Privacy Policy
Effective date: 6 August 2026
1. Who we are
This policy explains how we handle personal information.
CHANTAL MARIE-LAURENCE EDOUARD-BETSY, trading as heyCEOflow
Business Registration Number 123005171
Villa 1, Ave Des Capitaines, 1906-04, Mauritius
[email protected]
We are based in Mauritius and governed by the Mauritius Data Protection Act 2017. Where our clients or their contacts are in the United Kingdom, European Union, South Africa, Australia or the United States, additional laws apply, and we address those in Section 11.
2. The two roles we play, and why it matters to you
We handle personal information in two quite different ways, and your rights differ depending on which applies.
As a controller, for information about visitors to our website, people who enquire about our services, and our own clients. We decide what to collect and why. Sections 3 to 11 describe this.
On behalf of our clients, for the personal information our clients store in the platform we provide them: their contacts, leads, students, members and customers. We do not decide what that data is or what it is used for. Our client does. We simply operate the system it sits in. Section 12 covers this.
If you are here because a business you deal with uses heyCEOflow, that business is responsible for your data, not us. Please contact them directly. We will help them respond, but we cannot act on their data without their instruction.
3. Information we collect
When you visit our website
- IP address, browser type and version, device type, operating system, screen size
- pages viewed, time on page, referring URL, exit pages
- approximate location, derived from IP address
- cookie and similar identifiers, described in Section 6
When you contact us or fill in a form
- name, email address, telephone number
- business name, website, and information about your business
- whatever you choose to tell us in a message, enquiry form or assessment
- appointment details when you book a call
When you become a client
- billing name, address and tax details
- payment records and transaction history. Card details are handled by our payment processor and never reach us.
- account credentials and access records
- correspondence and support history
- project files, brand assets and content you supply
When you receive messages from us
- delivery, open and click records for email
- delivery and reply records for SMS
- subscription and unsubscribe status
What we do not collect
We do not knowingly collect information from anyone under 16. We do not collect special category data such as health, biometric, racial or ethnic origin, political opinions, religious beliefs, sex life or orientation, or trade union membership, and we ask that you do not send it to us.
4. Why we use it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Provide and operate the services you have bought | To perform our contract with you | Contract |
| Bill you and collect payment | To perform our contract | Contract |
| Answer enquiries and provide support | To respond to your request | Contract, or legitimate interests |
| Send service and account notices | To keep you informed about what you use | Contract |
| Send marketing emails | To tell you about relevant services | Consent, or legitimate interests for existing clients |
| Send SMS | To send reminders and confirmations you asked for | Consent |
| Measure how the website is used | To improve it | Consent or legitimate interests, depending on your location |
| Advertising and audience measurement | To reach relevant audiences | Consent or legitimate interests, depending on your location |
| Protect against fraud and abuse | To keep the service secure | Legitimate interests |
| Meet legal and tax obligations | Because we must | Legal obligation |
Marketing. You can unsubscribe from any marketing email using the link in it, reply STOP to any SMS, or email [email protected]. We will still send service messages about anything you actively use, because those are not marketing.
5. Who we share it with
We do not sell your personal information. We have never sold it and we will not.
We share it with the suppliers below, only as needed to run the service:
| Supplier | What for | Where |
|---|---|---|
| HighLevel / LeadConnector | The platform our services and client accounts run on | United States |
| Google (Workspace, Analytics, Fonts, reCAPTCHA) | Email, website analytics, fonts, form spam protection | United States and global |
| Meta | Advertising and audience measurement | United States |
| Stripe | Payment processing | United States and global |
| Twilio | SMS and voice delivery, via the platform | United States |
| Mailgun | Email delivery, via the platform | United States |
We also share information where we are legally required to, where necessary to establish or defend a legal claim, and with professional advisers under confidentiality. If the business is ever sold or restructured, information may transfer as part of that, and we would tell you.
Your data is never shared with, or used for the benefit of, another client.
6. Cookies and tracking
6.1 What runs on this website
| What | Purpose | Type |
|---|---|---|
| Google Analytics | Understanding how the site is used | Analytics |
| Meta Pixel | Advertising and audience measurement | Advertising |
| Google reCAPTCHA | Protecting our forms from automated abuse | Essential |
| Google Fonts | Loading typefaces. This transmits your IP address to Google. | Functional |
| Platform cookies | Session handling, language preference, form state | Essential |
| Device and session identifiers | Our website platform generates an identifier from your device and browser characteristics, so it can recognise a returning visit and attribute form submissions to the right session | Functional |
6.2 Your choices
We are introducing a cookie consent banner that lets you accept or reject non-essential cookies and choose between categories. Until it is live, analytics and advertising cookies are set when you visit.
