Privacy at Prodyflow

Choose the notice that describes you:

• Website visitors: if you visit our website, or contact us or ask for a quote.
• Companies using Prodyflow: if your company uses Prodyflow to run its business.
• Shoppers: if you buy in a webshop that runs on Prodyflow.
• Developers: if you build apps or webshop templates for Prodyflow.

1. Who we are

Prodyflow is an online business platform (ERP, webshop and sales tools) operated by Weborigo ("we", "us"). This page explains how personal data is processed when you use Prodyflow and its website.

Our company details and the way to contact us about data protection are in the Weborigo privacy notice: https://weborigo.hu/adatkezelesi-tajekoztato

Questions and requests about personal data: contact@prodyflow.com

2. Our two roles

When a company (our customer, the "webshop") uses Prodyflow to run its business, the webshop is the controller of the personal data it puts into the system, such as the data of its own customers, orders, deliveries, invoices, employees and suppliers. The webshop decides why and how this data is used, and is responsible for its own privacy notice and for answering requests of the people concerned. In this case we are the processor: we process the data only on behalf of the webshop and on its documented instructions.

For the data we need to run our own relationship with the webshop (accounts, contracts, billing, support and security of the service), we are the controller.

For the visitors of our website and for the developers who use the developer portal, we are the controller of their data as well. Each of these groups has its own notice.

We also use data about how Prodyflow and the webshops running on it are used to develop, test and improve Prodyflow, and to fix errors. For this purpose we are the controller. For development we use only the data that is needed, and where possible in aggregated form.

3. Where data is stored

Server hosting is provided by Hetzner, Rackforest and Time4VPS. Backups are stored with Backblaze, in its EU region. DNS and network protection are provided by Cloudflare and Amazon Route 53. Our outgoing email is sent through a mail relay that runs on our own servers. Sign-up and login forms are protected against bots by hCaptcha. These providers store data or carry it as part of the service, and their own privacy notices apply to their services. Providers used for one purpose only are listed in the notice that concerns it.

Hosting, backup, network and security

4. Transfers outside the European Economic Area

Some of the providers are companies seated outside the EEA, or are part of groups that are, such as Google, Meta, Microsoft, Stripe, Name.com, Cloudflare and Amazon. Where personal data is transferred to a country without an adequacy decision, we rely on the safeguards of Chapter V of the GDPR, such as the standard contractual clauses or the provider's certification under the EU-US Data Privacy Framework, as available for that provider. Backups are stored in the EU region of the backup provider.

5. How we protect the data

We use technical and organisational measures that fit the risk, including:

If a personal data breach happens, we report it to the supervisory authority and inform those concerned as the law requires.

• the data of different webshops is kept apart from each other;
• access to the data is limited by roles;
• private files are available only through protected, time-limited access;
• regular backups, kept separately from the live systems;
• access to the live systems is limited to the people who need it.

6. Cookies and similar technologies

Cookies are small files or identifiers that a website stores on your device or reads from it. Our websites use only the cookies and similar technologies they need to work.

Measurement and advertising tools are loaded only after you consent to them, and you can withdraw your consent at any time. They are listed in the privacy notice for website visitors.

To show the pages, your browser also loads fonts and icons from third-party servers (Google Fonts and the cdnjs service of Cloudflare), which receive your IP address and browser details when doing so.

7. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing (including objecting to direct marketing at any time), to data portability, and to withdraw a consent you gave.

Whom to ask depends on who is the controller of your data: see the notice that describes you. For the data we process as controller, write to contact@prodyflow.com. We answer within one month; if needed, this can be extended by up to two further months, and we tell you why.

You may also lodge a complaint with the supervisory authority; in Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, 1055 Budapest, Falk Miksa utca 9–11., ugyfelszolgalat@naih.hu, https://naih.hu), and you may turn to a court.

8. Changes

When we add or replace a provider or change how we process data, we update this page first. The date of the last update is shown at the top. If a change is significant, we also tell registered users by email.