Privacy policy

Who we are

FinishFlow ApS (“FinishFlow”, “we”) is the data controller for the personal data described in this policy. We provide market channels and fulfilment for paints, coatings and chemicals, and we operate finishflow.com, a supplier portal, and the FinishFlow Pulse workspace applications used by our own staff. You can reach us through the contact page.

The FinishFlow Pulse app

FinishFlow Pulse is an internal workspace app for FinishFlow employees and closely affiliated staff. Accounts are created and managed by FinishFlow — the app offers no self-service sign-up, and it is not intended for consumers.

When you use Pulse we process: your staff account profile (name, work email, job title, optional profile photo and work phone settings), the content you work with in the workspace (customer-service conversations, chat messages, orders, tasks and related business records), sign-in and security data (session tokens, passkeys, two-factor status, sign-in activity), and — if you enable notifications — a device push token issued by Apple or Google so we can deliver notifications to your device.

This data is used solely to operate the workspace: authentication, collaboration, customer service and order handling, notifications, and the security of our systems. We do not sell personal data, we show no advertising, and the app performs no cross-app tracking.

Staff accounts and their data are retained for the duration of the working relationship and thereafter only as long as legal obligations require. Staff can ask FinishFlow administration at any time to correct or delete their account; deactivated accounts have their access revoked immediately.

finishflow.com and the supplier portal

When you contact us through forms on finishflow.com we process the details you submit (name, company, email, message) to respond to your enquiry. Supplier portal accounts are created by agreement with your organisation and contain your name, work email and the commercial records your organisation shares with us.

Legal bases and sharing

We process personal data to perform our agreements (GDPR art. 6(1)(b)), to pursue our legitimate interests in running and securing our business (art. 6(1)(f)), and to meet legal obligations such as bookkeeping (art. 6(1)(c)).

Data is shared only with vetted service providers that host and operate our systems — cloud hosting, databases, email delivery and the Apple and Google push-notification services — under data-processing agreements, and where required with public authorities. Some providers process data in countries outside the EU/EEA under appropriate safeguards such as the EU standard contractual clauses.

Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, ask us to restrict or object to processing, and receive a copy of data you provided. Contact us through the contact page and we will respond promptly. You can also complain to the Danish Data Protection Agency (Datatilsynet).