Who We Are
FlowHive is a cloud-based business operations platform helping UK organisations manage workforce scheduling, operational planning, customer relationships, recruitment, business intelligence, and financial forecasting.
For the purposes of UK data protection law, FlowHive acts as a data controller in respect of personal data collected through our marketing website and communications, and as a data processor in respect of personal data that our customers upload and manage within the FlowHive platform.
Personal Data We Collect
Website & Marketing
- →Contact & enquiry data — name, email address, phone number, company name and message content when you submit a contact or demo request form
- →Trial registration data — name, work email, company, job title and password when you sign up for a free trial
- →Marketing preferences — your consent choices for receiving communications from us
- →Technical & usage data — IP address, browser type, device type, pages visited, time on site, referral source
- →Job applicant data — CV, cover letter, employment history and contact details when you apply for a role
FlowHive Platform
When customers use the FlowHive platform, the personal data processed is determined by the customer as data controller. This may include:
- ✓Workforce data — employee names, contact details, roles, working hours, schedules, holiday entitlements and payroll-related information
- ✓Recruitment data — candidate names, CVs, interview notes and application status
- ✓Customer & client data — names, contact details and communication history stored within the CRM module
- ✓Account & access data — usernames, roles, login timestamps and audit logs
- ✓Operational data — any business information uploaded or generated by users within the platform
How We Collect Personal Data
- ✓Directly from you — when you complete a form, register for a trial, contact us, or apply for a job
- ✓Automatically — through cookies and analytics tools as you browse our website
- ✓From your employer or organisation — when a customer administrator creates your account on the FlowHive platform
- ✓From third parties — such as LinkedIn or recruitment platforms, where you have applied for a role or connected your profile
Why We Use Personal Data
Website & Marketing Purposes
- →Responding to your enquiries and demo requests
- →Providing and managing your free trial access
- →Sending marketing and product communications (where you have consented or we have a legitimate interest)
- →Improving our website using aggregated analytics data
- →Processing job applications
- →Complying with our legal obligations
Platform Purposes (on behalf of customers)
- ✓Delivering the FlowHive software and its features to authorised users
- ✓Maintaining platform security and preventing misuse
- ✓Providing customer support
- ✓Generating operational and workforce analytics for customers
- ✓Meeting our contractual and legal obligations as a data processor
Lawful Bases for Processing
Under UK GDPR, we rely on the following lawful bases for processing personal data as a data controller:
| Lawful Basis | When We Use It |
|---|---|
| Consent | Marketing emails and non-essential cookies, where you have actively opted in. You may withdraw consent at any time. |
| Contract | Processing necessary to provide a free trial, manage your account, or fulfil our subscription agreement with you. |
| Legitimate Interests | Website analytics, security monitoring, fraud prevention, and B2B marketing to existing or prospective customers. |
| Legal Obligation | Retaining records as required by UK law (e.g. HMRC requirements, employment law, or responding to lawful authority requests). |
Who We Share Personal Data With
We do not sell personal data. We may share data only with trusted parties for the purposes described in this policy:
- ✓Cloud infrastructure providers — hosting and storage services operating in UK or EEA data centres
- ✓Analytics providers — such as Google Analytics (subject to your cookie preferences)
- ✓Email and communication platforms — used to send transactional and marketing messages
- ✓Customer support tools — used to manage and respond to support tickets
- ✓Payment processors — to handle subscription payments securely (we do not store card data)
- ✓Professional advisers — solicitors, accountants and insurers, subject to confidentiality obligations
- ✓Regulatory and law enforcement bodies — where required by law or to protect rights and safety
All third-party processors are subject to data processing agreements and are required to maintain appropriate security measures.
FlowHive as a Data Processor
When our customers use the FlowHive platform to manage employee, candidate, or client data, FlowHive acts as a data processor under UK GDPR. The customer remains the data controller and is responsible for:
- ✓Having a lawful basis for processing the data they input into FlowHive
- ✓Ensuring individuals are informed about how their data will be used
- ✓Responding to data subject requests from their own employees, candidates, and clients
- ✓Maintaining appropriate data protection practices within their organisation
FlowHive will only process platform data in accordance with documented customer instructions and will not use that data for our own purposes.
How Long We Keep Personal Data
| Data Type | Retention Period |
|---|---|
| Marketing enquiries | 3 years from last contact or until you unsubscribe |
| Trial account data | 90 days after trial expiry, unless converted to paid |
| Customer account data | Duration of contract + 7 years |
| Platform data (as processor) | Per customer instruction; deleted on contract termination |
| Invoice and payment records | 7 years (HMRC requirement) |
| Job applications | 6 months if unsuccessful; up to 2 years with consent |
| Security and audit logs | 12 months rolling |
International Data Transfers
We store all customer and platform data exclusively in UK-based data centres. We do not routinely transfer personal data outside the UK.
Where any third-party sub-processor operates outside the UK, we ensure appropriate safeguards are in place — such as UK adequacy decisions or Standard Contractual Clauses — before any transfer takes place.
Your Data Protection Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- ✓Right of Access — Request a copy of the personal data we hold about you
- ✓Right to Rectification — Ask us to correct inaccurate or incomplete data
- ✓Right to Erasure — Request deletion of your data where there is no lawful reason to retain it
- ✓Right to Restriction — Ask us to pause processing while accuracy or legitimacy is disputed
- ✓Right to Data Portability — Receive your data in a structured, machine-readable format
- ✓Right to Object — Object to processing based on legitimate interests or for direct marketing
- ✓Rights re: Automated Decisions — Not be subject to solely automated decisions with significant effects
- ✓Right to Withdraw Consent — Withdraw consent at any time where processing is consent-based
To exercise any of these rights, contact us at info@flow-hive.co.uk. We will respond within 30 days.
Cookies
We use cookies and similar tracking technologies on our website. Full details of which cookies we use and why are set out in our Cookie Policy.
You can manage your cookie preferences at any time through your browser settings or our cookie consent tool.
Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration or disclosure. These include:
- ✓Encryption of data in transit (TLS) and at rest (AES-256)
- ✓Access controls and role-based permissions
- ✓Regular security testing and vulnerability assessments
- ✓Staff security training and data protection awareness
- ✓Incident response and breach notification procedures
If you suspect a data breach or security incident, contact us immediately at info@flow-hive.co.uk.
Children's Data
Our Website and platform are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data relating to a child, please contact us so we can delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will publish an updated version on our Website and update the version number and effective date at the top of this document.
We recommend reviewing this policy periodically. Continued use of our Website or platform after an update constitutes acceptance of the revised policy.
Contact Us & Data Protection Officer
If you have any questions, concerns or requests relating to this Privacy Policy or your personal data, please contact us:
Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority.
Website: ico.org.uk | Helpline: 0303 123 1113
We would always prefer to resolve concerns directly first. Please contact us before escalating to the ICO.