Privacy Policy

1. Who we are and in what capacity we process data

Flowetica Studio SRL ("Flowetica", "we", "us"). Registered office: Strada D. Stoica, Nr. 1, Bl. H2, Sc. 2, Ap. 16, Craiova, Romania. Company registration: CUI 55179338, Nr. ORC J2026043729009. For any data-protection question, contact us at privacy@flowetica.com.

We process personal data in two distinct capacities, and your rights are exercised differently in each case:

As data controller, for data collected through our websites flowetica.com and flowetica.ro — the contact form, the online assessment, and traffic analytics. These processing activities are described in sections 2-8.

As data processor, for the customer data of businesses that have contracted our automation services. In this case the controller is that business (for example, a salon or clinic), and we process the data solely on its behalf and according to its instructions, under GDPR Art. 28. These processing activities are described in section 9.

2. What data we collect through the website

Contact form and assessment: your name, email address, phone number, company name, and the information you provide about your business and its operations.

Analytics: if you accept analytics cookies, Google Analytics collects pseudonymous usage data (pages viewed, approximate location, device and browser type).

Website chat: the messages you write, when you sent them, the page you started the conversation from and, if you give it to us, your email address. We don't ask for your address up front; we ask for it only if nobody replies within a few minutes or it is outside business hours, so that we can get back to you. You can have the whole conversation without giving it.

We do not collect special categories of data through the website. The chat is not the place for health data, financial data, or documents; if you need to send us something like that, we will tell you how at that point.

3. Why we use it and legal basis

We process your contact and assessment data to respond to your request, prepare a proposal, and provide our services. Legal basis: your consent and/or steps taken at your request prior to entering a contract (GDPR Art. 6(1)(a) and (b)).

We process chat messages in order to answer what you asked. Legal basis: steps taken at your request prior to entering a contract (GDPR Art. 6(1)(b)), since you are the one who starts the conversation. If you leave us your email address, we use it strictly to get back to you about that conversation, not to add you to any list.

Analytics data is processed only on the basis of your consent (Art. 6(1)(a)), which you can withdraw at any time.

4. Who we share website data with

We rely on trusted providers acting as processors: EU-based hosting infrastructure (Hetzner, Frankfurt, Germany), our automation platform (n8n) and database (Supabase), our scheduling provider (Cal.com, if you book an audit), Telegram (if you write in the website chat, see section 5), and Google Analytics (Google Ireland Ltd). We never sell your data and only share it where necessary to deliver our services or where required by law.

A complete list of the providers involved in all our processing activities, including those carried out on behalf of clients, is set out in section 10.

5. International transfers

Our operational infrastructure is located in the European Union. Certain providers may transfer data to servers outside the EU, including the United States. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission.

The website chat has one particularity that we prefer to state plainly. Conversations are stored by us, in the European Union, but your messages reach us through Telegram, because that is where we reply from. Telegram operates outside the European Union and is not covered by an adequacy decision of the European Commission, so the text of your messages passes through its servers.

If you would rather your message did not go that way, email us directly at contact@flowetica.com or use the contact form. It reaches the same people.

6. How long we keep your data

We keep contact and assessment data for as long as needed to handle your inquiry and any resulting business relationship, then delete it when it is no longer required. Google Analytics data is retained according to Google's settings (up to 14 months).

Chat conversations are kept for 12 months from the last message, then deleted. The deletion date is recorded on each conversation individually rather than left to anyone's memory, and deletion happens automatically. You can ask for earlier deletion at any time at contact@flowetica.com.

Retention periods for data processed on behalf of clients are set out in section 9.

7. Cookies

We use only necessary and, with your consent, analytics cookies. See our Cookie Policy for details. You can change or withdraw your consent at any time via the "Cookie settings" link in the footer.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time (without affecting processing carried out before withdrawal). To exercise any of these, email privacy@flowetica.com. We respond within 30 days.

If your data is processed by us on behalf of a business (section 9), you may contact that business directly or contact us — in the latter case we will forward your request to the controller and support them in resolving it. You can request deletion of your data at any time through the procedure described on the Data Deletion page.

9. Processing carried out on behalf of our clients

This section applies if you are a customer of a business that uses Flowetica's services. For this data, that business is the controller and we are the processor. We never use this data for our own purposes, for marketing, or to train artificial intelligence models.

10. List of providers involved in processing

We do not add a new provider without prior notice to our client, who has the right to object on reasoned grounds.

11. Right to lodge a complaint

If you believe your data-protection rights have been breached, you can lodge a complaint with the Romanian supervisory authority (the Romanian data protection authority): Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest; www.dataprotection.ro.

12. Updates

Last updated: September 2026. We will notify active clients of any material changes to this policy.

This policy is kept up to date as our services evolve. For any question, contact privacy@flowetica.com.