Privacy notice
VELIOFLOW LTD · Version 1.0 · Last updated: 1 November 2026
In short
- Who we are: VELIOFLOW LTD, a UK company that designs and builds websites, apps and business automation.
- Our website sets no cookies, uses no analytics or tracking, and has no forms. Our hosting provider (Cloudflare) processes technical data such as your IP address so the site can load securely.
- If you contact us by email, WhatsApp or a social media message, we use what you send to reply and, if you wish, to prepare a proposal.
- If we contacted your business: we found your business and its generic business email address in public sources (OpenStreetMap, the business's own website and Companies House). You can tell us to stop at any time — just reply "unsubscribe" (or "no thanks") — and we will not contact you again.
- Our demos run in your browser with sample data; nothing you enter is sent to us. A demo may save what you enter in your own browser so that it keeps working.
- Client projects: where we build a system for a client, the client decides how its customers' data is used; the client's own privacy notice applies.
- Your rights: you can ask for a copy of your data, ask us to correct or delete it, or object. You can complain to the ICO.
The sections below give the detail.
1. Who we are and how to contact us
VELIOFLOW LTD is the controller of the personal data described in this notice.
- Registered in England & Wales, company number 17535379
- Address: BA12 9AW, United Kingdom (postcode)
- We have applied to register with the Information Commissioner's Office (ICO) as a data controller (application reference C2074646). We will add our registration number here once it is issued.
- Email: admin@velioflow.com
- WhatsApp: +44 7474 050592
We are not required to appoint a Data Protection Officer. For any privacy question, email admin@velioflow.com.
This notice does not cover the I'M HERE app, which has its own privacy notice on useimhere.com.
2. What we collect, why, and our lawful basis
| Who you are | Data | Why we use it | Lawful basis (UK GDPR) |
|---|
| Website visitor (velioflow.com) | IP address, browser and device details, page requested, date and time | To deliver the website and protect it from abuse | Legitimate interests — running a secure website |
| Someone who contacts us (email, WhatsApp, social media messages) | Your name, email address or phone number, your message, and any business details you share | To reply, answer questions and, if you ask, prepare a quote | Legitimate interests — responding to enquiries; or steps you ask us to take before a contract |
| A business we contact (outreach) | See section 3 | To offer our services to businesses | Legitimate interests — see section 3 |
| A client, or a client's staff contact | Name, business contact details, contract and project correspondence, invoices and payments | To deliver the agreed work and keep business and tax records | Contract; legal obligation (accounting and tax records) |
Website — what we do not do. Our website does not set cookies, does not use analytics or advertising tools, has no tracking pixels and has no forms. Fonts are served from our own site, not from a third party. WhatsApp buttons on the site open a pre-filled draft in WhatsApp; nothing is sent until you press send yourself. Our footer links to our Instagram, Facebook and X pages. If you follow, message or interact with us there, that platform (Meta for Instagram and Facebook, X for X) also handles your data under its own terms and privacy policy; we use your message only to reply.
Demos. Interactive demos on demo.velioflow.com and kaplama.velioflow.com run in your browser using sample data. What you type into a demo is not sent to us. So that a demo keeps working when you reload the page, it may save what you enter in your own browser's storage (local storage). That data stays on your device and is not sent to us; you can delete it at any time by clearing this site's data in your browser. Please do not enter real personal data into a demo.
Client projects. When we build or run a system for a client (for example, a booking or quote app), we process the data of the client's customers on the client's behalf, as a processor. The client is the controller, and that processing is covered by our contract with the client and the client's own privacy notice — not by this notice.
3. Businesses we contact (outreach)
This section explains how we use business contact details that we did not collect from you directly.
Where the data comes from. Public sources only: OpenStreetMap (map data that lists the business), the business's own website (for example its home, contact, team and about pages) and the public register at Companies House. We do not buy contact lists.
