Privacy

Flow Labs Consultancy FZCO, trading as Discflow, is responsible for the personal data described here.

Personal data is stored in the EU, on Amazon Web Services in Frankfurt, Germany. FlowConnect’s AI processing runs in Sweden.

Nothing you or your people put into Discflow is used to train AI models.

We do not sell, rent or trade personal data.

Our free online quizzes do not store your answers or results.

To ask about your data or exercise your rights, email privacy@discflow.co.

This Privacy Policy explains how Flow Labs Consultancy FZCO (“Discflow”, “we”, “us” or “our”) collects, uses, shares, stores and protects personal data when you visit our website, contact us, take one of our free online quizzes, or use our assessment services and FlowConnect.

We are a company established in the United Arab Emirates. Our registered office is IFZA Business Park, 36387-001, Dubai Silicon Oasis, Dubai, United Arab Emirates. Company registration number DSO-FZCO-34306.

This Policy is written to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where they apply to our processing, the EU General Data Protection Regulation and the UK General Data Protection Regulation.

It matters who is responsible for your data, because that is who you should contact about it.

We are the controller for personal data we collect through our website, our free quizzes, enquiries, marketing, and our direct relationships with customers, partners and practitioners.

When an organization asks you to complete a Discflow assessment, that organization usually decides why your data is processed and who sees the results. In that case the organization is the controller and we process your data on its behalf, under a data processing agreement. Requests about that data are best sent to the organization, and we will help them respond.

Identity and contact information, such as your name, email address, telephone number, employer and job title.

Account information, such as login details, account identifiers and the services you use.

Assessment information: your responses to assessment questions and the behavioral and Emotional Intelligence profiles and reports produced from them.

FlowConnect information: the questions you ask, the situations you describe and the reflections you record, together with the guidance produced for you.

Information you choose to give us, such as feedback, correspondence and the content of enquiries.

Technical information, such as IP address, browser and device type, and pages visited, used to keep the website secure and working.

Our assessments are not designed to collect special category data, such as information about health, ethnicity or religious belief. Please do not include it in free-text answers or FlowConnect conversations.

Directly from you; from the organization that asked you to complete an assessment; from an authorized Discflow partner or practitioner working with that organization; or automatically when you use our website and services.

Where the law requires a legal basis for processing, these are the ones we rely on.

Providing assessments, reports and FlowConnect to customers and their participants: performance of a contract, or the instructions of the organization we act for.

Managing accounts, authentication and customer support: performance of a contract.

Responding to enquiries and quiz requests: steps you ask us to take, or our legitimate interest in responding.

Keeping our website and services secure, and preventing misuse: our legitimate interests.

Improving our products, including maintaining assessment norms using anonymized data: our legitimate interests.

Sending marketing: your consent, or our legitimate interests where the law permits for business contacts. You can opt out at any time.

Meeting legal, tax and regulatory obligations: legal obligation.

Where we rely on consent, you can withdraw it at any time. This does not affect processing that took place before you withdrew it.

Our free quizzes calculate your result in your browser. We do not store your answers or your result. If you give us your first name and email address to see your result, we store those details and which quiz you took, so that we can send you your result and related information. You can ask us to delete them at any time.

Our assessments produce profiles describing behavioral style and Emotional Intelligence. Depending on how a service is set up, your report may be shared with you, with the organization that asked you to complete it, and with an authorized Discflow partner or practitioner.

A profile describes how someone tends to behave and adapt. It is not a definitive statement about a person, and it does not rank people. Discflow reports should not be used to decide who is hired, promoted or dismissed. We do not make decisions with legal or similarly significant effects about individuals by automated means.

FlowConnect gives people coaching guidance based on their Discflow profile, through our platform, at the moment they need it. To do this it uses a large language model.

FlowConnect is built on Microsoft Azure OpenAI Service. AI processing takes place in Microsoft data centers in Sweden, within the EU.

