Last updated: 15 October 2026
Flow Group is a trading name of Flow Solutions Group Limited. In this Privacy Policy, “Flow Group”, “we”, “us” and “our” refer to Flow Solutions Group Limited when operating under the Flow Group name.
We provide leaflet distribution, direct mail, printing, hand fulfilment and related campaign management services to businesses across the United Kingdom.
We are committed to handling personal information responsibly and in accordance with applicable data protection law. This Privacy Policy explains what personal information we collect, how and why we use it, who we may share it with, how long we keep it and the rights available to you.
Our processing of personal information is governed by applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.
Depending on the services we provide and how you interact with us, we may handle personal information relating to:
Our legal responsibilities depend on the circumstances and the decisions we make about the information.
We generally act as a data controller when we decide why and how personal information is used for our own business purposes. This may include managing enquiries, customer relationships, accounts, marketing, supplier relationships, website administration, security and legal obligations.
As a controller, we are responsible for ensuring that our processing has a lawful basis and meets the applicable data protection requirements.
When a client supplies personal information so that we can print, prepare, fulfil, mail or distribute campaign materials on its behalf, the client will generally be the data controller, and we will act as its data processor.
In these circumstances, we process personal information in accordance with the client’s documented instructions and our contractual obligations, unless applicable law requires otherwise.
Our role may differ depending on the service and processing activity. Where we determine the purposes and means of a separate processing activity ourselves, we may act as a controller for that activity.
The information we handle depends on your relationship with us, the services involved and the purpose for which the information is needed.
This may include your name, job title, business name, business address, email address, telephone number and other contact details you provide.
We may collect information about your requirements, campaign objectives, target audience, distribution areas, quantities, budgets, proposed delivery schedules and any other details needed to respond to an enquiry or prepare a quotation. We may also keep records of related correspondence and discussions.
This may include order details, invoices, payment records, account information, delivery arrangements and communications relating to the services we provide.
Where a third party processes payments, that provider may collect and process payment information under its own privacy information. We will handle the payment-related information we receive in accordance with the purpose for which it was provided and our legal obligations.
When carrying out work for a client, we may process names, postal addresses and other information supplied for the campaign. Depending on the project, this may include mailing preferences, suppression records, delivery information and other details needed to organise printing, fulfilment, mailing or distribution.
We will process campaign information only to the extent necessary for the agreed service and in accordance with the applicable contractual arrangements and data protection requirements.
When you visit our website, we may collect technical information such as your IP address, browser type, device information, pages visited and details of how you interact with the website.
The information collected will depend on the website technologies in use, the purpose of those technologies and, where applicable, the cookie or tracking preferences you select.
We may keep records of your communication preferences, marketing consent where required, objections to marketing and requests to unsubscribe. We may also maintain limited suppression records to help ensure that your preferences continue to be respected.
We may process personal information contained in emails, telephone conversations, website messages, feedback, complaints and other communications with us.
Please do not send sensitive personal information unless it is necessary for the service and appropriate arrangements have been agreed.
We may collect information directly from you when you complete a website form, request a quotation, telephone us, email us, download a resource, place an order or otherwise communicate with us.
We may also receive information from your employer, business representatives, suppliers, service providers or other organisations involved in a campaign.
Where a client provides a mailing list or other campaign information, we will normally receive that information from the client and process it for the agreed service.
We may obtain business contact information from publicly available sources where doing so is lawful and appropriate. Public availability does not automatically mean that information can be used for direct marketing. We will consider the source, the intended use and the legal requirements that apply.
Where we obtain personal information from another source and act as the controller, we will provide the privacy information required by law, subject to any applicable exceptions. This may include information about the categories of personal information concerned and its source. Where we act as a processor, the client will generally be responsible for providing privacy information to the individuals concerned. We will provide reasonable assistance where required by law or our contractual arrangements.
We use personal information only where we have an appropriate lawful basis and a defined purpose.
Depending on the circumstances, we may use it to:
We will consider the purpose for which information was collected before using it for another purpose. Where required by law, we will explain the new purpose and provide any additional information before further processing.
Data protection law requires us to have a lawful basis for processing personal information. The basis we rely on depends on the purpose and circumstances of the processing.
We may process personal information where it is necessary to take steps at your request before entering into a contract or to perform a contract with you. This may include preparing a quotation, managing an account, providing our services and communicating about work you have commissioned.
We may process personal information where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.
Our legitimate interests may include responding to business enquiries, managing customer and supplier relationships, maintaining business records, improving our services, protecting our business and undertaking relevant business-to-business marketing where permitted by law.
Where we rely on legitimate interests, we consider whether the processing is necessary, proportionate and fair in the circumstances. We will respect the right to object where it applies.
Legitimate interests under data protection law do not, by themselves, permit marketing activity that would otherwise breach PECR.
