Privacy Notice

Privacy Notice — Fluxzero

Version: September 2026

1. Who Are We and What Do We Offer?

We are Fluxzero B.V. (Fluxzero). We provide a cloud platform for software, designed to let you build your application logic – including with your AI coding tools – while Fluxzero takes care of execution, scaling, persistence, security and deployment (the Platform). You can access our Platform via our Website: https://www.fluxzero.io (and the use of the Platform, the Website, the SDK, the CLI and related services collectively: our Services).

Our public websites include the developer documentation and the package repository at https://packages.fluxzero.io. Public package downloads do not require a Platform account.

2. Personal Data and Controller

We process certain Personal Data. Personal Data means all information by which a natural person can be directly or indirectly identified. Under the General Data Protection Regulation (GDPR), which applies to us, we are the Controller of your Personal Data for the processing activities described in this Privacy Notice.

If you process Personal Data through applications you build and run on the Platform, you remain the Controller for the processing of such Personal Data, and Fluxzero acts as a Processor on your behalf under the GDPR. The terms governing that relationship are set out in our Data Processing Agreement.

3. What Personal Data Do We Process as Controller?

We will process your Personal Data if you create an account (User), or when you represent one of our customers (Representatives).

Note that information uploaded by or generated by Users in relation to our Services is outside the scope of this Privacy Notice, as it is not processed by Fluxzero as a Controller. We process such information only on behalf of the written instructions of our customers, under their control. Therefore, our customers act as the Controller for this Personal Data. For information on how they process this Personal Data, please consult their privacy notices.

We may also process Personal Data in a general context, e.g. via our Website and social media accounts (General). We will also process your Personal Data if you apply for a job at Fluxzero (Applicants).

If You Are a User

When You Create an Account

Personal Data

• Name;
• email address (provided by you or the organisation you belong to);
• password (hashed); and
• organisation details.

Purpose(s)

We use this information to:

• create and secure your account;
• enable sign-in and authorisation; and
• inform you about maintenance and modifications of our Services.

Legal basis

We may process this Personal Data because it is necessary to perform our contract with you.

We may also process this Personal Data because we have a legitimate interest in providing our Services to you according to the agreement we have with your organisation. This includes securing our Platform and communicating with you about our Services.

When You Access Our Platform

Personal Data

• Service logs (timestamps, IP addresses, user/tenant IDs, API/resource IDs);
• device/browser information; and
• event metadata.

Purpose(s)

We use this information to:

• enable you to use our Services;
• improve our Services, for example by fixing errors and deciding which features to develop or update;
• maintain the security of our Platform and prevent abuse.

Legal basis

We may process this Personal Data because it is necessary to perform our contract with you.

We may also process this Personal Data because we have a legitimate interest in providing our Services to you according to the agreement we have with your organisation to the best we can. This includes securing our Platform and improving our Services.

When You Contact Support

Personal Data

• Messages, screenshots and attachments you send to support.

Purpose(s)

We use this information to respond to your requests and fix issues.

Legal basis

We have a legitimate interest in providing you with effective support.

If You Are a Representative

When You Communicate With Us

Personal Data

• Contact details;
• contents of our communications.

Purpose(s)

We use this information to maintain the relationship with the organisation you represent.

Legal basis

We may process this Personal Data because we have a legitimate interest in maintaining a professional relationship with you.

Payment Information

Personal Data

• Name;
• e-mail address;
• invoicing details;
• bank details (account number, IBAN and BIC-code); and
• VAT identification number.

Note that this information only qualifies as Personal Data if it relates to a person, for example when you are self-employed.

Purpose(s)

We use this information to:

• send you invoices;
• process and administer payments;
• maintain our list of accounts receivable and outstanding invoices; and
• include in our administration on behalf of the tax authorities.

Legal basis

We may process this Personal Data because it is necessary to perform our contract with you.

We are also legally obligated to share (some of) this data with the national tax authorities.

If You Are an Applicant

Contact Details

Personal Data

• First and surname;
• e-mail address;
• address; and
• telephone number.

Purpose(s)

We use this information to contact the Applicant about the application.

Legal basis

We may process this Personal Data because we have a legitimate interest in processing this data.

We process this Personal Data because it is necessary for the (preparation of the) performance of our contract with you.

Application Information

Personal Data

• Information provided by the Applicant, among others: Personal Data included in the Curriculum Vitae and motivation letter, qualifications, photo (if provided by the Applicant), gender and date of birth.

Purpose(s)

We use this information to:

• assess whether the Applicant is suited to the job and to Fluxzero; and
• determine which Applicant is the most suitable candidate.

Legal basis

We process this Personal Data because it is necessary for the (preparation of the) performance of our contract with you.

We may process this Personal Data because we have a legitimate interest in processing this data.

Information Retained During the Application Process

Personal Data

• Notes from interviews.

Purpose(s)

We use this information to:

• assess whether the Applicant is suited to the job and to Fluxzero; and
• determine which Applicant is the most suitable candidate.

