Privacy Policy

1. Introduction

Flowko Rešitve is committed to protecting your privacy. This privacy policy explains how we collect, use, disclose, and protect your information when you visit our website flowko.si and use our digital services. This policy complies with the EU General Data Protection Regulation (GDPR) and applies to all personal data we process about you. The exception is the data of customers who book an appointment through our online booking service: for that data we are not the controller but a processor, as described in section 3.4.

2. Data Controller

• Company: David Vojvodić s.p., Flowko
• Address: Ulica Daneta Šumenjaka 2A, 9000 Murska Sobota, Slovenia
• Email: info@flowko.io
• Data Protection Officer: David Vojvodic

3. Information We Collect

3.1 Information you provide:

• Contact information (name, email address, phone number)
• Company details (company name, industry, size)
• Communication preferences
• Technical requirements and project details
• Payment information (securely processed via third-party payment providers)

3.2 Automatically collected information:

• IP address and location data
• Browser type and version
• Device information
• Website usage patterns and analytics
• Cookies and similar tracking technologies

3.3 Google Calendar data (Flowko Rezervacije)

If you, as a service provider (hereinafter: the provider), connect your Google Calendar to our online booking service Flowko Rezervacije at booking.flowko.si, we access a limited set of data in your Google Account. Google's consent screen names the service as the app “Flowko Rezervacije”. Connecting is voluntary, and you can disconnect at any time. We are the controller of this data (section 2). The legal basis for processing it is the performance of the contract for use of the service. Where the person who connects the calendar is not themselves a party to that contract (for example an employee of a business that is our client), the legal basis is our client's and our legitimate interest in the service working as agreed.

Permissions we request

Before we send you to Google, a short notice tells you which data the app will read and write and points you to this section.

We request no other permissions for your Google Account. If you do not grant both when connecting, we do not set up the connection and do not store the token we received.

How we use the data

We use data from your calendar only to run online booking:

• to calculate free slots from the times when you are busy and to prevent double bookings;
• so that you can choose which calendars we check and which one we write bookings to;
• to write a confirmed appointment into your calendar and to update or delete it when it is rescheduled or cancelled;
• to show you your busy times when you are signed in: on a booking page, if you turn on the display of your own calendar, and in the availability troubleshooter;
• to recognise, from the primary calendar's identifier, which Google Account a connection belongs to, so that we do not duplicate a connection or revoke access that another connection to the same Google Account still uses.

We do not read the contents of other events in your calendar (titles, descriptions, attendees, locations): for those, Google tells us only the start and end of the times when you are busy. We do not store these times; we fetch them for each calculation. On the booking page, your customers see only which slots are free.

The event we create for a booking names your calendar's identifier (usually your Google email address) as the organizer. Unless you turn on the “Hide organizer's email” setting, the customer and the guests they added are also listed as attendees. When we create, change or delete the event, we instruct Google not to send the attendees invitations or notifications; according to Google's documentation, Google may still send some emails.

What we store

• the tokens Google issues to us (access token and refresh token), together with the permissions granted and the token's expiry time; the refresh token lets us check your availability even when you are not signed in;
• the identifier of your primary calendar (usually your Google email address), which we set automatically on connection for checking availability and writing bookings, and the identifiers of any other calendars you select;
• for each appointment booked through our service, the identifier of the event in your calendar and the identifier of the calendar we wrote it to.

Where and how we store it

The application and the database run with our hosting company Railway Corporation (San Francisco, USA) in its EU West region in Amsterdam, the Netherlands. Regardless of the hosting location, Railway operates its service largely from the USA, so the data may also be processed in the USA. Railway is on the EU-U.S. Data Privacy Framework List. For transfers to organisations on that list, the European Commission found in Commission Implementing Decision (EU) 2023/1795 that the USA ensures an adequate level of protection for personal data. The service is reached over an encrypted HTTPS connection. The database is not reachable from the public internet; only we, our hosting company and its sub-processors (list: trust.railway.com/item/subprocessors) have access to it. Google Calendar tokens (access and refresh tokens) are stored encrypted (AES-256-GCM); the encryption key is not stored in our database.