What we keep. About the business: its name, website, the contact details it publishes (its generic business email address, for example info@ or hello@, its phone number and the address of its contact form), sector and town or city, company details from Companies House, and our notes from its public website — publicly visible gaps (for example, no online booking), the technology the site uses, and public signs such as whether it advertises online, works with a web agency or is recruiting. About people: where the business's own website names its staff (for example on a team or about page), our research notes may include those names and job titles, and any email address or phone number (including a mobile number) that the website shows for them. We also keep a record of the emails we sent and any reply.
Most of this is business information. However, staff names and job titles, and an email address or phone number that relates to an identifiable person, are personal data, so we treat all of this information as personal data.
Why, and our lawful basis. We use it to introduce our services to businesses that may benefit from them. Our lawful basis is legitimate interests — promoting our business to other businesses. We have weighed this against your interests:
- we use only information the business itself has made public;
- we send our emails only to the business's generic address — not to a named member of staff, and not to personal or private addresses; staff names and job titles help us understand the business, and we do not use them to contact people individually;
- every email says who we are and how to stop further emails;
- the impact on you is low — at most an email you can ignore or decline;
- we stop as soon as you ask, and record that so you are not contacted again.
Email marketing rules (PECR). Under the Privacy and Electronic Communications Regulations, we send unsolicited marketing emails only to corporate subscribers (such as limited companies and LLPs). We do not send them to sole traders or partnerships treated as individuals unless they have consented.
Your right to object. You can object to direct marketing at any time, free of charge. Reply "unsubscribe" (or "no thanks") to any of our emails or write to admin@velioflow.com. We will then stop all marketing to you and keep only a minimal suppression record (the email address or business domain and the date) so that we never contact you again.
When we tell you. We link to this notice in our first email to a business. For businesses we research but never contact, we make this information available by publishing this notice.
4. Who we share data with
We do not sell personal data. We share it only with service providers who help us run our business, and only as needed:
- Cloudflare — website hosting, DNS and security
- Microsoft (Microsoft 365 / Outlook) — our business email
- WhatsApp (Meta) — when you message us on WhatsApp. WhatsApp also handles your data under its own terms and privacy policy.
- Instagram and Facebook (Meta) and X — when you message or interact with us on our social media pages. These platforms also handle your data under their own terms and privacy policies.
We may also share data with professional advisers (such as an accountant or lawyer) where needed, or with authorities when the law requires it.
If we start using another provider for your data (for example, a separate email-sending service), we will update this notice before we do.
5. International transfers
Some of our providers may process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or on the UK International Data Transfer Agreement or Addendum. Email us for more information.
6. How long we keep data
| Data | How long |
|---|
| Enquiries (email, WhatsApp) | 2 years after our last contact with you |
| Research records about businesses we have not contacted | 6 months after we collected them |
| Outreach records (businesses we contacted) | 12 months after our last contact, or until you object — whichever is sooner |
| Suppression record (people who opted out) | Kept for as long as we do outreach, so we can honour your choice; minimal data only |
| Client contracts, invoices and accounting records | For the contract, then 6 years after the end of the financial year they relate to (tax and company law) |
| Website technical logs | Held by Cloudflare for a limited period under its own policies; we do not add our own website logs |
7. Your rights
You have the right to:
- access a copy of your personal data;
- correct inaccurate data;
- ask us to delete your data;
- ask us to restrict how we use it;
- object to our use of it — and to direct marketing at any time, without giving a reason;
- data portability, where it applies.
To use any right, email admin@velioflow.com. It is free. We will reply within one month. We may ask you to confirm your identity first.
We do not make decisions about you using solely automated processing.
8. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint · 0303 123 1113.
9. Security
We use reputable providers and take appropriate technical and organisational measures to protect personal data. Access to our systems is limited to people who need it.
10. Children
Our services are for businesses. They are not aimed at anyone under 18, and we do not knowingly collect children's data.
11. Changes to this notice
We will update this notice when our practices change. The version number and "last updated" date at the top show the current version.
VELIOFLOW LTD · Registered in England & Wales · No. 17535379 · BA12 9AW · admin@velioflow.com
WhatsApp: +44 7474 050592 · E-mail: admin@velioflow.com · BA12 9AW