Privacy policy
How Flowpass processes personal data
Version 2.0. Last updated January 1, 2025.
In brief
Flowpass AB is responsible for the personal data processed when you use Flowpass to book spaces from hosts.
We process only the data needed for accounts, bookings, access, payment, security and support.
We do not store passwords, card numbers, national identification numbers or sensitive personal data.
Data is stored within the EU. The host you book with can see your name and booking, as this is needed to give you access.
We never sell personal data or share it with anyone for their own purposes.
1. Who is responsible
The controller is Flowpass AB, company registration number 559264-3885, Malmskillnadsgatan 36, 111 57 Stockholm, Sweden (“Flowpass”, “we”).
Data protection contact: cs@flowpass.co.
2. Whose data we process
Users, meaning employees and consultants who book and use spaces through Flowpass on behalf of their organisation.
Administrators at organisations, hosts and property owners.
Guests invited to a space by a user.
Contact persons at customers, hosts, property owners and suppliers.
Visitors to our website.
3. What data we process and where it comes from
Identity and profile. Your name, email address and, where applicable, phone number, job title, cost centre and profile picture. We receive this from you, from your organisation when it adds you as a user, or from your organisation’s identity provider (SSO).
Organisation and role. The organisation you belong to, your role and your permissions. We receive this from your organisation.
Bookings. The space, location, time, price and status of your bookings, and any digital key linked to them. We receive this from you when you book.
Access. Digital keys issued to you and access events reported by the host’s lock system. We receive this from the platform and from the lock system.
Guests. The name, email address and, where applicable, phone number of guests you invite. We receive this from the user who invites the guest.
Communication. Your notification preferences, emails and notifications sent to you, in-product chat messages and support requests. We receive this from you and from the platform.
Login. The time and IP address of your logins. We do not store passwords. We receive this from our login service Auth0 or from your organisation’s identity provider.
Event log. Who changed what and when in the platform, including when an administrator accepts the terms. This is generated by the platform.
Payment and invoicing. Your organisation’s billing details and a reference (token) to the payment method. Card numbers never pass through our systems. We receive this from your organisation and from Stripe.
Technical information. IP address, device, browser and technical logs for operations and security. This is collected automatically when you use the website, the web applications or the app.
We do not process national identification numbers or special categories of personal data under Article 9 GDPR. The service is not intended for persons under 18.
4. Why we process the data and on what legal basis
Accounts and permissions. We create and administer your account and permissions. The legal basis is our contract with your organisation and our legitimate interest in providing the service to its users.
Bookings and access. We handle your bookings and give you access to booked spaces, including through digital keys. The legal basis is contract and legitimate interest.
Invoicing and payment. We invoice and receive payment on the host’s behalf. The legal basis is contract and our legal obligation under the Swedish Bookkeeping Act.
Service messages. We send booking confirmations, reminders and other messages about the service. The legal basis is contract and legitimate interest.
Support, complaints and damage claims. We provide support and handle complaints and damage claims. The legal basis is legitimate interest.
Records of what was agreed. We record acceptance of the terms and which rules applied to each booking. The legal basis is our legitimate interest in being able to show what was agreed and to establish legal claims.
Security and operations. We process data for security, troubleshooting, operations and the prevention of misuse. The legal basis is legitimate interest.
Developing the service. We develop and improve the service, for example through feature flags and anonymised statistics. The legal basis is legitimate interest.
Information and marketing. We send information and marketing to contact persons at customers and prospective customers. The legal basis is legitimate interest, and you can unsubscribe at any time.
Where we rely on legitimate interest, we have assessed that our interest outweighs the impact on your privacy. You have the right to object, see section 10.
5. When Flowpass is a processor
When an organisation or a property owner uses Flowpass for its own spaces, for example for booking its own meeting rooms or for its tenant register, we process the data on its behalf. The organisation or property owner is then the controller and Flowpass the processor under a data processing agreement. Questions about that processing should be directed to the organisation or property owner.
6. Who we share data with
Hosts and property owners
When you book a space, the host can see your name and booking details, as this is needed to give you access. The host is an independent controller for its processing, and the host’s privacy information is linked in the booking confirmation. If your organisation has access to spaces through a property owner, the property owner can see bookings made under its offering.
Other organisations in the platform
Limited data is shared between organisations in the platform only where a function requires it, for example when you invite a guest or share a digital key.
Suppliers processing data on our behalf
We use suppliers for hosting and data storage, content delivery and security, login, card payments, email and notifications, logging and monitoring, feature management, in-product chat, accounting and our customer register. Data is stored within the EU, except for some email, feature management and chat services located in the USA (see section 7). Suppliers may only process data to provide their service to us, under data processing agreements. A current list of our subprocessors is available at flowpass.co/subprocessors.
Integrations chosen by the host or your organisation
Digital keys and access control, for example Accessy, Parakey and Partnersec. We send the data needed to issue a key to the booked space.
The host’s booking system, for example Nexudus. Bookings and availability are synchronised with the host’s system.
Your organisation’s identity provider (SSO). When SSO is used, login, password rules and multi-factor authentication are handled by your organisation.
Authorities
We disclose data to authorities where required by law.
7. Transfers outside the EU
Data is stored within the EU. Some suppliers, SendGrid, Statsig and Stream, process data in the USA, and Cloudflare operates a global network. For such transfers we use the European Commission’s standard contractual clauses, or the EU–U.S. Data Privacy Framework where the supplier is certified under it, together with additional safeguards where needed.
8. How long we keep the data
Account and profile. We keep your account and profile data while your account is active and for [12 months] after it is closed.
Bookings and acceptance of the terms. We keep these for [3 years] after the booking, or longer if needed to handle a claim.
Accounting records. Invoices and other accounting records are kept for 7 years after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act.
Access events and event log. We keep these for [24 months].
Messages and chat. We keep messages sent and chat messages for [24 months].
Technical logs. Logs for operations and security are kept for [30 days].
Guest data. We keep guests’ data for [12 months] after the visit.
When the data is no longer needed, it is deleted or anonymised.
9. Security
All traffic is encrypted with TLS. Stored data is encrypted by our provider. Only named employees have access to the production environment, via VPN. Permissions in the platform are role-based and limited to the user’s own organisation, and all changes to data are recorded in an event log.
10. Your rights
You have the right to:
know what data we hold about you and receive a copy of it
have inaccurate data corrected
have data erased if it is no longer needed or we have no basis for processing it
request restriction of processing
object to processing based on legitimate interest, and always to direct marketing
receive data you have provided in a machine-readable format (data portability)
Contact us at cs@flowpass.co. If your organisation has added you as a user, some changes may need to be made by your organisation’s administrator.
If you believe we process your data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or the supervisory authority in your country.
11. Cookies
The website and web applications use cookies that are necessary for login, security and for the service to work.
12. Changes
We update this policy when our processing changes. The date of the latest update is shown at the top. We notify material changes in the service or by email.