We may process or retain personal information where necessary to comply with a legal obligation, including applicable accounting, tax, regulatory and other statutory requirements.
Where consent is the appropriate lawful basis, we will ask for it clearly and explain what you are agreeing to. You can withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Making an enquiry, visiting our website or placing an order does not automatically mean that you have consented to receive marketing.
Where we rely on another lawful basis, we will not describe that processing as consent.
We may contact prospective and existing business customers about our services, including leaflet distribution, direct mail, printing, hand fulfilment and campaign management.
The rules that apply depend on the recipient, the type of contact information used, the communication method and the circumstances in which the information was obtained.
We will send electronic marketing only where the applicable legal requirements are met.
Under PECR, you can generally send unsolicited marketing emails to corporate subscribers, such as limited companies and limited liability partnerships, without consent under the electronic marketing rules. We must still identify ourselves appropriately and provide a valid opt-out option.
Sole traders and certain partnerships are treated as individual subscribers. Marketing emails and texts to these recipients generally require consent or a valid exception, such as the products and services soft opt-in, where all the legal conditions are met.
The soft opt-in is not a general permission to market to any business contact. It is subject to specific requirements, including how we collected the details, the relationship with the recipient, the type of marketing, and the opportunity to opt out.
We will not assume that a publicly available email address gives us permission to send electronic marketing. We will consider the recipient’s status, the source and use of the information, the relevant legal requirements and any previous objection.
We may use telephone calls or post for relevant business communications where permitted by law.
We will comply with applicable marketing restrictions, including relevant objections and preference services where required. We will take account of whether the recipient is an individual or a business and the rules that apply to the contact method.
You can ask us to stop sending promotional marketing at any time. You can use the unsubscribe link in a marketing email where one is provided or contact us at info@theflowgroup.co.uk.
We will act on valid objections and unsubscribe requests. Where necessary, we may keep a limited suppression record so that we can respect your request and avoid contacting you again for the same marketing purpose.
We may continue to send necessary communications about existing orders, payments, contracts, service issues or other administrative matters. We will not use service communications to disguise promotional marketing.
Our services may involve processing personal information supplied by clients for direct mail, printing, hand fulfilment, mailing, distribution and related campaigns.
Where we receive names, addresses or other personal information to prepare and deliver a campaign, we will use it for the agreed service and in accordance with our contractual obligations and applicable data protection law.
Unless otherwise agreed and lawfully authorised, we will not sell a client’s mailing list, use it for our own unrelated marketing or use it for an unrelated purpose.
Clients are responsible for establishing an appropriate lawful basis for their campaign, ensuring they are entitled to provide the information to us and meeting their obligations to provide privacy information and comply with applicable marketing rules. Our responsibilities depend on our role and the processing activities we carry out.
Where we act as a processor, we will follow the client’s documented instructions, apply appropriate security measures, use authorised subprocessors and provide assistance with data protection requests and other obligations where required by law and our agreement.
We may use authorised suppliers or subcontractors to support printing, mailing, fulfilment, delivery or other agreed campaign activities. Where they process personal information on our behalf, we will put appropriate contractual and security arrangements in place.
We will arrange for campaign information to be returned or securely deleted in accordance with the relevant agreement, our retention arrangements and applicable law. Information may need to be retained where there is a lawful reason to do so.
If we become aware of a personal data breach affecting information we process, we will follow the incident management and notification requirements that apply to our role and the circumstances.
Artwork, printed materials and campaign content may contain commercially sensitive information, personal information or material that has not yet been made public.
Placing an order does not automatically give us unrestricted permission to use your artwork, designs or printed materials for our own promotion.
We may wish to display examples of completed work on our website, social media, in our offices or in sales materials to demonstrate our services. Where we do so, we will ensure that we have the necessary permission, licence or other appropriate legal authority.
Permission to use artwork and the lawful basis for processing any personal information appearing in it are separate matters. We will consider both where relevant and take particular care with confidential information, personal information and details of unpublished campaigns.
If you have questions or concerns about the use of your materials, please contact us at info@theflowgroup.co.uk.
We do not sell personal information to third parties.
Where necessary for the purposes described in this policy, we may share personal information with:
Where a supplier processes personal information on our behalf, we will put appropriate contractual safeguards in place. Where an organisation acts as an independent data controller, it will be responsible for its own processing activities.
We will share only information that is reasonably necessary for the relevant purpose and take appropriate steps to protect it.
We may store personal information in our business systems, email services, document management systems, accounting software and other applications used to operate our business.
Depending on the services we currently use, third-party providers may support electronic signatures, payment collection, customer communications, and live chat. These may include DocuSign, GoCardless and Zendesk where relevant to the service. The providers we use may change over time.
