Your data.
Handled with care.

Who we are

SummitFlow is a trading name operated by Finnian Bos in England. For personal information we collect for our own business purposes—for example, information submitted through our website or provided by a prospective or existing client—we act as the data controller.

You can contact us at finn@summitflow.co.uk or 07949 845 919.

This policy is intended to explain our current practices, not to replace the service agreement or data-processing agreement that may apply when you become a client. Before publishing, ensure your business’s legal identity and contact details are complete and accurate.

Information we collect

Information you give us

• Enquiries and calls: your name, business name, work contact details, website, role and the information you choose to share when you contact us or book a call.
• Business qualification: information about your showroom, service area, current marketing, enquiry volumes, appointment process, objectives and budget, where you choose to provide it.
• Client and billing information: contact details, service preferences, campaign instructions, invoices, payment records and communications needed to manage our relationship.
• Campaign and appointment information: campaign performance, enquiry status, appointment dates and outcomes, and relevant notes needed to report on or deliver the agreed service.

Information collected automatically

When you visit our website, our hosting provider may record technical information such as IP address, request time, browser and device information, pages requested and security logs. We may also receive basic performance or referral information where a tool that provides it is enabled. The exact information depends on the website configuration and tools in use.

Information from other sources

We may obtain business contact details from publicly available business websites, directories or professional sources to contact businesses about relevant services. We take reasonable steps to use such information appropriately and respect objections to direct marketing.

How we use information

• Respond to enquiries, arrange introductory calls and assess whether our services are a suitable fit.
• Prepare proposals, agree campaign plans, manage client accounts and deliver Google Ads and appointment-setting services.
• Route, review and follow up on homeowner enquiries and arrange design appointments where this forms part of a client’s agreed service.
• Communicate about delivery, campaign performance, appointments, billing, service changes and support.
• Maintain business, accounting and tax records; protect our systems; prevent misuse; and handle disputes or legal claims.
• Understand website usage and improve our services, where we have an appropriate lawful basis and any required cookie consent.

We do not sell personal information. We do not use information collected for one purpose for an unrelated purpose unless we have a lawful basis and provide any information required by law.

Our lawful bases

Data protection law requires us to have a lawful basis for each processing purpose. Depending on the circumstances, we may rely on:

• Steps before a contract and contract performance: to respond to a request for information, prepare a proposal, provide services, administer a client relationship or process billing.
• Legitimate interests: to manage and develop our business, maintain business records, secure our website and systems, and conduct proportionate business-to-business marketing. We consider the impact on people’s rights and expectations and stop direct marketing where a valid objection applies.
• Legal obligation: to meet tax, accounting, regulatory or other legal requirements.
• Consent: where consent is required, such as for non-essential cookies or certain electronic marketing. Where we rely on consent, you can withdraw it at any time; this does not affect processing already carried out lawfully.

Where we rely on legitimate interests, those interests are the ones described above. The appropriate basis depends on the specific data and activity, not simply on this list as a whole.

Google Ads, AI tools and human follow-up

Our service is designed to help kitchen showrooms reach homeowners searching for a new kitchen and turn suitable enquiries into booked design appointments. Depending on the service agreed, this may involve Google Ads, CRM and scheduling software, automated messages or AI-assisted first responses, and follow-up by a person.

• We use enquiry details to respond, understand the homeowner’s requirements, assess basic suitability and coordinate an appointment for the relevant showroom.
• AI or automation may help with timely initial responses, routing, reminders or administrative tasks. Human review or follow-up may be used to clarify a homeowner’s plans and suitability.
• We do not intend to make decisions producing legal or similarly significant effects about individuals solely through automated processing. If a particular service changes this, we will provide the information and safeguards required by law.
• Information supplied to third-party AI, CRM or scheduling tools may be processed by those providers under their terms and settings. We aim to limit information shared to what is reasonably needed for the task.

Advertising platforms may process data under their own privacy notices and roles. The specific data flows depend on the campaign configuration, tracking tags, integrations and client instructions in use.

Homeowner information handled for a showroom

When we handle a homeowner’s enquiry or appointment details on behalf of a kitchen showroom, the showroom will generally determine why and how that information is used and will act as the data controller. SummitFlow will generally act as the showroom’s data processor, processing the information under the showroom’s documented instructions and the applicable service or data-processing agreement.

In that situation, the showroom is usually the first contact for requests about the homeowner data. We will assist the showroom with requests and compliance obligations as required by our agreement and applicable law. If SummitFlow uses information for its own independent purposes, we will be responsible for explaining that processing separately.

Showrooms are responsible for ensuring they have an appropriate basis and provide required privacy information when collecting homeowner details, including where relevant through their websites, lead forms and advertising campaigns. Our client agreement should define each party’s responsibilities, permitted data uses, security, retention, deletion and assistance with rights requests.

