Privacy Policy

Dogan Akgun, trading as Akflow, is the data controller for the processing activities described in this privacy policy that Akflow carries out on its own account.

This privacy policy applies to the Akflow website and to personal data Akflow processes in connection with enquiries, requests, quotes, agreements and its own business operations. When Akflow, within a client project, processes personal data solely on behalf of a client, that client may be the data controller and Akflow the processor. In that case additional arrangements are made, for example in a data processing agreement.

Which data we process depends on your relationship with Akflow and on the service you use.

Website visits and technical security

When you visit the website, technical data may be processed that is needed to provide, secure and manage the website, such as:

• IP address;
• date and time of the request;
• requested page or route;
• browser and device characteristics, to the extent provided by the technical infrastructure;
• error, security and abuse signals.

Akflow does not use this data to build a hidden profile of individual visitors without a clear legal basis.

Contact and enquiry form

The current contact form may ask for the following data:

• name;
• e-mail address;
• company name, if you voluntarily provide it;
• the topic or area for improvement your question relates to;
• your description of the situation or challenge;
• your current website, if you voluntarily provide it.

The free-text fields are intended for a business description of your question. Do not share passwords, API keys, highly sensitive personal data, health data, criminal data, trade secrets or complete confidential client files through a general contact form.

Introductory calls, quotes and agreements

When we are in contact about a possible or ongoing assignment, we may process, among other things: business contact details; company and billing details; correspondence and appointment data; notes needed to understand your question; quote, scope and contract data; information about systems, processes and desired outcomes to the extent relevant to the assignment.

Delivering projects and support

Depending on the assignment, Akflow may gain access to, or process data in connection with, for example, websites and forms, CRM and customer processes, automations and system integrations, AI workflows or AI chatbots, technical configurations, support requests and Secure AI Workplace engagements. We aim to limit project access and data processing to what the assignment requires.

Billing and administration

For quotes, agreements, invoices and statutory business records we may process name and business contact details, company name, address and billing details, trade register (KVK) and VAT details where relevant, payment and transaction references, and contract and invoice information.

Cookies, analytics and similar techniques

Akflow uses cookies and similar techniques only in accordance with the actual technical configuration and the current cookie policy. Non-essential techniques are not activated, where consent is legally required, before a valid choice has been made. Current analytics status: Akflow uses Vercel Web Analytics only after you have given consent for analytical techniques. Vercel Web Analytics does not use cookies and processes anonymised usage data. Query parameters and sensitive or restricted routes are excluded before transmission. The legal basis for this processing is consent. You can withdraw this consent at any time via the cookie settings. More information is available in the Cookie Policy.

AI-assisted tools

Akflow may use internal AI-assisted tools to support its work. The starting point is: no input of personal data or confidential information without purpose, necessity and an appropriate assessment; extra caution with sensitive or special-category personal data; appropriate human oversight where the impact of errors is relevant. No personal data is automatically provided to external AI providers through this website. Akflow does not enter names, e-mail addresses, phone numbers, free-text message content, client documents or other identifiable client data into external AI tools. AI tools may only be used internally with anonymised or non-personal information and with appropriate human oversight.

Akflow only processes personal data when a valid legal basis exists for doing so. Depending on the situation, this may be:

Preparing or performing an agreement — for example to assess an enquiry, plan an introductory call, prepare a quote, deliver a service or provide support.

Legal obligation — for example for data that Akflow must retain for tax or other statutory record-keeping obligations.

Legitimate interest — such as securing the website and systems, preventing misuse and fraud, limited business administration, defending legal claims, and improving our own business processes, to the extent the privacy interests of data subjects do not outweigh this.

Consent — for example for certain non-essential tracking or separate marketing activities. You can withdraw consent at any time; withdrawal does not retroactively affect processing that was lawful before the withdrawal.

Akflow does not sell personal data as a commodity.

