Privacy policy

You can change or withdraw your choice about statistics and marketing at any time, here or via Cookie settings at the bottom of every page.

Data controller

Flo Pay AB, org. no. 556665-9339, Dalvägen 16, 2 tr, 169 56 Solna, Sweden, is the data controller for the processing described on this page. Where it says that Google, Meta or Cloudflare is an independent controller, they are responsible for their own processing.

Flo Pay has a data protection officer, whom you can reach at it@flopay.se.

If you have questions about how we process personal data, or want to exercise your rights, contact us at support@flopay.se.

What data we process

When you submit a form on flopay.se, we process the data you provide yourself:

• Contact details: name, email address and phone number.
• Company details: organisation number, company name and the company's registered address. If you run a sole proprietorship, the organisation number may be your personal identity number.
• Case information: what you write in the message field and the details belonging to your request, for example when terminating or transferring an agreement or setting up a direct debit mandate.

When you enter an organisation number, the site automatically fetches the company's registered name and address from the European Commission's VAT register. Only the organisation number is sent, and the response consists of public register data.

We may also receive your data from someone else, for example when a company transfers its agreement and names you as contact person or authorised signatory.

When you submit one of our ad forms on Facebook or Instagram, we process your name, email address, phone number, the type of business you run and which of our ad forms the data comes from. Meta may prefill your name, email address and phone number from your Meta account, and you can change them before you submit.

When you call us from an ad on Google, Google Ads may show us your phone number, when you called and how long the call lasted.

When you visit flopay.se, technical data such as your IP address, browser, the page address and where you came from is processed. What is used and for what is described under Cookies and measurement.

When we email you from our customer system, we may see whether and when the email is opened and whether a link in it is clicked.

Why we process the data

We use the data to:

• answer your enquiry, book a demo of the POS system and follow up expressions of interest from companies, including later on,
• handle your support case,
• administer your agreement — termination, transfer or direct debit mandate,
• improve our services based on answers you choose to give in the termination form,
• protect the website and the forms against abuse and keep the website running,
• produce visitor statistics with Google Analytics and measure whether our ads lead to enquiries via the website, but only if you have consented to it,
• count page views and load times with a cookieless visitor counter, and see whether calls to us come from our ads on Google.

We process enquiries, cases and agreements on the basis of our legitimate interest in answering and following up enquiries from companies and their representatives and in performing agreements with the company you represent. If you run a sole proprietorship, the processing is instead based on the agreement with you. Seeing whether our emails are opened is based on our legitimate interest in following up enquiries.

Protection against abuse, running the website, the visitor counter, measuring calls from our ads and improving our services are based on our legitimate interest in a secure, working website, in knowing which ads lead to calls and in good services. The statistics in Google Analytics and the ad measurement in Google Ads are based on your consent.

Providing data is up to you. Without contact details we cannot answer you, and without the details of an agreement case we cannot handle it.

Cookies and measurement

Statistics in Google Analytics and ad measurement in Google Ads are only used if you say yes in the box shown when you arrive at flopay.se. Statistics and marketing are chosen separately, and saying no is as easy as saying yes. If you withdraw your consent, nothing more is sent to Google, but cookies that have already been set remain until they expire or until you delete them in your browser.

The box and the measurement are run by Cloudflare Zaraz. When a page loads, your browser sends the page address (including any campaign parameters), where you came from, the page title, screen size and time zone to Cloudflare, also before you have chosen. This data is used to show the box and to make sure only what you have said yes to runs.

This is always used:

• cf_zaraz_client: a cookie that Cloudflare Zaraz, the tool behind the consent box and the measurement, sets on every page view, also before you have chosen. In our checks it has been empty. 12 months.
• zaraz-consent-v2: stores your choice in the box. 12 months. The box's language is stored in your browser's local storage until you clear it.
• Security check (Cloudflare Turnstile) on every page. It protects the forms against automated submissions, processes your IP address and details about your browser, and stores a value in your browser's local storage for Cloudflare's domain challenges.cloudflare.com until you clear it.
• Error reports (Network Error Logging): your browser stores, for 7 days, a rule to report to Cloudflare when a page cannot be loaded.
• Visitor counter (Cloudflare Web Analytics): counts page views and load times without cookies and without storing anything in your browser. It sends the page address without campaign parameters, together with details about the browser and the page load, to Cloudflare.