Who we share information with

We share personal information only where reasonably necessary for the purposes described in this policy, including with the following categories of recipients:

• Service providers: website hosting, form handling, business email, CRM, appointment scheduling, cloud storage and IT/security providers.
• Advertising and technology platforms: Google and other platforms or integrations used for a client’s agreed campaigns, reporting or enquiry handling.
• Clients and their authorised staff: the relevant kitchen showroom, so it can respond to enquiries, prepare for appointments and manage its customer relationship.
• Professional advisers and authorities: accountants, legal advisers, insurers, regulators, courts or law-enforcement bodies where necessary or legally required.

Depending on the setup, our tools may include Formspree, GoHighLevel and AppointWise, or replacement providers. We will keep the actual provider list and relevant agreements under review as our systems change. Service providers should only process personal data under appropriate arrangements and safeguards.

International transfers

Some technology providers may store or access information from outside the United Kingdom. Where personal data is transferred internationally, we will use a transfer mechanism permitted by applicable data protection law where required—for example, an applicable adequacy regulation or appropriate safeguards—and provide information about those safeguards on request where the law requires it.

The countries involved and the safeguards used depend on the providers and configurations selected for the service. We should confirm these details against each provider’s current terms and data-processing documentation.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, reporting and dispute-resolution needs. Actual retention depends on the type of information and any client instructions or contractual requirements.

• Unsuccessful enquiries and prospective client details: normally reviewed for deletion within 12 months after the last meaningful contact, unless a longer period is justified or you ask us not to contact you.
• Client, contract and financial records: generally retained for the contract period and up to six years afterwards where needed for tax, accounting or legal claims.
• Homeowner enquiries and appointment records: retained according to the showroom’s instructions and the applicable data-processing agreement; the showroom’s retention policy may apply.
• Suppression records: we may retain limited information, such as an email address or business contact identifier, to remember and respect a request not to receive marketing.
• Technical and security logs: retained for the period set by our hosting and security configuration, based on operational and security needs.

We may retain information longer where required by law or needed to establish, exercise or defend legal claims. When it is no longer needed, we will securely delete it or anonymise it where appropriate.

Security and confidentiality

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration or disclosure. These may include access controls, account security, limiting access to people who need it, and using service providers with appropriate security arrangements.

No website, email service or electronic storage system can be guaranteed completely secure. If a personal data breach occurs, we will assess it and notify the relevant parties or regulator where required by law. Clients must also protect their own accounts, credentials and systems and tell us promptly about suspected unauthorised access affecting the service.

Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

• request access to the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request erasure of information;
• request restriction of processing;
• object to processing based on legitimate interests, including direct marketing;
• receive certain information in a portable format, where the right applies; and
• withdraw consent where processing is based on consent.

These rights are not absolute in every situation. We may need to verify your identity before acting on a request and may explain if a legal exception applies. We aim to respond without undue delay and within the statutory period, normally one month, subject to lawful extensions for complex or multiple requests.

If your request relates to homeowner data that we process on behalf of a showroom, please contact the showroom in the first instance. We will support the controller as required by our agreement and law.

Business communications and marketing choices

We may contact business contacts about SummitFlow services where permitted by applicable marketing and data protection law. The rules can differ depending on whether a contact is a corporate subscriber, sole trader or certain partnership, and whether the communication is by phone, email, text or another channel.

You can ask us to stop sending marketing at any time by emailing finn@summitflow.co.uk. We will respect objections and maintain a limited suppression record where needed to ensure we do not contact you again. A request to stop marketing does not prevent essential service, contractual or legal communications.

We do not treat publicly available business contact details as unrestricted permission to market. We aim to check applicable rules, use appropriate contact details, identify ourselves and honour opt-outs.

Cookies and similar technologies

Cookies and similar technologies may be used for website operation, security, remembering preferences, analytics or advertising, depending on the tools enabled on the site. Strictly necessary technologies may be used where permitted by law. We will provide clear information and obtain consent before using non-essential cookies or similar technologies where consent is required.

You can also control cookies through your browser settings, although blocking some cookies may affect site functionality. Browser controls do not replace any consent choices offered by the website.

Children

Our services are intended for businesses and adults. We do not knowingly seek to collect personal information from children through our business enquiry forms. If you believe a child has provided us with personal information, contact us so we can review and delete it where appropriate.

Changes to this policy

We may update this notice when our services, tools or legal obligations change. The “last updated” date at the top indicates when this version was prepared. If a change materially affects how we use information, we will take any additional steps required by law to inform affected people.

Contact us or make a complaint

For questions about this policy or to exercise your rights, contact:

If you are unhappy with how we have handled your information, please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office (ICO). Guidance and contact details are available at ico.org.uk.