Privacy notice for companies

1. Introduction

This notice is for the companies (“webshops”) that use Prodyflow to run their business, and for the people who work for them. It explains which data we process for you and for ourselves, who helps us, and how the AI features work.

Who we are, our two roles, and what applies to everything (where data is stored, transfers outside the EEA, security, cookies, your rights) are in the privacy overview.

2. Data processed on behalf of webshops

Depending on the modules a webshop uses, Prodyflow stores and processes:

Contact, delivery and invoicing details: of the webshop's customers and partners (name, address, email, phone, tax number).
Orders and payments: orders, baskets, returns and invoices, and the status and references of payments. The card data itself is handled by the payment provider the webshop chose.
Messages and support tickets: customer messages and tickets, including attachments uploaded by customers or staff.
Staff accounts: the webshop's staff accounts, roles, and their activity in the system.
Business data and files: product, stock, production and other business data, and files such as images, documents and videos.
Technical data: logs, IP addresses, device and browser information needed to run the service.

3. Data we process as controller

For our own purposes we process the following about the people who register for, use or contact Prodyflow:

Account and contact data: name, email, phone, company details and the language setting.
Contract and billing data: contract, subscription, payment and invoicing data.
Communication with us: support requests, contact and quote requests, and messages.
Security and technical logs: logs of the service kept for its security and operation.
Usage data: data about how you and your webshop use Prodyflow (features used, errors, performance), used to develop, test and improve it. For development we use only the data that is needed, and where possible in aggregated form.

4. Purposes and legal bases

As processor, we process data to provide the service to the webshop, on the webshop's instructions (Article 28 GDPR). The webshop chooses the purposes and the legal basis of its own processing. For the data we process as controller, the table shows why we do it and on what legal basis.

Data	Purpose	Legal basis
Data processed on behalf of webshops	Providing the service to the webshop	The webshop's instructions (Article 28 GDPR); the webshop chooses its own legal basis
Account and contact data	Creating and running your account, contacting you about the service	Performance of the contract (Article 6(1)(b))
Contract and billing data	Concluding the contract, managing the subscription, invoicing and payment	Performance of the contract (Article 6(1)(b)); legal obligation for accounting and tax records (Article 6(1)(c))
Communication with us	Answering contact, quote and support requests	Steps before or under the contract (Article 6(1)(b)); legitimate interest in answering requests (Article 6(1)(f))
Security and technical logs	Security, stability and improvement of the service, handling claims	Legitimate interest (Article 6(1)(f))
Usage data about the service and webshops	Developing, testing and improving Prodyflow, fixing errors, analysing how the service and webshops are used	Legitimate interest in improving the service (Article 6(1)(f))
AI chat conversations	Providing the AI features you use	Performance of the contract (Article 6(1)(b))

5. Who may receive personal data

Depending on the modules a webshop uses, we may give personal data to the following categories of recipients:

Service providers: companies that host, protect or support our systems, take payments or issue invoices for us. They are listed below and in the privacy overview.
Integrations chosen by the webshop: payment providers, couriers or invoicing services that the webshop switches on. The webshop chooses and contracts them and is responsible for them; we send them only the data the integration needs.
Legal reasons: to comply with the law or answer a valid legal request, to detect and prevent fraud and abuse, and to protect our rights and those of our customers.
Change of control: actual or prospective acquirers and their advisers in a sale, merger or restructuring of our business, under confidentiality.
Sharing at your instruction: where you or the webshop authorise it.

6. Sub-processors and where data is stored

To run Prodyflow we use providers that store data or carry it as part of the service, and their own privacy notices apply to their services. The providers that host and protect our systems are in the privacy overview.

Subscriptions are invoiced through Billingo, which issues the invoices on our behalf. Payments are handled by Stripe and Revolut. They process the payment under their own rules, including fraud and money-laundering prevention, so for that part they act as independent controllers. We do not store card data.

If you buy a domain through Prodyflow, the registration data (the registrant's name, address, email and phone number) is passed to the registrar, Name.com or DotRoll, and from there it can reach the domain registry, as the rules of domain registration require.

Invoicing and payments of subscriptions

Provider	What it does	Seat	Data location	Privacy notice
Billingo	Invoicing (issues the invoices)	Hungary	—	Read
Stripe	Payment processing of subscriptions	Ireland	—	Read
Revolut	Payment processing of subscriptions	Lithuania	—	Read

Only when you buy a domain through Prodyflow

Provider	What it does	Seat	Data location	Privacy notice
Name.com	Domain registration	United States	—	Read
DotRoll	Domain registration	Hungary	—	Read

7. AI features

Prodyflow has AI features, such as the chat, message analysis, translation, writing help and workflows. They run on language models that we operate on our own servers (Prodyflow AI), so the text does not leave our infrastructure. Conversations of the AI chat are deleted after 30 days of inactivity.

A webshop may connect an AI provider of its own choice. In that case the webshop is responsible for that provider, and the data it sends to it.

We do not make decisions about you that are based solely on automated processing and have legal or similarly significant effects on you. The AI prepares suggestions and drafts, and a person decides.

8. Retention and deletion

The webshop decides how long its own data is kept, and can delete it in the system. For example, the files of tickets can be set to expire after a number of days, and then they are deleted, together with their backup copy.

When the contract ends, the data of the webshop is returned or deleted as agreed in the contract. Data we keep as controller is kept for as long as the contract lasts and afterwards for the periods our legal obligations and the limitation of claims require.

How long we keep data depends on:

The contract: data is kept while the contract lasts.
The law: accounting, tax and other rules can require us to keep data longer.
Claims: data can be kept while a claim could be made.
The webshop's instructions: the webshop decides how long its own data is kept.

9. Your rights

Your rights under the GDPR are described in the privacy overview. Whom to ask depends on who is the controller of the data. For the data of a webshop's customers, the webshop is the controller. For requests that cannot be done in the system, write to us.

A company can do much of this itself in the system:

View and correct: customer, partner and order data can be opened and edited by the webshop's staff with the right role.
Export: orders, customer and partner records, products and warehouse data can be exported to Excel, CSV or PDF.
Delete: customer and partner records can be deleted in the system.
Expiry: the files of tickets can be set to expire after a number of days, and AI chat conversations are deleted after 30 days of inactivity.

10. How to contact us

Questions about how Prodyflow processes data for companies: contact@prodyflow.com. Our company details are in the privacy overview.

Privacy notice for companies using Prodyflow