1. Who we are
1.1 APEXi Flow is a trading name of APEXi Digital Limited ("we", "us", "our"), a company registered in England and Wales under company number 17290313. Our registered office is Ingleby Road, Messingham, North Lincolnshire, DN17 3SS. We are not registered for VAT.
1.2 We are registered with the Information Commissioner's Office (ICO), registration number ZC276689.
1.3 To contact us about anything in this policy, write to support@apexiflow.com or to the address above. Enquiries and requests for a demonstration go to info@apexiflow.com, which is also the address our website's demonstration form uses. We have not appointed a Data Protection Officer because the law does not require one for us; privacy matters are dealt with by our Director.
1.4 We run the APEXi Flow website and application at apexiflow.com and app.apexiflow.com (the "Service").
2. What this policy covers, and what it does not
2.1 This policy covers personal data about people who use Flow as, or on behalf of, a training organisation: account owners, administrators, trainers and anyone we deal with about billing or support. It also covers anyone who contacts us or asks for a demonstration, including through our website. For that data we decide how and why it is used, so we are the "controller".
2.2 Training organisations also store information about their own candidates in Flow: registrations, results, signatures, identity checks, certificates and course records. The training organisation decides what is collected and why, so the organisation is the controller of that information and we are its "processor", acting only on its instructions and under the data processing terms in our Terms and Conditions (Schedule 1). If you are a candidate, please read the privacy notice of the organisation that registered you, and contact it, not us, to use your rights. If you contact us about candidate data, we will pass your request to the organisation concerned.
2.3 The Service may link to other websites, including Stripe's payment pages and the websites of training organisations. We do not control them. Please read their privacy notices.
3. What is personal data?
3.1 Personal data is any information about an identifiable living person, as defined by the UK GDPR and the Data Protection Act 2018 (together, the "Data Protection Legislation"). It covers obvious details such as a name and email address and less obvious ones such as an online identifier or an IP address.
4. What data we collect and how
4.1 We collect the following, depending on how you use the Service:
| Data | What it includes | How we get it |
|---|---|---|
| Identity and contact | name, email address, telephone number, job title, the organisation you belong to and your role in it | you, or the person who invited you |
| Sign-in | your email, a protected (hashed) password if you use one, passkey details if you set one up, and the identifier from Google if you choose to sign in with Google | you, and Google if you use it |
| Agreements | which version of our Terms and Conditions and Privacy Policy was agreed, by whom and when | you, when you set up an organisation |
| Profile | your preferences, and for trainers any qualifications and supporting documents you or your organisation upload | you or your organisation |
| Billing | the organisation's legal name and address, plan and invoices, and the brand and last four digits of a payment card. Full card numbers are held only by Stripe, never by us | the organisation, and Stripe |
| Communications | what you send us (support messages, issue reports, files), and a record of the emails Flow sends and whether they were delivered | you, and our email provider |
| Enquiries | your name, organisation, email address, telephone number and message, if you contact us or ask for a demonstration | you |
| Technical | IP address, device and browser type, sign-in times, and error reports | your device, automatically |
4.2 We do not intentionally collect special category data (such as health information) about account holders. If an organisation chooses to record such information about its candidates, that is its decision and its responsibility as controller.
4.3 You may choose not to give us some information, but you cannot use the Service without the details needed to create and secure your account.
