Privacy policy

FlowFlow France SAS places particular importance on protecting your personal data. This Privacy Policy explains what data we collect, why we use it, how long we retain it, and what rights you have, in accordance with Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act (Loi Informatique et Libertés).

1. Data Controller

The data controller is:

FlowFlow France SAS
2 rue de Verdun
78500 Sartrouville, France
Email: contact@flowflowfrance.com

2. Data Collected, Purposes and Legal Bases

We may process the following categories of data:

• Identification, contact and delivery data: name, postal address, email address and telephone number, for the purpose of processing and delivering Orders and providing customer service.
  Legal basis: performance of the contract.
• Payment data: payments are processed by our secure payment service providers. FlowFlow does not retain full bank card numbers.
  Legal basis: performance of the contract and compliance with our legal obligations.
• Account and customer service data: information relating to customer accounts, Orders and communications with our customer service team.
  Legal basis: performance of the contract and, where applicable, FlowFlow’s legitimate interest in managing customer relationships and ensuring the security of its services.
• Browsing and technical data: information relating to the use of the Site, including where cookies or other tracking technologies are used.
  Legal basis: consent where required, or legitimate interest for tracking technologies that may lawfully be used without consent.
• Data used for marketing purposes: email address and marketing preferences.
  Legal basis: consent where required or, where permitted by applicable law, FlowFlow’s legitimate interest.
  You may unsubscribe at any time using the link provided in our communications.

FlowFlow does not ask users to provide data relating to their health or sex life when placing an Order. We ask that you do not provide this type of information unless it is strictly necessary for us to process your request.

3. Retention Periods

Personal data is retained only for as long as necessary for the purposes for which it was collected.

In particular:

• data required to manage Orders and customer relationships is retained for the duration of the commercial relationship and may then be archived where necessary to comply with our legal obligations or defend our rights;
• invoices and accounting records are retained for 10 years, in accordance with applicable legal requirements;
• data used for marketing to prospective customers is retained for 3 years from the date of collection or the last contact initiated by the prospective customer;
• customer data used for marketing purposes may be retained for the duration of the commercial relationship and for 3 years after it ends.

4. Recipients of Personal Data

Your personal data may be shared only with persons and service providers who require it in order to provide their services, including:

• Shopify, for the operation of the online store;
• our logistics providers and carriers;
• our payment service providers;
• our email marketing, CRM and customer service providers;
• our technical, analytics or advertising service providers, where their use is permitted and, where applicable, after obtaining your consent;
• public authorities or other authorized bodies where required by law.

FlowFlow France SAS does not sell your personal data to third parties.

5. Cookies and Tracking Technologies

The Site uses cookies and other tracking technologies that are necessary for its operation and may also use, with your consent where required, audience measurement, personalization or advertising tools.

Non-essential cookies requiring your consent are placed only after you have given your consent.

You may accept, reject or change your choices at any time using the cookie management tool available on the Site.

Further information is available in our Cookie Policy.

6. Transfers of Personal Data Outside the European Economic Area

Some of our service providers, including Shopify or certain of their subprocessors, may process personal data outside the European Economic Area.

Where such transfers take place, they are governed in accordance with the GDPR, in particular by an adequacy decision of the European Commission, Binding Corporate Rules (BCRs), or Standard Contractual Clauses approved by the European Commission, depending on the applicable mechanism.

7. Your Rights

In accordance with the GDPR, and subject to the conditions provided for by applicable law, you have the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to data portability;
• right to object;
• right to withdraw your consent at any time where processing is based on your consent.

To exercise your rights, you may contact us at:

contact@flowflowfrance.com

Proof of identity may only be requested where necessary to verify your identity, in particular where there is reasonable doubt.

You may also lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), the French data protection authority.

8. Security

FlowFlow France SAS implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure.

Updates to this Privacy Policy

This Privacy Policy may be updated, in particular to reflect changes to our services, our service providers or applicable laws and regulations.

Last updated: September 2026