Privacy Policy

1. Who We Are

Hubflow is an individually operated business, not an incorporated company.

• Business operator: Abdullah Anjum
• Trading name: Hubflow
• Operating location: Lahore, Pakistan
• Privacy enquiries: privacy@hubflowhq.com
• General enquiries: hello@hubflowhq.com
• Correspondence address: [CONFIRM: Serviceable postal or correspondence address, if required by applicable law]

Lahore, Pakistan describes the business’s operating location. It is not presented as a complete postal address or as an address for formal service of documents.

When we determine why and how personal information is processed for our own enquiries, website operations and business administration, we act as the controller where that term applies under relevant law.

When we process information on a client’s documented instructions, our role may instead be that of a processor or service provider, depending on the arrangement.

2. Websites Covered by This Policy

This policy applies to the following Hubflow-operated web addresses:

• hubflowhq.com
• hubflowhq.de
• hubflow.uk
• hubflow.si

These websites may have different landing pages, contact forms, integrations, scripts or measurement technologies. The presence of a technology on one domain does not mean that it is deployed on every other domain.

Domain-specific collection and tracking information is set out here: [CONFIRM: Actual form destinations, analytics, advertising tags and consent arrangements for each of the four domains]

Our central Cookie Policy provides information about cookies and similar technologies.

3. Our Own Processing and Client-Directed Processing

Two different types of processing may occur in connection with Hubflow.

Hubflow’s own business processing: We handle personal information to receive and respond to enquiries, communicate with prospective and existing clients, prepare proposals, manage agreements, administer payments and maintain our business.

For these activities, Hubflow ordinarily determines the relevant business purposes and means of processing.

Processing on behalf of clients: Client projects may involve personal information contained in customer conversations, CRM records, support tickets, invoices, documents, scheduling systems or other connected business applications.

Where Hubflow processes this information on the client’s instructions, the client ordinarily determines the purposes of the processing and is responsible for providing an appropriate privacy notice to the affected individuals.

Applicable project agreements and data-processing arrangements define the parties’ responsibilities.

If your information is held in a client’s system, you should normally contact that client first. We assist the client according to the applicable agreement and legal obligations.

4. Personal Information We Collect

Depending on how you interact with Hubflow, the information involved may include:

• Identity and contact details: Name, business email address, telephone number and job title.
• Business information: Organisation name, website, industry and business requirements.
• Enquiry information: Selected service, project description, budget or timing information, where requested in a form, and other details you provide.
• Communications: Messages, meeting arrangements, correspondence and support requests.
• Commercial information: Proposals, contracts, invoices, transaction records and related administrative information.
• Technical information: IP addresses, browser or device characteristics, security events and server or application logs, where collected by the relevant system.
• Website interaction data: Page visits, identifiers and interaction events, to the extent recorded by technologies actually enabled on the relevant domain.
• Client project information: Personal information provided or made accessible through agreed client systems and workflows.

Not every category is collected during every interaction, and different project arrangements may involve different data.

Please do not submit passwords, access tokens, full payment-card details or sensitive personal information through general enquiry forms.

5. Where Information Comes From

Information may be obtained:

• Directly from you when you contact Hubflow, submit an enquiry or discuss a project.
• From a business or organisation that authorises you to communicate with us.
• Through communications and records generated while managing an agreed client relationship.
• From systems connected or made accessible for an agreed project.
• Automatically from website infrastructure or enabled measurement technologies, depending on the relevant domain.

Where client-directed services involve additional sources, those sources and permissions are determined through the client engagement.

6. Why We Use Information

Hubflow uses information for purposes relevant to its websites and business activities:

• Receiving, assessing and responding to enquiries.
• Preparing quotations, proposals and agreements.
• Communicating about prospective or existing engagements.
• Designing, delivering and supporting agreed services.
• Administering invoices, transactions and business records.
• Maintaining website functionality and investigating technical problems.
• Protecting against unauthorised access, abuse and security incidents.
• Complying with applicable legal requirements and handling relevant disputes.

Website analytics, advertising measurement or other optional tracking activities must be described according to their actual configuration and applicable user choices.

[CONFIRM: The actual purposes and operation of non-essential tracking on each domain]

We may be unable to respond to an enquiry or provide a requested service if essential information is not supplied.

