Privacy Policy

QUAFLOW OÜ

Version: 1.1.8 - Last updated: June 3, 2025

Introduction

Thank you for visiting the Quaflow website together with its content, domains, tools and services, the ("Site"). Your privacy is important to us. To better protect your privacy, we provide this comprehensive privacy policy ("Privacy Policy") explaining our online information practices and the choices you can make about the way your information is collected and used at this Site. This Privacy Policy forms part of the Terms of Service.

This Privacy Policy has been designed to comply with multiple international data protection regulations, including but not limited to the European General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Brazil's General Data Protection Law (LGPD), Australia's Privacy Principles (APP), India's Digital Personal Data Protection Act (DPDP) and Quebec's Law 25.

Definitions

For the purposes of this Privacy Policy:

• "Personal Information" or "Personal Data" means any information that may be used, either alone or in combination with other information, to personally identify an individual, including, but not limited to, a first and last name, personal profile, a home or other physical address, an email address, phone number, precise location data, financial information, or other contact information.
• "Sensitive Personal Information" means personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, data concerning a person's sex life or sexual orientation, or certain financial information.
• "Data Subject" or "Data Principal" means the individual to whom the Personal Information relates.
• "Data Controller" or "Data Fiduciary" means QUAFLOW OÜ, which determines the purposes and means of processing Personal Information.
• "Processing" means any operation performed on Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Consent

By using this Site, you consent to the terms of our Privacy Policy and to our collection, use, retention, disclosure and processing of Personal Information for the purposes as discussed in this Policy. If you do not agree to this Privacy Policy, please do not use our Site, Products or Services.

We obtain your consent through clear affirmative actions. Your consent must be freely given, specific to the purpose, informed, unambiguous, and indicated by a clear positive action. For children under 18 years of age, we require parental or guardian consent.

You may withdraw your consent at any time by contacting us at the details provided at the end of this policy. Please note that withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Information We Collect

A. Information You Provide to Us

We may collect Personal Information that you voluntarily provide to us when you:

• Register for an account
• Use our products or services
• Fill out forms on our website
• Subscribe to our newsletter
• Contact our customer support
• Participate in surveys or promotions
• Apply for employment

The types of Personal Information we collect may include:

• Contact information (name, email address, phone number, postal address)
• Account credentials (username, hashed password)
• Payment information (payment method, billing address)
• Professional information (company name, job title)
• Communications and feedback you provide to us

B. Information We Collect Automatically

When you visit our Site, we may automatically collect certain information about your device and usage, including:

1. Log Data: We collect information that your browser sends whenever you visit our Site. This may include your computer's Internet Protocol (IP) address, browser type and version, the pages you visit, the time and date of your visit, time spent on those pages, and other statistics.
2. Device Information: We collect information about the device you use to access our Site, including hardware model, operating system and version, unique device identifiers, and mobile network information.
3. Location Information: We may collect and process information about your actual location using various technologies, including IP address, GPS, and other sensors.
4. Cookies and Similar Technologies: We use cookies, web beacons, pixels, and similar technologies to collect information about your browsing behavior and preferences. For more details, please see our Cookie Policy section below.

Cookie Policy

What Are Cookies

Cookies are small files placed on your hard drive that can help us analyze our web page flow, customize our services, content and advertising, measure promotional effectiveness, and promote trust and safety.

Types of Cookies We Use

• Essential Cookies: Necessary for the functioning of our website and services.
• Preference Cookies: Enable the website to remember information that changes the way the website behaves or looks.
• Statistics Cookies: Help us understand how visitors interact with our website by collecting and reporting information anonymously.
• Marketing Cookies: Used to track visitors across websites to display relevant advertisements.

Your Cookie Choices

You are always free to decline our cookies if your browser permits, although doing so may interfere with your use of some of our sites or services. Please consult the HELP menu of your browser to understand more about how to block cookies.

We use Google Analytics to help us understand how our customers use our website. You can read more about how Google uses your Personal Information at https://policies.google.com/privacy. You can also opt-out of Google Analytics at https://tools.google.com/dlpage/gaoptout.

How We Use Your Information

We use the information we collect for various purposes, including to:

• Provide, maintain, and improve our Site, products, and services
• Process transactions and send related information, including confirmations and invoices
• Send administrative information, such as updates, security alerts, and support messages
• Respond to your comments, questions, and requests
• Communicate with you about products, services, offers, promotions, and events
• Monitor and analyze trends, usage, and activities in connection with our services
• Detect, investigate, and prevent fraudulent transactions and other illegal activities
• Personalize your experience on our Site
• Comply with legal obligations

We process your Personal Information based on one or more of the following legal grounds:

• Your consent
• Performance of a contract with you
• Compliance with a legal obligation
• Our legitimate interests, provided they do not override your fundamental rights and freedoms

Data Retention

We retain your Personal Information only for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for Personal Information, we consider:

• The amount, nature, and sensitivity of the Personal Information
• The potential risk of harm from unauthorized use or disclosure
• The purposes for which we process the data and whether we can achieve those purposes through other means
• Applicable legal requirements

When we no longer need your Personal Information, we will securely delete or anonymize it. If this is not possible (for example, because your Personal Information has been stored in backup archives), we will securely store your Personal Information and isolate it from any further processing until deletion is possible.

Information Sharing and Disclosure

We may share your Personal Information with the following categories of recipients:

Service Providers

We may share your information with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf. These entities are restricted from using your Personal Information for any purpose other than to provide services for us.

Business Transfers

If we are involved in a merger, acquisition, financing, or sale of business assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your Personal Information.