Legal basis

We process this Personal Data because it is necessary for the (preparation of the) performance of our contract with you.

We may process this Personal Data because we have a legitimate interest in processing this data.

Information From Public Sources

Personal Data

• Information in public profiles, such as LinkedIn and other social networks (where applicable).

Purpose(s)

We use this information to:

• assess whether the Applicant is suited to the job and to Fluxzero; and
• determine which Applicant is the most suitable candidate.

Legal basis

We may process this Personal Data because we have a legitimate interest in processing this data.

We process this Personal Data because it is necessary for the (preparation of the) performance of our contract with you.

Personal Data We May Process in General

If You Visit Our Public Websites

Personal Data

• Information on your device type, session date and time, IP address, browser or other client type, and the requested page or file;
• security-event details if a request is flagged or blocked.

Purpose(s)

We use this information to:

• communicate in the same language of the browser;
• adapt our Website to the used device;
• deliver our Website and public files;
• protect our Services and diagnose availability or security problems; and
• improve our Services.

Legal basis

We may process this Personal Data because we have a legitimate interest in providing functioning and secure public Services and improving them for our customers.

If You Use Documentation Feedback

Personal Data

• contact or account details you provide or use when submitting feedback;
• the documentation page, selected text and feedback message you submit.

Purpose(s)

We use this information to:

• let you submit feedback or questions about our documentation;
• link feedback to the relevant documentation page or selected text;
• manage, review and respond to documentation feedback; and
• improve our documentation and Services using the feedback we receive.

Legal basis

We may process this Personal Data because we have a legitimate interest in receiving and managing documentation feedback.

Via Our Social Media Pages

Personal Data

• Information of visitors who leave a comment or otherwise post something on our social media pages, including the Personal Data within these comments and/or posts.

Purpose(s)

We use this information to:

• contact the visitors in reply of their post and/or comment via our social media pages; and
• process the feedback left on our social media pages.

Legal basis

We may process this Personal Data because we have a legitimate interest to process this data and because the visitors voluntarily made public such information.

Social media pages are controlled by the social medium itself as Controller. Please check their own privacy notices to see how each social medium handles Personal Data:

• LinkedIn: https://www.linkedin.com/company/fluxzero/

If You Contact Us

Personal Data

• Your name;
• contact details; and
• the content of the correspondence.

Purpose(s)

We use this information to:

• answer your questions and/or handle any complaints;
• support you in using our Services; and
• improve our Services using questions and feedback from you.

Legal basis

We may process this Personal Data because we have a legitimate interest to contact and assist you based on your comment or question and to improve our Services using the questions and feedback we receive.

If You Subscribe to Our Newsletter

Personal Data

• Communication preferences;
• name, surname; and
• e-mail address.

Purpose(s)

We use this information to send you our newsletter and keep you informed on all our (future) Services.

Legal basis

We process this Personal Data if you have given us your consent to do so.

You can unsubscribe at any time via the link provided at the bottom in each email.

4. Mandatory Information

When you use our Services, it may be required that you provide us with certain Personal Data, as indicated above. If you choose not to provide this information, we may not be able to provide (certain parts of) our Services to you. For example, we cannot create an account for you without your name and email address.

5. Cookies

We use functional cookies and similar browser technologies on our Website. A cookie is a simple small text file that can be stored on your device when visiting the Website.

We do not use cookies or similar browser technologies for advertising, retargeting, cross-site profiling, social media tracking, heatmaps, session replay or optional analytics on the public Website, documentation or package repository.

We use strictly necessary cookies where required for functionality you request, including documentation feedback and security challenges. We may also use browser storage for functional documentation preferences.

For more information on our use of cookies, please refer to our Cookie Notice: https://fluxzero.io/docs/about/cookies/.

6. How Long Do We Keep Personal Data?

We will not process or store any Personal Data that we do not need. We store Personal Data for as long as we need it for the above purposes, unless we are legally required to retain the Personal Data for a longer period. In this respect, we apply the following retention periods:

• Personal Data of Users: We retain the Personal Data for 30 days after the User’s account has been deleted.
• Personal Data of Representatives: We retain the Personal Data for 5 years after our professional relationship with you has ended.
• Newsletters: We retain the Personal Data used for sending newsletters until you unsubscribe from our newsletter.
• Personal Data in our correspondence: We retain the Personal Data as long as necessary to handle your message/question/complaint and for a period of 2 years thereafter.
• Personal Data in our records for the (tax) authorities: We retain the Personal Data for 7 years, unless we are legally obliged to retain the data for a longer period.
• Personal Data of Applicants: We retain the Personal Data for a maximum of 4 weeks after the application process, unless the Applicant has given us permission to store the Personal Data for (up to) 1 year.
• Platform service logs: We retain Platform service logs for 90 days after generation, unless a longer period is required for security investigations.
• Public website security events: Cloudflare makes sampled events available to us for up to 24 hours. We retain incident information longer only as needed for the investigation and resulting legal obligations or claims.

