union, access by their support staff from a third country cannot be excluded. For such cases, transfers are covered by the standard contractual clauses under Commission Implementing Decision (EU) 2021/914, or by certification under the EU–U.S. Data Privacy Framework pursuant to the European Commission's adequacy decision of 10 July 2023.
We will provide a copy of the safeguards applied on request.
8. Security
We apply technical and organisational measures appropriate to the risk under Article 32 GDPR, in particular:
- encrypted transmission using TLS 1.2 or higher and encryption of data at rest on the database platform provider's side;
- separation of individual organisations' data at database level using Row Level Security;
- roles and permissions within the organisation, with access to shared projects only upon explicit sharing;
- storage of passwords solely as cryptographic hashes and a minimum password length of twelve characters;
- request rate limiting as protection against overload and abuse;
- restriction of access to production data to the necessary group of persons, bound by confidentiality;
- separation of development and production environments and automated scanning of source code for credential leaks.
A detailed overview of the measures is set out in Annex C to the Data Processing Agreement.
9. Cookies
We use cookies in accordance with Section 89(3) of Act No. 127/2005 Coll., on electronic communications.
9.1 Strictly necessary cookies
Stored without consent, as the service cannot be provided without them.
| Cookie | Purpose | Duration |
|---|---|---|
sb-*-auth-token |
sign-in and maintenance of the user session | session, up to 7 days |
fl_active |
short-term confirmation that the account is active | 5 minutes |
fl_dark |
storing the light or dark mode preference | 1 year |
fl_lang |
storing the language preference | 1 year |
fl_inv_* |
carrier session opened from an e-mail link, valid for one document only | until the link expires |
fl_carrier_lang |
language of the carrier pages | 1 year |
| form abuse protection | securing sign-in and form submission | session |
9.2 Other cookies
We do not use analytics or marketing cookies, which is why the website shows no consent banner. Cookies may be managed in your browser settings; blocking strictly necessary cookies will, however, prevent sign-in.
10. Your rights
In relation to processing in which we act as controller, you have the right:
| Right | GDPR provision | Note |
|---|---|---|
| of access and to a copy | Article 15 | the first copy is free of charge |
| to rectification of inaccurate data | Article 16 | some data can be edited directly in your profile |
| to erasure | Article 17 | does not apply to data retained under statute |
| to restriction of processing | Article 18 | |
| to data portability | Article 20 | where processing is based on contract or consent |
| to object to processing based on legitimate interest | Article 21 | unconditionally in the case of direct marketing |
| to withdraw consent | Article 7(3) | without affecting the lawfulness of prior processing |
You may exercise your rights by e-mail at info@flowlogis.com, in writing to the controller's address or via data box. We will respond within one month of receiving the request; in complex cases this period may be extended by a further two months, of which we will inform you. To protect your data, we may ask you to verify your identity.
No automated decision-making or profiling with legal effects under Article 22 GDPR is carried out.
11. Complaint to a supervisory authority
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
www.uoou.gov.cz, data box qkbaa2n
12. Changes to this policy
We may update this policy in response to changes in the service or in legislation. The new wording will be published at this address with the date on which it takes effect. We will inform registered users of material changes by e-mail at least 30 days in advance.