Privacy

1. General

This privacy statement describes how Flowstate Capital GmbH, operating under the name WebsiteFlow, processes personal data in connection with the website websiteflow.online, business communications, quotations, assignments, services, project execution, support and other business contacts.

WebsiteFlow attaches importance to the careful handling of personal data and processes personal data in accordance with applicable data protection legislation, including in particular the Swiss Federal Act on Data Protection (FADP/DSG) and, where applicable, the General Data Protection Regulation (GDPR).

This privacy statement is intended to provide transparency about our data processing. It does not constitute an extension of WebsiteFlow's statutory or contractual obligations to the extent that applicable law does not require this.

2. Controller

The controller for the processing activities covered by this privacy statement is:

• Flowstate Capital GmbH
• operating under the name WebsiteFlow
• Heinzenbergstrasse 1
• 7421 Summaprada
• Switzerland
• UID: CHE-175.192.007
• Website: websiteflow.online
• Email: hello@websiteflow.online

Questions about privacy or requests relating to personal data can be submitted via the email address above.

3. When this privacy statement applies

This privacy statement applies, among other situations, when you:

• visit websiteflow.online;
• contact us by email, telephone or another communication channel;
• request information, a quotation or a proposal;
• enter into an agreement with WebsiteFlow or are involved in an assignment on behalf of an organisation;
• make an appointment with WebsiteFlow;
• collaborate with us as a supplier, partner, adviser, freelancer or other business relation;
• are passed on to us as a contact person by a client, relation, colleague, employer or other third party;
• use a website, digital environment or other service for which WebsiteFlow itself determines the purpose and means of the relevant processing.

4. WebsiteFlow as processor for clients

In the execution of assignments, WebsiteFlow may gain access to personal data for which a client is itself the controller, for example when we develop, manage, migrate, maintain or technically support a website.

To the extent that WebsiteFlow processes such personal data solely on behalf of and in accordance with the instructions of the client, WebsiteFlow acts as processor and the client as controller. In that case, the client is in principle responsible for the lawfulness of the collection and processing, the information provided to data subjects and the instructions given to WebsiteFlow.

Where required, additional arrangements regarding data processing can be recorded in a data processing agreement or other written agreement. In the event of a conflict between this privacy statement and a specifically concluded data processing agreement with respect to processing on behalf of a client, the specific agreement shall prevail for that processing.

WebsiteFlow is not responsible for the privacy statements, legal bases, cookie settings, consent mechanisms or other privacy obligations of clients' websites or systems, unless WebsiteFlow has expressly and in writing accepted responsibility for these.

5. What personal data we may process

Depending on the nature of the contact or the services provided, we may process the following categories of personal data:

• identification data, such as name and job title;
• business contact details, such as email address, telephone number, company name, business address and website;
• information that you yourself provide in correspondence, conversations, briefing documents, forms or other communications;
• data required for the preparation and execution of quotations, assignments and agreements;
• invoice, payment and administrative data, including invoice address, payment status and transaction-related information;
• project information, files, content and other data made available to WebsiteFlow for the execution of an assignment;
• technical data, such as IP address, date and time of a request, browser and device information, visited URLs, referring pages, server and security logs and technical error information;
• data relating to appointments, such as name, email address, organisation, chosen date and time and any information you provide when making an appointment;
• data relating to business relations, suppliers, representatives, contact persons and other persons involved in the execution or establishment of an assignment;
• information from public sources, business registers, company websites, professional platforms or information lawfully provided to us by third parties, to the extent relevant to our business activities;
• information necessary for fraud prevention, security, disputes, debt collection, legal proceedings or the enforcement of our rights.

We endeavour not to process more personal data than is reasonably necessary for the relevant purpose.

6. Special or sensitive personal data

WebsiteFlow does not in principle request special or sensitive personal data and asks you not to provide us with such information unnecessarily.

Where special or sensitive personal data is nonetheless part of project information supplied by a client, we process it only to the extent that this is necessary and lawful and, where WebsiteFlow acts as processor, within the instructions of the relevant client.

7. Purposes of processing

We may process personal data for, among others, the following purposes:

• answering questions and requests;
• scheduling and conducting introductory conversations and appointments;
• preparing, issuing, discussing and following up on quotations and proposals;
• entering into, managing and executing agreements;
• developing, designing, building, migrating, maintaining and supporting websites and digital services;
• project management, quality control, communication and customer service;
• managing client, supplier and partner relationships;
• invoicing, payment administration, bookkeeping and tax administration;
• following up on outstanding payments and conducting debt collection;
• securing our website, systems, accounts and services;
• preventing, investigating and combating misuse, fraud, attacks, technical failures and other undesirable activities;
• analysing and improving our internal processes, services, website and technical performance;
• documenting appointments and communications;
• establishing, substantiating, exercising or defending legal claims;
• complying with statutory obligations, court orders or lawful requests from competent authorities;
• internal administration, business operations, risk management and continuity;
• business communications and, where permitted, informing existing or potential business relations about relevant services;
• preparing or executing a reorganisation, financing, merger, sale of assets, transfer of activities or similar business transaction;
• other purposes compatible with the purpose for which the data were obtained or for which a separate legal basis exists.

