This Privacy Notice for Nexabyte Ltd (doing business as Flow) ('we', 'us', or 'our'), describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:

Visit our website at nexabyteflow.uk, or any website of ours that links to this Privacy Notice
Engage us for payment systems advice and implementation, temporary retail setup, or equipment hire
Engage with us in other related ways, such as asking about our services

Questions or concerns?

Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@nexabyteflow.uk.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by finding the section you are looking for below.

What personal information do we process?

When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information?

Some of the information may be considered 'special' or 'sensitive' in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.

Do we collect any information from third parties?

Stripe tells us when you've paid, been refunded or disputed a payment, with its reference. Resend tells us whether our emails reached you, and Cloudflare Turnstile tells us whether the hire form passed its automated abuse check.

How do we process your information?

We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so.

In what situations and with which parties do we share personal information?

We share information with the three suppliers that run our email, payments and hosting, and in the other situations set out in section 5.

How do we keep your information safe?

We have adequate organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

What are your rights?

Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.

How do you exercise your rights?

The easiest way to exercise your rights is by emailing us at info@nexabyteflow.uk. We'll consider and act on any request in accordance with applicable data protection laws.

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, ask us for a quote, book a hire, or otherwise contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

names
email addresses
business names
phone numbers
hire dates, venue and delivery details
the content of any message you send us

If you are enquiring about equipment hire, section 2 sets out exactly what we ask for and what we do with it.

Sensitive Information. We do not process sensitive information.

Payment Data. You pay our invoices on a secure page run by our payment provider, Stripe. Stripe collects and stores your card details; we never see or keep your full card number. We keep a record of each payment and refund: the amount, the date, how you paid and Stripe's reference. See Stripe's privacy notice at https://stripe.com/gb/privacy.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

2. HIRE AND QUOTE ENQUIRIES

In Short: If you ask us to quote for equipment hire, we use your details to prepare that quote and reply to you. We don't ask for account logins, ID documents or card numbers at this stage.

Hire isn't bought online. You send us an enquiry, we send back one itemised quote, and nothing is reserved or charged until you accept it. This section explains what happens to your information in between.

What we ask for

Our contact form asks for your name, email, optional business name and message. The hire-request journey also asks for:

your equipment, service, quantities, hire dates and venue details
your phone number and business name, if you choose to provide them
delivery, return, access and support requirements
if you use Help me choose, your answers about how you trade, payments, products, provider, connectivity and the help you need

We keep your original answers, the suggested setup and your final choices so we can understand and explain your request. The questionnaire follows set rules; a person reviews availability, feasibility and the quotation before making a commitment. Your free-text answers are not sent to product analytics.

Please include only information relevant to your request. For the hire form, we store a salted hash of the submitting IP address for abuse prevention, not the raw address. We also use Cloudflare Turnstile to help protect the form from automated abuse.

Why we use it

To understand what you need, price it, and send you a quote. To reply to you and answer anything you ask afterwards. If you accept the quote, the same details become part of your booking: we use them to take your payments, send and collect the equipment, refund your deposit and keep the records the law asks us to keep.

Our lawful basis

Steps prior to entering into a contract. You asked us for a quote, so we need your details to prepare one and get back to you. This covers the enquiry, the quote, and the conversation around it.
Performance of a contract. Once you accept a quote, we need your details to carry out the hire you've agreed: payments, delivery or collection, the return, your deposit and any refund.
Legal obligation. We keep booking, invoice, payment and refund records because accounting and tax law requires us to.
Legitimate interests. We rely on this to keep the form secure and free of spam, and to keep a record of the quotes we've sent. Our interest is running the business properly. It doesn't override your rights, because what's involved is ordinary business contact detail rather than anything sensitive.

