Cookie Policy

Last updated: 29 April 2026. Effective from: 29 April 2026.

1. Who we are and what this policy covers

1.1 FLOX is operated by VCL Trading Europe Limited ("VCL", "we", "us" and "our"). We are registered in England and Wales under company number 07784688, with our registered office at Marlborough House, 298 Regents Park Road, London, United Kingdom, N3 2SZ. Our VAT number is GB288257261.

1.2 This Cookie Policy explains how we use cookies and similar technologies on the FLOX website at https://www.flox.is (the "Site") and the FLOX Mobile App. It applies to all visitors to the Site and all users of the Mobile App, whether or not they have an Account.

1.3 The cookies and similar technologies described in this policy are placed by Value Chain Lab Ltd, our parent company, which acts as the data controller for website-visitor analytics and marketing activities. Value Chain Lab Ltd is registered in England and Wales under company number 07980832 with its registered office at Marlborough House, 298 Regents Park Road, London, United Kingdom, N3 2SZ. Value Chain Lab Ltd contracts directly with Cookiebot, Google Ireland Limited and Apollo.io and shares website-visitor insights with VCL Trading Europe Limited as a separate controller for the purposes of FLOX-related sales and marketing follow-up.

2. How this policy relates to our other terms

2.1 This Cookie Policy should be read alongside our Privacy Policy, which explains how we process personal data more broadly, our Website Terms of Use, our Platform Terms and our Acceptable Use Policy. Capitalised terms used but not defined in this Cookie Policy (including "FLOX Platform", "Site", "Mobile App", "Account", "Authorised User") have the meanings given to them in the Platform Terms.

3. What cookies (and similar technologies) are

3.1 A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer or device if you agree. Cookies contain information that is transferred to your computer or device.

3.2 In this Cookie Policy, "cookies" also covers similar technologies — including local storage, session storage, web beacons, pixels and JavaScript snippets such as the Apollo.io website-visitor tracker — that read or write information to your device. Where any of these technologies behave like cookies for transparency and consent purposes, we treat them in the same way under this policy.

4. The categories of cookies we use

4.1 We group cookies into the four standard categories used by our consent management platform (Cookiebot, see clause 7):

1. Strictly necessary cookies. These are cookies that are required for the operation of our Site and Mobile App. These essential cookies are always enabled because our Site and Mobile App will not work properly without them. They include, for example, cookies that enable you to log into your Account, maintain a session as you move between pages, balance load across our infrastructure, and protect against fraud and abuse. You can switch off these cookies in your browser settings but you may then not be able to access all or parts of the Site or Mobile App.
2. Preferences cookies. These are used to recognise you when you return to the Site or Mobile App. They allow us to remember your preferences (for example, your choice of language or region) and personalise your experience. In Cookiebot these may also be referred to as "Functionality" cookies.
3. Statistics cookies. These allow us to recognise and count the number of visitors and to see how visitors move around the Site when they are using it. We use this category for our analytics provider, Google Analytics 4 (see clause 6.3). It helps us improve the way the Site works — for example, by ensuring users find what they are looking for easily. In Cookiebot these may also be referred to as "Analytical or performance" cookies.
4. Marketing cookies. These cookies record your visit to the Site, the pages you have visited and the links you have followed, in order to make the Site and any advertising more relevant to you. We also use this category for our B2B website-visitor identification provider, Apollo.io (see clause 6.2), which identifies the company visiting the Site rather than the individual. In Cookiebot these may also be referred to as "Targeting (Advertisement)" cookies.

5. The lawful basis on which we set cookies

5.1 We rely on the following lawful bases under the UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR):

1. For Strictly Necessary cookies, our legitimate interests (UK GDPR Art 6(1)(f)) in operating a secure, functional Site and Mobile App. These cookies are exempt from the consent requirement in PECR Reg 6(4)(a) and (b) on the basis that they are strictly necessary for the provision of a service requested by you.
2. For all other categories (Preferences, Statistics, Marketing), your consent (UK GDPR Art 6(1)(a) and PECR Reg 6), which we capture through the Cookiebot consent banner described in clause 7. You can withdraw your consent at any time using the methods described in clause 8.

6. The third parties we work with

6.1 Value Chain Lab Ltd uses a small number of trusted third-party providers whose services involve cookies. The third parties below are independent controllers (or, where stated, our processors) for any personal data they collect via cookies. We have a contract with each of them and have, where required, completed transfer impact assessments and put in place the UK International Data Transfer Addendum and / or EU Standard Contractual Clauses where personal data is transferred outside the UK or the EEA.

6.2 Apollo.io (B2B website-visitor identification). Value Chain Lab Ltd uses the Apollo.io Website Visitor tracker (provided by ZenLeads, Inc. trading as Apollo.io, headquartered in San Francisco, California, USA) to identify the businesses that visit our Site so we can prioritise our outbound activity. The Apollo.io script (loaded from assets.apollo.io) uses cookies and JavaScript fingerprinting to recognise the company associated with a visit (typically by IP address and other technical signals). Apollo.io is set only after you give consent to Marketing cookies. We treat Apollo.io as an independent controller in respect of the data it collects through this script. Personal data may be transferred to the United States; the transfer is protected by the UK IDTA / EU SCCs and Apollo.io's certification under the EU-US Data Privacy Framework. You can opt out of Apollo.io tracking either by withdrawing consent to Marketing cookies via Cookiebot, or by visiting Apollo.io's privacy centre at https://www.apollo.io/privacy-policy.

