PRIVACY

Last updated: 5 October 2026

This Privacy Policy explains how Flow & Form handles personal information collected through this website, enquiries and our business relationships. We aim to process personal information lawfully, fairly and transparently in line with South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA). Where privacy laws such as the EU GDPR or UK GDPR apply to a particular visitor or processing activity, we also aim to respect the rights and transparency standards required by those laws. This policy should be read together with our Cookie Policy and PAIA Manual.

For information collected through this website and direct enquiries, Flow & Form is the responsible party / controller unless another arrangement is stated. We are based in the Kloof / Hillcrest area of KwaZulu-Natal, South Africa. Privacy enquiries can be sent to lisafernandes65@gmail.com.

We may collect information you choose to provide, such as your name, email address, business name, project information and the contents of an enquiry. Technical information may also be processed when you use the website, such as IP address, device or browser information, security logs, pages viewed and analytics information where measurement tools are enabled.

We may use personal information to respond to enquiries; prepare proposals or provide requested services; communicate with clients and prospects; manage projects and business records; operate, secure and improve the website; understand website performance where analytics is enabled; comply with legal, tax, accounting or regulatory duties; and establish, exercise or defend legal rights.

Depending on the context, we process information because it is necessary to respond to your request or perform a contract, because we have a legitimate business interest that does not override your rights, because we must comply with law, or because you have given consent. Where consent is the basis, you may withdraw it at any time for future processing.

We may use trusted service providers for website hosting, security, analytics, communications, email, project delivery and similar business functions. We only share information that is reasonably necessary for the relevant purpose. We do not sell personal information to advertisers.

Because we work internationally and may use global cloud or technology providers, personal information may be processed outside South Africa. Where required, we take reasonable steps to ensure that cross-border processing is subject to appropriate safeguards and complies with applicable transfer requirements, including POPIA and, where applicable, GDPR or UK GDPR transfer rules.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, for an ongoing client relationship, or to meet legal, tax, accounting, security or dispute-resolution obligations. Retention periods vary according to the type of record and the reason it is held.

Subject to applicable law, you may ask us to confirm whether we hold personal information about you, request access or correction, object to certain processing, request deletion where appropriate, or withdraw consent. If GDPR or UK GDPR applies, additional rights may include restriction, portability and objection to certain automated or direct-marketing processing. We may need to verify your identity before acting on a request.

We use reasonable technical and organisational measures to protect personal information against loss, unauthorised access, alteration, misuse or disclosure. No internet transmission or storage system can be guaranteed to be completely secure.

This website and our services are directed primarily at businesses and adults. We do not knowingly seek personal information from children through this website. If you believe a child has provided personal information to us inappropriately, contact us so we can review and, where appropriate, delete it.

This website may link to external websites or services. Their privacy practices are controlled by their own operators. We recommend reviewing their privacy notices before submitting personal information to them.

Please contact us first if you have a privacy concern so that we can try to resolve it. In South Africa, you may also lodge a complaint with the Information Regulator. Current contact details published by the Regulator include Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg; telephone 010 023 5200; and enquiries@inforegulator.org.za. If EU or UK data-protection law applies to your situation, you may also have the right to complain to the relevant supervisory authority in that jurisdiction.

We may update this policy when our practices, services or legal obligations change. The latest version will be published on this page with the updated date.

Privacy requests and questions can be sent to lisafernandes65@gmail.com.