[bidflow]INVESTPrivacy Policy
Last updated: 12 August 2026
This policy explains what personal data Bidflow Invest collects through bidflowinv.com, why we collect it, who can access it and what rights you have. It covers this website only — not the campaigns we run for our clients, which are governed by our contracts with them.
1. Who is responsible for your data
The data controller is BIDFLOW LLC, registered at Sharjah Media City, Sharjah, United Arab Emirates, United Arab Emirates.
For any question about this policy or to exercise your rights, write to support@bidflowinvest.com. We answer within 30 days.
2. What we collect, and when
We collect personal data submitted through the contact form, and our host processes the technical data needed to serve the site (see section 5). We do not run analytics, advertising trackers or behavioural profiling on this website.
| Data | Source | Why |
|---|---|---|
| Name | You type it | To address you properly in our reply |
| Email address | You type it | To reply to your enquiry |
| Message | You type it | To understand and answer your request |
| IP address | Collected automatically on submission | To limit abuse: no more than 5 submissions per address per 10 minutes |
Nothing else is collected. There is no account, no newsletter subscription and no hidden field beyond a single anti-spam trap that is always empty for human visitors.
3. Legal basis
- Your enquiry (name, email, message) is processed on the basis of your request — steps taken at your request prior to entering into a business relationship (GDPR Art. 6(1)(b)), or our legitimate interest in answering people who contact us (Art. 6(1)(f)).
- Your IP address is processed on the basis of our legitimate interest in protecting the form against automated abuse (Art. 6(1)(f)).
4. Who else sees your data
Your message is delivered to our own mailbox. It is not sold, rented or shared with advertisers or data brokers. Two service providers are technically involved:
| Provider | Role | Where |
|---|---|---|
| IONOS SE | Hosts the website and processes the form submission | European Union (Germany) |
| Google Ireland Ltd. (Google Workspace) | Transports and stores the resulting email in our mailbox | European Union, with possible transfers to the United States under Google's standard contractual clauses and the EU–US Data Privacy Framework |
Everything else this website needs — fonts, images, scripts — is served from our own server. No content delivery network, no font provider and no third-party library host sees your IP address when you browse this site.
As we are established in the United Arab Emirates, data you send us is also accessible from the UAE. Where the GDPR applies to you, that transfer is necessary for the performance of the steps you requested by contacting us (Art. 49(1)(b)).
6. Server and access data
Independently of the contact form, our hosting provider processes the technical information required to deliver and secure the website. This typically includes the page or file requested, the date and time of the request, browser and device information, the referring page, and the IP address (or an anonymised form of it, where applicable).
This data is processed on the basis of our legitimate interest in operating a functioning, secure website. It is not used to profile visitors and is not combined with the contact form data.
Retention is governed by our hosting provider's standard configuration; the exact duration is being confirmed and will be stated here once verified.
6. How long we keep it
- Anti-abuse record (a one-way hash of your IP address, never the address itself): 10 minutes, then discarded.
- Your message in our mailbox: kept for as long as needed to handle your enquiry, and up to 3 years from our last exchange, which is the standard retention period for commercial prospection records. After that it is deleted.
- If we become a client of yours or you become one of ours, the contractual and accounting retention periods of our engagement apply instead.
7. Cookies
This website sets no cookies. None at all — not for analytics, not for advertising, not for preferences. Nothing is written to your device and nothing is read from it. That is why you are not being asked to accept anything.
8. Your rights
Where the GDPR applies to you, you may at any time request access to your data, its correction, its deletion, a restriction of its use, its portability, and you may object to processing based on legitimate interest.
Write to support@bidflowinvest.com. We do not require a specific form of words — a plain email is enough. If you believe we have mishandled your data, you may lodge a complaint with the supervisory authority of your country of residence.
9. Security
The site is served exclusively over an encrypted connection (HTTPS). Form submissions travel encrypted, and the email is transmitted to our mailbox over an authenticated, encrypted channel. Access to the mailbox is protected by two-factor authentication.
10. Children
This website addresses businesses. We do not knowingly collect data from anyone under 16. If you believe a minor has sent us personal data, contact us and we will delete it.
11. Changes to this policy
If we change how we handle personal data, we will update this page and the date shown at the top. Material changes will be signalled on the homepage.