Privacy Policy & Cookie Statement

1. Introduction & Data Controller

Welcome to GenFlow Digital ("we," "our," or "us"). We operate genflowdigital.com and provide professional custom AI automation workflows, high-performance web development, and digital marketing consulting services.

Under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR), GenFlow Digital acts as the Data Controller for any personal data collected directly through this website or during exploratory consultation communications.

We treat your privacy with the utmost seriousness, adhering to strict data minimization, privacy-by-design, and zero-monetization principles.

2. Lawful Basis for Processing (GDPR Article 6)

We only collect and process personal data when we have a verified legal basis under data protection laws:

3. Information We Collect

We collect information in two distinct manners:

• Directly Provided Information: When you complete our contact or demo request forms, we collect your full name, organization name, work or personal email address, phone number (if provided), project goals, and timeline requirements.
• Automated Technical Data: When browsing our pages, our edge infrastructure logs essential network telemetry (browser user agent, timestamp, referring URL, and IP address for geolocation security and bot detection).
• Client Confidential Data: For active client engagements, any API keys, workflow credentials, or business process schemas provided to us are handled under strict non-disclosure terms.

4. Cookie Policy & Tracking Technologies

In compliance with the Privacy and Electronic Communications Regulations (PECR) and GDPR, we inform you clearly about the cookies and browser storage mechanisms we utilize.

You can modify or withdraw your cookie consent at any moment by clicking the "Cookie Preferences" button in our website footer or by clearing your browser cookies.

5. Third-Party Infrastructure & International Transfers

To guarantee enterprise-grade availability and security, we partner with industry-leading infrastructure sub-processors:

• Vercel Inc. (United States & Global Edge): Hosts our Next.js application on their globally distributed edge network. Compliant with the EU-U.S. and UK-U.S. Data Privacy Framework.
• Resend Inc. (United States): Dispatches transactional email inquiries submitted via our contact forms. Protected via Standard Contractual Clauses (SCCs) and end-to-end TLS encryption.
• Google Cloud / Google Workspace: Inbound client communications routing.

Where data is processed outside the United Kingdom or European Economic Area, we ensure appropriate safeguards including the UK International Data Transfer Addendum and European Commission Standard Contractual Clauses (SCCs) are in effect.

6. Data Security & Retention

We enforce multi-layered security measures to protect your submissions against interception, injection, or unauthorized exposure:

• Transport Layer Security (TLS 1.3): Strict HTTPS encryption across all web traffic with 2-year HSTS enforcement.
• Input Sanitization: Server-side sanitization of form submissions preventing Cross-Site Scripting (XSS) and header injections.
• Security Headers: Strict Content Security Policy (CSP), X-Frame-Options: DENY (clickjacking defense), and Permissions Policy restrictions.
• Retention Timelines: Client inquiry data is retained only for as long as necessary to address your service request, provide project estimates, or satisfy tax and legal record-keeping obligations. Inactive inquiries are purged after 12 months.

7. Your Legal Privacy Rights

Under the UK GDPR, EU GDPR, and applicable US state privacy laws (including California CCPA/CPRA), you have enforceable rights regarding your personal data:

• Right of Access: Request a copy of all personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your inquiry details.
• Right to Restriction & Objection: Object to processing based on legitimate interests.
• Right to Data Portability: Obtain your data in a structured, machine-readable format.
• Right to Non-Discrimination: We will never deny services, charge different rates, or provide degraded service for exercising your privacy rights.

To exercise any of these rights, email us directly at hello@genflowdigital.com. We respond to all verified data subject requests within 30 days free of charge.

8. Right to Lodge a Complaint

If you believe our processing of your personal data infringes applicable data protection legislation, you have the right to lodge a formal complaint with your relevant supervisory authority:

• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• European Union: Your national Data Protection Authority (DPA) under the European Data Protection Board.