8. Legal bases

To the extent that the GDPR applies, we process personal data depending on the situation on the basis of one or more of the following legal bases:

• the processing is necessary for taking steps at your request prior to entering into an agreement;
• the processing is necessary for the performance of an agreement;
• the processing is necessary for compliance with a legal obligation;
• the processing is necessary for the purposes of the legitimate interests pursued by WebsiteFlow or a third party, to the extent that your interests or fundamental rights do not override those interests;
• you have given consent for a specific processing;
• another legal basis available under applicable law.

Our legitimate interests may include, among other things, conducting and protecting a sound business, efficiently executing projects, managing business relationships, securing systems, improving services, preventing fraud and misuse, conducting administration, retaining appropriate evidence and establishing, exercising or defending legal claims.

Under Swiss law, we process personal data in accordance with the principles and requirements of the FADP. Where a justification is required for a specific processing, this may, depending on the circumstances, include consent, an overriding private or public interest or a statutory basis.

9. Provision of personal data

You are in principle not obliged to provide personal data to WebsiteFlow, unless a statutory or contractual obligation requires this.

Where certain personal data are necessary for a quotation, agreement, payment, appointment or execution of an assignment and you do not provide them, WebsiteFlow may be unable to issue a quotation, enter into an agreement, carry out an appointment or provide a service.

10. Business communications and marketing

WebsiteFlow may use contact details for business communications, relationship management and bringing its own services to the attention of others, to the extent permitted under applicable law.

Where prior consent is required by law, we will request such consent. Where processing can be based on a legitimate interest, we take into account the nature of the relationship, the reasonable expectations of the data subject and the right to object.

You may unsubscribe from direct marketing communications at any time. An unsubscription does not affect necessary service messages, contractual communications, invoices or other communications not intended as marketing.

11. Technical data and server logs

When visiting websiteflow.online, technical data may be processed automatically in order to keep the website available, stable and secure. This may include, among other things, IP addresses, timestamps, browser information, visited pages, error messages, network data and security events.

These data may be used for hosting, error analysis, security, misuse prevention, capacity management and incident investigation. Technical log data are not retained for longer than is reasonably necessary for these purposes, unless an incident, statutory obligation or legal claim justifies a longer retention period.

12. Cookies and similar technologies

WebsiteFlow may use cookies, local storage, pixels, scripts or similar technologies that are necessary for the operation, security, language preferences, session management or other functionalities of the website.

Non-essential cookies or similar technologies are used only in a manner consistent with applicable law. Where consent is required, such technologies are not activated before the required consent has been obtained.

As of the date of this version, WebsiteFlow does not knowingly use its own advertising pixels or behavioural tracking pixels for personalised advertising. If the technical configuration of the website changes in the future, this statement and any cookie settings may be updated accordingly.

Browser settings can be used to restrict or delete cookies. Blocking technically necessary storage may result in parts of the website not functioning or not functioning optimally.

13. Appointments and external calendars

On the contact page, you can load the Flowstate Capital Cal.com calendar to book a 30-minute introduction. The calendar and external script only load after you click ‘Allow and load calendar’. Until then, this integration makes no connection to Cal.com.

Once loaded, Cal.com receives technical data such as your IP address and browser information. When booking, it processes your chosen time, name, email address and any additional information you enter for the appointment and related communication. Cal.com may use cookies or local storage for functionality, preferences, security and usage measurement. WebsiteFlow adds no advertising or analytics pixels of its own.

The loading choice is held only in memory while the contact page is open. ‘Close calendar’ or ‘Cookie settings’ stops the embedded calendar and its further connections. This does not automatically erase data already processed or cookies stored by Cal.com. Removal is possible through browser settings or a privacy request to the relevant provider.

Cal.com, Inc. is based in the United States. Its privacy policy describes processing in the United States and by international subprocessors. Further information about processing, retention, rights and applicable safeguards is available at https://cal.com/privacy. WebsiteFlow may change its booking provider and will update this notice accordingly.

14. Hosting, infrastructure and technical suppliers

For the delivery, security, storage, development and operation of the website and our services, we may make use of external technical service providers, including suppliers of hosting, cloud infrastructure, content delivery networks, security, email, storage, project management, communication, software development and backups.

