MicroFlow Enablement Ltd

Version 1.0 | Last updated: May 2026

Data Controller	MicroFlow Enablement Ltd
Registered in	England and Wales
Company Number	17197302
ICO Registration	Pending — registration to be obtained before platform launch (required under Data Protection (Charges and Information) Regulations 2018)
Registered Address	20-22 Venture West, Greenham Business Park, Newbury, RG19 6HX
Data Protection Lead	Greg de Bressac
Contact	dpo@microflowenablement.com

1. About This Policy

This Privacy Policy explains how MicroFlow Enablement Ltd (“MicroFlow”, “we”, “us”, “our”) collects, uses, stores, and shares personal data in connection with the MicroFlow platform and any related services.

MicroFlow operates as both a data controller and a data processor, depending on the nature of the processing activity:

As a data controller: when we collect and use personal data for our own operational purposes, including account management, billing, marketing communications, and platform administration.
As a data processor: when we process personal data on behalf of our vendor clients (“Clients”) in the course of delivering the MicroFlow platform to their channel partner users (“Partners”). In this capacity, our obligations are governed by a separate Data Processing Agreement (DPA) with each Client.

This policy applies to individuals whose data we process as controller. If you are a Partner user accessing MicroFlow on behalf of your employer at the direction of a vendor Client, please also refer to the privacy policy of the relevant Client, who acts as controller in respect of your participation in their enablement programme.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Personal Data We Collect

2.1 Client Account Data

When a vendor Client signs up for MicroFlow, we collect:

Full name, job title, and business email address of account holders and authorised admin users
Company name, registered address, and billing details
Payment card or bank account information (processed via our third-party payment provider; we do not store full card numbers)
Communications with our support and onboarding teams

2.2 Partner User Data (Processor Role)

When Clients enrol their channel partner staff on the MicroFlow platform, the following personal data is uploaded by the Client or collected through platform use:

Name and business email address of Partner users
Job title, company name, region, and partner tier (as provided by the Client)
Platform usage data: content viewed, micro-doses completed, engagement timestamps, quiz responses, and completion rates
Device and session data: device type, operating system, IP address, and login timestamps

This data is processed by MicroFlow solely on the instructions of the relevant Client and in accordance with the applicable DPA. MicroFlow does not use Partner user data for its own commercial purposes.

2.3 Website and Marketing Data

When you visit microflowenablement.com or engage with our marketing communications, we may collect:

Name and email address submitted via enquiry forms or contact requests
Browsing behaviour and page interaction data via cookies and analytics tools
Email open rates and link click data in marketing emails

Our use of cookies is governed by our separate Cookie Policy, available at microflowenablement.com/cookie-policy/.

3. Legal Bases for Processing

We rely on the following legal bases under UK GDPR Article 6. Where we act as data processor for a Client, the legal basis for processing Partner user data is determined by the Client as data controller. Our processor obligations in those circumstances are governed by Article 28 and the applicable DPA.

Processing Activity	Legal Basis (Art. 6)	Role
Managing Client accounts and delivering the platform	Performance of a contract (Art. 6(1)(b))	Controller
Processing payments and managing billing	Performance of a contract (Art. 6(1)(b))	Controller
Processing Partner user data on behalf of Clients	Determined by the Client as Controller; MicroFlow acts as Processor under Art. 28 and the applicable DPA	Processor
Sending service-related communications to Clients	Performance of a contract (Art. 6(1)(b))	Controller
Sending marketing communications	Legitimate interests (Art. 6(1)(f)) or Consent (Art. 6(1)(a)) where required	Controller
Platform analytics, security, and fraud prevention	Legitimate interests (Art. 6(1)(f))	Controller
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))	Controller

4. How We Use Personal Data

As a data controller, we use personal data for the following purposes:

Provisioning and administering Client accounts on the MicroFlow platform
Processing subscription payments and issuing invoices
Providing technical support, onboarding assistance, and account management
Communicating service updates, security notices, and policy changes
Sending marketing communications about MicroFlow products and services (where lawfully permitted or consented to)
Analysing platform usage to improve functionality and user experience
Detecting and preventing fraud, security incidents, and unauthorised access
Complying with applicable legal and regulatory obligations

As a data processor, we use Partner user data exclusively to deliver the enablement platform functionality on behalf of the relevant Client, including content delivery, engagement tracking, analytics reporting, and push notification scheduling. We do not use Partner user data to build profiles for our own commercial purposes, serve advertising, or share data with third parties outside the scope of the applicable DPA.

5. Data Sharing and Third Parties

We do not sell personal data. We share personal data only in the following circumstances:

5.1 Sub-processors and Service Providers

We engage third-party service providers to support platform delivery. All sub-processors are bound by appropriate data processing terms and are required to process data only on our instructions. A current list of sub-processors is maintained as part of our Data Processing Agreement and is available on request at dpo@microflowenablement.com. We give Clients at least 30 days’ prior written notice of any intended addition or replacement of a sub-processor, in accordance with our Data Processing Agreement.

