Privacy


FlowMe — flowme.shop
Effective Date: June 20, 2026
Last Updated: June 20, 2026

  1. DATA CONTROLLER IDENTITY

This Privacy Policy is issued by the owner and operator of the online store FlowMe at flowme.shop. The Data Controller responsible for processing your personal data is:

Full Name / Legal Entity: Olha Troshkina
Brand Name: FlowMe
Tax Identification Number (NIF): Y8171109M
Registered Address: Av. Roentgen 7, Torrevieja, 03183, Alicante, Spain
Contact Email: help@flowme.shop
Phone: 632283125
Website: https://flowme.shop

  1. SCOPE AND PURPOSE OF THIS POLICY

This Privacy Policy explains how FlowMe ("we", "us", "our") collects, uses, stores, and discloses personal data when you visit or browse the website flowme.shop, create an account or place an order, contact us for customer support, subscribe to our newsletter or promotional communications, or interact with us through any other channel.

This Policy applies to both individual consumers (B2C) and professional buyers (B2B). Where GDPR protections apply specifically to natural persons, this is indicated in the relevant section.

By using our website or purchasing from us, you acknowledge that you have read and understood this Privacy Policy.

  1. PERSONAL DATA WE COLLECT

3.1 Data You Provide Directly

  • Identity data: full name, username or display name.
  • Contact data: email address, telephone number, billing and delivery address.
  • Account data: password (stored in encrypted form), account preferences.
  • Order and transaction data: products purchased, order history, returns and exchanges.
  • Payment data: payment method type and last four digits of card (full card numbers are processed exclusively by our payment processor and are never stored by us).
  • Communications: messages, emails, and chat content you send to our customer support team.
  • Professional data (B2B buyers): company name, VAT/tax identification number, billing entity.

3.2 Data Collected Automatically

  • Device and technical data: IP address, browser type and version, operating system, device identifiers.
  • Usage data: pages visited, time spent on pages, links clicked, products viewed or added to cart.
  • Cookie and tracking data: as described in our separate Cookie Policy, available on our website.

3.3 Data from Third Parties

  • Payment processors (e.g. Stripe, PayPal): transaction confirmation and fraud-check data.
  • Logistics and shipping providers: delivery status and address validation data.
  • Analytics providers: aggregated behavioural data to help us improve the website.

We do not purchase personal data from data brokers or third-party marketing lists.

  1. LEGAL BASIS FOR PROCESSING

We process your personal data only where we have a valid legal basis under Article 6 of Regulation (EU) 2016/679 (GDPR). The applicable basis for each purpose is set out below:

(a) Performance of a contract (Art. 6(1)(b) GDPR): processing your order, managing your account, arranging delivery, processing returns and refunds.

(b) Compliance with a legal obligation (Art. 6(1)(c) GDPR): issuing invoices and maintaining accounting records, responding to lawful requests from public authorities, complying with consumer protection and tax legislation.

(c) Legitimate interests (Art. 6(1)(f) GDPR): fraud prevention, IT security, improving website functionality, and analytics. We have assessed that our legitimate interests are not overridden by your rights and freedoms.

(d) Consent (Art. 6(1)(a) GDPR): sending you marketing emails and newsletters; placing non-essential cookies on your device. You may withdraw consent at any time without affecting the lawfulness of prior processing.

  1. HOW WE USE YOUR PERSONAL DATA

We use your personal data for the following purposes:

  • Order fulfilment and delivery — to process and ship your orders. [Contract — Art. 6(1)(b)]
  • Account management — to create and maintain your customer account. [Contract — Art. 6(1)(b)]
  • Customer support — to respond to your enquiries, handle complaints and process returns. [Contract — Art. 6(1)(b)]
  • Invoicing and tax compliance — to issue receipts and fulfil our accounting obligations. [Legal obligation — Art. 6(1)(c)]
  • Fraud prevention and security — to detect and prevent fraudulent transactions and unauthorised access. [Legitimate interest — Art. 6(1)(f)]
  • Website analytics and improvement — to understand how visitors use our website and to improve performance. [Legitimate interest — Art. 6(1)(f)]
  • Marketing communications — to send you promotional emails about our products, offers, and news, only where you have opted in. [Consent — Art. 6(1)(a)]
  • Personalised advertising — to show you relevant advertisements based on your browsing and purchase history, only where you have given consent through our cookie banner. [Consent — Art. 6(1)(a)]

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects without human review.

  1. RETENTION OF PERSONAL DATA
  • Order and transaction records: 5 years from the date of the transaction (Spanish commercial and tax law).
  • Account data: duration of your account plus 2 years after closure.
  • Customer support communications: 2 years from the date of the last interaction.
  • Consent records for marketing: 3 years from the date consent was given, or until withdrawal.
  • Invoice and accounting records: 6 years (Spanish accounting regulations).

When the retention period expires, data is securely deleted or anonymised.

  1. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

We do not sell your personal data.

7.1 Data Processors (acting on our instructions)

  • Shopify Inc.: website hosting, order management, checkout processing. Shopify acts as our data processor under a Data Processing Agreement.
  • Payment service providers (e.g. Stripe, PayPal): secure processing of payments, subject to PSD2/Strong Customer Authentication requirements.
  • Logistics and courier companies: delivery of orders and management of returns.
  • Email marketing platform: sending of transactional and promotional emails, only where you have consented.
  • IT and cloud infrastructure providers: secure hosting and data storage within the EEA or under adequate safeguards.
  • Analytics providers (e.g. Google Analytics): anonymised or pseudonymised website performance data.

