Privacy Notice
Last updated: 28 August 2026
Data controller: FLOW Group Ltd, Shrewsbury (and FLOW Freedom to Learn Our Way CIC for donations and grant-funded activity)
Contact: hello@flowcommunity.co.uk
This notice explains what personal data we collect through flowcommunity.co.uk, why we collect it, who we share it with, and your rights.
1. Who we are
FLOW connects families with inclusive local activities for children outside full-time school. We operate a booking and payment platform. Activities are delivered by independent providers, who are separate data controllers for the information they receive about attendees.
- FLOW Group Ltd — activity bookings, provider accounts, advertising. Company number: 17375101. ICO registration number: ZC231537.
- FLOW Freedom to Learn Our Way CIC — donations, sponsorship and grant-funded work. Company number: 17293296. ICO registration number: ZC231520.
2. What we collect
Families (registration)
- Parent/guardian name, email address, phone number, town
- Password (stored only as a secure hash — we never see it)
- Each child's first name, date of birth, and interests
- Photo permission choice, marketing opt-in choice, terms acceptance
Bookings
- Activity, session date, child name, any specific needs you tell us about the session, booking status, amount paid
Donations and sponsorships
- Donor name, email, message, amount, whether the donation is anonymous, and cadence (one-off or recurring)
Providers and advertisers
- Contact name, business name, email, phone, website, activity details, images, and subscription status
Everyone
- Contact-form messages, and basic technical data needed to run the site securely (e.g. IP address in server logs)
We do not collect home addresses, postcodes, emergency contacts, or a child's sex.
3. Why we use your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account | Contract |
| Taking bookings and payments | Contract |
| Sharing attendee details with the activity provider | Contract |
| Photographs and video for promotion | Consent (opt-in, withdrawable) |
| Marketing emails and newsletter | Consent (opt-in, unsubscribe any time) |
| Donation receipts and Gift Aid records | Contract / legal obligation |
| Safeguarding and incident records | Legal obligation / vital interests |
| Site security and fraud prevention | Legitimate interests |
4. Who we share it with
| Recipient | What they receive | Role |
|---|---|---|
| Activity providers | Child's first name, session date, and any specific needs disclosed for that session; parent name, email and phone for contact | Independent controller — bound by our provider data-sharing agreement |
| Stripe Payments Europe / Stripe Inc. | Payment card details (collected directly by Stripe — we never see card numbers), name, email, amount | Independent controller / processor |
| Supabase (our database and authentication hosting, provided through Lovable Cloud) | All data stored by the platform | Processor |
| Email delivery provider | Recipient email address and message content | Processor |
| Professional advisers, funders (aggregate/anonymised only), and authorities where legally required | As required | Various |
We never sell your data or share it for third-party marketing.
5. International transfers
Some providers (including Stripe and parts of our hosting infrastructure) process data in the United States. Transfers are covered by UK International Data Transfer Addenda / EU Standard Contractual Clauses.
6. How long we keep it
- Family accounts and children's records: kept while your account is active, then 24 months after your last booking, then deleted.
- Booking and payment records: 7 years (tax and accounting).
- Donation records: 7 years; Gift Aid declarations as required by HMRC.
- Marketing list: until you unsubscribe, then a suppression record only.
- Contact form messages: 12 months.
- Safeguarding records: in line with our safeguarding policy.
7. Security
Access is protected by per-account authentication and row-level database security, so families can only see their own record and providers only see attendees of their own activities. Administrative access is restricted to named FLOW staff. Card details are handled solely by Stripe (PCI DSS compliant).
8. Your rights
You have the right to access, correct, delete, restrict or object to our use of your data, to data portability, and to withdraw consent at any time. Email hello@flowcommunity.co.uk and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
9. Children
Accounts are held by a parent or guardian, who provides all information about their child. We do not create accounts for under-18s directly and do not market to children.
10. Cookies
We use only essential cookies needed to keep you signed in and to process payments securely.
11. Changes
We will post any changes on this page and, for significant changes, notify registered families by email.