Privacy Policy
Download the official PDF (v2.0)
Flex Up, by Circular Stream S.L. — Canary Islands, Spain Version 2.0 — 24 August 2026
1. Who we are
Flex Up is operated by Circular Stream S.L. (“we”, “us”), registered office Calle Guirre 1, CC Oasis Tamarindo 1, Local 18-19, 35660 Corralejo — Las Palmas, Spain, CIF B19832914, contact hello@flexupworld.com.
We are the controller of the personal data described in this policy. For any privacy matter, write to privacy@flexupworld.com.
2. The short version
- We never see or store your identity documents or your selfie. Verification runs entirely inside Stripe; we receive a pass/fail result only.
- We never store your full card number. Your card is tokenised by Stripe; we hold a reference token and the last four digits.
- We keep proof of what you accepted and when — that protects both of us.
- We do not sell your data. We do not run advertising on it.
- Sharing your social profile is optional and is never the only way to reach any level of the Klub.
3. What we collect, why, and on what legal basis
| # | Processing | Data | Legal basis (art. 6 GDPR) |
|---|---|---|---|
| 1 | Ordering (our online store) | Name, email, phone, delivery address, order details | Contract (6.1.b) |
| 2 | Identity verification (Stripe Identity) | Handled by Stripe: ID document, selfie. Received by us: verification result (pass/fail), verification date, Stripe reference only | Legitimate interest (6.1.f) — protecting equipment released without any blocked deposit (§5) |
| 3 | Card registration & debit authorisation (Stripe) | Card token, last 4 digits, expiry, authorisation record (timestamp, IP, user agent) | Contract (6.1.b); legitimate interest (6.1.f) for the deposit-replacement authorisation |
| 4 | Acceptance records | For each acceptance: the exact text and document version you accepted (with its digital fingerprint), timestamp, IP, browser details, display language; your email-verification event; the confirmation email as sent | Legitimate interest (6.1.f) — proving what was agreed |
| 5 | Subscription management | Contract data, equipment items, billing schedule | Contract (6.1.b) |
| 6 | End-of-contract assessment & invoicing | Equipment condition record (photos of the gear, not of you), Wear & Tear Scale application, invoice | Contract (6.1.b) |
| 7 | Klub levels | Your payment history with us; optionally referral activity or a social profile link you choose to share | Payment history: legitimate interest (6.1.f). Social sharing and referral: consent (6.1.a) |
| 8 | Service emails (order confirmation with your accepted documents attached, resumption links, card-deregistration notice) | Email, contract context | Contract (6.1.b) |
| 9 | News to existing clients | Email, subscription history | Legitimate interest (6.1.f) — opt-out link in every message |
| 10 | Recovery of unreturned equipment | Contract file, communications, acceptance records | Legitimate interest (6.1.f) — exercising claims |
We do not build advertising profiles and we do not sell personal data. Cookies are covered by the separate Cookie Policy.
4. Identity verification — what Stripe does and what we never hold
Verification is performed by Stripe Identity, on your own device: your ID document and selfie go directly to Stripe and are stored by Stripe — never on Flex Up systems. Stripe’s privacy notice covers that processing and is shown at the verification step.
We receive and keep only: verified yes/no, the date, and a Stripe reference. The result stays valid for 24 months; after that we may ask you to verify again.
No anti-money-laundering law obliges us to verify identities. It is our own commercial control — the thing that lets us hand you valuable equipment without freezing a cent of your money.
5. Why we are allowed to do this without your consent
Some of the processing above rests on our legitimate interest. In plain words: we release equipment worth hundreds or thousands of euros without blocking any deposit. What makes that possible is knowing who you are, holding a debit authorisation on your registered card, and keeping proof of what was agreed. We collect the minimum needed for that purpose — and you can object at any time (§9).
6. Klub levels — three doors, all equal
Higher equipment ceilings open through any of: clean payment history with us · referral · sharing a social profile. These are equal, parallel routes. Sharing a social profile is never required — if you never share anything, you reach the same levels through payment history. Level decisions use objective, verifiable facts only (payments made, equipment returned, verified referrals) — never who you are, where you come from, or any discretionary judgment. If you disagree with a level decision, write to us and a person will review it.
7. Who receives your data
| Recipient | Role | What they get |
|---|---|---|
| Stripe | Payments, identity verification, debit authorisations | Card data and identity documents (never seen by us), authorisation records |
| Circuly | Subscription management | Contract and billing data — no identity documents, no acceptance records |
| Our website host and transactional email provider | Running the store and sending service emails | Account, order and email data |
| Courts and authorities | Only where legally required, or to exercise our claims | The relevant file |
Data stays in the EEA, except that Stripe may transfer data to the United States under the EU–US Data Privacy Framework and standard contractual clauses. A current list of our processors is available on request at privacy@flexupworld.com.
8. How long we keep things
| Data | Retention |
|---|---|
| Identity verification result | 24 months from verification, then re-verification or deletion when your account winds down |
| Account & contract data | Contract term + a 90-day run-off period |
| Acceptance records, accepted document versions, sent-email archives | Contract term + the statutory limitation period (5 years) |
| Invoices & accounting records | 6 years (Spanish commercial law) |
| Card token | Until your contracts end and everything is settled — then it is revoked, and we tell you when it is |
| Klub signals (shared profile link, referrals) | Until you withdraw consent or your account closes |
| Recovery files | Until the claim is closed + the limitation period |
If you return after a run-off, we restore your record; your Klub level is recomputed from current facts.
9. Your rights
You can ask for access, rectification, erasure, restriction, portability, and you can object to any processing based on legitimate interest. Where processing rests on consent (social sharing, referral, news emails), you can withdraw it at any time — and withdrawing never affects your level eligibility through the other doors.
Write to privacy@flexupworld.com. We answer within one month. We will ask you to confirm control of your account email before releasing anything — and we never confirm to an unauthenticated visitor whether an account exists.
You can complain to the supervisory authority: the Agencia Española de Protección de Datos — AEPD (www.aepd.es), or to the authority of your own country.
10. Your data, kept accurate
When you return to Flex Up, we show you the data we hold so you can confirm or correct it. Use that screen — it keeps your file right.
11. Changes to this policy
This policy carries a version number and date, and every version is recorded in our document registry with its digital fingerprint. Earlier versions remain available at stable addresses. If we change this policy, the change is notified; changes that worsen your position never apply to a running contract.
Version history: v2.0 (24 August 2026) — full rewrite for the automated onboarding: Stripe Identity, card-as-deposit authorisation, acceptance records, Klub levels. Replaces the previous privacy policy.
