Privacy and data handling

This page explains how KataFlow LTD handles personal data in the context of business outreach and communications via hellokataflow.com.

Who we are

What data we process

We process business contact details — name, company, professional email address, and publicly-available role information — sourced from publicly-accessible business directories and company websites. We do not process consumer data, financial information, or special categories of personal data.

Legal basis

For business-to-business communication with employees of companies within our professional target audience, we rely on legitimate interest under Article 6(1)(f) GDPR, UK GDPR, and the equivalent provisions of the Swiss nFADP. For recipients in the United States we comply with CAN-SPAM, including mandatory identification, physical address, and opt-out provisions.

How long we retain data

Active contacts: up to 24 months from the last meaningful interaction. Contacts who have opted out or requested erasure: retained only as a salted hash of the email address, for up to 24 months, solely to prevent re-contact.

Your rights

You may at any time request:

• Access — a copy of the data we hold about you
• Rectification — correction of inaccurate data
• Erasure — deletion of your data
• Objection — opt-out from all further processing
• Portability — your data in a machine-readable format

To exercise any of these, email privacy@hellokataflow.com. We respond within 30 days as required by law. You may also complain to the UK Information Commissioner's Office (ICO), the Swiss Federal Data Protection and Information Commissioner (FDPIC), or the supervisory authority where you live.

Opting out of email

You can opt out at any time by:

• Replying STOP to any email we have sent you
• Emailing privacy@hellokataflow.com with "unsubscribe" in the subject

Opt-out requests are honoured within 4 business hours of receipt, and no later than 24 hours.

Third parties

We use the following processors on our behalf:

• Instantly.ai (sending platform, USA) — email addresses and delivery metadata
• Google Workspace (mailbox host, USA/EU) — email delivery infrastructure
• MillionVerifier (email verification, EU) — validates email syntax and deliverability

All are bound by Data Processing Agreements and GDPR-appropriate safeguards.

Updates

Last updated: 2026-08-11. Material changes will be reflected on this page.