1. Who we are and our role

FlowDocs is a business-to-business ticketing, workflow and document-management service delivered through Microsoft Teams. Depending on the context, FlowDocs acts:

(a) as a data Processor on behalf of business customers, for Customer Personal Data processed to deliver the Services — this processing is governed by the FlowDocs Data Processing Addendum (https://flowdocs.co/dpa) and the Master SaaS Terms (https://flowdocs.co/terms); and

(b) as an independent Controller for our own website, contracting, account, security, support and marketing activities. This Privacy Policy describes that controller processing. It applies to all promotional and marketing campaigns operated by FlowDocs, current and future; campaign-specific rules are set out in the applicable campaign terms (for example, https://flowdocs.co/uae-terms).

2. Data we collect

Business identity and contact data: name, business email, job title, company, licence details where verification is required, and optional phone number.

Account and tenant identifiers: Microsoft Entra ID (Azure AD) identifiers, tenant ID, Workspace ID, authentication events.

Service content: tickets, documents, forms, approvals, messages, comments and attachments submitted to the Services (processed as Processor on the Customer’s instructions).

Technical and usage data: IP address, device and browser data, configuration, usage, security and audit logs.

Support chat content: what you choose to write in the support chat (Crisp), if you open it.

Marketing data: product news and offer preferences, consent records, campaign source (UTM) and suppression-list status.

3. Where data is hosted and who processes it

Customer data is hosted in Microsoft Azure, UAE North region. Database backups are kept for 14 days locally and 30 days in UAE North storage. Leads submitted through the website are stored in FlowDocs’ own database in the UAE.

We engage a limited set of subprocessors, listed with purposes and locations in our public subprocessor register at https://flowdocs.co/subprocessors As of this version these are: Microsoft (Azure hosting, Teams platform, Entra authentication, marketplace billing — UAE North and your Microsoft 365 tenant region); Twilio SendGrid (transactional and service email — United States); HubSpot (CRM and marketing systems for our marketing website); Zapier (workflow integrations, only where the Customer connects them — United States); and Crisp (support chat — European Union, France). We do not use Amazon, Google, Stripe or AI services to process customer data.

Where data is transferred internationally, we use the safeguards described in Section 10 of the DPA, including the UAE PDPL transfer grounds and, for restricted transfers, the 2021 EU Standard Contractual Clauses.

4. Retention

Account and billing data are retained while your account is active and thereafter as required by law. For promotional workspaces (for example, the “Made in the UAE” offer): access lasts twelve months from activation; the workspace then enters Read-Only Mode for ninety days, after which the workspace and its data are deleted in accordance with Section 9 of the DPA, and backups are purged on documented cycles (14 days local / 30 days UAE North). Security and audit logs are retained under documented cycles and deleted or de-identified when the applicable period ends.

5. Security

We maintain risk-appropriate technical and organisational measures, including encryption in transit, encryption at rest through the hosting platform, role-based least-privilege access, environment and tenant separation, logging and monitoring, vulnerability and change management, backup and recovery controls, incident-response procedures and subprocessor due diligence, as described in Section 4 of the DPA.

6. Marketing and your choices

Accepting our terms is never marketing consent. We send product news and offers only with a separate, optional opt-in, recorded with date, source and scope. Channel-specific consent is obtained before marketing calls, SMS or social-messaging outreach, in line with UAE telemarketing rules (Cabinet Resolution No. 56 of 2024), including Do-Not-Connect-Register screening. You may withdraw consent at any time free of charge: automated unsubscribe takes effect immediately, other requests without undue delay. Withdrawal never affects essential service notices (security, expiry, legal).

7. Your rights

Depending on your jurisdiction (including UAE PDPL and GDPR), you may request access, correction, deletion, portability, restriction or object to processing, and withdraw consent. Organisation-level requests must be made by an authenticated Admin. Contact support@flowdocs.co; we respond within one to two UAE business days (target, not a service level). You may also complain to the UAE Data Office or your local supervisory authority.

8. Cookies

We use the minimum cookies required for the website to function. We do not use third-party advertising trackers or analytics services such as Google Analytics.

9. Business service only

FlowDocs is offered exclusively to businesses. The Services are not directed at individuals acting for personal, family or household purposes, and we do not knowingly collect data from children.

10. Changes to this Policy

Material changes will be notified to registered administrators by email at least fourteen days before taking effect, and published here with an updated revision date. Previous versions are archived.

11. Contact

FlowDocs is a product of FlowBe FZE (SRTIP Licence 4157, Sharjah Research Technology and Innovation Park, Sharjah, United Arab Emirates). FlowDocs is a trade name of FlowBe FZE; the contracting party is FlowBe FZE.

FlowBe FZE, SRTIP Licence 4157, Sharjah Research Technology and Innovation Park, Block B-B21-121, Sharjah, United Arab Emirates. Privacy: support@flowdocs.co. Legal notices: admin@flowdocs.co.