We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure or destruction. Depending on the system and the risks involved, these measures may include access controls, authentication, staff permissions, encryption, secure transfer arrangements and appropriate storage controls.
Access to personal information should be limited to people who need it for their work or an authorised business purpose.
No method of electronic transmission or storage can be guaranteed to be completely secure. We nevertheless take appropriate steps to protect the information entrusted to us and to respond to security incidents in accordance with our legal obligations.
Some service providers may store or process personal information outside the United Kingdom. Whether this applies will depend on the providers and services used for the relevant activity.
Where personal information is transferred internationally, we will ensure that the transfer is permitted under applicable data protection law and that any required safeguards are in place.
Depending on the circumstances, these safeguards may include a UK adequacy regulation or an approved transfer mechanism, together with any additional measures required by law.
If you would like further information about a relevant international transfer and the safeguards that apply, please contact us at info@theflowgroup.co.uk.
We retain personal information for as long as it is reasonably necessary for the purpose for which it was collected, taking account of our legal obligations, contractual requirements, business needs and the need to establish or defend legal claims.
Different types of information may be retained for different periods.
We may retain enquiry and quotation information while dealing with your request and for a further period where necessary to manage follow-up, maintain business records or deal with potential disputes.
We retain relevant customer and order information for the duration of the relationship and for any further period required for accounting, tax, legal or dispute resolution purposes.
We retain marketing information while it remains appropriate to contact you and in accordance with your preferences and the applicable marketing rules.
Where necessary, we may retain limited suppression records to ensure that marketing objections and unsubscribe requests continue to be respected.
We retain mailing lists and campaign data in accordance with the relevant service agreement, client instructions and operational requirements. When the information is no longer needed for the agreed purpose, we will arrange for its return or secure deletion, subject to any applicable legal obligation or other lawful reason for retention.
We may retain information for longer where necessary to comply with a legal obligation, establish or defend a legal claim, investigate an incident or demonstrate compliance with applicable law.
When personal information is no longer required, we will take appropriate steps to delete it securely or anonymise it where appropriate. Our retention arrangements are reviewed periodically to help ensure that information is not kept for longer than necessary.
Our website may use cookies and similar technologies to support its operation and, where applicable, understand website performance or improve the visitor experience.
These technologies may include cookies, tracking pixels, scripts, tags or other technologies that store information on or access information from your device.
Some technologies are strictly necessary to provide a website function or online service you have requested. Others, including certain analytics and advertising technologies, may require your consent before they are used.
Where consent is required, we will seek it through our cookie management mechanism before using the relevant technologies. You can change your preferences through the available cookie settings.
The information collected may include device identifiers, IP addresses, browsing activity and details of how visitors interact with our website. Depending on the technology and the information involved, this may constitute personal data.
Our cookie notice or cookie settings should explain the technologies actually in use, their purposes, providers and relevant retention periods. These details may change as our website and services develop.
Disabling certain cookies or technologies may affect how parts of the website function.
Depending on the circumstances and subject to applicable legal conditions and exceptions, you may have the right to:
These rights are not absolute in every circumstance. For example, we may need to retain certain information to meet a legal obligation or establish, exercise or defend legal claims.
To exercise your rights, contact us at info@theflowgroup.co.uk. Please explain your request so that we can identify the information and processing involved. We may ask for information to verify your identity where reasonably necessary to protect your personal information.
We will respond within the time limit required by law, normally one month after receiving your request. Where the law permits an extension, for example because a request is complex or we receive several requests, we will explain this within the applicable time limit.
We will not charge a fee for a standard request unless the law permits us to do so. If we cannot comply with a request, we will explain our decision where required by law.
Where we process personal information on behalf of a client, we may need to refer your request to that client or assist the client in responding, depending on our role and the applicable arrangements.
If you have concerns about how we use your personal information, please contact us first at info@theflowgroup.co.uk. We will consider your concerns and respond appropriately.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
You can find information about your rights and how to make a complaint at:
https://ico.org.uk/make-a-complaint/
Our website may contain links to other websites, including partner organisations and service providers.
When you follow an external link, the privacy policy and practices of that organisation will apply to its website and services. We are not responsible for how other organisations handle personal information, so we recommend reviewing their privacy information before submitting details to them.
We may update this Privacy Policy from time to time to reflect changes in our services, the way we handle personal information or applicable law.
The latest version will be published on this page, together with the date it was last updated. Where appropriate, we will notify affected individuals of significant changes. Where the law requires us to provide privacy information directly, updating this page alone may not be sufficient.
If you have a question about this Privacy Policy, wish to exercise your data protection rights or have a concern about how your information is handled, please contact:
Flow Group
A trading name of Flow Solutions Group Limited
Email: info@theflowgroup.co.uk
Please use this email address for privacy enquiries and requests relating to personal information.
Sectors
© Flow Group. All rights reserved