7. Legal Bases for Processing

Where UK GDPR, EU GDPR or another applicable law requires a lawful basis, the relevant basis depends on the activity, the relationship with the individual and the actual circumstances.

Contractual necessity under UK or EU GDPR does not automatically apply to every employee or representative of a corporate client.

Legitimate interests require an appropriate assessment of necessity and the impact on affected individuals.

[CONFIRM: Actual lawful basis assigned to each website tracking, enquiry, relationship-management and other controller-processing activity, including any required legitimate-interest assessments]

Where valid consent is the basis for processing, you may withdraw it. Withdrawal does not affect processing lawfully carried out before withdrawal.

8. Website Forms and Communications

When you submit a Hubflow contact form, the information you enter is used to handle the enquiry and related communications.

Different Hubflow domains or landing pages may use different form fields, verification services, submission mechanisms and storage arrangements.

The following operational details must reflect the actual configuration:

[CONFIRM: Form processors, recipients, storage locations, submission destinations and any CRM or email integrations used on each domain]

Submitting an enquiry does not by itself create a paid service contract.

Please avoid including information that is unnecessary for your enquiry.

9. Demonstrations and Example Data

Hubflow websites may contain interactive demonstrations, sample conversations, example CRM records or simulated automation workflows.

Fictional names, records, invoices, messages and scenarios shown as examples are demonstration content, not evidence of actual customer transactions.

A fictional demonstration record is different from real personal information that a visitor enters into a form or other interactive feature.

If a demonstration accepts user-entered information, any collection, transmission, storage or tracking of that information must be described according to its implementation.

[CONFIRM: Which interactive demonstrations, if any, transmit, log or store real visitor inputs or related usage events]

10. AI and Automated Workflows

Hubflow services may involve AI and automation for approved tasks such as drafting responses, retrieving information, classifying enquiries, processing documents, updating records and supporting business workflows.

Some projects may require information to be transmitted to selected AI, communication or automation providers.

The providers, data categories, purposes, access arrangements, retention settings and contractual restrictions depend on the specific project.

Client-directed processing must follow the agreed instructions and applicable processing arrangements.

We do not make a general promise that every external AI provider applies zero retention, prohibits all model training or processes data in a particular country.

These matters must be addressed through the actual provider arrangements and applicable project documentation.

[CONFIRM: Whether Hubflow’s own website or enquiry systems send personal information to AI providers and, if so, the relevant recipients and purposes]

[CONFIRM: Whether any Hubflow-controlled processing involves solely automated decisions with legal or similarly significant effects, and any required disclosures]

11. Who May Receive Information

Depending on the service or website configuration, personal information may need to be disclosed to relevant categories of recipients, including:

• Website infrastructure and hosting providers.
• Business email and communication services.
• Form submission, enquiry management and CRM services.
• Scheduling and project management services.
• Accounting and payment service providers.
• AI and workflow automation services used for agreed processing activities.
• Analytics, advertising or measurement providers, where enabled.
• Authorised contractors and professional advisers, where applicable.
• Public authorities and other recipients where disclosure is legally required.

This list describes possible recipient categories. It does not mean every category is used on every website or project.

[CONFIRM: Actual recipients and processors for hosting, email, forms, analytics, advertising, CRM, payments and any Hubflow-controlled AI processing]

For client projects, the permitted systems, providers and disclosures are addressed in the relevant agreement and processing instructions.

12. International Processing and Transfers

Hubflow operates from Lahore, Pakistan. Personal information handled for enquiries, business administration or client services may therefore be accessed or processed from Pakistan.

Where external services are used, information may also be processed or stored in other countries, depending on the selected provider and configuration.

We do not make a blanket commitment that information remains exclusively in Pakistan, the United Kingdom or the European Union.

Where applicable law restricts international transfers, the parties must establish an appropriate lawful basis and any required safeguards for the actual transfer.

[CONFIRM: Countries of actual processing and storage, relevant international-transfer mechanisms and supplementary measures, where required]

You may contact privacy@hubflowhq.com with questions about relevant transfer arrangements and information that can lawfully be provided about them.

