Privacy Policy

1. Controller

KOMUNIQUE by Philipp Roth
Blumenrainstrasse 29, 9050 Appenzell, Switzerland
Email: support@flowtifyy.com

2. What data we collect

2.1 Registration and account data

Upon registration: name, email address, password (encrypted), shop name and shop URL.

2.2 Shop and transaction data

During use: product data, order data, customer data of your end customers (name, email, delivery address), and payment information (depending on the payment method, via Stripe, Payrexx or PayPal).

2.3 Usage data

Technical data such as IP address, browser type, access times and pages visited are recorded in server logs.

2.4 Cookies

We use technically necessary cookies only (session cookie fi_session, language preference fi_lang). No tracking or advertising cookies are used.

3. Legal basis for processing

Processing is based on the GDPR and, additionally, the Swiss Data Protection Act (DSG/FADP):

• Contract performance (Art. 6(1)(b) GDPR / Art. 31(2)(a) DSG): Registration, account management, service delivery
• Legitimate interests (Art. 6(1)(f) GDPR / Art. 31(1) DSG): Operational security, fraud prevention, product improvement
• Legal obligation (Art. 6(1)(c) GDPR / Art. 31(2)(c) DSG): Retention obligations
• Consent (Art. 6(1)(a) GDPR / Art. 31(1) DSG): Where explicitly obtained

4. Hosting and data location

The Flowtifyy platform and database are hosted via an external cloud infrastructure provider in the USA. The infrastructure is operated in compliance with the GDPR and the Swiss DSG (FADP), and uses Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR and corresponding guarantees under Swiss DSG. A data processing agreement (DPA) is in place with KOMUNIQUE. Your data is therefore transferred to and processed in the USA on a lawful basis. The full list of sub-processors is available at /legal/providers.

5. Third parties and processors

We have data processing agreements (DPAs) pursuant to Art. 28 GDPR and Art. 9 DSG in place with all processors. The complete list of sub-processors (including hosting infrastructure) is available at /legal/providers. The key payment and communication providers are listed below:

6. Retention periods

• Account data: For the duration of the contractual relationship plus statutory retention periods (generally 10 years)
• Order data: 10 years (commercial law retention obligation)
• Server logs: 30 days
• Cookies: Session cookies until browser is closed; preference cookies max. 1 year

7. Your rights

You have the following rights regarding your personal data (under GDPR and Swiss DSG/FADP):

• Access (Art. 15 GDPR / Art. 25 DSG): Copy of your stored data
• Rectification (Art. 16 GDPR / Art. 32 DSG): Correction of inaccurate data
• Erasure (Art. 17 GDPR / Art. 32 DSG): Deletion where no retention obligations apply
• Restriction (Art. 18 GDPR): Restriction of processing
• Data portability (Art. 20 GDPR / Art. 28 DSG): Export of your data
• Objection (Art. 21 GDPR): Objection to legitimate interests
• Complaint: To the competent supervisory authority (Switzerland: FDPIC/EDÖB)

To exercise your rights: support@flowtifyy.com

8. Data processing by Flowtifyy customers

Where you as a Flowtifyy customer process personal data of your end customers via the platform, you are the data controller under the GDPR and Swiss DSG. Flowtifyy acts as a processor. A data processing agreement (DPA) pursuant to Art. 28 GDPR and Art. 9 DSG can be requested at support@flowtifyy.com.

9. Security

• TLS/HTTPS encryption of all connections
• Bcrypt password hashing
• JWT-based authentication with httpOnly cookies
• Regular security updates
• Access restrictions on sensitive data

10. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy. The current version is always available at app.flowtifyy.com/datenschutz. Registered users will be informed by email of any material changes.