Privacy Policy.

About this policy

This draft covers the GGFlow informational website and enquiries sent directly by email or Telegram. The planned production website will use WordPress. It will not have a contact form; visitors will contact us through an email address or an external Telegram link.

Any separate onboarding or payment-provider service may involve additional processing and its own privacy information. This website policy does not replace those notices or describe a provider's KYC/KYB process.

Who is responsible

The organisation operating the GGFlow website is responsible for deciding how personal data collected through the website and its enquiry channels is used. "GGFlow" is the brand name, not a confirmed legal entity in this draft.

The proposed contact is hello@ggflow.com, subject to confirmation by the website operator.

Information we handle

When you browse

Hosting and security services may process your IP address, requested pages, access times, browser or device information and error or security logs. The production hosting and plugin configuration must be checked to confirm the exact data collected.

When you contact us

Your email address or Telegram details visible to us, your name if provided, your message, business information, attachments and our correspondence. Please share only what is needed for your enquiry.

If you allow analytics

If Google Analytics 4 is enabled after launch, it may process online identifiers, pages and interactions, referral information, device and browser details, and approximate location. The actual events and features enabled must be confirmed before launch.

Why we use information

Where GDPR applies, the following are the proposed purposes and legal bases. They must be checked against the operator's actual activities before this notice takes effect.

• Operating and protecting the website: legitimate interests in reliable service, troubleshooting and preventing abuse, where the processing is necessary and proportionate.
• Responding to enquiries: steps you request before entering a contract where applicable; otherwise, legitimate interests in responding to business communications.
• Optional audience measurement: your consent for analytics and associated non-essential storage or access.
• Meeting legal requirements or handling claims: an applicable legal obligation or a legitimate interest in establishing, exercising or defending legal claims, as relevant.

You choose whether to contact us. Without a reply address or enough context, we may be unable to respond. The site can be used without agreeing to optional analytics.

Cookies & analytics

WordPress and essential storage

Using WordPress does not mean every visitor receives the same cookies. Cookies depend on the theme, plugins, hosting and features actually used. Login cookies for administrators should not be described as cookies set for every public visitor. The live site needs a cookie audit before launch.

Google Analytics 4 and Google Tag Manager

Google Analytics 4 measures website use. Google Tag Manager manages the tags that run on a site; it is not an alternative analytics service. GA4 may be installed directly or through GTM. That choice has not yet been made for this draft.

If activated, these services involve requests to Google. Analytics identifiers should not be treated as anonymous data. A tag manager's privacy impact also depends on the tags and configuration it loads.

Consent before measurement

The proposed production setup is to leave optional analytics off until a visitor chooses to allow it, with an equally accessible way to reject it and a persistent way to change or withdraw that choice. These controls must be implemented and tested in WordPress before analytics is enabled.

Google Consent Mode is not itself a consent banner. Its advanced mode can send cookieless measurements before analytics consent is given. The final implementation must match the choice described to visitors, including whether any Google requests occur before consent.

For provider information, see Google's Privacy Policy and Google Tag Manager's privacy information.

Email & Telegram

An email link opens your email application. The website does not receive a submitted contact form. If you send a message, GGFlow and its email service process the information in that correspondence.

A direct Telegram link takes you to a separate service. It is not an embedded chat widget. Telegram handles information under its own Privacy Policy, and GGFlow receives the profile information and messages made available when you contact it there.

Sending an enquiry is not permission to subscribe you to unrelated marketing. This draft does not cover a newsletter or a marketing subscription.

Providers & international transfers

Relevant recipients may include authorised people handling your enquiry and suppliers of hosting, security, email and website support. Google would be involved if the planned Google services are enabled. Telegram processes information when you use its service.

Information may also need to be disclosed to professional advisers or competent authorities where required by law or necessary for a relevant legal claim. Any introduction to a payment provider should be explained in the enquiry or onboarding process before information is shared.

Some providers may process data outside your country, including outside the European Economic Area. Where GDPR transfer rules apply, an appropriate transfer mechanism and any necessary safeguards must be in place. The destination countries, provider arrangements and applicable safeguards have not yet been verified for the production setup.

How long we keep data

Personal data should be retained only for as long as needed for its stated purpose, with any applicable legal obligations or relevant claim periods taken into account.

Enquiries

For handling and following up the request, then subject to a documented deletion or review schedule.

Hosting and security logs

For a limited operational or security period agreed with the relevant provider.

Analytics and consent records

According to the selected analytics and consent-tool settings. Cookie expiry is separate from retention of data on analytics servers.

The enquiry and log schedules, analytics retention and backup-deletion arrangements need confirmation. No unverified fixed retention period is presented as a current setting.

Your choices & rights

Depending on the law that applies, you may request access to your personal data, correction of inaccurate information, deletion, restriction of processing or a portable copy of eligible data. You may also object to processing based on legitimate interests, subject to the applicable conditions.

Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal. You can also complain to the relevant data protection authority, including an authority in your place of habitual residence or work where GDPR provides that right.

Use the confirmed privacy contact to make a request. We may need proportionate information to verify your identity. The relevant supervisory authority and any local requirements must be checked once the operator's establishment is confirmed.

Security & updates

Appropriate access controls, secure configuration and other proportionate safeguards should be applied to the live site and its enquiry channels. No website or messaging service can guarantee absolute security.

This notice should be reviewed whenever the site's providers, plugins, tracking or processing purposes change. Before production release, replace the draft status with an effective date after the operator has verified the content and implementation.