We keep the tokens and calendar settings until you disconnect or until your user account is deleted. We keep event and calendar identifiers together with the bookings (section 3.4). Deleted data may remain for up to 6 more days in the daily database backups kept by the hosting provider.

Who receives it

We do not sell data from your Google Calendar, and we do not use it for advertising, or to develop, improve or train artificial-intelligence or machine-learning models. It is received only by our hosting company Railway and its sub-processors, which store it on our behalf as processors, and by the attendees of the events we create, to the extent described above; we pass it to other recipients only where the law requires us to.

We and our contractors do not look at your Google Calendar data unless you explicitly ask us to (for example, to resolve a problem you report), it is necessary for security purposes (for example, investigating a bug or abuse), or it is required by law.

Disconnecting and revoking access

You can disconnect at any time on booking.flowko.si under Apps → Installed apps → Calendars, with “Remove app”. We then delete the tokens and calendar settings from our database and ask Google to revoke our access. We do not ask for revocation if another Google Calendar from the same Google Account is still connected to your booking.flowko.si user account, if we determine that the same Google Account is also connected to someone else's booking.flowko.si user account, or if a permanent technical fault means the stored token cannot be read. We attempt revocation only once: if it fails or cannot be made, we do not retry it. We therefore recommend that you also check or revoke access at myaccount.google.com/connections. If a temporary technical fault prevents us from removing the connection, we ask you to try again later; until then, the connection stays as it is. Events we have already written to your calendar remain there.

If your booking.flowko.si user account is deleted, we also ask Google to revoke access, except for connections already revoked at Google, for a Google Account that we determine is also connected to someone else's user account, and for connections whose stored token we cannot read because of a technical fault. Here too, we do not retry a revocation that fails. We then delete the account together with its tokens and bookings. Events we have already written to your calendar remain there.

If the connection stops working

If Google rejects our token (for example because you revoked access only at Google or the permission expired), we mark the connection as invalid and send you one email with a link to your calendar settings. As long as a calendar selected for checking availability belongs to an invalid connection, your booking page shows no free slots and we accept no bookings, so that nobody books a time when you may be busy. We do not delete an invalid connection automatically: remove it under Apps → Installed apps → Calendars with “Remove app” and, if needed, connect Google Calendar again.

If we cannot read one of the calendars we check (for example because it was deleted or is no longer shared with you), your booking page likewise shows no free slots; in that case we do not send an email.

Other sections of this policy, and changes

We use, store and share Google Calendar data only as described in this section; the general sections 4 and 5 of this policy do not apply to it. Before we use this data in a new way or for a different purpose, or access other types of data in your Google Account, we will notify you and ask you to consent to the updated policy.

Limited Use (Google Limited Use)

Flowko Rezervacije's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

You exercise your rights regarding this data as described in section 7.

3.4 Data of customers who book an appointment through our service

If you booked an appointment through an online booking form that we provide to a company or sole trader (hereinafter: the provider), or visited a website of the provider into which that form is embedded, the controller of your data is the provider. The provider is named in the booking confirmation; if you did not book, the provider is the company or sole trader whose website you visited. The provider is responsible for the processing of your data; this section describes how we process it on the provider's behalf. We are the processor: we process the data on the provider's behalf and on its instructions.

What data we process

• your name and your email address and/or phone number, as the form requires;
• the selected slot, and your time zone and language;
• your answers to the questions in the form, any additional notes, and the location of the appointment if you enter it yourself (for example an address or phone number);
• the email addresses of guests you add to the appointment;
• the reason for a reschedule or cancellation and the email address of the person who rescheduled or cancelled;
• campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and other parameters of the form metadata[…], if the link to the form or the code that embeds it contains them, or, where the code is set up to pass them on, the address of the page into which the form is embedded;
• a rating and comment, if you submit them;
• a note of whether you attended the appointment, if the provider records it.

