Privacy Policy

Winning Flows is a trade name of Trustive Commerce, registered with the Dutch Chamber of Commerce (KVK) under number 98032631. We are the controller for the processing of personal data as described in this privacy policy, in accordance with the EU General Data Protection Regulation (GDPR / AVG).

1. What data do we collect?

We process personal data that you provide to us directly, for example through forms on our website, lead forms on Facebook and Instagram, email or WhatsApp:

• First and last name
• Email address
• Website or webshop URL
• Phone number (if you contact us via WhatsApp or phone)
• Business details (company name, billing information) when you become a client
• The content of our correspondence

When you visit our website, we may also process technical data such as IP address, browser type and browsing behaviour (see section 8, Cookies).

2. Why do we use your data?

• Delivering your free email marketing audit: preparing and sending the audit you request from us
• Contact and follow-up: responding to your request by email or WhatsApp
• Providing our services: onboarding, project communication and invoicing when you become a client
• Marketing: sending emails with relevant information and offers, only when you have given consent or are an existing client
• Advertising: measuring and improving our ad campaigns on Meta platforms (Facebook and Instagram)

3. Legal basis for processing

• Consent: for example when you submit a form for the free audit or sign up for our emails. You may withdraw your consent at any time.
• Performance of a contract: when you are or become a client.
• Legal obligation: for example the statutory retention period for financial records.
• Legitimate interest: for example following up on a business enquiry you submitted to us.

4. How long do we keep your data?

• Lead data (enquiries that do not lead to a collaboration): up to 2 years after our last contact, after which your data is deleted.
• Client data: for the duration of the collaboration and up to 2 years after it ends, unless a longer statutory period applies.
• Invoice and administrative records: 7 years, in accordance with the Dutch tax retention obligation.
• Email marketing profiles: until you unsubscribe or withdraw your consent.

5. Who do we share your data with?

We never sell your data. We only share data with parties that support our services (processors), including:

• Klaviyo: email marketing and lead management
• Meta Platforms (Facebook / Instagram): lead forms and advertising
• Google (Workspace, Forms, Sheets): forms, storage and administration
• Slack: internal project communication
• WhatsApp (Meta): client communication

Data processing agreements apply with these parties where required. Some of these providers are based in the United States. Transfers of data outside the EU only take place with appropriate safeguards in place, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. Data we process on behalf of our clients

When we provide our services, we work in our clients' email marketing platforms, such as Klaviyo. For the personal data of our clients' subscribers and customers, our client is the controller and we act as processor. We process this data only to perform our services and on our client's instructions, keep it confidential and take appropriate security measures. Questions about this data can be directed to the store concerned. Further arrangements are set out in our Terms & Conditions and the agreement with the client.

7. How do we protect your data?

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Our website uses a secure connection (HTTPS) and access to personal data is limited to team members who need it for their work.

8. Cookies and tracking

Our website may use cookies and similar technologies, including the Meta Pixel, to analyse website usage and measure the effectiveness of our advertising. We ask for your consent before placing non-essential cookies via a cookie notice. You can delete or block cookies at any time through your browser settings.

9. Your rights

Under the GDPR you have the following rights:

• Access to the data we process about you
• Rectification of inaccurate data
• Erasure of your data ("right to be forgotten")
• Restriction of processing
• Data portability
• Objection to processing, including direct marketing
• Withdrawal of consent, without affecting prior lawful processing

To exercise any of these rights, email us at winningflows@gmail.com. We will respond within 4 weeks. We may ask you to verify your identity before handling your request.

If you believe we are not handling your data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

10. Changes to this policy

We may update this privacy policy from time to time. The most recent version is always available on this page. In the event of significant changes, we will inform you actively.

Trustive Commerce, trading as Winning Flows, KVK 98032631