1. Who We Are
Flowen Co., Ltd. (“Flowen,” “We,” “us,” or “our”) is a company incorporated in Thailand with its registered office at 22/103 Klong Lum Chiak Rd., Nawamin, Bueng Kum, Bangkok 10230. We operate a behavioral AI platform designed to help financial institutions and collection teams optimize their debt recovery processes.
This Privacy Notice explains how we collect, use, store, disclose, and protect your personal data when we act as a data controller, that is, when we determine the purposes and means of processing your personal data.
2. Scope
This Privacy Notice applies to personal data we collect and process in connection with: (a) any transaction or action executed and coordinated on Our website (www.flowenco.com) (the “Website”) and any related online services and communication, particularly on Flowen Platform (the “Platform”); (b) Our business development and sales activities, including communications with prospective and existing clients (the “Client”); (c) Our relationship with Our Client personnel who access and use the Platform as authorised users (the “User”); and (d) your visit to and use of our Website, including when you submit an enquiry through the contact form on our Website (the “Visitor”).
This Privacy Notice does not cover personal data that we process on behalf of our Client as a data processor (such as debtor records and related financial data). The processing of such data is governed by the applicable service agreement and Data Processing Agreement between Flowen and the relevant Client.
Our Website and services are intended for businesses and professionals. They are not directed at individuals under twenty (20) years of age, and we do not knowingly collect personal data from minors through our Website. If you believe that a minor has provided us with personal data, please contact us and we will take steps to delete it.
3. Personal Data We Collect
| Category | Types of Data | How We Collect It |
|---|---|---|
| Business Contact Data | Name, job title, company name, work email address, phone number | Directly from you (enquiries, meetings, business card exchanges, event registrations) and indirectly from legitimate reference |
| Website Enquiry Data | Full name, company name, work email address, the content of your message, your selected website language, and the web page from which the enquiry was submitted | Directly from you when you complete and submit the contact form on our Website |
| Platform User Data | Name, email address, login credentials, role/permissions, activity logs within the Platform | From Client (during onboarding) and from your use of the Platform |
| Website Usage Data | IP address, browser type and version, device information, operating system, pages visited, time spent, referring URLs, cookies | Automatically via cookies and similar technologies, and through server and security logs maintained by our website hosting provider |
| Correspondence Data | Records and content of communications between you and Flowen (emails, enquiry forms, chat messages) | Directly from you |
We do not intend to collect sensitive personal data (as defined under Section 26 of the PDPA, such as health, biometric, religious or criminal record data) through our Website. Please do not include such data in any enquiry you submit to us.
3.1 Cookies and Tracking Technologies
Our Website and Platform use cookies and similar technologies to improve your browsing experience, analyse website traffic, and understand how visitors interact with our Website and Platform. Cookies are small text files placed on your device when you visit a website. Similar technologies include pixels, tags, local storage and software development kits.
We use the following categories of cookies:
- Strictly necessary cookies: Required for the Website and Platform to function properly and securely (for example, security, load balancing and remembering your cookie choices). These cannot be disabled.
- Functional cookies: Remember choices you make (such as your preferred language) to provide a more personalised experience. These are only placed with your consent.
- Analytics cookies: Help us understand how visitors use our website so we can improve it. These are only placed with your consent.
- Marketing cookies: Used to deliver relevant content and measure the effectiveness of our communications. These are only placed with your consent.
Current use on our Website. As at the Effective Date of this Notice, our Website does not place functional, analytics or marketing cookies. Our website hosting and security provider may use strictly necessary technologies to protect the Website against abuse, such as bot and denial-of-service attacks.
Consent. Before we place any cookie that is not strictly necessary, we will display a cookie consent banner that allows you to accept, reject, or customise each category. Non-essential cookies will remain disabled unless and until you give your consent. You may change or withdraw your consent at any time through the cookie settings available on our Website, without affecting the lawfulness of processing carried out before the withdrawal.
Third-party cookies. Where we use third-party tools (for example, web analytics providers), those third parties may set cookies and process data in accordance with their own privacy notices. We will identify such providers in our cookie consent mechanism.
Duration. Session cookies are deleted when you close your browser. Persistent cookies remain on your device for the period specified in our cookie consent mechanism, which will not exceed thirteen (13) months unless a longer period is required for the cookie to function.