We want to be straightforward with you about what that banner does and does not do. It controls which cookies are stored on your device. It does not prevent the analytics and advertising technologies listed above from loading when you open a page, which means your IP address, browser details and the page address may still be transmitted to Google and Meta. This is a limitation of the website platform we use, it is shared by every business built on that platform, and we would rather tell you than let you assume otherwise. We are actively working on stronger controls.
In the meantime, you have these options, and they do work:
- Browser settings. Every major browser lets you block or delete cookies, and most offer a tracking protection mode that blocks these technologies outright.
- Google Analytics opt out. Google publishes a browser add-on that prevents Analytics from collecting your data on any site.
- Meta. You can control advertising preferences in your Facebook or Instagram account settings.
- Ask us. Email [email protected] and we will tell you what we hold about you and remove it.
Do Not Track. Browser Do Not Track signals are not currently honoured, because there is no agreed standard for interpreting them.
7. How long we keep it
| What | How long |
|---|---|
| Website analytics | Up to 14 months |
| Enquiries that do not become clients | 24 months from last contact |
| Client account and project records | For the contract, then 7 years for tax and legal purposes |
| Billing and tax records | 7 years, or as local law requires |
| Marketing subscriptions | Until you unsubscribe, then a suppression record indefinitely so we do not contact you again |
| Support correspondence | 3 years |
Client data held in the platform on our clients' behalf is retained in line with Section 12 and our Terms and Conditions.
8. Keeping it safe
We use encrypted connections, access controls and two factor authentication, keep credentials in a password manager, and limit access to those who need it.
No system is perfectly secure, and neither we nor our suppliers can guarantee against loss or unauthorised access. If a breach affects your personal information we will notify you and the relevant regulator where the law requires it.
9. Where your information goes
We are based in Mauritius. Our suppliers are largely in the United States.
Mauritius does not currently benefit from a European Union adequacy decision. Transfers of United Kingdom or European Union personal data to us therefore rely on appropriate safeguards, such as Standard Contractual Clauses or the United Kingdom International Data Transfer Addendum, rather than on adequacy. If you would like details of the safeguards that apply to you, email [email protected].
10. Your rights
Depending on where you are, you may have the right to access your information, correct it, have it deleted, restrict or object to how we use it, receive it in a portable format, withdraw consent at any time, and complain to a regulator.
To exercise any of these, email [email protected]. We will respond within one month, or sooner where the law requires. We may need to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.
Where to complain. Mauritius: the Data Protection Office. United Kingdom: the Information Commissioner's Office. European Union: your national supervisory authority. South Africa: the Information Regulator. Australia: the Office of the Australian Information Commissioner.
11. Country specific information
United Kingdom and European Union. Where the UK or EU GDPR applies, you have the rights set out in Section 10, and our lawful bases are set out in Section 4.
South Africa. POPIA applies where personal information is processed by or for a responsible party in South Africa. Where we act for a South African client we do so as an operator under a written operator agreement, which addresses the restrictions on transferring personal information outside South Africa.
Australia. The Privacy Act and the Australian Privacy Principles may apply to you. Australian Privacy Principle 8 governs disclosure overseas and generally leaves the Australian entity accountable for the overseas recipient.
United States. Depending on your state, you may have rights to know, delete, correct, and opt out of the sale or sharing of your personal information. We do not sell personal information as those laws define it. If you would like us to stop using your information for advertising purposes, email [email protected] and we will action it.
12. Data our clients store in our platform
This section is for our clients, and for people whose data our clients hold.
12.1 Where a client stores personal information in the platform we provide, the client decides what is collected and why. We act on their instructions.
12.2 We do not access client data except to provide support, to keep the platform secure, or where the law requires. We do not use it for our own purposes, we do not use it to train AI models, we do not sell it, and we do not use it for the benefit of any other client.
12.3 Clients own their data, as set out in our Terms and Conditions.
12.4 If you are a contact, customer, student or member of one of our clients and want to access or delete your information, please contact that business directly. They control it. We will support them in responding, but we cannot act without their instruction.
12.5 Retention and deletion of client data, including what happens if an account is paused, suspended or terminated, is governed by our Terms and Conditions.
12.6 A data processing agreement is available to any client who needs one. Email [email protected].
13. Changes to this policy
We may update this policy. The current version is always published here with its effective date. Where a change materially affects your rights, we will give notice.
14. Contact
Questions, requests or complaints:
CHANTAL MARIE-LAURENCE EDOUARD-BETSY, trading as heyCEOflow
BRN 123005171
Villa 1, Ave Des Capitaines, 1906-04, Mauritius
Copyrights 2026 | heyCEOflow | Terms & Conditions | Privacy