Privacy Policy

1. Who we are

Spirit Flow is the controller responsible for the personal data described in this Privacy Policy, unless a separate agreement states that we act as a processor on behalf of a client. If you have questions about this Policy or wish to exercise your rights, you can contact us through the contact details or contact form published on this website.

2. Scope of this Policy

This Policy applies to personal data processed when you visit our website, request information, communicate with us, subscribe to updates, become a client, apply to work with us, or otherwise interact with Spirit Flow. It does not apply to third-party websites, services, or platforms that have their own privacy notices.

3. Personal data we may collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity and contact data, such as your name, company, role, email address, phone number, and business address.

• Communication data, such as messages, enquiries, feedback, meeting notes, support requests, and preferences.

• Project and service data, such as requirements, content, files, credentials you choose to share, approvals, invoices, and contractual information.

• Technical and usage data, such as IP address, device information, browser type, pages visited, referral source, approximate location, session data, and cookie identifiers.

• Marketing data, such as newsletter preferences, consent records, event registrations, campaign interactions, and opt-out choices.

4. How we collect personal data

We collect personal data directly from you when you complete a form, send an email, book a call, sign an agreement, or provide information during a project. We may also collect technical data automatically through cookies, analytics tools, server logs, and similar technologies. Where appropriate, we may receive business contact information from public sources, referrals, partners, or professional networks.

5. Lawful bases for processing

Under the GDPR, we only process personal data where we have a lawful basis. Depending on the context, this may include performance of a contract, steps taken before entering into a contract, compliance with legal obligations, our legitimate interests, your consent, or protection of vital interests where required by law.

Our legitimate interests may include operating and improving our website, responding to enquiries, developing and delivering services, protecting our business, preventing misuse, maintaining records, and communicating with existing or prospective clients in a proportionate and privacy-respecting way.

6. Why we use personal data

We may use personal data to provide and manage our services, respond to enquiries, prepare proposals, administer contracts, communicate about projects, process payments, maintain business records, improve our website, measure performance, ensure security, comply with legal duties, resolve disputes, and send marketing communications where permitted.