We do not store your IP address with the booking. However, our hosting company automatically logs requests to booking.flowko.si, including the IP address, browser details (user agent) and the address of the requested page. If the form is embedded in the provider's website, your browser loads the form's script from booking.flowko.si when you visit that page, and, for a form shown directly on the page, also the form itself and the free slots, even if you do not book; these requests are logged in the same way.

Cookies and browser storage

A form embedded in the provider's website stores no cookies in your browser. In your browser's local storage it keeps only technical display settings: the form's colour theme, the clock format, which the form reads from your browser's settings, and the time zone if you change it or the provider sets it in advance for the service.

Pages you open directly on booking.flowko.si (the booking page, the booking details page and the pages for rescheduling and cancelling an appointment) store two technical session cookies: __Secure-next-auth.csrf-token, which protects against forged requests, and __Secure-next-auth.callback-url, which holds the address the page returns to after signing in. When you confirm a cancellation, the session cookie calcom.csrf_token, which also protects against forged requests, is stored as well and deleted once the cancellation has gone through. Your browser deletes session cookies when the session ends, usually when you close it. In your browser's local storage these pages keep technical display settings and an entry that keeps the sign-in state in sync between browser tabs. Entries in local storage remain in your browser until you delete them.

We do not use cookies or other technologies for analytics or advertising on booking.flowko.si.

What we use it for, and on what basis

We use the data to book the appointment and prevent double bookings, to send you, the provider and any guests you add a confirmation and notices of changes, to write the appointment into the provider's calendar, to let you reschedule or cancel it, and to store the rating and comment you submit and the attendance note the provider records.

The legal basis is, as a rule, the performance of the contract between you and the provider, or steps taken at your request before entering into the contract (Article 6(1)(b) of the General Data Protection Regulation). The provider, as a rule, processes the data of guests you add on the basis of its legitimate interest in informing the attendees about the appointment, and campaign tags and other link parameters on the basis of its legitimate interest in knowing which link or campaign you came through. The provider, as a rule, processes the rating, comment and attendance note on the basis of its legitimate interest in monitoring the quality and delivery of its services. Technical logs are processed on the basis of a legitimate interest in the security and operation of the service. Without the data the form marks as required, the appointment cannot be booked.

Who receives it

• the provider you booked with;

• Google (the Google Calendar service), if the provider has connected Google Calendar: we create an event in the provider's calendar. Its title usually contains your name. Its description contains:

  • your name, your email address and your phone number (if you gave one), and the names and email addresses of your guests;
  • the location, additional notes and your answers in the form;
  • the reason for a reschedule (if you gave one);
  • a link for managing the booking.

  Unless the provider turns on the “Hide organizer's email” setting, you and your guests are listed as attendees of the event. We instruct Google not to send you invitations or notifications for it, but according to its own documentation Google may still send some emails;

• guests you add: they receive a confirmation listing the names, email addresses and phone numbers of all attendees, including yours, and, unless the provider hides them, your additional notes and your answers in the form;

• the website into which the form is embedded, if you booked through an embedded form: it receives a notice that a booking was made and the time of the appointment, but not your details;

• the email delivery service Postmark (AC PM LLC, an ActiveCampaign company, USA), through which we send confirmations and notices. Postmark states that its primary data and servers are hosted in a data centre near Chicago (USA) and with Amazon Web Services, and that it has no plans to add servers in the EU;

• our hosting company Railway (section 3.3).

Anyone who has the link to the booking details page can open it; the page shows the names and email addresses of the attendees and the answers in the form. Therefore, do not forward the link.

Transfers to the USA

Railway and Postmark are US companies. For users of Google services in the EEA, the data controller is, as a rule, Google Ireland Limited (Ireland), and Google processes data on servers around the world. Your data may therefore be transferred to the USA. Railway Corporation and Google LLC are on the EU-U.S. Data Privacy Framework List, so transfers to them rely on Commission Implementing Decision (EU) 2023/1795 on adequacy; for transfers that decision does not apply to, Google uses standard contractual clauses. Transfers to Postmark are based on the EU-U.S. Data Privacy Framework and/or the European Commission's standard contractual clauses, which form part of the data processing agreement between us and Postmark (postmarkapp.com/dpa). Google describes its safeguards at policies.google.com/privacy/frameworks. You can also request a copy of the standard contractual clauses from us at info@flowko.io.