You can manage your cookie preferences through your browser settings or through the cookie consent mechanism on our Website and Platform. Please note that blocking strictly necessary cookies may affect how the Website or Platform functions.
4. How We Use Your Personal Data
| Purpose | Data Categories Used | Legal Basis (PDPA) |
|---|---|---|
| Managing our relationship with Clients and providing access to the Platform | Business Contact Data, Platform User Data | Contract performance |
| Responding to your enquiries and communications | Business Contact Data, Correspondence Data | Contract performance |
| Responding to enquiries submitted through our Website contact form and taking steps at your request before entering into a contract | Website Enquiry Data, Correspondence Data | Contract performance (steps prior to entering into a contract) and Legitimate interest |
| Business development, sales outreach, and maintaining prospective client relationships | Business Contact Data, Website Enquiry Data | Contract performance and Legitimate interest, case by case |
| Sending marketing communications about Flowen’s products and services | Business Contact Data | Consent |
| Improving and securing our Platform and Website, including preventing spam, fraud and abuse | Website Usage Data, Website Enquiry Data, Platform User Data | Legitimate interest |
| Complying with legal and regulatory obligations (i.e. tax and accounting laws) | All categories as necessary | Legal obligation |
| Establishing, exercising, or defending legal claims | All categories as necessary | Legitimate interest |
| Cookies functioning | Website Usage Data | Consent (non-essential cookies); Legitimate interest (strictly necessary cookies) |
The fields marked as required in our Website contact form are necessary for us to respond to your enquiry. If you do not provide them, we may not be able to respond to you.
6. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:
| Data Category | Retention Period | Basis |
|---|---|---|
| Business Contact Data | Duration of business relationship + 2 years | Legitimate interest in maintaining relationships and re-engagement |
| Website Enquiry Data | Two (2) years from our last communication with you where no business relationship is established; otherwise, as for Business Contact Data | Legitimate interest; potential legal claims |
| Platform User Data | Duration of Client’s service agreement + 1 year | Contract performance; Legitimate interest in account deactivation & reactivation process |
| Website Usage Data | As long as it is necessary to fulfil the defined purposes; cookies as described in Section 3.1 | Legitimate interest and consent for cookies |
| Correspondence Data | Duration of business relationship + 2 years | Legitimate interest; potential legal claims |
When the retention period expires, we will securely delete or anonymise your personal data. We may retain data for longer where required by law or in connection with actual or potential legal proceedings.
7. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration pursuant to the minimum security requirements defined under the PDPA. These measures include encrypting data transmitted through our Website (HTTPS/TLS) and restricting access to personal data to authorised personnel who need it to perform their duties.
While we take reasonable steps to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure.
8. Your Rights
Under the PDPA, you have the following rights with respect to your personal data: (a) Access: You may request confirmation of whether we process your personal data and obtain a copy of such data; (b) Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you; (c) Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw your consent; (d) Restriction: You may request that we restrict processing of your personal data in certain circumstances; (e) Data portability: You may request to receive your personal data in a structured, commonly used, machine-readable format; (f) Objection: You may object to processing based on legitimate interests or for direct marketing purposes; (g) Withdrawal of consent: Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing; and (h) Complaint: You have the right to lodge a complaint with the Personal Data Protection Committee if you believe your rights have been violated.
To exercise any of these rights, please contact our Privacy Team using the details in Section 9. We will respond to your request within thirty (30) days. We may ask you to verify your identity before processing your request.
9. How to Contact Us
If you have any questions, concerns, or requests regarding this Privacy Notice or our data practices, please contact us at:
| Company | Flowen Co., Ltd. |
|---|---|
| Address | 22/103 Klong Lum Chiak Rd., Nawamin, Bueng Kum, Bangkok 10230 |
| privacy@flowenco.com | |
| Privacy Team | Flowen Privacy Team |
10. Changes to This Notice
We may update this Privacy Notice from time to time to reflect changes in our data practices, legal requirements, or business operations. We will publish the updated Notice on our Website and Platform and indicate the date of the latest revision. Where changes are material, we will use reasonable efforts to notify you by email or through a prominent notice on our Website or Platform.