5. How we use your data, and why
5.1 We must have a lawful basis for each use of personal data. These are ours:
| What we do | Data | Lawful basis |
|---|---|---|
| Create and run your account and give you the Service | identity and contact, sign-in, profile | Contract, or steps before a contract |
| Bill the organisation and take payment | billing | Contract; legal obligation (tax and accounting records) |
| Send you messages needed to use the Service (invitations, sign-in and security notices, billing notices, reminders you have set up) | identity and contact, communications | Contract; legitimate interests |
| Keep the Service secure, prevent fraud and abuse, and find and fix faults | technical, sign-in, error reports | Legitimate interests: keeping a service that holds other organisations' records safe and working |
| Give support and handle complaints | identity and contact, communications | Contract; legitimate interests |
| Reply to your enquiry or demonstration request, and arrange the demonstration | enquiries | Legitimate interests: answering people who ask about our service; and steps you ask for before a contract |
| Understand how the Service is used so we can improve it | technical (aggregated where we can) | Legitimate interests |
| Meet legal duties and respond to lawful requests | any | Legal obligation |
| Send the account owner and administrators updates about the Service: new and changed features, improvements, maintenance and tips on using it | identity and contact | Contract (these are part of the service we provide) and legitimate interests (keeping our customers informed about software they use). These are not marketing: they never promote offers, discounts or upgrades. Every one has a link to manage or stop them, and you can object at any time. We never send them to candidates, bookers or trainers whose details are held for an organisation |
| Send you marketing (offers, promotions, events or other products) by email | identity and contact | Consent. We send this only if you have asked for it, by a box that is never ticked for you, and you can withdraw at any time using the unsubscribe link in every such email |
5.2 We do not make decisions about you based only on automated processing that have a legal or similarly significant effect.
5.3 We will only use your data for the purpose we collected it for, unless we reasonably believe another purpose is compatible, in which case we will tell you. Where the law allows or requires, we may process data without telling you, for example in response to a court order.
6. How long we keep your data
6.1 We keep personal data no longer than is needed for the reasons we collected it:
| Data | How long |
|---|---|
| Your own sign-in, identity, contact and profile details | while you belong to at least one organisation on Flow. If you belong to none and have not signed in for 12 months, we email you and, if you do not sign in after that email, delete them. You can ask us to delete them sooner |
| An organisation's records, including its candidates | until the organisation's account is finally closed, then deleted, except the certificate verification records and our billing records described in section 12 of the Terms and Conditions |
| Billing records (invoices and payment records) | 6 years from the end of the financial year in which they were issued, as tax and company law require |
| The record of who agreed to our Terms and Conditions and Privacy Policy for an organisation, which version and when | while the organisation's account exists, then 6 years after it closes, as evidence of the contract |
| Support messages and issue reports | 2 years after the matter is closed |
| Enquiries and demonstration requests that do not lead to an account | 2 years after our last contact with you |
| Error reports | 90 days |
| Sign-in and security logs | 12 months |
| Backups | 7 days: data deleted from the live system disappears from backups within 7 days |
6.2 When an organisation closes its account, the closure process in our Terms and Conditions applies, including how it can export its data first and when everything is permanently deleted.
7. Where we store and send your data
7.1 We store your data with the providers listed in section 8. The main database is held in the United Kingdom (London). Uploaded files are stored in Cloudflare R2 in the EU. Emails are sent from Ireland, but our email provider stores its account data and logs in the United States. The application itself runs on Cloudflare's global network, close to the visitor, and stores nothing there beyond what is needed to deliver each page.
7.2 Some providers are based in, or can access data from, the United States. Where personal data goes outside the UK we rely on one of: an adequacy decision (the EEA and the UK–US Data Bridge for certified companies), or the ICO's International Data Transfer Agreement or UK Addendum to the EU standard clauses. Contact us if you want to see the safeguard used for a particular provider.
7.3 We protect your data with, among other measures: encrypted connections (HTTPS) everywhere; sessions that expire after inactivity; a session cookie that scripts on a page cannot read; passkey sign-in as an option; storage that keeps each organisation's data separate; private file storage with time-limited access; and limiting staff access to people who need it, all under a duty of confidentiality. We have a procedure for personal data breaches, and will tell the ICO and anyone affected where the law requires. No online system is completely secure, so we cannot promise absolute security.
8. Who we share your data with
8.1 We use these providers to run the Service. Each acts as our processor and may use your data only to provide its service to us:
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | database and sign-in | United Kingdom (London) |
| Cloudflare | hosting the application and storing uploaded files (R2) | Cloudflare's global network; uploaded files stored in the EU |
| Resend | sending the emails Flow sends and recording delivery | emails sent from Ireland; account data and logs stored in the United States |
| Stripe | taking and managing payments, and card storage | Stripe's global network, including the United States |
| Cloudflare Turnstile | checking that a visitor to a sign-in, sign-up or forgotten-password form, or about to make a paid booking, is a real person, to stop automated abuse. | Cloudflare's global network |
| Sentry | recording technical errors so we can fix them (personal details are removed before sending where we can) | EU (Germany) |
| optional sign-in with Google | United States |
8.2 We may also share personal data with professional advisers (lawyers, accountants and insurers) under duties of confidentiality, and with the police, courts, regulators or other public authorities where the law requires.
