Fleksi.io - Privacy Notice

1. Who is responsible for the data?

Fleksi.io is a software service operated from Finland. The current operator of the Service determines how personal data described in this Notice are used and is responsible for that processing.

Privacy questions and requests can be submitted through the contact form on Fleksi.io.

2. Scope and roles

This Notice describes processing when a person:

visits a Fleksi public website;
contacts Fleksi or creates a Fleksi workspace;
creates or administers a Fleksi account;
represents a prospective customer, supplier or business partner; or
receives service, security or business communications.

For these activities, Fleksi determines the purposes and means of processing.

An organisation may also store personal data in its own Fleksi workspace. The organisation then generally decides why and how that data is processed and acts as controller, with Fleksi processing Customer Data on its behalf. That relationship is described in this overview and in a Data Processing Agreement agreed in writing with the customer.

3. Data processed

Depending on the interaction, Fleksi may process:

name, employer, role, business address, email address and telephone number;
organisation, workspace, user role, authentication and access information, language and other preferences;
workspace use, communications and support history;
contact-form subject, message and other information chosen by the sender;
invoicing, tax and payment-status information related to an agreed paid order;
IP address, device and browser information, timestamps, session and event logs, diagnostic information and suspected misuse;
cookie choices and, with consent where required, page use, interactions, campaign attribution and session analytics; and
business information lawfully received from an organisation's representatives, public business sources or partners.

Sensitive personal data, production credentials or confidential production content should not be submitted through public forms.

4. Purposes and legal bases

Fleksi processes personal data to:

provide a requested website, account or Service and take steps requested before a possible contract;
respond to enquiries, arrange demonstrations and manage business relationships;
authenticate users, prevent abuse, investigate incidents and secure the Service;
operate, troubleshoot and improve the Service;
meet accounting and other statutory duties;
measure optional website analytics and advertising after the required consent;
send relevant service information and appropriate B2B product communications; and
establish, exercise or defend legal claims.

The legal bases are:

performance of a contract or steps requested before a contract;
compliance with legal obligations;
Fleksi's legitimate interests in customer service, operating and improving the Service, protecting users and systems, appropriate B2B communications and protecting legal rights; and
consent for optional analytics, advertising or other processing where consent is required.

When relying on legitimate interests, Fleksi considers the purpose, necessity and impact on the individual. A person may object as described below.

Optional analytics and advertising are not activated before the required consent. Consent may be withdrawn at any time.

5. Sources

Data are received:

directly from the individual;
from the organisation the individual represents;
automatically from the device and use of the website or Service;
from an integration or provider chosen by the organisation; and
from lawful public business sources and business partners.

6. Required information

Information marked as required is needed to process a request, prevent abuse, create an account or provide the relevant function. Without it, Fleksi may be unable to respond or provide access. Optional information may be left blank.

7. Recipients and service providers

Access is limited to people and providers who need personal data for the described purpose. They may include:

Fleksi personnel and professional advisers subject to confidentiality;
hosting, infrastructure, security, communications, support and backup providers;
Cloudflare Turnstile for protection of signup and contact forms;
Apple iCloud for the current delivery of contact messages;
Google-hosted fonts and icons on public pages;
Smartlook for optional website session analytics;
Meta and Google for optional advertising measurement; and
authorities or transaction parties where required by law or necessary for a genuine corporate transaction under appropriate safeguards.

The list is kept up to date. Fleksi does not sell personal data.

8. Processing locations and international transfers

Fleksi aims to keep core Customer Data in the region stated for the Service. Website, security, support, email and supplier data may be processed in countries where the listed providers operate.

If personal data are transferred outside the European Economic Area, Fleksi will use a lawful transfer mechanism where required, such as an adequacy decision or the European Commission's standard contractual clauses, together with supplementary safeguards where appropriate.

Fleksi does not currently promise that every website, support, email, telemetry and backup operation takes place only in the European Union.

9. Retention

Personal data are kept only as long as needed for the stated purpose and for legal, accounting, security and claim requirements.

Account and relationship information is kept for the relationship and thereafter as reasonably needed for legal claims and statutory records.
Enquiries that do not lead to an ongoing relationship are normally removed within 24 months of the last meaningful interaction.
Routine security and diagnostic logs are normally kept for no longer than 12 months unless needed to investigate an incident or protect legal rights.
Accounting records are retained for the period required by law.
Cookie choices and optional analytics data follow the periods described in the Cookie Notice and the relevant tool settings.
Customer Data follow the Service's exit and deletion process.

Protected backups may contain residual copies until they are overwritten in the normal backup cycle. Data may be kept longer where law requires it, a dispute is ongoing or evidence must be preserved.

10. Security

Fleksi uses safeguards appropriate to the risks, including access controls, confidentiality duties, secure development and maintenance, monitoring, backups and incident-management practices. Safeguards are reviewed as the Service and risks develop.

Customers are responsible for their users, permissions, devices, integrations and exported copies. No system can be promised completely secure.

11. Individual rights

Subject to the GDPR and its limitations, a person may have the right to:

access their personal data;
correct inaccurate or incomplete data;
request erasure;
restrict processing;
receive data they provided in a portable format;
object to legitimate-interest processing and direct marketing;
withdraw consent; and
lodge a complaint with a supervisory authority.

A request can be submitted through the contact form on Fleksi.io. Fleksi may need to verify identity and clarify the request. If Fleksi holds the data only for a customer organisation, the request may be directed to that organisation.

The Finnish supervisory authority is the Office of the Data Protection Ombudsman: https://tietosuoja.fi/en/home

12. Direct marketing

A person may opt out of direct marketing at any time using the link in the message or the contact form. A minimal suppression record may be retained to respect the choice.

13. Automated decisions and children

Fleksi does not use public-site or business-contact data to make solely automated decisions that have legal or similarly significant effects.

The Service is intended for organisations and authorised business users, not for children acting on their own behalf. Public forms should not be used to submit information about children.

14. Changes and contact

This Notice may be updated when the Service, suppliers or law changes. The new version and date will be published, and an additional notice will be given if a change materially affects individuals.