DATA PROCESSING INFORMATION

Last updated: 8 August 2026

This document applies to FlowNest Workspace ("we", "us", "our"), a UK sole trader business operated by Mohammad Sahamulla of 43 East Road, Feltham, TW14 8DG, United Kingdom. You can contact us at info@flownestworkspace.co.uk or +44 7344 062403.

1. Roles

Where you use FlowNest Workspace to store information about your own clients and staff, you act as the data controller and we act as your data processor. For information we collect about you directly, such as your enquiry or purchase details, we act as the controller.

2. Subject matter and duration

We process customer data for as long as your licence is active, plus a 30 day export grace period, unless a longer period is required by law or you ask for earlier deletion.

3. Nature and purpose of processing

Storage, organisation, retrieval, backup, transmission and deletion of workspace content for the purpose of providing the software and supporting you in using it.

4. Categories of data and data subjects

• Data subjects: your staff, your clients and any other individuals whose details you enter.
• Categories: names, contact details, business information, project content, notes, uploaded files and activity records.
• You should not store special category data in the workspace unless you have confirmed with us that appropriate additional safeguards are in place.

5. Our obligations as processor

• Process data only on your documented instructions, unless required otherwise by law.
• Ensure anyone with access is bound by confidentiality.
• Apply appropriate technical and organisational security measures.
• Assist you with data subject requests, impact assessments and breach notifications.
• Delete or return data at the end of the relationship, subject to legal retention requirements.
• Make available the information needed to demonstrate compliance.

6. Sub-processors

We use a small number of carefully selected sub-processors: our hosting provider for infrastructure, Stripe for payment processing and our email provider for transactional messages. Each is bound by written data protection terms. We will tell you before adding or replacing a sub-processor that handles workspace content.

7. Security measures

Encryption in transit and at rest, access control on a least-privilege basis, separate administrative credentials, regular patching, automated daily backups with tested restores, and logging of administrative access.

8. Personal data breaches

If a breach affecting your data occurs, we will notify you without undue delay and in any event within 48 hours of becoming aware, providing the details you need to meet your own regulatory obligations.

9. International transfers

Data is hosted in the United Kingdom and the European Economic Area. Any transfer outside these areas is protected by appropriate safeguards such as UK adequacy regulations or an International Data Transfer Agreement.

10. Audit and assistance

On reasonable written request, and no more than once a year unless required by a regulator, we will provide information demonstrating compliance with these obligations.

Contact us

If you have any questions about this document, email info@flownestworkspace.co.uk, call +44 7344 062403 or write to FlowNest Workspace, 43 East Road, Feltham, TW14 8DG, United Kingdom. We aim to respond to all written enquiries within five business days.