GDPR Statement

About this statement #

This statement applies where the EU General Data Protection Regulation, or the UK GDPR, applies to how FLOW FN PTE. LTD. (UEN 202617303Z), a company incorporated in Singapore processes your personal data. It supplements our Privacy Notice. For data a customer controls - its content and its team - see the Data Processing Addendum: the customer is the controller and we are its processor.

Our legal bases #

• Contract: to create your account, provide the Service, and take payment for it.
• Legitimate interests: to keep the Service and its users secure, prevent abuse, fix errors, keep records of who did what in an organization, and defend legal claims. We have weighed these against your interests, and you may object.
• Legal obligation: to keep accounting records and answer lawful requests.
• Consent: for anything we ask your consent for, such as marketing email. You can withdraw it at any time.

Your rights #

You have the right to access your personal data, to have it corrected, to have it erased, to restrict how we use it, to receive it in a portable form, and to object to processing based on our legitimate interests. We do not make decisions about you by automated means that have legal or similarly significant effects.

Write to privacy@nayto.io or use our privacy request form. We may ask you to confirm who you are, and we answer within one month, or within three months for a complex request, in which case we will tell you within the first month.

Transfers #

We are in Singapore and the Service is hosted there. Singapore does not have an adequacy decision from the European Commission or the UK, so where personal data comes to us from the EEA or the UK, we rely on the European Commission's standard contractual clauses and the UK's addendum to them. For customers, they are incorporated into our Data Processing Addendum. Our subprocessors outside Singapore are bound by the same clauses where they apply. You can ask us for a copy at privacy@nayto.io.

Retention and security #

We keep personal data for the periods in our Data Retention Schedule, and protect it as our Security page describes. If a breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours of becoming aware of it, and you without undue delay where the risk is high.

Representative and data protection officer #

Our data protection officer can be reached at dpo@nayto.io. We have not appointed a representative in the EU or the UK. If the law comes to require one, we will appoint one and name them here.

Complaints #

You may complain to the data protection supervisory authority where you live or work, or where you think the law was broken. The European Data Protection Board lists the authorities in each EEA country; in the UK it is the Information Commissioner's Office. We would like the chance to put things right first, so please write to us too.

How this document changes #

Every version of this document has a number and the date it applies from, both printed under the title. A change is published as a new version rather than an edit to this one, so what the document said on any day can be checked.

When a change matters to what you have agreed or to how we use your data, we tell you before it takes effect. Earlier versions are available from legal@nayto.io.