Statistics (only if you say yes)

Google Analytics shows us how visitors use flopay.se and which campaigns they come from. Google receives the page address and title (including any campaign parameters and the ad click ID), where you came from, your browser, language and screen size, a random visitor ID and how long you are active on the page. When you submit a form as a sales enquiry, Google learns that it was submitted and whether it was the demo or the contact form, but never what you wrote. Your IP address is not sent to Google. Google processes the statistics on our behalf and keeps the data about your visits for 14 months after your most recent visit. Aggregated statistics that cannot be linked to you may be kept longer.

Read more about how Google uses information from sites that use its services.

• cfz_google-analytics_v4: visitor ID and counters for your visits. 12 months.
• cfzs_google-analytics_v4: counters for the current visit. Removed when you close your browser.

Marketing (only if you say yes)

Google Ads measures whether a click on our ads on Google leads to an enquiry. If you come to flopay.se from an ad, the ad click ID is stored in a cookie. When you submit a form as a sales enquiry, your browser sends a message about it to Google, including the time, the page address and, if you came from an ad, the ad click ID. Google then sees your IP address and may read and set its own cookies, for example IDE on doubleclick.net (about 13 months). For this measurement Google is an independent controller, and Google may also use the data to personalise ads.

We do not send your name, email address or phone number to Google Ads.

Read more in Google's information on privacy and consent.

• cfz_google-ads: the ad click ID. 12 months.

The cookies on flopay.se also apply to its subdomains, so they are sent along when you visit the web shop at shop.flopay.se. The web shop is not covered by this policy.

Ad forms on Facebook and Instagram

When you submit one of our ad forms on Facebook or Instagram, Meta Platforms Ireland Limited collects the data and passes it to us. Meta is an independent controller for its own processing, see Meta's privacy policy. We receive the data in our customer system and use it to contact you about Flopay's POS system, including follow-up later on. We do not share it with others for marketing.

We use no tracking code from Meta on flopay.se.

Who receives the data

We never sell your data. The data is received by:

• Our customer system, where contact details, enquiries and cases are stored. It runs in data centres within the EU and is provided by a US company.
• Cloudflare, which hosts the website and runs the consent box, the security check, the error reports and the visitor counter. Technical logs are kept briefly, and email addresses, phone numbers and addresses are masked in them. Cloudflare also uses the signals from the security check, as an independent controller, to improve it.
• Google: Google Analytics on our behalf and Google Ads as an independent controller, only if you have consented (see Cookies and measurement). If you call us from an ad on Google, Google receives the call details.
• Our tools for email and calendar, internal chat, telephony, contract signing, automation and backups, and other IT services our staff use in their work. The internal chat shows, for example, the name of a new enquiry, which for the ad forms is your name.
• The European Commission's VAT register, which receives the organisation number when company details are looked up.

Transfers outside the EU/EEA

Cloudflare, Google, the provider of our customer system and the providers of some of our tools are US companies, so data may be processed in the United States. The transfer is based on the European Commission's decision on the EU-US Data Privacy Framework, under which the companies are certified, and otherwise on the European Commission's standard contractual clauses. Contact us if you would like a copy of the clauses.

How long we keep the data

• Enquiries via flopay.se and our ad forms that do not lead to an agreement are deleted from our customer system no later than 12 months after our most recent contact with you.
• Data belonging to a customer relationship is kept while the agreement is in force and also after it has ended. Accounting records, such as invoices, are kept under the Swedish Bookkeeping Act until the end of the seventh year after the end of the calendar year in which the financial year ended.
• The data about your visits is kept at Google for 14 months after your most recent visit.
• The cookies have the lifetimes listed under Cookies and measurement.

Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• know what data we hold about you and receive a copy of it,
• have inaccurate data corrected,
• have your data deleted,
• request that processing be restricted,
• receive your data in a machine-readable format (data portability),
• withdraw your consent to statistics and marketing at any time, without affecting what happened before.

Right to object

You have the right to object at any time to processing based on our legitimate interest. If you object to us contacting you for marketing purposes, for example to follow up an enquiry, we will stop.

Contact us at support@flopay.se and we will help you. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

Changes to this policy

If the policy changes, we will publish the new version on this page with a new date.