FlowClub

Privacy Policy

Version: 1.0
Last Updated: September 2, 2026
Applicable Law: Data Protection Act, 2019 (Republic of Kenya)
Data Controller: Flow Africa
Contact (DPO): dpo@flowclub.co.ke

1. Introduction

Flow Club (hereinafter "we", "us", "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, register as a member, or use our services.

This policy is drafted in accordance with the Data Protection Act, 2019 (DPA) of Kenya and reflects our dedication to transparency, accountability, and lawful data handling.

2. Data Controller and Contact Information

For the purposes of the DPA, the Data Controller is:

  • Entity: Flow Africa
  • Postal Address: Nairobi, Kenya
  • Email (Data Protection Officer): dpo@flowclub.co.ke

If you have any questions about this policy, wish to exercise your legal rights, or need clarification on how we process your data, please contact our Data Protection Officer (DPO) at the above email.

3. Categories of Personal Data Collected

We collect and process the following categories of personal data:

| Category | Description | |--------------|-----------------| | Identity Data | First name, last name, date of birth. | | Contact Data | Email address, phone number, postal address. | | Professional Data | Business sector, number of employees, turnover range. | | Transactional Data | Subscription status, payment history (via third-party payment processors), membership points. | | Technical Data | IP address, browser type and version, device information, time zone settings, operating system, and browsing patterns (via cookies) to improve user experience. |

We collect this data directly from you (e.g., when you register, update your profile, or contact us) and automatically (e.g., through our IT systems, such as Supabase, Vercel logs, and analytics tools).

4. Legal Basis for Processing (Article 25, DPA)

We process your personal data only on valid legal grounds, as specified under the DPA:

  1. Consent: You have given explicit consent for specific processing purposes (e.g., receiving our weekly WhatsApp content or marketing communications).
  2. Contractual Necessity: Processing is necessary for the performance of our membership agreement (e.g., providing templates, articles, community access, and membership benefits).
  3. Legal Obligation: Processing is necessary to comply with legal requirements, such as tax retention obligations (KRA), anti-money laundering laws, and statutory reporting.
  4. Legitimate Interests: Processing is necessary for our legitimate business interests, including service improvement, fraud prevention, platform security, and marketing analysis. We always balance your rights and interests before relying on this basis and do not use it for automated decision-making.

5. Purposes of Processing

We use your personal data for the following purposes:

  • To provide and maintain your membership, including access to exclusive templates, articles, video content, and community features.
  • To manage your payments, subscriptions, and renewals.
  • To send you administrative notifications (e.g., policy updates, payment confirmations, service changes).
  • To personalise your experience and improve our services (e.g., recommending relevant content).
  • To comply with legal and regulatory requirements (e.g., tax audits, KRA compliance).
  • To investigate and prevent fraud, security incidents, and unauthorised access.

Important: We do not sell your personal data to third parties for marketing or any other purpose.

6. Data Retention and Deletion (Right to be Forgotten)

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements.

| Category | Retention Period | |--------------|----------------------| | Active accounts | Duration of your active membership. | | Inactive accounts | If your account remains inactive (no login or activity) for 2 consecutive years, we will anonymise your data. | | Billing records | Retained for 5 years as required by Kenyan tax law and the Companies Act. | | User-requested deletion | When you or an administrator request deletion, we will anonymise your personal data (name, email, phone) within 30 days. Hard deletion from backups occurs after 6 months. |

7. Data Sharing and Transfers

We do not share your personal data with third parties for their own marketing purposes.

We may share your data with the following categories of recipients:

  • Service Providers: We engage trusted third-party processors to perform services on our behalf, including:

    • Supabase (database and authentication)
    • Vercel (web hosting and serverless functions)
    • Imgur (image hosting)
    • WhatsApp (content delivery)

    These processors act under strict contractual terms and are bound by data processing agreements that comply with Kenyan law.

  • Government and Regulatory Bodies: We may disclose data if required to comply with law, regulation, or a court order (e.g., KRA, ODPC, law enforcement).

  • International Transfers: Your data may be stored on servers located in the United States (Supabase, Vercel). We ensure that these transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission and recognised by Kenyan authorities, guaranteeing adequate protection.

8. Data Security Measures (Integrity and Confidentiality)

We implement appropriate technical and organisational measures to protect your personal data:

  • Access Controls: Strict Role‑Based Access Control (RBAC) and Row‑Level Security (RLS) on our database. Only authorised administrators with unique credentials can access sensitive data.
  • Audit Logs: All admin actions (viewing, modifying, deleting members) are logged with timestamps and IP addresses to ensure accountability and detect unauthorised access.
  • Encryption: Data is encrypted in transit (HTTPS/TLS) and at rest using Supabase's built‑in encryption.
  • Two‑Factor Authentication (2FA): Admin accounts are protected with 2FA to prevent unauthorised access.
  • Regular Security Reviews: We conduct periodic security assessments and vulnerability scanning to maintain a robust security posture.

9. Your Rights as a Data Subject (Chapter IV, DPA)

Under the Data Protection Act, you have the following rights, which you can exercise at any time:

  1. Right of Access: You can request a copy of your personal data held by us.
  2. Right to Rectification: You can request correction of inaccurate or incomplete data.
  3. Right to Erasure (Right to be Forgotten): You can request deletion of your data (subject to our retention obligations).
  4. Right to Restriction: You can request that we stop processing your data (e.g., while we verify its accuracy).
  5. Right to Data Portability: You can request your data in a structured, commonly used, machine-readable format for transfer to another controller.
  6. Right to Object: You can object to processing based on legitimate interests.
  7. Right to Withdraw Consent: You can withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, please email us at dpo@flowclub.co.ke. We will respond within 14 days of receiving your request, as required by Kenyan law.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of the breach, as mandated by Section 43 of the DPA. We will also provide information about the nature of the breach, the categories of data affected, and the measures taken or proposed to mitigate the risks.

11. Cookies and Tracking Technologies

We use minimal cookies strictly for authentication and session management. These cookies are essential for the proper functioning of the website and do not require your explicit consent under Kenyan law. You may control cookie preferences in your browser settings. We do not use tracking cookies for advertising purposes.

12. Changes to This Policy

We reserve the right to update this Privacy Policy to reflect changes in the law, our services, or best practices. When we make significant changes, we will notify you via email or a prominent notice on our platform. The "Last Updated" date at the top of this document indicates the latest revision. We encourage you to review this policy periodically.

13. Acceptance of Terms

By using Flow Club services, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you do not agree with any part of this policy, you must cease using our services immediately.

For any inquiries or to exercise your rights, please contact:

Data Protection Officer (DPO)
Email: dpo@flowclub.co.ke
Address: Nairobi, Kenya