This is a courtesy translation. FluX operates under Spanish law, and the Spanish version of this policy is the binding one. If the two ever differ, the Spanish text prevails.
01
Who we are
The data controller is Anthony Sebastián Xerri Hawley, sole trader (natural person), Spanish tax ID 01847414P, based in Madrid, Spain (hereinafter «FluX», «we»).
You can write to us about anything concerning your personal data at privacidad@on-flux.com.
This policy applies to the website on-flux.com and to the platform app.on-flux.com, on the terms set out below.
02
The two roles of FluX
FluX is a platform that companies use to run their operations. That means we process personal data in two very different situations, and the law gives us a different role in each. Telling them apart matters because it determines who you should approach to exercise your rights.
When we are the controller
We decide why and how the data is processed. This covers information from our own relationship with you: browsing this website, the contact form, managing the customer account, invoicing and support.
When we are the processor
We merely process the data following our customer's instructions. This covers all the content a company enters into the platform: its employees, its work orders, its assets, its inventories, its forms and its reports.
In that case the controller is the customer company, not FluX. If you are an employee of a company that uses FluX and you want to access, rectify or erase your data, you must approach your employer. If you ask us directly, we will pass the request on to your employer and let you know, but we cannot resolve it ourselves: legally it is not ours to resolve.
03
What data we process
As a controller, we process the following categories of data:
If you visit the website
- Technical connection data that is unavoidable in order to serve the page: IP address, browser type and operating system, and date and time of access. It is recorded on the servers for security and operational reasons.
- This site uses no analytics, tracking or advertising tools and builds no browsing profiles. You can find the detail in our Cookie Policy.
If you write to us through the contact form
- Name, email address and company.
- Industry and approximate team size.
- Whatever message you choose to include.
If you are a customer or a platform user
- Identifying and contact data: name, email, phone number and assigned role.
- Access credentials. The password is always stored encrypted using key derivation functions: FluX cannot look it up or recover it at any point.
- Access and activity logs: IP address, date and time of connection and a trace of the actions performed on the platform. They are needed for security and for the traceability that our customers' audits require.
- Billing data and data from the contractual relationship.
- The communications we exchange with you through support.
04
What we use it for and on what legal basis
The GDPR requires every processing operation to have a legal basis. These are ours:
We do not sell personal data nor pass it on to third parties for their own purposes. Nor do we take automated decisions producing legal effects concerning you or similarly significantly affecting you.
05
The data our customers keep on the platform
The operational content a customer company enters into FluX (work orders, assets, inventories, forms, reports, signatures and their audit logs) may contain personal data of its employees or of third parties.
Regarding that data, and as a processor, we undertake to:
- Process it only following the documented instructions of the customer.
- Not use it for our own purposes, and in particular not use it to train artificial intelligence models.
- Keep customers isolated from one another: each organisation can only reach its own data, enforced at database level.
- Require our providers to meet the same confidentiality and security obligations we take on ourselves.
- Assist the customer when it receives requests to exercise rights, and notify it without undue delay of any security breach affecting its data.
- Erase or return the data when the service ends, whichever the customer decides.
These obligations are set out in the data processing agreement (DPA) we sign with every customer under article 28 of the GDPR. You can request a copy at privacidad@on-flux.com.
06
Artificial intelligence
Some platform features (the ORION assistant, automatic reports, preparing compliance documentation and the planner) use language models supplied by a third party acting as a sub-processor.
There are three things worth knowing about this:
- The data sent to the model is limited to what is needed to answer the specific query of the user.
- The provider does not use that data to train or improve its models, under the commercial terms we have signed.
- The AI features produce proposals and analysis, not decisions carried out automatically: they always require a person to review and approve them before they take effect.
07
Providers with access to the data
To provide the service we rely on infrastructure providers acting as processors or sub-processors, with a contract signed under article 28 of the GDPR. These are, openly, all those that can access personal data:
We may also disclose data to professional advisers, financial institutions and public authorities where there is a legal obligation or it is necessary to defend our rights.
We keep this list up to date. If we add or replace a provider that processes the data of our customers, we will tell them with the notice period agreed in the data processing agreement, so they can object if they see fit.
08
International transfers
The database holding the information of the platform is hosted in the European Union (France).
Some of the providers listed in the previous section are established in the United States. Where an international transfer is necessary, it relies on one of the safeguards set out in Chapter V of the GDPR: the Standard Contractual Clauses approved by the European Commission, together with any supplementary technical and organisational measures that apply, or the adherence of the provider to the EU-US Data Privacy Framework where it is certified.
You can ask us about the safeguards applied to a specific provider by writing to privacidad@on-flux.com.
09
How long we keep the data
Once those periods have passed, the data is erased or irreversibly anonymised. For as long as liabilities may arise, it is kept blocked and available exclusively to judges, courts and the competent authorities.
10
How we protect the data
We apply the appropriate technical and organisational measures required by article 32 of the GDPR, in particular:
- Encryption of communications in transit (TLS) and of data stored at rest.
- Strict isolation between organisations through row-level security policies in the database: the separation does not depend on application code but on the data engine itself.
- Role-based access control, on the principle of least privilege.
- Passwords stored encrypted, never in clear text and never accessible to us.
- Credentials and secrets managed outside the source code.
- An audit log of the relevant actions performed on the platform.
- Backups and restore procedures.
No system is completely invulnerable. Should a security breach occur that poses a risk to your rights, we will notify you and report it to the Spanish Data Protection Agency within the legally prescribed periods.
11
Your rights
You can exercise the following rights at any time:
- Access: find out whether we process your data and obtain a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete data that is no longer necessary.
- Objection: object to processing based on our legitimate interest, and in all cases to direct marketing.
- Restriction: ask us to suspend processing while an issue is verified.
- Portability: receive your data in a structured, commonly used format, or have us transmit it to another provider.
- Withdrawal of consent: where processing is based on it, without affecting the lawfulness of processing carried out beforehand.
Write to privacidad@on-flux.com stating which right you wish to exercise. We may ask you to prove your identity if there is reasonable doubt about who is making the request. We will reply within one month, extendable by two further months if the request is particularly complex, in which case we will tell you why within the first month. Exercising these rights is free of charge.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — aepd.es).
Remember what section 2 says: if your data is on the platform because your employer put it there, you must address your request to your employer, which is the controller.
12
Minors
FluX is a service aimed exclusively at companies and professionals. It is not aimed at minors and we do not knowingly collect their data. If we find that we have processed the data of a minor without proper grounds, we will erase it as soon as possible.
13
Changes to this policy
We may update this policy to reflect regulatory, technical or organisational changes. The version in force will always be the one published on this page, with its last update date.
Where the change is substantial and affects you materially, we will tell you by email or through a prominent notice in the platform before it takes effect.
14
Contact
For anything about privacy and data protection: privacidad@on-flux.com.
For legal or contractual matters: legal@on-flux.com. For service support: soporte@on-flux.com.
We handle any request through these channels, including the exercise of the rights described in section 11. If you need to write to us by post, contact us first at legal@on-flux.com and we will give you the address to send it to.