Flowskraft^® privacy notice

1. Who are we?

Flowskraft B.V. is the controller for the processing of personal data described in this notice.

• Flowskraft B.V., registered with the Dutch Chamber of Commerce (Kamer van Koophandel, KvK) under number 42070015;
• Tollensstraat 2, 3771 ZK Barneveld, the Netherlands;
• questions about privacy: privacy@flowskraft.nl.

We are not required to appoint a data protection officer (DPO) and have not done so. The management board is jointly responsible for data protection.

2. Our two roles

As a processor. For the data you enter or use in your employer's workspace on the platform – such as your account, projects, schedule and images – your employer (our customer) is the controller and we are the processor. The arrangements for this are set out in our data processing terms, an annex to our terms and conditions. If you have questions about this data, please contact your employer first.

As a controller. For a number of our own purposes, we decide why and how we process data: invoicing and administration, security and abuse prevention, improving the service and keeping it stable, running the Skraft app on your device, the customer relationship and support, approaching businesses, and our website. The rest of this notice is about those processing activities. We receive contact details from the customer or from you, and, when we approach a business ourselves, from that business's website or from a contact; security, usage and device data arise when the platform and the app are used.

Images. The customer is responsible for photos and videos. We publish nothing automatically: the customer decides for each project whether it appears on a public shared overview. If, with a customer's permission, we use its project images in our own communications, such as on our website or LinkedIn, we are responsible for that ourselves. If you are recognisable in an image and want it removed, email privacy@flowskraft.nl.

3. What data do we process?

• Contact and billing details of customers and their contact persons: name, business email address, phone number, job title, company name, address, Chamber of Commerce (KvK) number and VAT number, bank account number (IBAN) and payment status. We check a VAT number from another EU country with the European Commission (VIES). On each invoice, we record these details as they stood at that moment.
• Businesses we approach ourselves: the name, job title and business contact details of a contact person, as shown on the business's website or as we receive them from a contact, and what we have discussed.
• Requesting a subscription in the portal: the name and email address of the owner of the new workspace, the company details, the chosen plan and, if provided, a reference. Every request also reaches us by email.
• Acceptance of our terms: who accepts the terms and conditions on behalf of a customer and reads this notice, with their email address, the version, the time and the browser.
• Security and usage data: login and audit data, IP address, two-factor authentication, AI usage, the use of our server functions, and error reports with technical data and a user ID. To prevent abuse of forms, such as when requesting a subscription or a new invitation, we store only an irreversible code of the IP address and email address.
• Device data from the Skraft app: a fixed device name (such as "Android (Skraft)"), a hashed device identifier, the time of registration and of last use, the status, the session and the push token for notifications.
• Location in the Skraft app – only while you are using the app and if you have allowed it: to suggest nearby projects (on your device itself), to determine an address via our server, without your name, when you use "Gebruik mijn locatie" (Use my location), and for your daily schedule, such as the order of your stops and the driving times between them. For the driving times, your position (up to your first stop) and those of the stops are sent via our server to Mapbox; we do not store positions in the process. We do record who requested the driving times, when and why, for example on arrival at a stop.
• Reports and feedback in the portal: your message, a screenshot if you add one, the page you were on, technical data about your browser and our reply.
• Consent for your logo: if we ask a customer whether we may show its logo on flowskraft.nl, we record the answer (yes, no or withdrawn), with the date and who answered, as well as which account saw the question and when.
• Customer satisfaction: stars, a comment and, if provided, a review from the owner of a workspace, with the name of the person answering. Only Flowskraft reads the comment. A review appears on flowskraft.nl only with consent, with the company name or with the name and company name, as the owner chooses.
• Requests via our website: name, company name, email address, your message and the language of the page; for a demo request, also your phone number (if you provide it), sector and preferred plan.
• Correspondence when you contact us, including via WhatsApp or social media.

We do not process special categories of personal data and we do not make automated decisions about people: the AI produces at most a draft, and a person decides. We do not use app or location data to track or assess employees, or to check attendance. Unlocking with a fingerprint or face takes place entirely on your device; we receive no biometric data.

4. On what legal basis?

Where we rely on legitimate interest, we have weighed our interests against yours. That assessment is set out in our data protection impact assessment (DPIA); you can request it via privacy@flowskraft.nl. We do not show advertisements and do not sell data.

5. Email

Messages that belong to the use of the service – invoices, invitations, notifications and security messages – we send on the basis of the contract or a legal obligation. We send news about our own services only to contact persons of customers, always with a way to unsubscribe. When we approach a business ourselves, we do so with a personal message; if you let us know that you no longer want to be contacted, we stop.

6. How long do we keep data?

• contact and billing details: 7 years (statutory tax retention period); an invoice and the customer details on it are kept for those 7 years, even if the rest of the customer's workspace has been deleted;
• businesses we approach ourselves and website requests without follow-up: 12 months after the last contact;
• a subscription request that we do not approve: at most 14 days in the portal; the email with the request in our mailbox: 12 months;
• the codes against abuse of forms: 24 hours to 7 days;
• audit data: 24 months; data on AI usage: 13 months;
• the use of our server functions, such as converting an address or requesting driving times: 90 days;
• a device registration: the push token until you or your admin revoke the device, the registration itself until your account is deleted;
• converted addresses and positions: we reuse them for 30 days and delete them after 60 days;
• the acceptance of our terms, reports and feedback, the consent for your logo, the answers on customer satisfaction and the visit statistics for the shared overview: for as long as the customer is with us; who has seen the logo question: until the account or the customer is deleted;
• data in a customer's workspace: after the end of the contract, can be reopened for 30 days for an export, and is deleted after 90 days at the latest;
• database backups: 7 to 14 days;
• log files of our hosting, error monitoring and security: according to the fixed period of the party concerned, currently 7 days at Supabase (including logins with IP address), 1 to 7 days at Netlify, 30 to 90 days at Sentry (depending on the plan) and 31 days for security events at Cloudflare.