Legal Requirements

We may disclose your Personal Information if we have a good faith belief that disclosure is necessary to:

• Comply with applicable laws, regulations, legal processes, or governmental requests
• Enforce our Terms of Service, including investigation of potential violations
• Detect, prevent, or address fraud, security, or technical issues
• Protect against harm to the rights, property, or safety of Quaflow, our users, or the public as required or permitted by law

With Your Consent

We may share your information with third parties when you have given us your consent to do so.

International Data Transfers

We may transfer, store, and process your Personal Information in countries other than your own. When we transfer Personal Information internationally, we implement appropriate safeguards to ensure your information receives an adequate level of protection, including:

• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules for transfers within our corporate group
• Compliance with regional data protection frameworks
• Obtaining your explicit consent for certain transfers

If you are located in the European Economic Area (EEA), United Kingdom, Brazil, or other regions with data protection laws that may restrict data transfers, please note that your Personal Information may be transferred to and processed in the United States and other countries that may not provide the same level of data protection as your jurisdiction.

Your Rights and Choices

Depending on your location, you may have certain rights regarding your Personal Information. These may include:

For All Users:

• Right to Access: You can request a copy of the Personal Information we hold about you.
• Right to Rectification: You can request correction of inaccurate or incomplete Personal Information.
• Right to Deletion: You can request deletion of your Personal Information in certain circumstances.
• Right to Restrict Processing: You can request restriction of processing of your Personal Information in certain circumstances.
• Right to Data Portability: You can request a copy of your Personal Information in a structured, commonly used, machine-readable format.
• Right to Object: You can object to our processing of your Personal Information in certain circumstances.
• Right to Withdraw Consent: You can withdraw consent at any time where we rely on consent to process your Personal Information.

For European Users (GDPR):

In addition to the rights above, European users have the right to:

• Lodge a complaint with a supervisory authority
• Not be subject to a decision based solely on automated processing, including profiling

For California Residents (CCPA):

California residents have the right to:

• Know what Personal Information is being collected about them
• Know whether their Personal Information is sold or disclosed and to whom
• Say no to the sale of their Personal Information
• Access their Personal Information
• Request deletion of their Personal Information
• Not be discriminated against for exercising their privacy rights

California residents can make requests regarding their Personal Information up to twice per year free of charge.

For Brazilian Users (LGPD):

Brazilian users have additional rights, including:

• Confirmation of the existence of processing
• Information about public and private entities with which the controller has shared data
• Information about the possibility of not providing consent and the consequences

For Australian Users (APP):

Australian users have rights under the Australian Privacy Principles, including:

• The right to request access to and correction of Personal Information
• The right to make a complaint about a breach of the APPs

For Indian Users (DPDP):

Indian users have rights under the Digital Personal Data Protection Act, including:

• The right to obtain a summary of Personal Information being processed
• The right to correction and erasure of Personal Information
• The right to nominate another person to exercise rights in case of death or incapacity

How to Exercise Your Rights

To exercise any of these rights, please contact us using the contact information provided at the end of this Privacy Policy. We will respond to your request within the timeframe required by applicable law.

For verification purposes, we may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Information (or to exercise any of your other rights).

Data Security

We implement appropriate technical and organizational measures to protect your Personal Information against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

• Encryption of sensitive data
• Regular security assessments
• Access controls and authentication procedures
• Staff training on data protection
• Incident response plans

While we strive to use commercially acceptable means to protect your Personal Information, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.

Children's Privacy

Our Site is not intended for children under the age of 18. We do not knowingly collect Personal Information from children under 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Information, please contact us. If we discover that a child under 18 has provided us with Personal Information, we will delete such information from our servers.

Third-Party Links and Services

Our Site may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to such third-party services. We recommend reviewing the privacy policies of any third-party services you access.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

We encourage you to review this Privacy Policy periodically for the latest information on our privacy practices. Your continued use of our Site after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

Specific Regional Provisions

European Economic Area and United Kingdom (GDPR)

If you are a European resident, the data controller of your Personal Information is QUAFLOW OÜ The legal bases for processing your information include:

• Consent: Where you have given clear consent for us to process your Personal Information for a specific purpose.
• Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legal Obligation: Where processing is necessary for compliance with a legal obligation.
• Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms.

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your Personal Information violates applicable law.

California (CCPA/CPRA)

California residents have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). In addition to the rights outlined above, California residents can:

• Opt-out of the sale or sharing of Personal Information
• Limit the use and disclosure of Sensitive Personal Information
• Access information about our data practices over the past 12 months

To exercise these rights, please contact us using the methods described in the "How to Exercise Your Rights" section.

We do not sell the Personal Information of users we know are under 16 years of age without affirmative authorization.

Brazil (LGPD)

For Brazilian users, we process your Personal Information in accordance with the Lei Geral de Proteção de Dados (LGPD). The legal bases for processing include:

• Consent
• Compliance with legal obligations
• Execution of contracts
• Legitimate interests
• Protection of life or physical safety
• Protection of rights in legal proceedings
• Health protection
• Credit protection

Australia (APP)

For Australian users, we comply with the Australian Privacy Principles (APP) contained in the Privacy Act 1988 (Cth). In addition to the rights outlined above, you have the right to:

• Request access to your Personal Information
• Request correction of your Personal Information
• Make a complaint to the Office of the Australian Information Commissioner

India (DPDP)

For Indian users, we comply with the Digital Personal Data Protection Act. In addition to the rights outlined above, you have the right to:

• Nominate another person to exercise your rights in case of death or incapacity
• File a complaint with the Data Protection Board of India

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

QUAFLOW OÜ
Email: privacy@quaflow.com
Address: Harju maakond, Tallinn, Kesklinna linnaosa, Veskiposti tn 2-1002, 10138, Estonia

For European users, our EU representative can be contacted at: eu-rep@quaflow.com

We will respond to your inquiry as soon as reasonably possible and within the timeframe required by applicable law.