7.2 Public Authorities
We may disclose personal data to tax authorities, law enforcement, or courts where required by applicable Spanish or EU law.

7.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, subject to the same protections as described in this Policy.

We do not share your personal data with third parties for their own independent marketing purposes without your explicit consent.

  1. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Where possible, we store and process your personal data within the European Economic Area (EEA). If any data is transferred outside the EEA, we ensure protection via an adequacy decision by the European Commission, Standard Contractual Clauses (Art. 46(2)(c) GDPR), or other approved transfer mechanisms.

You may request details of the specific safeguards by contacting us at help@flowme.shop.

  1. YOUR RIGHTS AS A DATA SUBJECT

If you are located in the European Economic Area, you have the following rights under GDPR and Ley Orgánica 3/2018 (LOPDGDD):

  • Right of access (Art. 15 GDPR): to request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16 GDPR): to request correction of inaccurate or incomplete data.
  • Right to erasure / 'right to be forgotten' (Art. 17 GDPR): to request deletion of your data, subject to legal retention obligations.
  • Right to restriction of processing (Art. 18 GDPR): to request that we limit processing of your data in certain circumstances.
  • Right to data portability (Art. 20 GDPR): to receive your data in a structured, machine-readable format.
  • Right to object (Art. 21 GDPR): to object to processing based on legitimate interests or for direct marketing.
  • Right to withdraw consent (Art. 7(3) GDPR): to withdraw consent to marketing or cookies at any time.
  • Right to digital will (Art. 96 LOPDGDD): to designate a person to manage your personal data after your death.

To exercise any of these rights, please contact us at help@flowme.shop. We will respond within 30 days.

  1. RIGHT TO LODGE A COMPLAINT

Spanish Data Protection Authority (AEPD): www.aepd.es
Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, Spain.

Regional Consumer Authority (Comunidad Valenciana): Agència Valenciana del Consum

EU Online Dispute Resolution Platform: https://ec.europa.eu/consumers/odr

We encourage you to contact us first at help@flowme.shop so that we may resolve any concern directly.

  1. COOKIES AND SIMILAR TECHNOLOGIES

We use the following categories of cookies:

  • Strictly necessary cookies: essential for the website to function. No consent required.
  • Analytical/performance cookies: help us understand how visitors use our website. Consent required.
  • Functional cookies: remember your preferences. Consent required.
  • Marketing/targeting cookies: used for relevant advertisements. Explicit consent required.

When you first visit flowme.shop, you will be shown a cookie consent banner. You can change your cookie settings at any time via the cookie preferences link in the website footer.

For full details, please refer to our Cookie Policy at flowme.shop/cookie-policy.

  1. CHILDREN'S PRIVACY

Our website is not directed at children under the age of 14. We do not knowingly collect personal data from children under 14. If you believe your child has provided us with data, please contact us at help@flowme.shop and we will promptly delete it.

The minimum age for consent to data processing in Spain is 14 years (Art. 7 LOPDGDD).

  1. SECURITY OF YOUR PERSONAL DATA

We implement the following measures to protect your data:

  • SSL/TLS encryption for all data transmitted via our website.
  • Access controls limiting who can access personal data within our organisation.
  • PCI-DSS compliant payment processors — full card data is never stored on our servers.
  • Regular security reviews of our systems and service providers.

In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the AEPD within 72 hours and, where required, notify affected individuals without undue delay.

  1. OUR RELATIONSHIP WITH SHOPIFY

Shopify Inc. (or its EEA entity, Shopify International Limited) acts as a Data Processor on our behalf under a Data Processing Agreement (Art. 28 GDPR). Shopify processes your data solely according to our instructions to provide us with e-commerce services.

Shopify Privacy Policy: https://www.shopify.com/legal/privacy
Shopify Privacy Portal: https://privacy.shopify.com/en

  1. MARKETING COMMUNICATIONS AND YOUR CHOICES

We send marketing communications only where you have actively opted in, or where you are an existing customer who has not opted out (soft opt-in rule, LSSI-CE Art. 21).

You may unsubscribe at any time by clicking 'unsubscribe' in any marketing email, contacting us at help@flowme.shop, or updating your account settings.

Unsubscribing from marketing does not affect transactional communications (order confirmations, shipping notifications, support replies).

  1. CHANGES TO THIS PRIVACY POLICY

When we make material changes, we will update the 'Last Updated' date, notify registered users by email where required, and display a prominent notice on our website.

  1. CONTACT US

Email: help@flowme.shop
Postal address: Av. Roentgen 7, Torrevieja, 03183, Alicante, Spain
Phone: 632283125

We aim to respond to all requests within 30 calendar days.

  1. GOVERNING LAW AND JURISDICTION

This Privacy Policy is governed by Spanish law and applicable EU data protection law. Disputes shall be subject to the courts of Torrevieja (Alicante), Spain, without prejudice to your rights as a consumer to bring proceedings in the courts of your country of residence.