Who else handles it

Three suppliers handle this information for us:

Resend delivers enquiry acknowledgements, owner alerts, our replies and quotations, and the emails about your booking and payments. It handles the recipient details and message contents needed for those emails. See their privacy policy.
Stripe issues our invoices, takes your payments and sends your refunds. We give it your name, business name and email address, with the booking and quote references, hire and dispatch dates, items and amounts for each invoice. You enter your payment details on Stripe's own payment page, so they go to Stripe, not us. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal duties. See their privacy policy.
Cloudflare hosts this website, stores hire enquiries, quotation revisions, bookings and correspondence records, and protects the owner portal. It also runs the analytics that count visits to our pages. The analytics don't use cookies, they don't follow you to other websites, and they have nothing to do with your enquiry. Turnstile, which checks the hire form for automated abuse, sees technical details from your browser such as your IP address, and Cloudflare also uses those to improve its bot detection. See their privacy policy.

Those are the only three. We don't sell your details and we don't pass them to advertisers or lead brokers.

How long we keep it

We retain open enquiries while we are working with you. Our normal retention period for closed hire enquiries, their quotations and correspondence in the owner portal is 24 months after closure. We review and remove records under that policy. Once you accept a quote, your acceptance, booking, invoices, payments and refunds are financial records. We keep them for at least six years after the end of the financial year they relate to, as UK accounting rules require, even if the enquiry is closed. Records about our own equipment, such as which unit went out on a hire and what it earned, can be kept for longer without your contact details. You can ask us to delete your details sooner; we remove what we can and tell you what we have to keep. Sending an enquiry does not add you to a marketing list.

What we never ask for at enquiry stage

To be plain about it, we do not ask for any of the following when you enquire or when we quote:

Merchant credentials. No usernames, passwords or logins for your SumUp, Square, PayPal, Shopify or any other provider account. That account is yours and it stays that way. If a hire goes ahead and setup work needs access, you sign in yourself, or you set us up as a limited user you can remove afterwards.
Identity documents. No passport, driving licence or proof of address. Your payment provider runs its own identity checks when you open an account with them, and that's between you and them.
Card details. No card numbers and no security codes. There's no payment step in an enquiry, so there's nothing to take payment for.

If something claiming to be from Flow asks you for any of these at enquiry stage, it isn't us. Please tell us at info@nexabyteflow.uk.

Seeing or deleting what we hold

Email info@nexabyteflow.uk and tell us what you want. You can ask for a copy of what we hold about you, ask us to correct something that's wrong, or ask us to delete it. You can use the contact form instead, though email is easier if you want your own record of the request. We'll reply within one month, and there's no charge.

3. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To deliver the services you've asked for. We may process your information to provide you with the requested service.
To reply to your enquiries and support you. We may process your information to respond to your enquiries and solve any potential issues you might have with the requested service.
To send administrative information to you. We may process your information to send you updates about your enquiry or booking, and changes to our terms and policies.
To keep our forms secure. We may process your information to protect our forms from spam and automated abuse.
To meet our legal obligations. We may keep booking, invoice, payment and refund records because accounting and tax law requires us to.
To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

4. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e. legal basis) to do so under applicable law, such as to comply with laws, to provide you with services to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
Legitimate Interests. We may process your information where it is necessary for our legitimate business interests, such as keeping our forms secure and free of spam and keeping a record of the quotes we've sent, and those interests don't override your rights. Section 2 explains how this applies to hire enquiries.
Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

5. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

Service Providers. We use Resend to deliver our emails, Stripe to issue our invoices, take payments and send refunds, and Cloudflare to host this website, store enquiry and booking records, protect our hire form and count page visits. Section 2 sets out what each one receives. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal duties, and Cloudflare uses its form checks to improve its bot detection. They are the only three.
Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Enquiries, quotes and bookings are covered by the retention approach in section 2.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

8. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18. If we learn that personal information from users less than 18 years of age has been collected, we will take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at info@nexabyteflow.uk.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: In some regions, such as the European Economic Area (EEA), United Kingdom (UK), and Switzerland, you have rights that allow you greater access to and control over your personal information.

In some regions (like the EEA, UK, and Switzerland), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below.

We will consider and act upon any request in accordance with applicable data protection laws. If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

If you have questions or comments about your privacy rights, you may email us at info@nexabyteflow.uk.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

11. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated 'Last updated' date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at info@nexabyteflow.uk.

13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact us at info@nexabyteflow.uk.

PRIVACY POLICY