.svg)
In short
- We collect what you send us through our forms, email, WhatsApp and bookings, plus basic analytics about how the site is used.
- We use it to reply to you, plan and deliver projects, run the business and improve the site.
- We never sell your data. We share it only with the service providers that run our business.
- You can ask to see, correct, move or delete your data at any time by emailing us.
Who we are
This website is run by Flow Resources (IP0591361-P), trading as FlowCreates. In this policy, "FlowCreates", "we" and "us" mean Flow Resources. We decide how and why your personal data is used, which makes us the data user under the Personal Data Protection Act 2010 (PDPA).
This policy covers flowcreates.com.my, our forms, our emails and the work we do for clients. It does not cover websites we build for clients. Each client publishes its own privacy policy for its own site.
What we collect
Information you give us
- Waiting list and contact forms: your name, work email, firm name, role, phone or WhatsApp number, and what you tell us about your project, timing, budget and decision-making.
- Calls and bookings: your name, email and any notes you add when you book a call through Calendly.
- Email and WhatsApp: the content of messages you send us and the contact details they come from.
- Client projects: contact details of your team, billing details, and the content, logins and files you share so we can build your website.
- Job applications: your name, email, location, links to your work and your answer to our test brief.
Information collected automatically
- Pages visited, time on page, device and browser type, approximate location from your IP address, and the site or ad that sent you.
- This data is collected through cookies and similar tools. Our Cookie Policy explains each one.
We do not ask for sensitive personal data, such as health, religious or biometric data. Please do not send it to us.
How we use it
- Reply to your enquiry and decide whether we are the right fit for your project.
- Prepare proposals, deliver projects, send invoices and collect payment.
- Run our waiting list and contact you when a project slot opens.
- Review job applications.
- Measure how the website performs and improve it.
- Measure the results of our advertising.
- Keep our systems secure and meet our legal, tax and accounting obligations.
We send marketing emails only if you have asked to hear from us. Every marketing email has a way to opt out.
What happens if you don't share it
Fields marked as required on our forms are needed for us to reply. If you leave them out, we may not be able to respond or take on your project. Everything else is optional.
Transfers outside Malaysia
Some of our providers store data outside Malaysia, mainly in the United States and the European Union. We only use providers that protect personal data to a standard substantially similar to the PDPA, through their own data protection terms and security certifications.
How long we keep it
| Data | How long |
|---|---|
| Enquiries that don't become projects | Up to 2 years from our last contact |
| Client project and billing records | 7 years after the project ends, to meet tax and accounting rules |
| Job applications | Up to 1 year, unless you ask us to keep you in our talent pool longer |
| Analytics data | 14 months |
After that, we delete the data or make it anonymous.
How we protect it
We limit access to personal data to the people who need it, use two-factor authentication on our accounts and use providers with recognised security standards. No system is perfectly secure. If a data breach is likely to cause you significant harm, we will tell you and the Personal Data Protection Commissioner as the PDPA requires.
Your rights
Under the PDPA, you can:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct data that is wrong, incomplete or out of date.
- Withdraw your consent, or ask us to limit how we use your data.
- Ask us to send your data to another organisation in a usable format.
- Opt out of marketing at any time.
Email general@flowcreates.com with your request. We reply within 21 days and don't charge for reasonable requests. We may ask you to confirm your identity first.
Children
This website and our services are meant for businesses. We don't knowingly collect personal data from anyone under 18.
Changes to this policy
We update this policy when our tools or the law change. The date at the top shows the latest version. If a change affects how we use data you have already given us, we will tell you by email.
Contact us
Questions, requests or complaints about your personal data go to the FlowCreates data protection team.
Flow Resources (IP0591361-P), trading as FlowCreates
Oasis Square, Block A-7-09, Level 7, Jalan PJU1A/7, Ara Damansara, 47301 Petaling Jaya, Selangor, Malaysia
Email: general@flowcreates.com
Phone: +60 17-674 1737
Hours: Monday to Friday, 8am to 6pm (Malaysia time)
If you're not satisfied with our reply, you can complain to the Personal Data Protection Commissioner of Malaysia.