1. Who is responsible for your data
BRIDGEFLOW LTD is the controller of personal data described in this policy.
Company number: HE 496400
Registered office: Panteli Katelari 4, Egkomi, 2413, Nicosia, Cyprus
Privacy contact: services@bridgeflow.world
2. Information we may collect
Depending on how you interact with us, we may process:
- your name, work email address, telephone number and job title;
- your company name, website, operating markets and business contact details;
- information you include in an enquiry or later correspondence;
- records of meetings, introductions, decisions and commercial communications;
- technical information generated when the website is accessed, such as IP address, browser type, device information, timestamps and security logs.
Please do not send special-category personal data, payment credentials or confidential customer information through the website enquiry form.
3. Why we use personal data
We use personal data to respond to enquiries, understand business requirements, arrange relevant discussions, manage potential or existing commercial relationships, maintain records, secure the website and comply with legal obligations.
Our legal bases may include taking steps at your request before entering into a contract, performing a contract, complying with a legal obligation, and our legitimate interests in operating and protecting our business and responding to B2B enquiries. Where the law requires consent, we will request it separately and you may withdraw it at any time.
4. Enquiries and provider introductions
Submitting an enquiry does not automatically send your information to any payment provider. If a potential introduction is identified, we will explain the intended recipient and context before sharing personal or business contact information, unless disclosure is otherwise required by law.
5. Who may receive information
Information may be accessed by authorised BridgeFlow personnel and by service providers supporting email, website hosting, security, professional advice and business administration. It may also be shared with independent payment providers or acquiring partners where this is relevant to a requested introduction and a lawful basis exists.
Recipients act under their own legal responsibilities where they independently determine how information is used.
6. International transfers
Some suppliers or potential payment partners may be located outside the European Economic Area. Where personal data is transferred internationally, we use an applicable legal mechanism, such as an adequacy decision, standard contractual clauses or another safeguard recognised by data-protection law.
7. How long we keep information
General enquiries are normally retained for up to 24 months after the last meaningful contact. If a business relationship develops, relevant records may be retained for the duration of that relationship and afterwards for the period required by applicable legal, accounting or dispute-management obligations. Security and access logs are retained only for as long as reasonably necessary for security and troubleshooting, normally no longer than 12 months unless an incident requires longer retention.
8. Your rights
Subject to the GDPR and applicable Cyprus law, you may have rights to access, correct or erase personal data; restrict or object to processing; receive portable data in certain cases; withdraw consent; and complain to a supervisory authority. These rights are not absolute and may depend on the circumstances and legal basis involved.
Send requests to services@bridgeflow.world. We may ask for information needed to verify your identity.
9. Complaints
You may complain to the Cyprus Office of the Commissioner for Personal Data Protection at 15 Kypranoros Street, 1061 Nicosia, Cyprus. Current contact information is available at dataprotection.gov.cy.
10. Security, children and updates
We use proportionate technical and organisational measures intended to protect information. No internet transmission or storage system can be guaranteed completely secure. This website and our services are intended for business users and are not directed to children.
We may update this policy when our activities, service providers or legal obligations change. The current version and update date will remain available on this page.