Privacy Policy

1. Introduction

1. Welcome to the privacy and cookies policy for DIGITALFLOW CO. LTD. This policy applies to your use of extraflowdoc.com its features (our “Website”) and via our technology platform (the “Platform”) and, unless otherwise communicated to you, all services that we provide.
2. The policy sets out information about us and how we process your personal information whenever you use our Website and services, regardless of where you are in the world.
3. If you do not agree with the terms of this policy, you must stop using our Website and our services immediately. If you continue to browse and use this Website and/or our services, you are agreeing to this policy.
4. This website is not intended for children and we do not knowingly collect data relating to children.
5. This privacy policy may be varied by us from time to time. Such revised terms will apply to the Website and our services from the date of publication. You should check this page regularly to ensure familiarity with the most up to date version.

2. About us

1. www.extraflowdoc.com is operated by DIGITALFLOW COMPANY LIMITED, 0111219245, No. 1, Alley 22, Lane 163 Khuyen Luong Street, Linh Nam Ward, Hoang Mai District, Hanoi, Vietnam (“ExtraflowDoc”). (“we” or “us”).
2. You can contact our person responsible for data protection at: privacy@extraflowdoc.com. You should email this address if you have any questions about how we process your data, or if you wish to exercise any of your legal rights with respect to your data.

3. The personal data we collect

1. We consider personal data to be any data which can identify you as an individual person. As such, anonymous data, or data where your identity has been irretrievably removed does not constitute personal data.
2. The types of information we may collect include:
   1. Basic information, such as name, title, date of birth, gender and marital status.
   2. Contact information, such as email address, telephone number and physical addresses.
   3. User profile information, such as username, password, purchase and site history and your preferences with regard to marketing communications.
   4. Financial information, such as bank account and payment card details.
   5. Technical information, such as the internet browser and computer you use, your IP address, your location, the plug-ins you have installed in your browser and information about the cookies you have on your device. We may also receive this information if you use other websites which use our cookies - see our Cookie Policy.
   6. Site activity information, including how you use the Website, Platform and their features.
3. We do not collect any sensitive personal information about you. This means we do not collect information in the following areas: race and ethnicity, religious and philosophical beliefs, sex life, sexual orientation, health information, genetic and biometric data, political opinions and information about trade union membership. You agree to not tell us or send us this type of information.
4. We collect this data as you:
   1. use our Website and its features;
   2. use our services and buy our products;
   3. request to receive marketing materials; and
   4. contact or correspond with us.
5. We may also receive personal information about you from analytics providers (such as Google and Linkedin), search engines (such as Google and Bing) and advertising companies.

4. How we use your data

1. At all times we will not use your data in any way that breaches Vietnam law.
2. We may use your personal data:
   1. to fulfil our business goals;
   2. where we need to comply with a legal obligation (such as performing a contract or disclosing information to the Courts);
   3. to contact you in relation to your use of our Website and services;
   4. where we need to use your data to perform our contractual obligations with you (for example to provide you with the services this Website offers);
   5. to create aggregated statistics; and
   6. where we have a legitimate interest to use your personal data and your fundamental rights and interests do not override these interests.
3. Where we are part of, or become part of, a group of companies, our parent company and other companies in our group may also have access to the data we store.
4. You may receive marketing communications from us where it is legal for us to send them. Where we send you marketing materials, you can opt out at any time by following the instructions set out on the marketing materials, or by emailing us at .
5. We will not sell your personal data to third parties without your consent.
6. We will only hold data on you for as long as is reasonably necessary to fulfil the purpose we have collected it for, unless we are required to keep it for longer to fulfil a legal requirement (e.g. tax, accounting or if we suspect there is a reasonable prospect of litigation).

5. Purposes for which we use your data

1. To register you as a new customer
   • Type of Data: (a) Identity, (b) Contact
   • Lawful Basis: Performance of a contract with you
2. To process and deliver your order, including:
   • (a) Manage payments, fees and charges
   • (b) Collect and recover money owed to us
   • Type of Data: (a) Identity, (b) Contact, (c) Financial, (d) Transaction, (e) Marketing and Communications
   • Lawful Basis:
     • (a) Performance of a contract with you
     • (b) Necessary for our legitimate interests (to recover debts due to us)
3. To manage our relationship with you, including:
   • (a) Notifying you about changes to our terms or privacy policy
   • (b) Asking you to leave a review or take a survey
   • Type of Data: (a) Identity, (b) Contact, (c) Profile, (d) Marketing and Communications
   • Lawful Basis:
     • (a) Performance of a contract with you
     • (b) Necessary to comply with a legal obligation
     • (c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our services)
4. To enable you to partake in a prize draw, competition or complete a survey
   • Type of Data: (a) Identity, (b) Contact, (c) Profile, (d) Usage, (e) Marketing and Communications
   • Lawful Basis:
     • (a) Performance of a contract with you
     • (b) Necessary for our legitimate interests (to study customer use, develop services, and grow our business)
5. To administer and protect our business and this website
   • Includes troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting.
   • Type of Data: (a) Identity, (b) Contact, (c) Technical
   • Lawful Basis:
     • (a) Necessary for our legitimate interests (business operations, IT services, network security, fraud prevention, restructuring)
     • (b) Necessary to comply with a legal obligation
6. To deliver relevant website content and advertisements to you and measure their effectiveness
   • Type of Data: (a) Identity, (b) Contact, (c) Profile, (d) Usage, (e) Marketing and Communications, (f) Technical
   • Lawful Basis: Necessary for our legitimate interests (to study customer behavior, improve services, grow our business, and inform marketing strategy)
7. To use data analytics to improve our website, products, marketing, and customer experience
   • Type of Data: (a) Technical, (b) Usage
   • Lawful Basis: Necessary for our legitimate interests (to define customer types, keep the website updated, develop our business, and inform marketing strategy)
8. To make suggestions and recommendations about goods or services that may interest you
   • Type of Data: (a) Identity, (b) Contact, (c) Technical, (d) Usage, (e) Profile, (f) Marketing and Communications
   • Lawful Basis: Necessary for our legitimate interests (to develop our services and grow our business)