8.3 If we sell or merge our business, your data may pass to the new owner, who must keep using it as this policy says.
8.4 We do not sell your personal data.
9. Cookies and similar technologies
9.1 A cookie is a small file a website places on your device. We also use your browser's local and session storage in the same way. We use them under the Privacy and Electronic Communications Regulations 2003 (PECR). Everything below is strictly necessary to provide the Service you ask for or to remember choices you make, so the law does not require your consent.
9.2 What we use:
| Name | Type | What it does | How long |
|---|---|---|---|
apexi-refresh | first-party cookie, HttpOnly | keeps you signed in on this device | up to 30 days, or until you sign out |
| Selected organisation and role | local storage | remembers which of your organisations you are working in | until you clear browser data |
| Screen settings (for example menus folded away, notices already seen, setup guides finished) | local storage | remembers how you left the screen | until you clear browser data |
| Page history within a session | session storage | makes the Back button work | until you close the tab |
| Cloudflare Turnstile (on sign-in, sign-up, forgotten-password and paid-booking pages) | third-party, set by Cloudflare | checks the visitor is a real person, to stop automated abuse; needed to keep the Service secure | for the visit, or as Cloudflare's notice says |
| Stripe (only on pages that take a payment) | third-party, set by Stripe | detecting and preventing fraud on payments | as Stripe's notice says |
Cloudflare and Stripe set these cookies themselves and may change them, so we describe what they do instead of listing their names. See Cloudflare's and Stripe's own cookie and privacy notices for details. Both are strictly necessary for security and fraud prevention, so the law does not require your consent for them.
9.3 We do not use analytics, advertising or tracking cookies. If we add any, we will update this policy and ask for your consent first.
9.4 You can block or delete cookies in your browser settings, but you will not be able to stay signed in.
10. Your rights
10.1 Under the Data Protection Legislation you have the right to: be informed about how we use your data; access it; have it corrected; have it erased; restrict how it is used; object to its use; withdraw consent where we rely on it; receive it in a portable form; and not be subject to certain automated decisions. These rights have conditions, and we will tell you if one stops us acting on a request.
10.2 To use a right, contact us as in section 1.3. We may ask for proof of identity first and will keep you informed.
10.3 It is important that the data we hold is accurate. Please tell us if your details change.
11. Seeing the data we hold about you
11.1 You can ask us for a copy of the personal data we hold about you (a "subject access request"). Please write to the contact in section 1.3. A form is not required, but giving us enough detail helps us reply quickly.
11.2 There is normally no charge. If a request is manifestly unfounded or excessive we may charge a reasonable administrative fee or refuse it, and we will explain why.
11.3 We will reply within one month of receiving the request and your identity being confirmed. If your request is complex or you have made several, we may extend this by up to two further months, and we will tell you within the first month. If we need to ask you for more detail to find your information, the time limit pauses until you answer. We carry out reasonable and proportionate searches for the information.
12. Complaints
12.1 If you are unhappy with how we have used your data, please tell us as in section 1.3. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
12.2 You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
13. Children
13.1 The Service is for business use and its account holders must be over 18. We do not knowingly collect account data from children. Information about candidates, who may be younger, is recorded by the training organisation as controller.
14. Changes to this policy
14.1 We may change this policy, for example if the law changes or we change the Service. The current version is always on this page with its version number and date. For a significant change we will email the account owner before it takes effect. Please check this page from time to time.
15. Contact
15.1 APEXi Digital Limited (trading as APEXi Flow), Ingleby Road, Messingham, North Lincolnshire, DN17 3SS. Email support@apexiflow.com (or info@apexiflow.com for enquiries and demonstrations).