Key categories of sub-processor include:

Cloud infrastructure and hosting (Vercel / Amazon Web Services): platform hosting, data storage, and content delivery within the EEA (Ireland, AWS eu-west-1 region)
Database and authentication (Supabase): managed PostgreSQL database and authentication services
Payment processing (Stripe): subscription billing and invoice management
Email delivery (Resend): transactional and notification email delivery
Edge security (Cloudflare): DNS, DDoS protection, and edge caching
Vulnerability scanning (Snyk): continuous dependency and code security scanning

5.2 Clients

Where we process Partner user data on behalf of a Client, we provide that Client with engagement analytics, completion data, and reporting as part of the platform service. This is governed by the applicable DPA and the Client’s own privacy obligations to their Partner users.

5.3 Legal Disclosure

We may disclose personal data to law enforcement, regulatory authorities, or courts where required by law, or where necessary to protect the rights, property, or safety of MicroFlow, our Clients, or others.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of MicroFlow Enablement Ltd, personal data may be transferred to the acquiring entity as part of that transaction. Affected individuals will be notified in advance where required by law.

6. International Data Transfers

MicroFlow is based in the United Kingdom. All MicroFlow customer and Partner user data is stored and processed within the European Economic Area, in Ireland (AWS eu-west-1 region). We do not transfer customer data outside the EEA in the ordinary course of providing our services.

Where any international transfer is required in connection with our sub-processors’ transactional functions (for example, limited payment metadata flowing to Stripe or email delivery metadata flowing to Resend), those sub-processors are bound by the EU Standard Contractual Clauses or an applicable adequacy mechanism. Details are maintained in our sub-processor list available on request.

Where MicroFlow personnel access system data from outside the EEA for technical or support purposes, such access is conducted under contractual controls and Standard Contractual Clauses, and is limited to what is necessary for the documented business reason.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.

Data Category	Retention Period
Client account data	Duration of the contract, plus 7 years for accounting and legal compliance purposes
Billing and payment records	7 years (Companies Act 2006 and HMRC guidance)
Partner user data (processor role)	As directed by the Client under the applicable DPA; deleted or returned within 30 days of contract termination unless retention is required by law. Backup data deleted within 90 days of termination
Platform usage and engagement data	Duration of the Client contract, plus 12 months to support dispute resolution and analytics
Marketing enquiry data	24 months from last interaction, or until withdrawal of consent
Website analytics data	13 months (standard analytics retention)
Security and access logs	12 months

8. Your Rights Under UK GDPR

As a data subject, you have the following rights in respect of personal data processed by MicroFlow as controller:

Right of access (Art. 15): to obtain a copy of the personal data we hold about you
Right to rectification (Art. 16): to correct inaccurate or incomplete personal data
Right to erasure (Art. 17): to request deletion of your personal data in certain circumstances
Right to restriction of processing (Art. 18): to limit how we use your data in certain circumstances
Right to data portability (Art. 20): to receive your personal data in a structured, commonly used format
Right to object (Art. 21): to object to processing based on legitimate interests or for direct marketing purposes
Right to withdraw consent (Art. 7(3)): where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing

If you are a Partner user, your data subject rights in respect of your participation in a Client’s enablement programme should be directed to the relevant Client in the first instance, as they are the data controller for that processing. MicroFlow will assist Clients in fulfilling data subject requests as required under our DPA obligations.

To exercise any of your rights in respect of data processed by MicroFlow as controller, contact: dpo@microflowenablement.com. We will respond within one calendar month of receipt, in accordance with UK GDPR Article 12.

9. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256)
Multi-tenant architecture with application-layer and database-layer tenant isolation on every request
Access controls, role-based permissions, and the principle of least privilege for platform administration
Tokenised auto-login for email-based content delivery (no persistent password required for Partner users consuming email content)
Continuous vulnerability scanning via Snyk and GitHub Dependabot
Sub-processor due diligence and contractual security obligations

Full details of our security posture, engineering controls, and infrastructure certifications are available in the MicroFlow Security and Trust Overview, provided on request to security@microflowenablement.com.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, in accordance with UK GDPR Article 33. We will notify affected Clients within 72 hours in accordance with our DPA obligations. Affected individuals will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34).

10. Cookies and Tracking Technologies

Our website and platform use cookies and similar tracking technologies. Our use of cookies, the categories we use, and how you can manage your preferences are set out in our Cookie Policy, available at microflowenablement.com/cookie-policy/.

Strictly necessary cookies are set on the MicroFlow product surfaces (enable., dealreg., launchpad., activate.microflowenablement.com) to enable authentication and platform functionality. No analytics, marketing, or advertising cookies are set on the product surfaces.

11. Complaints and Supervisory Authority

If you have a concern about how we handle your personal data, please contact us in the first instance at dpo@microflowenablement.com. We take all complaints seriously and will respond within 10 business days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal requirements, or business operations. Where changes are material, we will notify Clients by email and update the version date at the top of this document. Continued use of the MicroFlow platform following notification of material changes constitutes acceptance of the updated policy.

Contact Us

Email: dpo@microflowenablement.com
Data Protection Lead: Greg de Bressac, MicroFlow Enablement Ltd
Registered Address: 20-22 Venture West, Greenham Business Park, Newbury, RG19 6HX

This document is for informational purposes and does not constitute legal advice. MicroFlow Enablement Ltd recommends periodic review with a qualified data protection solicitor. ICO registration number to be added on receipt of registration confirmation.