6. Third party content

1. Please be aware that we link to third party websites and may add functionality to our Website which integrates with third parties (e.g. payment providers). When you click these links or use third party functionality different terms and privacy policy will apply to your experience. Please consider reading the Terms and Privacy Policy and the Cookie Policy of each website you visit and feature you use.
2. We may subcontract various parts of the provision of the Website and its features or our services to third parties. This may require sharing your data with these third parties. Where this takes place we will ensure that it is in compliance with the law and that your data is kept secure and can only be used for specified purposes and in accordance with our instructions.

7. Third party services

1. We use trusted third-party service providers to operate, improve, and support our platform. These providers may process limited personal and technical data on our behalf in accordance with applicable data protection laws.
2. Product Analytics (PostHog)
   We use PostHog to analyze how users interact with our product and to improve functionality. This may include collection of usage data such as page views, clicks, session activity, device and browser information, and IP address.
3. Website Analytics (Google Analytics)
   We use Google Analytics, a web analytics service provided by Google LLC, to understand how visitors use our website. Google Analytics may collect information such as IP address, device and browser information, pages visited, time spent on pages, and interactions with the website. This information is used to analyze trends and improve user experience.
4. Payments and Billing (Paddle)
   We use Paddle as our payment processor and merchant of record to handle payments, subscriptions, and billing. When you make a purchase, Paddle may collect and process personal data such as your name, email address, billing details, payment information, IP address, and transaction data in order to complete and manage your purchase and comply with legal obligations. Paddle acts as a data processor and processes personal data in accordance with applicable data protection laws.
5. Customer Support and Live Chat (Tawk.to)
   We use Tawk.to to provide live chat support and communicate with users. When you interact with our chat, we may collect information such as your name, email address (if provided), chat messages, IP address, and device or browser information.
6. Error Monitoring (Sentry)
   We use Sentry to monitor application performance and detect errors. Sentry may collect technical information such as error logs, device data, browser type, and diagnostic information to help us identify and fix issues. We take reasonable steps to avoid sending any sensitive personal data through these logs.
7. Embedded Chat Scripts
   We use embedded scripts (including Tawk.to services) to enable real-time chat functionality on our website. These scripts may collect technical data such as IP address and device information as necessary for the service to function.
8. All third-party providers act as data processors and process data only on our behalf and under our instructions. We do not sell personal data to third parties. Data processed by these providers may be transferred to and stored in countries outside your jurisdiction, including the United States, where appropriate safeguards are in place to protect your data.

8. Data security

1. We take the security of your data extremely seriously and have implemented a range of technical measures to ensure that your data will not be lost, accidentally deleted, modified, or accessed in an unauthorised manner.
2. We have put in place procedures to follow in the event that our data security measures are ever breached and will comply with our legal obligations with regard to notifying you and the Vietnam’s Information Commissioner’s Office (“ICO”).

9. International transfers

1. A number of the third parties we work with are based outside of the Vietnam. As such from time to time we may need to export your data outside of the Vietnam. Where this takes place, we will ensure that these transfers are made in accordance with the law and that adequate technical and contractual safeguards are put in place.

10. Retention

1. We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
2. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
3. DigitalFlow (“Extraflowdoc”) retains Client data for so long as you remain are a Client and will delete Client’s information within 12 months of either party’s termination of applicable Client agreement upon written request. We retain User level data on the Platform as directed by our Clients and for a reasonable time thereafter for audit purposes and as otherwise required by law.

11. Your legal rights

1. In certain circumstances you have the following legal rights in respect of the data we hold on you:
   1. the right to be informed - in circumstances where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent;
   2. the right of access - you have a right to request a copy of the personal data that we hold about you. Please use the contact details at the end of this policy if you would like to exercise this right, or any of the rights listed below. If you are a European resident and consider our use of your personal data to be unlawful, you have the right to lodge a complaint with the relevant supervisory authority;
   3. the right to rectification - you have the right to request that we correct the personal data we hold about you, although we may need to verify the accuracy of the new information you provide to us as well as possibly your identity, depending upon your request;
   4. the right to erasure - you have the right to request that we delete or remove personal data where there is no good reason for us continuing to process it. Please note that we may not always be able to comply with your request for erasure if there are specific legal reasons which will be notified to you at the time of your request;
   5. the right to restrict processing - you have the right to request that we suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
   6. the right to data portability - you have the right to request that the personal data we hold about you is transferred to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.;
   7. the right to object - you have the right to object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms; and
   8. rights in relation to automated decision making and profiling.
2. You can find more about these rights on the ICO’s website available at www.ico.org.uk (the “ICO Website”)
3. If you wish to exercise any of these rights, please email us privacy@extraflowdoc.com. We may charge you a fee for exercising your rights where it is legal and reasonable to do so. We may also require you to prove your identity to us before allowing you to access these rights. We will always require you to prove your identity to us where you are seeking to exercise your right to access or your right to data portability.

12. Complaints

1. You have the right to complain about us and how we process your data to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).
2. However, in the first instance, we ask that you please email us with your problem at privacy@extraflowdoc.com so that we may first try to resolve your issue.
3. You can find further details of how to complain to the ICO about us on the ICO Website.