How long we keep it

We do not delete booking data automatically, even after the appointment has passed or been cancelled. We keep it for as long as the provider uses our service; we delete an individual booking earlier if the provider instructs us to. When the provider stops using the service, we delete its user account together with all bookings within 30 days at the latest. When a booking is cancelled, we also delete the event from the provider's Google Calendar if the connection to it works; otherwise the provider manages the event there. We back up the database once a day and keep each backup for 6 days, so deleted data may remain in backups for up to 6 more days.

Postmark keeps the content of sent messages, their metadata and their delivery data for 45 days. It keeps recipients' email addresses on a suppression list with no time limit if a message sent to them bounced as undeliverable, if they reported a message as spam, or if they unsubscribed.

Technical logs (request and error logs), which may contain your IP address and individual booking details (for example an email address), are kept by our hosting company; on our plan they are available to us for 30 days.

Your rights

You have the right of access to your data and the rights to rectification, erasure, restriction of processing and data portability (Articles 15–18 and 20 of the General Data Protection Regulation – GDPR). You also have the right to object (Article 21) where your data is processed on the basis of legitimate interests. Address requests to the provider; if you send them to us at info@flowko.io, we forward them to the provider without delay. You can lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si) or with the supervisory authority of the EU member state where you habitually live or work or where the alleged infringement took place.

4. How We Use Your Information

We use, store and share Google Calendar data (section 3.3) only as described in section 3.3; sections 4 and 5 do not apply to it.

4.1 Service delivery (legal basis: contract performance):

• Providing digital solutions and consulting services
• Project management and communication
• Technical support and maintenance
• Billing and payment processing

4.2 Business operations (legal basis: legitimate interest):

• Website analytics and improvements
• Security monitoring and fraud prevention
• Business development and service improvement

4.3 Marketing (legal basis: consent):

• Sending newsletters and insights
• Promoting relevant services

5. Data Disclosure

We do not sell, trade, or otherwise transfer your personal data to third parties, except:

5.1 Service providers:

• Website hosting (secure EU providers)
• Payment processing
• Email providers (for agreed communications)
• Analytics tools (Google Analytics with IP anonymization)
• Hosting of the online booking service booking.flowko.si: Railway (section 3.3); email for that service: Postmark (section 3.4).

5.2 Legal requirements:

• When required by law
• To protect our rights or property
• In good faith to prevent criminal activity

6. Data Security

We use appropriate technical and organisational measures to protect personal data. The website flowko.si and the online booking service booking.flowko.si are reached over an encrypted HTTPS connection. Only we and the service providers named in sections 3.3, 3.4 and 5 have administrative access to the systems in which we store personal data. The booking service's database is not reachable from the public internet. Google Calendar tokens (access and refresh tokens) are stored encrypted (AES-256-GCM); the encryption key is not stored in our database.

7. Your GDPR Rights

Under GDPR you have the right to:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (“right to be forgotten”)
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interests
• Withdraw consent: For marketing communications at any time

To exercise these rights, contact us at info@flowko.io. We will respond within 30 days. For data covered by section 3.4, the procedure described in section 3.4 applies.

8. Data Retention

• Contact information: 3 years after last contact
• Project data: 7 years (tax requirements)
• Analytics data: 26 months (Google Analytics)
• Cookies: In accordance with our cookie policy

For data covered by sections 3.3 and 3.4, the periods stated there apply.

9. Policy Updates

We may update this policy from time to time. We will notify you of significant changes by email or by posting a notice on our website. If we change the way we use Google Calendar data (section 3.3), we will notify you and ask you to consent to the updated policy before we use it in a new way or for a different purpose.

10. Contact Us

For privacy inquiries or to exercise your rights:

• Email: info@flowko.io
• Data Protection Officer: David Vojvodic

You also have the right to file a complaint with the relevant supervisory authority if you believe your data protection rights have been violated.