After expiry of the aforementioned retention period(s), we may process and retain certain Personal Data to comply with legal retention obligations and/or for fraud/misuse investigations or to substantiate a (judicial) claim. In such events, we will retain the Personal Data separately and only use such Personal Data for the aforementioned purposes.

7. Do We Share Your Personal Data With Others?

Processors

We work with third parties who process Personal Data on our behalf (Processors). By doing so, we continue to uphold responsibility for ensuring protection of your Personal Data during such processing. These Processors may only use or disclose the data collected and processed by us within the scope of our instructions to them and under no circumstances for other purposes. We enter into a data processing agreement with all of our Processors.

For instance, we use Processors for:

• email management and communication;
• data storage;
• cloud hosting and infrastructure;
• payment processing;
• sending newsletters.

Cloudflare provides storage, content delivery, security and network-error diagnostics for our public websites. Cloudflare’s Data Processing Addendum sets out the data-protection terms for its processing on our behalf.

Controllers

We might also share your Personal Data with third parties who use it for their own purposes (Controllers). Once they have your Personal Data, it is their responsibility to protect it. To know how these parties handle Personal Data, you can check their privacy notices.

We share Personal Data with:

• Tax authorities: We are legally obliged to include (some of) the Personal Data in our financial administration, which must be shared with the national tax authority.
• Suppliers: Which may include insurers, attorneys and other professional service providers.

Apart from the above, we will only share Personal Data with third parties if the law obliges us to, if you give your permission or if this is necessary in special situations such as:

• the protection of our own interests or those of third parties;
• dealing with a legal case; or
• in connection with a merger, acquisition, asset sale, or similar corporate transaction.

8. Export of Personal Data Outside the European Union/European Economic Area

We primarily process and store your Personal Data in the EU/EEA. We may transmit or give access to Personal Data to parties outside the EU/EEA, if one of our Processors or other Controllers is established there. Personal Data will only be transferred to countries and/or parties that provide an adequate level of protection as decided by the European Commission, or if we have Standard Contractual Clauses (SCCs) and/or other appropriate safeguards in place. You may contact us if you wish to receive more information or a copy of the safeguards we have put in place.

Our public websites use Cloudflare’s global network, so request and security information may be processed outside the EU/EEA under the safeguards described above and in Cloudflare’s Data Processing Addendum.

9. Third Party Websites

You may find hyperlinks on our Website that link to the websites, products and services of partners, suppliers, sponsors, licensors or other third parties. We do not control the content or the links that appear on these websites, and we are not responsible for the practices employed by websites linked to or from our Website. In addition, these websites, products, and services, including their content and links, may be constantly changing. Browsing and interaction on any other website, including websites that are linked to or from our Website, are subject to the terms and policies of that website.

10. Security

We apply appropriate technical and organisational measures to protect your Personal Data, including encryption in transit and at rest, role-based access controls, automated backups, and continuous monitoring. Our platform architecture enforces component isolation and validates all requests before code execution. We assess and monitor the security practices of our sub-processors and provide regular security awareness training to our staff. Our infrastructure providers maintain industry-standard security certifications. If we are legally required to notify a data breach, we will notify you and the relevant supervisory authority without undue delay.

11. Children

Our Services are designed for business use only. We do not knowingly offer Services directly to children. If you are under sixteen, please do not use our Services. If we learn we have collected data from a child without appropriate consent, we will delete it promptly.

12. Changes to This Privacy Notice

This Privacy Notice may be changed from time to time. Please check our Website regularly to access the latest version of the Privacy Notice. The new Privacy Notice will be effective immediately upon posting on our Website. If we change our Privacy Notice significantly, we will clearly indicate this on our Website, together with the revised Privacy Notice.

13. Your Rights as a Data Subject and Our Contact Data

You have the right to:

• Access: You can ask us to provide access to, and a copy of, your personal data along with additional relevant details.
• Data portability: You can ask us to give you your personal data in a format that you can easily use elsewhere.
• Rectification: You can ask us to rectify any inaccuracies or complete any incompleteness in your personal data.
• Restrict processing: You can ask us to stop using your personal data, but still keep it stored.
• Erasure: You can ask us to erase your personal data, a right often referred to as “the right to be forgotten”.
• Withdraw consent: You can ask us to stop using your personal data for the purpose we requested your consent for. This does not impact the legality of any prior or other uses of your data.
• Object: You can ask us to stop using your personal data for things like direct marketing or for our own business needs.

To exercise any of these rights, please email us at privacy@fluxzero.io. We may ask to verify your identity. We will respond within one month of receiving your request.

You are always entitled to file a complaint with a data protection supervisory authority if you believe that we are not processing your Personal Data in accordance with the GDPR. In the Netherlands, the supervisory authority for data protection is:

Autoriteit Persoonsgegevens
Website: https://www.autoriteitpersoonsgegevens.nl

Fluxzero B.V.
Wilhelminakade 81
3072 AP Rotterdam
The Netherlands
E: privacy@fluxzero.io
W: https://www.fluxzero.io
Chamber of Commerce: 90481291