13. How Long Information Is Kept

Retention depends on the purpose of processing, contractual requirements, relevant legal duties and any applicable claims.

Different record categories may require different periods:

• Enquiries: Retention relevant to handling an enquiry, any continuing relationship and legitimate recordkeeping needs.
• Client and project records: Retention relevant to delivery, support, contracts and applicable claims.
• Accounting information: Retention required by applicable accounting and tax obligations.
• Security and technical logs: Retention appropriate to investigating incidents, protecting services and resolving technical issues.
• Client-directed information: Retention governed by relevant client instructions, contractual terms and legal requirements.

[CONFIRM: Actual retention periods or sufficiently specific determination criteria for enquiry records, client records, accounting data, technical logs and tracking information]

[CONFIRM: Backup retention, backup access, expiry and restoration-related deletion procedures]

Deletion from an active system does not necessarily result in immediate deletion of every backup copy.

14. Your Privacy Rights

Depending on the law applicable to your information and the circumstances, you may be entitled to:

• Request access to personal information.
• Request correction of inaccurate information.
• Request deletion of eligible information.
• Request restrictions on certain processing.
• Object to processing in relevant circumstances.
• Request portability of eligible information.
• Withdraw consent where consent is the applicable basis.
• Exercise applicable rights concerning qualifying automated decisions.
• Object to direct marketing where the relevant right applies.

To make a request, email privacy@hubflowhq.com . No special request form is required.

We may ask for proportionate information needed to verify your identity and locate the relevant records.

Requests are subject to applicable legal conditions, exceptions and response timeframes.

If the information is controlled by a client, the request may need to be handled by that client, with assistance from Hubflow as appropriate.

15. Deletion and Connected Accounts

You may ask about deletion of information controlled by Hubflow by contacting privacy@hubflowhq.com .

Requests are assessed according to applicable rights, legal exceptions and recordkeeping obligations.

Where a client authorises a connection to an external system, disconnecting access and deleting information already processed are separate matters.

Revocation or disconnection may need to be performed through the connected provider or client system.

Client-controlled data is handled according to the relevant client’s instructions and applicable obligations.

16. Cookies and Similar Technologies

Hubflow websites may use cookies, pixels, scripts, local storage and similar technologies for functionality, security, analytics or other configured purposes.

The technologies and available choices may differ between hubflowhq.com, hubflowhq.de, hubflow.uk and hubflow.si.

See our central Cookie Policy for relevant information.

[CONFIRM: Cookie and tracking inventory, purposes, providers, expiry periods, consent behaviour and method for changing choices on each domain]

You can also manage some technologies through browser settings. Blocking certain technologies may affect website functions.

Browser controls are not necessarily a replacement for any consent mechanism required by applicable law.

17. Security

The handling of personal information should be supported by technical and organisational measures appropriate to the processing risks, contractual requirements and applicable law.

Specific measures depend on the systems, accounts and services in use.

[CONFIRM: Actual security arrangements for website forms, business communications, storage, access management, backups and incident handling]

No online transmission or storage environment can be guaranteed completely risk-free.

General information about Hubflow’s approach can be found on the Security & Data page.

You may report suspected privacy or security issues to privacy@hubflowhq.com .

18. Questions and Complaints

For questions or concerns about the processing of your personal information, contact privacy@hubflowhq.com .

Depending on the law that applies to your information, you may also have a right to complain to the relevant supervisory or regulatory authority.

Where UK data-protection law applies, information about complaints is available from the Information Commissioner’s Office .

Where EU or EEA data-protection law applies, you may contact the competent supervisory authority in the relevant jurisdiction.

You do not have to contact Hubflow before exercising an applicable statutory right to complain.

19. Changes to This Policy

This policy may be updated to reflect changes in Hubflow’s services, processing activities or applicable requirements.

Where required by law, appropriate additional information or notice will be provided for material changes.

Any publication or last-updated date should reflect the date on which the relevant version is actually adopted.

20. Related Legal Information

You can also read:

• Cookie Policy — cookies, pixels and related website technologies.
• Terms & Conditions — website use and contractual arrangements.
• Security & Data — general security and data-handling information.

Where a separate project agreement or data-processing agreement applies, its relevant provisions also govern the engagement.