Legal
Privacy policy
Last updated: 15 October 2026
24Flow BV takes the privacy of its customers, prospects and website visitors seriously. This policy explains which personal data we collect, why we use it, who we share it with, how long we keep it and which rights you have.
Who we are
This website (24flow.eu) is operated by 24Flow BV, a Belgian private limited company with company number BE 0711 846 178 and its registered office at Kruisboogstraat 6, 9000 Ghent, Belgium. Our office is at Dublinstraat 31/010, 9000 Ghent, Belgium. 24Flow BV is the controller of the personal data described in this policy.
For anything about your personal data, contact us at privacy@24flow.eu or by post at 24Flow BV, Dublinstraat 31/010, 9000 Ghent, Belgium. For other questions: info@24flow.eu, +32 9 396 91 71.
Scope
This policy covers the personal data we process through our website, our forms, emails, webinars and events, and in our contacts with customers, prospects, partners and job applicants. We comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
This policy does not cover the data our customers process in the 24Flow platform. For that data the customer is the controller and 24Flow acts as its processor under the customer agreement.
What personal data we collect
You do not have to give us personal data to use most of our website.
Data you give us:
- Name, job title, company, business email address and phone number;
- What you tell us in a form, an email, a call or at an event, for example your question or your interest in a demo;
- Registration and attendance for our webinars and events;
- For customers: contract, billing and invoicing details, and the names and business contact details of the people we work with at the customer;
- If you apply for a job: your CV, cover letter and what you tell us during the selection process.
Data we collect when you use our website:
- Without cookies: the pages you view, clicks, the website you came from, browser, device type, approximate country and the time of your visit. This is collected without storing your IP address and cannot be linked to you (see “Website analytics and marketing tools”).
- With cookies, only after your consent: see “Website analytics and marketing tools” and our cookie policy.
- Technical logs at our hosting provider: IP address, time, requested page and browser, used to keep the site secure and running.
Data from other sources:
- Publicly available business information, such as your company’s website, the company register and professional profiles such as LinkedIn, to check and complete the data of business contacts;
- Apollo.io: the company a website visit comes from, and business contact details from Apollo’s database.
We may record video or phone calls to take notes and for quality and training purposes. We only do so when we tell you at the start of the call and you do not object.
We do not ask for special categories of personal data (such as health data). Our website is meant for businesses and is not intended for children.
Why we use your data and on what legal basis
| Purpose | Legal basis (art. 6(1) GDPR) |
|---|---|
| Answer your question, demo request or contact request, and follow up on it | Steps you ask for before a contract (b), and our legitimate interest in answering business enquiries (f) |
| Deliver our products and services, manage the customer relationship, give support and invoice | Performance of a contract (b) |
| Keep accounting and tax records and meet other legal obligations | Legal obligation (c) |
| Send newsletters and marketing emails about our products, webinars and events | Your consent (a). For contacts at existing customers, our legitimate interest (f) for similar products and services. Every email has an unsubscribe link |
| Find and contact companies that may need our software, including prospect research and Apollo.io company identification | Legitimate interest (f): business development towards companies. You can object at any time |
| Cookieless website analytics (PostHog) and Google Search Console | Legitimate interest (f): understand and improve our website |
| Analytics and marketing cookies (Google Analytics, Microsoft Clarity, Pardot tracking, Apollo.io tracker) | Your consent (a), given in the cookie banner |
| Keep our website and systems secure and prevent fraud and misuse | Legitimate interest (f) |
| Recruitment | Steps before an employment contract (b); your consent (a) if we keep your application for future vacancies |
| Establish or defend legal claims, and a sale or merger of our business | Legitimate interest (f) |
Where we rely on our legitimate interest, we have weighed it against your interests and you can object (see “Your rights”).
Website analytics and marketing tools
- PostHog (PostHog Inc., data hosted in the EU in Frankfurt): cookieless website analytics. PostHog sets no cookies and does not store your IP address. Page views and clicks are counted with an anonymous identifier that changes every day, so we cannot recognize you on a later visit. We use the results only as totals. When you send a form, we record that a form was sent, not what you typed in it.
- Google Analytics (Google Ireland Limited): website statistics with cookies, only after you accept analytics cookies. IP addresses are not logged or stored by Google Analytics 4.
- Microsoft Clarity (Microsoft Corporation): heatmaps and session recordings that show how visitors scroll and click on our pages, with cookies, only after you accept analytics cookies. Clarity masks the text you type in form fields.
- Salesforce Marketing Cloud Account Engagement, also called Pardot (Salesforce, Inc.): our marketing automation. Once you have filled in a form or clicked a link in one of our emails, Pardot links your later visits to your contact record so our team can follow up. With cookies, only after you accept marketing cookies. Our marketing emails contain a small image and tracked links, so we can see whether an email was opened and which links were clicked.
- Apollo.io (ZenLeads Inc., trading as Apollo.io): identifies the company a website visit comes from, based on the IP address, so our sales team knows which companies show interest. Only after you accept marketing cookies.