We are currently setting up the automatic deletion of audit data and data on AI usage once their period has ended. Website requests, the details of businesses we approach and messages in our mailbox are cleaned up manually.

7. Who do we share data with?

We work with carefully selected parties, with arrangements on use and security: a data processing agreement or the standard terms of that party. Some work for our own purposes, others for our customers; the latter are also listed in Annex B to our data processing terms.

SCC = standard contractual clauses of the European Commission; DPF = EU-US Data Privacy Framework. You can request a copy of the safeguards, or a reference to them, via privacy@flowskraft.nl.

Partners. If one of our partners manages your organisation's workspace, that partner sees what it needs for this, such as the users, the reports and the feedback. We agree data protection arrangements with a partner before it is given access.

8. Cookies, storage on your device and external sources

The portal does not place tracking or advertising cookies. Your session, your preferences and a few settings, such as a collapsed menu or a chosen export folder, are kept in your browser's storage; Cloudflare's bot check stores its own identifier there. The Skraft app stores on your device your session, encrypted keys and PIN, a working copy of your daily tasks and your profile, photos still to be uploaded, a half-completed new project and a temporary copy of map sections and photos you have already viewed. When you log out, your session, PIN, device key, working copy and upload queue are deleted; the built-in authenticator stays, so that you keep your second factor, and a half-completed new project stays until you finish or discard it; if it is older than a week, the app discards it as soon as you start a new project.

The maps in the portal, the app and the public shared overview come from our own map server at Cloudflare. Some of the small maps in the portal, such as those for choosing a location, in the schedule and in the sharing wizard, still load their tiles from CARTO. If you are still using an older version of the Skraft app, the map there runs on Google Maps (Android) or Apple Maps (iOS) with tiles from CARTO; after an update it no longer does. Those map sections, the script of our error monitoring (Sentry) and the bot check (Cloudflare) are fetched directly by your browser or device. Those parties see your IP address and technical data, and for maps the area you are viewing. Each time a portal page loads, our error monitoring receives a short session message, without your name or email address. If you scan a QR code in the Android app, Google ML Kit reads it on your device; Google receives data about the device, the app and how the scanner is working, not the content of the code. If you tap navigate, the app passes the destination to the navigation app on your device, or opens Google Maps in your browser.

Website. The website does not place cookies and stores nothing on your device. We measure visits with Plausible Analytics, without cookies and without storing your IP address; the figures are aggregated and stay in the EU. Forms reach us via Netlify, and we use them only to follow up your request.

WhatsApp and social media. If you contact us via WhatsApp or social media, Meta (WhatsApp, Facebook, Instagram) or LinkedIn processes your message under its own terms. The buttons on the website are ordinary links: the site loads nothing from those parties. For the visitor statistics of our own pages on those platforms, we are jointly responsible with the platform; what the platform collects for this is set out in its own privacy notice.

Public shared overview. When someone opens a shared overview, we count that visit for the customer: what was viewed, by which route (for example a QR code, WhatsApp, email, LinkedIn or an embedded map), the type of device and the time. We do not store the IP address or browser data, and no cookie is placed. So that a visit is not counted twice, your browser remembers a sequence number during the visit; it disappears when you close the tab.

9. Security

We keep each customer's data separate, require two-factor authentication for owners and admins, encrypt connections and storage, make daily backups of the database and remove location data (GPS) from photos you upload to a project. We leave personal data out of error reports as far as possible. The Skraft app works with an encrypted PIN, and a device can be revoked remotely.

10. Data breaches

We report a notifiable data breach for which we are responsible to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) within 72 hours and, where necessary, to the data subjects. If it concerns data we process for a customer, we inform that customer without undue delay and within 48 hours at the latest; the customer decides on the notification.

11. Your rights

You have the right of access, rectification, erasure, restriction and portability of your data, and you can object. If you have given consent for something, such as a review or your logo on our website, you can withdraw it at any time; we then remove the review or the logo from the website within five working days. Objection: where we rely on legitimate interest, you can always object on grounds relating to your particular situation; we then stop, unless compelling grounds require otherwise.

If your request concerns data in a customer's workspace, such as your account, projects or images, it goes through that customer (usually your employer); we will help with this. You can have your account deleted via your admin or via flowskraft.nl/account-verwijderen. You can also send a request to take images offline directly to us. For our own processing, email privacy@flowskraft.nl; we respond within one month. You can also lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) or with the supervisory authority in the country where you live or work.

12. Minors

Our service is intended for business users, not for children under 16. If we nevertheless unintentionally receive data from a child under 16, we delete it as soon as possible.

13. Changes

We may amend this notice. The current version is available at flowskraft.nl/privacy and can be opened from the Skraft app; in the portal, the owner of a workspace finds it under Company → Data & legal. When there is a new version, we ask the owner to read it. This notice is also available in Dutch and German; in case of differences, the Dutch text prevails. Last updated: 31 October 2026.