6.3 Google Analytics 4 (web analytics). Value Chain Lab Ltd uses Google Analytics 4 (GA4) to understand how visitors use our Site, where bottlenecks exist, and how the Site's performance can be improved. Our contract for GA4 is with Google Ireland Limited, which acts as a data processor on our behalf. Google Ireland Limited engages Google LLC (based in the United States) as a sub-processor; accordingly, your personal data may be subject to local lawful access in the United States. The transfer to Google LLC is protected by the UK International Data Transfer Addendum / EU Standard Contractual Clauses, and Google LLC is certified under the EU-US Data Privacy Framework. We have configured GA4 to operate with IP address truncation and Google Consent Mode v2 enabled, so analytics signals are only sent in line with your Cookiebot choices. We retain GA4 event data for 14 months. GA4 is only loaded after you give consent to Statistics cookies. For more information on how Google uses your data, see https://policies.google.com/privacy. To opt out of Google Analytics across all sites, you can also install the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

6.4 Cookiebot (consent management). Value Chain Lab Ltd uses use Cookiebot (provided by Cybot A/S, Havnegade 39, 1058 Copenhagen K, Denmark) as our consent management platform. Cookiebot stores a consent identifier in a cookie on your browser so we can record and demonstrate the choices you make. The Cookiebot cookie is itself classified as Strictly Necessary because the Site cannot honour your consent choices without it. Consent records are retained by Cookiebot for 12 months by default, after which you will be re-prompted. Cookiebot is based in the European Union; its servers are located in Frankfurt, Germany.

7. How Cookiebot manages your consent

7.1 When you first visit the Site, a Cookiebot consent banner is displayed. The banner asks you to choose which categories of cookies you consent to (Necessary cookies are always enabled because the Site cannot function without them). Until you make a choice, no Preferences, Statistics or Marketing cookies are set: Cookiebot blocks them at script-loading level using its Automatic Cookie Blocking feature.

7.2 Once you have made a choice, Cookiebot records it and only loads the third-party scripts (such as GA4 and Apollo.io) that match your choice. You can change or withdraw your consent at any time as described in clause 8.

7.3 A live, auto-updating register of every cookie and similar technology in use on the Site is rendered at the end of this Cookie Policy. The register is generated by Cookiebot, refreshed monthly through an automated scan of the Site, and shows your current consent state for each category. See clause 9.

8. How to manage your consent

8.1 You can change or withdraw your consent at any time using any of the following methods:

1. Click the small Cookiebot icon in the bottom-left of any page on the Site to re-open the consent banner.
2. Click the "Change your consent" or "Withdraw your consent" link inside the cookie register at the end of this page (clause 9).
3. Use your browser settings to block, delete or limit cookies. The most popular browsers all allow you to manage cookies; if you use your browser settings to block all cookies (including Strictly Necessary cookies) you may not be able to access all or parts of the Site. Useful links: Google Chrome, Microsoft Edge, Mozilla Firefox, Apple Safari, Opera.
4. Use the third-party opt-out tools provided by GA4 (clause 6.3) and Apollo.io (clause 6.2) directly.

9. The cookies currently in use on this Site

9.1 The complete, up-to-date list of cookies and similar technologies in use on this Site — together with their purpose, retention period and category — is shown in the live register below. The register is generated and kept up to date by Cookiebot through an automated monthly scan of the Site. It also lets you see your current consent state and change or withdraw your consent.

9.2 Except for Strictly Necessary cookies, all cookies expire no later than 13 months after they are set, after which Cookiebot will prompt you to renew your consent.

[Cookiebot Cookie Declaration — live register rendered here via embedded script]

10. Hosting and infrastructure

10.1 The FLOX Site is hosted by us on Google Cloud Platform in the europe-west2 region (London). The Site is served from our own infrastructure and we do not use HubSpot, Salesforce, Cloudflare or Seismic to deliver the Site or to set cookies on it. If you have visited an earlier version of flox.is hosted on HubSpot and have older cookies set by those services, those cookies are not set or read by the current Site and will expire under their own retention rules.

11. Changes to this Cookie Policy

11.1 We will review, and where necessary update, this policy from time to time. The current version is always available at https://www.flox.is/cookie-policy. If we have your email address and the change is material, we may also email you with information on the changes.

11.2 Where the change concerns the categories or purposes of cookies that require your consent, Cookiebot will automatically prompt you to re-confirm your consent on your next visit.

12. Contact

12.1 If you have any questions or concerns about our use of cookies, please contact us by email at info@flox.is for general enquiries (which includes data-protection enquiries) or support@flox.is for account, security and abuse matters. You may also contact us by post at:

• Value Chain Lab Ltd (for cookie, analytics and marketing matters), Marlborough House, 298 Regents Park Road, London, United Kingdom, N3 2SZ; or
• VCL Trading Europe Limited (for FLOX Platform matters), Marlborough House, 298 Regents Park Road, London, United Kingdom, N3 2SZ.

12.2 You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time, via https://www.ico.org.uk. We would, however, appreciate the opportunity to address your concerns first.