- Google Search Console (Google): reports the search terms that bring visitors to our site. It uses Google’s own search data; we receive only totals per search term and page.
Who we share your data with
We share personal data only when needed:
- With service providers that process data on our behalf and under our instructions (processors), under a data processing agreement:
- Salesforce, Inc. (customer relationship management and Marketing Cloud Account Engagement, also called Pardot);
- Google Ireland Limited and Google LLC (Google Analytics, Google Tag Manager, Google Search Console, and Google Workspace for email and documents);
- Microsoft Corporation (Microsoft Clarity);
- PostHog Inc. (website analytics, hosted in the EU);
- ZenLeads Inc., trading as Apollo.io (sales intelligence);
- Combell NV, Belgium (website hosting);
- Livestorm SAS, France (webinar registration and hosting).
- With a third party you ask us to share your data with.
- With authorities, courts or advisers, when the law requires it or to establish, exercise or defend legal claims, or to protect our rights, property or safety and that of others.
- If our business is sold or merged: with the buyer and its advisers, under confidentiality. Your data stays subject to this policy.
We do not sell or rent your personal data.
Transfers outside the European Economic Area
Some of our service providers are based in the United States or may access data from there:
- Salesforce, Inc., Google LLC, Microsoft Corporation and ZenLeads Inc. (Apollo.io) are certified under the EU-US Data Privacy Framework. Transfers to them rely on the European Commission’s adequacy decision of 10 July 2023. Their contracts with us also include the European Commission’s standard contractual clauses.
- PostHog stores our data in the EU (Frankfurt). Where PostHog Inc. staff in the United States can access it, for example for support, the standard contractual clauses apply.
- Combell (Belgium) and Livestorm (France) process data within the EU.
You can ask us for a copy of the safeguards that apply, using the contact details above.
Cookies and similar technologies
We use cookies and similar technologies on our website. Which ones, why, for how long, and how you give or withdraw consent is explained in our cookie policy. Analytics and marketing cookies are only set after your consent.
How long we keep your data
| Data | How long |
|---|---|
| Enquiries, demo requests and prospect data (Salesforce, Pardot) | As long as we are in contact. Deleted or anonymized 3 years after your last interaction with us (a form, an email reply, a click, a meeting) |
| Unsubscribe and objection requests | Your email address stays on our do-not-contact list for as long as we send marketing emails, so we do not contact you again |
| Customer and contract data | For the duration of the contract and 10 years after it ends (the Belgian limitation period for contractual claims) |
| Accounting and tax documents | As long as Belgian accounting and tax law requires (currently 10 years) |
| Job applications | Deleted 6 months after the selection process ends, or kept 2 years with your consent for future vacancies |
| Call recordings | 12 months |
| Google Analytics | 14 months, then deleted automatically |
| Microsoft Clarity | Session recordings 30 days; heatmaps and click data 13 months |
| PostHog (cookieless, does not identify you) | Up to 7 years, as totals for trend reporting |
| Apollo.io website visit data | At most 2 years |
| Technical server logs (hosting) | At most 3 months |
| Cookies on your device | See the cookie policy |
Your rights
Under the GDPR you have the following rights over your personal data:
- Access: you can ask whether we process your data and get a copy.
- Correction: you can ask us to correct or complete data that is wrong, outdated or incomplete.
- Erasure: you can ask us to delete your data, for example when we no longer need it for the purpose we collected it for. This is also called the “right to be forgotten”.
- Restriction: you can ask us to temporarily limit the use of your data, for example while we check a correction you asked for.
- Data portability: you can ask to receive the data you gave us in a structured, commonly used and machine-readable format, or to have it sent to another controller.
- Objection: you can object to processing based on our legitimate interest. You can object to direct marketing at any time, without giving a reason; every marketing email has an unsubscribe link.
- Withdraw consent: where we rely on your consent, you can withdraw it at any time, for cookies through “Cookie settings” at the bottom of every page. This does not affect what we did before you withdrew it.
- Automated decisions: we do not take decisions about you based solely on automated processing that have legal or similarly significant effects for you.
To use your rights, email privacy@24flow.eu or write to 24Flow BV, Dublinstraat 31/010, 9000 Ghent, Belgium. We may ask you to prove your identity, so we only give data to the right person. We answer within one month; for complex requests this can be extended by two more months, in which case we tell you why. In some cases the law allows us to refuse or limit a request; if so, we explain why.
You have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, +32 2 274 48 00, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be, or with the data protection authority in the EU country where you live or work.
Security
We take appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Access is limited to the people who need it for their work. No system on the internet is fully secure, so we cannot guarantee that unauthorized third parties will never get past these measures.
Links to other websites
Our website links to other websites, such as LinkedIn and YouTube. We are not responsible for their content or their privacy practices. Please read their privacy policies before you share data with them.
Changes to this policy
We may update this policy when our processing changes. The new version is published on this page and applies from the date at the top. Please check this page from time to time.