We may share data with parties that are necessary for business operations or service delivery, for example:

• hosting and infrastructure providers;
• e-mail and communication services;
• form and backend services;
• CRM and project services;
• accounting or administrative service providers;
• security and monitoring services;
• AI or automation providers, only when necessary for an assessed use case;
• professional advisers when necessary;
• competent authorities when a legal obligation requires it.

The actual list of providers is maintained on a dedicated subprocessors page, to the extent a provider acts as processor or subprocessor in the relevant role. An English version of that page is not yet available; visit our homepage or contact us at info@akflow.nl for details.

Some providers may process or make personal data accessible outside the European Economic Area. Akflow uses Vercel for hosting and web analytics, Supabase for database and authentication functions, and Resend for sending e-mail. When using these providers, personal data may be processed outside the European Economic Area, including in the United States. Where personal data is processed outside the EEA, Akflow uses a valid transfer basis and appropriate safeguards, such as an applicable adequacy decision and/or the standard contractual clauses approved by the European Commission. Akflow does not claim that all data remains exclusively within the European Union.

We do not keep personal data longer than necessary for the purpose for which it was collected, unless a legal obligation or demonstrable necessity justifies a longer period.

Contact enquiries that do not lead to an assignment

A maximum of 6 months after the last substantive contact. Resend retains delivery data according to its own standard retention period; received e-mails are deleted within Akflow’s own period.

Quotes without a resulting assignment

A maximum of 2 years after the last substantive contact or the expiry of the quote, unless the data is no longer needed sooner or is needed longer for a specific legal claim.

Project and contract files

For the duration of the agreement and a maximum of 2 years after completion for ordinary project files. Contracts, invoices and other data that form part of the tax records are retained for 7 years. Data is only retained longer where a legal obligation or specific legal claim makes this necessary.

Support and ticket data

A maximum of 2 years after the support request is closed. Where the data forms part of a contract or tax file, the retention period applicable to that file applies.

Technical / security logs

Normally a maximum of 90 days. Rate-limiting records are deleted within 24 hours at the latest. Data needed to investigate a specific security incident may be retained for a maximum of 1 year, or longer where a legal obligation or legal claim makes this necessary.

Cookie and consent preference

A maximum of 12 months after the choice is made. After that, Akflow asks for consent again. The preference is deleted or invalidated sooner if the visitor withdraws it, clears their browser data, or the policy version changes. Akflow does not keep a central visitor profile for this purpose.

Tax records

7 years, in line with the Dutch statutory tax record-keeping obligation.

Back-ups

According to a separate, limited back-up cycle; deletion may be reflected in back-ups with a delay.

Akflow does not apply a general rule that every client record must automatically be kept for seven years.

Akflow takes appropriate technical and organisational measures suited to the nature of the data, the processing and the risks involved. Depending on the environment, this may include:

• access restriction and least privilege;
• strong authentication and, where appropriate, multi-factor authentication;
• encrypted connections;
• separated management of secrets and API keys;
• logging and monitoring with attention to data minimisation;
• back-up and recovery measures;
• vendor assessment;
• periodic access and configuration reviews.

No technical environment is entirely risk-free. Akflow therefore does not give an absolute guarantee that security incidents are impossible.

Depending on the situation, under the GDPR you may have, among others, the right to: information about the processing; access; rectification; erasure; restriction; data portability where this right applies; objection to certain processing; withdrawal of consent; and protection against certain solely automated decisions that have legal or similarly significant effects.

To exercise a right, contact us at info@akflow.nl or via the contact form on akflow.nl. We may need to verify your identity in order to assess your request.

Akflow does not use the current public website and contact form to make solely automated decisions about visitors or applicants that have legal effects or similarly significant effects. If this changes in the future, this text must be updated before that use begins and the processing must be separately assessed.

If you have a privacy question or complaint, please first contact us at info@akflow.nl. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Akflow may update this privacy policy when its services, technology, providers or applicable law change. The current version is always available on this page. In the event of material changes, we assess whether additional communication is needed.