Privacy Policy

Flow is a companion application for Sage Evolution. It provides business modules — such as voucher management and approvals, reporting, document management, and notifications — alongside the ERP, while Sage Evolution remains the system of record for accounting. This policy explains what personal information Flow processes, on what legal basis, how it is protected, and the rights you have under the laws of the Republic of Zambia, in particular the Data Protection Act, No. 3 of 2021 (the “Data Protection Act”).

Flow is deployed and operated by the organisation that provisioned your account (the “operator”). The operator is the data controller for personal information processed in Flow within the meaning of the Data Protection Act, and is responsible for registration with, and reporting to, the Office of the Data Protection Commissioner where the Act requires it. Flow is the system through which that processing happens.

Flow processes three categories of information:

• Account information — the name, email address, roles, and permissions of the people the operator's administrator provisions. Passwords are stored only as salted hashes; they are never stored or displayed in plain text.
• Operational records — the vouchers, approvals, comments, documents, attachments, notification rules, and other records you create or manage in Flow's modules. These may contain personal information about third parties, such as suppliers, customers, or employees, that appears in ordinary business documents.
• Technical and security records — sign-in attempts and their originating network addresses (kept to rate-limit password guessing and credential stuffing), session records, and an audit trail of privileged and accounting-relevant actions attributing each action to the account that performed it.

Flow also reads accounting data from the operator’s Sage Evolution company database — for example supplier, customer, and ledger records — to display, validate, and report on it. That data is collected and controlled through Sage Evolution under the operator’s existing accounting processes; Flow’s access to it is read-only everywhere except the narrow, audited posting path described below.

The Data Protection Act requires a lawful basis for processing. Flow’s processing rests on the following bases:

• Performance of a contract and employment administration — your account exists so you can perform your role in the operator's business processes.
• Compliance with legal obligations — Zambian tax, accounting, and company law requires accurate financial records and supporting documents to be kept, and an attributable trail of who authorised what.
• Legitimate interests of the operator — running orderly approval workflows, securing the system against misuse, and reconciling what Flow posts against what Sage Evolution records.

Where the operator relies on your consent for any additional processing, you may withdraw that consent at any time without affecting processing that happened before withdrawal.

Flow keeps its own records in a database on the operator’s own infrastructure, alongside the operator’s Sage Evolution installation. Flow is not a public cloud service and does not transmit your information to the software’s authors. Any storage or transfer of personal information outside the Republic of Zambia is the operator’s decision and must satisfy the localisation and cross-border transfer conditions of the Data Protection Act, including the requirement that sensitive personal data be processed and stored on a server or data centre located in Zambia unless the Act permits otherwise.

Security is central to Flow’s design. Safeguards include:

• Permission-based access control — every action is checked against the permissions your roles grant, so you see only the data and actions you are entitled to.
• Hashed passwords and server-side sessions — only a token's hash is ever stored, sessions are revocable immediately, and disabling an account takes effect on its next request.
• Read-only access to Sage Evolution data everywhere except the audited posting path, which writes only specific, named accounting transactions on final approval and records the resulting Sage audit number.
• Rate-limited sign-in to resist password guessing and credential stuffing, applied without revealing whether an account exists.
• Verified, automatic backups of Flow's own records, retained under the operator's control.

If a breach of security leads to accidental or unlawful access to, or loss of, personal information, the operator is responsible for notifying the Data Protection Commissioner and affected data subjects as the Data Protection Act requires.

Personal information in Flow is not sold and is not shared for marketing. It is visible within the operator’s organisation only as far as each user’s permissions allow, and may be disclosed to the operator’s auditors, professional advisers, or a competent public authority where the law requires or permits it. Any service provider the operator engages to host or maintain the system acts as a data processor under the operator’s instructions and the Data Protection Act.

Account information is kept for as long as your account exists and for a reasonable period afterwards for audit purposes. Operational and accounting records — including vouchers, supporting documents, and the audit trail attributing approvals and postings — are kept for the periods prescribed by Zambian law, including the Income Tax Act, the Value Added Tax Act, and the Companies Act, 2017 (typically between six and ten years), and thereafter deleted or anonymised.

Subject to the conditions in the Data Protection Act, you have the right to:

• be informed about how your personal information is processed;
• access the personal information held about you;
• have inaccurate or incomplete information rectified;
• have information erased or its processing restricted where the Act allows — noting that statutory record-keeping duties may require accounting records to be retained;
• object to processing, and withdraw any consent you have given;
• data portability, where processing is by automated means;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise these rights, contact the operator’s administrator or data protection officer. If you are not satisfied with the response, you may lodge a complaint with the Office of the Data Protection Commissioner.

Flow routes work according to rules the operator configures — for example, which roles must approve a voucher — but no decision with legal or similarly significant effect on you is made solely by automated processing. Approvals are made by people.

Flow uses a small number of strictly necessary cookies: an httpOnly session cookie that keeps you signed in (never readable by scripts in your browser) and preference cookies for interface settings such as the theme and sidebar state. Flow sets no advertising, analytics, or cross-site tracking cookies.

This policy may be updated as Flow gains modules or as the law changes. Material changes will be reflected by the “last updated” date above, and the operator should bring significant changes to your attention.

Questions about this policy, or requests concerning your personal information, should be directed to your organisation’s administrator or its designated data protection officer.