What you enter into FlowConnect, and the guidance it produces, is not used to train AI models — ours, Microsoft’s or anyone else’s.

Your FlowConnect history is stored with the rest of your account data in the EU, and is kept and deleted on the same terms as your account.

FlowConnect guidance is a coaching aid. It is not professional, medical or psychological advice.

The organization that asked you to complete an assessment or gave you access to our services.

An authorized Discflow partner or practitioner involved in delivering the service to you.

Service providers acting on our instructions, including Amazon Web Services (hosting), Microsoft (FlowConnect AI processing), HubSpot (customer relationship management), our customer support provider, and providers of email, security and technical services.

Professional advisers, auditors and insurers, where reasonably necessary.

Courts, regulators and other authorities, where the law requires or permits it.

We do not sell, rent or trade personal data. A current list of our service providers is available on request from privacy@discflow.co.

Personal data held in our assessment platform and FlowConnect is stored on Amazon Web Services in Frankfurt, Germany. FlowConnect’s AI processing takes place in Sweden. Both are within the EU.

Some of our service providers may access personal data from outside the EU for limited purposes. Our customer support provider, based in the Philippines, may access account information to help resolve support requests. Where personal data is accessed from or transferred to a country without an adequacy decision, we use the safeguards the law requires, such as the European Commission’s Standard Contractual Clauses, and carry out a transfer risk assessment. You can request details of these safeguards from privacy@discflow.co.

We keep personal data only as long as we need it for the purposes described here, then delete or anonymize it.

Assessment responses and reports: while the account is active, and for up to five years after the participant’s last activity, unless the organization that commissioned the assessment instructs us to delete it sooner.

FlowConnect history: while the account is active, and deleted with the account data above.

Account information: while the account is active, and for up to five years after last activity.

Enquiries and free quiz details: two years from our last contact with you.

Contracts, invoices and financial records: as long as the law requires, normally five to seven years.

Marketing preferences: until you opt out. We keep a record of the opt-out so that we can respect it.

Cookie consent records: twelve months.

Anonymized, aggregated assessment data, from which no individual can be identified, may be kept for longer to maintain and improve the accuracy of our assessment norms. Once data is anonymized it is no longer personal data.

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration or disclosure. These include encryption of personal data in transit and at rest, access controls, authentication, monitoring, backups, staff confidentiality obligations and controls on our service providers. No system can be guaranteed to be completely secure, but we work to keep the risk as low as reasonably possible.

Depending on where you live and the law that applies, you may have the right to:

Know what personal data we hold about you and how it is used, and receive a copy of it.

Have inaccurate data corrected.

Have your data deleted.

Restrict or object to certain processing, including direct marketing.

Receive your data in a portable format.

Withdraw consent where we rely on it.

Complain to a data protection authority.

To exercise any of these rights, email privacy@discflow.co. We may need to confirm your identity first. We respond within one month, which the law allows us to extend by up to two further months for complex requests; if we do, we will tell you why. If your request concerns an assessment an organization asked you to complete, we may refer it to that organization, as described above.

We send service messages that are needed to provide our services. We send marketing only where the law allows and, where required, with your consent. Every marketing email includes a way to unsubscribe, and you can also opt out by emailing privacy@discflow.co.

Our website and services are designed for adults in a work context. They are not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

If we become aware of a personal data breach, we will act promptly to contain it and will notify the relevant regulators and affected individuals where the law requires us to.

Please send privacy questions, requests and complaints to privacy@discflow.co, or write to Flow Labs Consultancy FZCO, IFZA Business Park, 36387-001, Dubai Silicon Oasis, Dubai, United Arab Emirates.

If you are not satisfied with our response, you can complain to a data protection authority. In the UAE this is the UAE Data Office. In the United Kingdom it is the Information Commissioner’s Office. In the EU, you can contact the data protection authority in the country where you live or work.

We may update this Policy when our services, our processing or the law changes. The current version will always be published on this website with its last-updated date. If we make a material change, we will take reasonable steps to let affected people know.