Privacy Policy
Last updated:
Signal Workflows Haavik ENK (“Signal Workflows”, “we”, “us”, “our”) respects your privacy. This policy explains how we collect and use personal data when you visit signalworkflows.com (including subdomains), download a resource, schedule a call, communicate with us, or use our platforms, including Pulse and ClubAdmin (together, the “Services”). It also explains how we use business contact data when we contact businesses about our services (see Legitimate interest (LIA): business outreach).
It is written to comply with the General Data Protection Regulation (GDPR) as it applies in Norway and the EEA, and with the rules for SMS messaging in the EU and the United States.
1. Data controller
Signal Workflows Haavik ENK (Jakob Leivdal Haavik) Leivdalsvegen 123, 6774 Nordfjordeid, Norway Organisation number: 831 581 662 Email: privacy@signalworkflows.com
When we process personal data on behalf of a client inside our platforms (for example, the client’s own customer records in Pulse), the client is the controller and we act as processor under a data processing agreement.
2. What we collect
- Information you give us: name, email address, phone number, company name and message content when you download a resource, request or schedule a call, sign up for product updates, or contact us. For product updates we also store which kind of organisation you are and which modules interest you.
- Consent records: what you consented to (e.g. marketing email or SMS), the exact wording version, the time, and the page you consented on.
- Technical data: IP address (stored only as a one-way hash in our consent and rate-limit records), browser type and basic request data needed to deliver and secure the website.
- Usage statistics: aggregated, cookieless page statistics (see section 5).
- Business outreach: if we contact you about our services, we store the business contact data we collected from public sources (see Legitimate interest (LIA): business outreach).
We do not buy personal data or contact lists.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Delivering a resource you requested | Your request (Art. 6(1)(b)) |
| Arranging and holding a discovery call | Steps prior to a contract (Art. 6(1)(b)) |
| Sending marketing emails and newsletters | Consent (Art. 6(1)(a)) |
| Sending product updates (e.g. Pulse) you signed up for, and using your answers to plan what we build | Consent (Art. 6(1)(a)) |
| Sending SMS about your booking | Consent (Art. 6(1)(a)) |
| Providing our Services to clients | Contract (Art. 6(1)(b)) |
| Keeping consent records, securing the site, preventing spam and abuse | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
| Contacting businesses about our services (business outreach), see below | Legitimate interests (Art. 6(1)(f)) |
| Accounting and bookkeeping | Legal obligation (Art. 6(1)(c)) |
You can withdraw consent at any time: use the unsubscribe link in any email, reply STOP to any SMS, or email us. Withdrawal doesn’t affect processing that took place before.
We do not use your personal data to train public AI models.
4. Free resources and double opt-in
When you request a resource, we send a confirmation link to your email address. Only after you confirm do we send the download, and, if you ticked the separate box, add you to our newsletter. We store the request, confirmation and consent record as proof of consent.
Product updates (such as the Pulse interest list) work the same way: we only email you updates after you click the confirmation link.
5. Cookies and statistics
We use cookieless analytics (Cloudflare Web Analytics) that don’t track you across sites or store identifiers on your device. We don’t use advertising or tracking cookies. See our Cookie Policy.
6. Where your data is stored, and who processes it
| Provider | What for | Location and safeguards |
|---|---|---|
| Cloudflare, Inc. | Website hosting, forms, consent records (database), spam protection (Turnstile), cookieless analytics, video hosting (Stream) | Consent records are stored in the EU. Cloudflare is a US company; transfers are covered by the EU–US Data Privacy Framework and Standard Contractual Clauses (SCCs). |
| Resend (Plus Five Five, Inc.) | Sending emails (confirmations, downloads, newsletters) and managing email subscribers | US company; data processing agreement and SCCs. |
| SMS delivery provider | Sending SMS to phone numbers that have opted in | Data processing agreement and SCCs where data leaves the EEA. |
| Email outreach platform | Sending business outreach emails (see below) | Data processing agreement and SCCs where data leaves the EEA. |
| EU hosting for Pulse and client platforms | Hosting our platforms and client data | Hosted in the EU/EEA. |
For clients with a custom deployment agreement, data may be stored on infrastructure specified in that agreement, with the safeguards described there.
All processors are bound by data processing agreements. We implement appropriate technical and organisational measures to protect personal data. No system is completely secure; please tell us right away if you suspect a breach.
7. Sharing
We share personal data only with the processors listed above, with authorities where the law requires it, or as part of a merger or sale of the business. We never sell or rent your personal data, and we never share your phone number or SMS consent with third parties for their marketing.
8. How long we keep it
- Booking requests: up to 12 months after the last contact, unless we enter into a contract.
- Business outreach data: deleted 12 months after the last contact. If you object, see your choices.
- Unconfirmed resource requests and product-update signups: deleted after 30 days.
- Product-update signups: until you unsubscribe or the product is launched and the list is no longer needed.
- Newsletter subscribers: until you unsubscribe. After that we keep a minimal record of the unsubscribe so we don’t email you again.
- Consent records: as long as the consent is in use, plus up to 3 years as documentation.
- Accounting records: as required by Norwegian bookkeeping law.
9. Children
Our Services are not aimed at children under 16, and we don’t knowingly collect their data. If we learn we have, we delete it.
10. Your rights
You have the right to access, rectify, erase, restrict and port your personal data, and to object to processing, including direct marketing at any time. To exercise these rights, email privacy@signalworkflows.com. We reply within one month.
You can also complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.
11. Changes
We may update this policy. The date at the top shows the latest version, and we will notify you of material changes where the law requires it.
Contact: privacy@signalworkflows.com
Legitimate interest (LIA): business outreach
We contact owners and managers of small businesses by email about our services. We use legitimate interest as the legal basis (GDPR Art. 6(1)(f)). Our interest is finding new business clients. We have done a legitimate interest assessment (LIA) for business outreach. You can request it by emailing privacy@signalworkflows.com.
What we store: your name, business email address, phone number, and information about you or your business that is public on social media or in the press. We only use information that relates to your business role.
Where it comes from: we collect it ourselves from public business websites, professional profiles and the press. We do not buy personal data or contact lists.
Where it is stored: in Pulse, our own CRM, hosted in the EU, and with the email outreach platform we use to send the messages (see section 6). We never sell it or share it for others’ marketing.
How long we keep it: prospect data is deleted 12 months after the last contact.
How to object or ask for deletion: reply to any of our emails, or email privacy@signalworkflows.com. We stop contacting you right away. If you ask for deletion, you choose one of two options:
- Stay on the block list: we keep only your name and email address, and use them only to make sure we never contact you again.
- Full deletion: we delete all your data. We keep only a one-way fingerprint (hash) of your email address. It cannot be turned back into your address, but it lets us check that we don’t contact you again.
You also have the other rights in section 10, including the right to complain to Datatilsynet.