Privacy Statement

1. Our Commitment to Privacy

We are committed to keeping your data safe, secure and confidential. Sipflow handles personal and business data in line with applicable privacy laws, including the General Data Protection Regulation (GDPR).

‍

2. Information We Collect

When you use the Sipflow platform, we may collect:

• Business Information : Company name, business registration details, contact persons.
• User Account Details : Email addresses, usernames, encrypted passwords, user roles (e.g., supplier, venue).
• Activity Data : Messages, deals created, contracts formed, and platform usage data.
• Technical Information : IP addresses, device info, session cookies for login, and analytics.

‍

3. Confidentiality of Deals & Business Data

All deals, communications, and contracts created or facilitated via Sipflow are strictly confidential. Here’s how we handle this information:

• We securely store deal and contract data to support platform functionality and record-keeping.
• We do not sell, pass on or disclose contract or deal data. Data is shared with a supplier only where you have an active deal with that supplier on Sipflow, and then only the volumes recorded under that deal and, where the deal provides for it, pricing.
• We do not share account-specific information with any third parties for marketing or commercial purposes.
• We may use aggregated and anonymised data (e.g. average prices, market trends, category volumes) for internal reporting, analytics or market reviews, but not in a way that reveals or identifies any specific user, deal or business.

‍

4. How We Use Your Data

We use your information to:

• Provide and improve access to Sipflow services;
• Facilitate secure communications and deal execution between verified users;
• Perform internal analytics to enhance user experience and service offerings;
• Enforce our Terms of Service and meet legal or regulatory obligations.

‍

5. Security, recipients and retention

We apply technical and organisational measures to protect your data, including:

• Platform data hosted on Supabase in the AWS Zurich region (eu-central-2), Switzerland, which holds an EU adequacy decision;
• Access enforced by row-level security;
• Database data encrypted in transit and at rest;
• Documents held in access-controlled storage.

Sipflow staff have no access to the production database. A supplier can see your data only where you have an active deal with that supplier, and then only the volumes recorded under that deal and, where the deal provides for it, pricing. You own the data you put on Sipflow; Sipflow holds a licence only to the extent needed to run the service. If a security incident affects your data, we notify affected accounts without undue delay and within 72 hours of becoming aware, in line with the GDPR.

For the full picture of where your data lives, who can see it, our sub-processors and how long we keep data, see our Data Security page at sipflow.io/data-security.

‍

6. Data Retention

We retain your information as long as necessary to maintain your account, fulfil platform functions (e.g. record-keeping, support) and meet legal and compliance obligations.

On cancellation we archive your account so you can return and continue where you left off. Archived accounts are deleted automatically after 24 months. On request, deletion is completed within 30 days, and backups roll off after that period. You can request an export of your data.

‍

7. International Data Use

Sipflow operates across jurisdictions. When data is processed or accessed internationally, we apply appropriate safeguards, such as Standard Contractual Clauses (SCCs) and compliance with local regulations.

8. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access or correct your personal data;
• Request deletion or restriction of your data;
• Object to specific uses;
• Request a copy (portability) of your data.

These rights can be exercised by contacting us as outlined in our Terms of Service.

‍

9. Messaging via WhatsApp and Meta platforms

Sipflow sends transactional messages, such as demo confirmations, waiting-list updates and support replies, over the WhatsApp Business Platform, operated by Meta Platforms Ireland Ltd. If you contact us through WhatsApp or Facebook, or connect a Meta account, we process the information you share through those channels only to deliver the service you asked for.

• We use your phone number and message content only to send and receive the messages you opted into, and to provide support.
• We do not use data obtained through Meta platforms for advertising, and we never sell it.
• Meta transmits and delivers these messages on its own infrastructure; its handling of your data is governed by Meta's own privacy policy.
• You can opt out of WhatsApp messages at any time by replying STOP, and you can request erasure of your data as described on our Data Deletion page (sipflow.io/data-deletion).

‍

10. Website visitors, free tools and the newsletter

If you join our waiting list or newsletter, or use one of our free tools, we hold your name, email and any free-tool inputs. These sit outside the secure platform.

• Free-tool inputs are stored and may be used in aggregated, anonymised form to improve Sipflow and publish industry insights. They are never published in a form linked to a named venue or person.
• Newsletter and waiting-list sign-ups require an explicit tick-box.

See our Data Security page at sipflow.io/data-security for more on how we handle this data.

‍

11. Sending proposals on your behalf

Our free Deal Profitability Calculator lets a distributor or importer send a brand-support proposal to a brand owner by email. When you use this feature, you provide the brand contact's name and email address so we can deliver your proposal to them. The legal basis for this processing is the sender's legitimate interest in making a business-to-business proposal. For the sending itself Sipflow acts as a processor on your instruction; for the record we keep of the request we are the controller.

Every proposal email names the person and company who sent it and why it was sent, and carries a working opt-out link. Using that link, or marking the message as spam, adds the recipient's address to a suppression list that blocks all future proposal sends to that address from any sender. We store the sender's IP address only in hashed form, never in the clear, and use it solely for abuse prevention.

Brand-contact details captured through this feature are retained for 12 months after the last proposal sent to that contact, after which they are deleted. The proposal email contains only the venue, product, volume, term and the total investment requested. It never discloses the sender's margins, prices, costs or profit.

‍

12. Changes to This Privacy Statement

We may update this statement periodically. Material updates will be communicated via the platform or by email. Continued use after updates constitutes acceptance of the revised policy.

‍

13. Company Information

Sipflow B.V., registered with the Dutch Chamber of Commerce (KvK) under registration number 97015326, with its registered office at Kraijenhoffstraat 137A, 1018 RG Amsterdam, the Netherlands.

‍

‍