The technical configuration of a website may change over time. WebsiteFlow is therefore not obliged to name every technical sub-supplier individually in this privacy statement, unless applicable law requires this in the specific situation. Where necessary, we will provide information about categories of recipients, relevant international transfers and other legally required information.

15. Use of AI-assisted software

WebsiteFlow may use software with artificial intelligence or other automated functions in the execution of its work, for example to support design, programming, text editing, translation, summarisation, quality control, research or internal efficiency.

We endeavour not to include personal data that are not necessary in such systems. Where personal data are processed via an external AI or software provider, that provider may act as processor, sub-processor or independent controller, depending on the service, configuration and contractual arrangements.

The use of AI-assisted tools does not mean that decisions with legal consequences or similarly significant effects are taken solely by automated means.

16. Recipients and categories of recipients

WebsiteFlow may share personal data, to the extent necessary and lawful, with:

• hosting, cloud, security and infrastructure providers;
• providers of email, office software, storage, project management and communication;
• providers of calendar, appointment or video conferencing services;
• providers of development, design, translation, AI or other supporting software;
• banks, payment service providers and financial institutions;
• bookkeepers, tax advisers, accountants and administrative service providers;
• lawyers, legal advisers, bailiffs, debt collection service providers, insurers and other professional advisers;
• employees, directors, freelancers, contractors and collaboration partners to the extent that access is necessary for their work;
• competent authorities, supervisory bodies, courts and other government bodies when we are required to do so or when disclosure is lawful and necessary;
• potential or actual buyers, investors, financiers, successors in title or advisers in the context of a reorganisation, financing, merger, acquisition, sale of assets or transfer of activities;
• other parties where you have given consent or where another legal basis exists.

We require, where appropriate, that service providers treat personal data confidentially and with appropriate security measures.

17. Changes in suppliers

WebsiteFlow may replace or add suppliers, technical infrastructure and software without informing every visitor or relation individually in advance, to the extent that this is compatible with applicable law and the nature and purposes of the processing do not materially change.

Where a change requires additional information or consent under applicable law, we will take appropriate measures.

18. International transfers of personal data

WebsiteFlow is established in Switzerland and may use service providers that are established in Switzerland, the European Economic Area, the United Kingdom, the United States or other countries, or that process data there.

Where personal data are transferred from Switzerland or a country to which the GDPR applies to a country without a recognised adequate level of protection, we use appropriate safeguards where required. These may include recognised standard contractual clauses, additional contractual and technical measures or another legally permitted transfer mechanism.

Where an adequacy decision, a recognised data protection framework or another legal transfer basis is available and applicable, we may make use of it.

No international transfer can fully exclude the possibility that foreign authorities may seek access to data under their national legislation. WebsiteFlow assesses and mitigates such risks to the extent that this can reasonably and lawfully be required of us.

19. Retention periods

WebsiteFlow does not retain personal data for longer than is reasonably necessary for the purposes for which they are processed, unless a longer retention period is justified or required by law.

In determining the retention period, we may take into account the duration of the business relationship, statutory retention obligations, tax and accounting obligations, contractual obligations, relevant limitation periods, the need to be able to demonstrate appointments and performance, potential disputes, security incidents and our legitimate need to establish, exercise or defend legal claims.

In general, the following starting points may be applied:

• ordinary requests and business correspondence may be retained for an appropriate period after the last substantive contact;
• quotations, contracts, project documentation and relevant client communications may be retained for the duration of the relationship and thereafter for the applicable statutory or contractually relevant period;
• invoices, accounting records and other legally relevant administration are retained for at least the statutory prescribed period; for certain Swiss accounting records, a retention period of ten years applies in principle;
• technical logs are generally retained for a shorter period, unless they are needed for security, investigation or evidence;
• data necessary for an ongoing or reasonably anticipated dispute may be retained for as long as necessary for its resolution;
• backups may still contain personal data for a limited technical rotation period after data have been deleted from active systems.

Data that have been genuinely anonymised and can no longer be linked to a person may be used for longer or without a fixed period for statistical, technical or business purposes.

20. Security

WebsiteFlow takes appropriate technical and organisational measures tailored to the nature of the data, the processing, the available technology, the cost of implementation and the relevant risks.

Depending on the situation, such measures may include access restrictions, authentication, encrypted connections, backups, logging, updates, supplier management, confidentiality agreements and restriction of access to persons who need the data for their work.

No method of storage, transmission or digital security is entirely risk-free. WebsiteFlow therefore cannot guarantee absolute or unconditional security, but will comply with the security obligations that can reasonably and lawfully be required of it under applicable law.

21. Data breaches and security incidents

When a personal data breach occurs, WebsiteFlow assesses the incident and takes appropriate measures.

Where required by applicable law, WebsiteFlow will notify a competent supervisory authority and/or affected individuals within the applicable conditions and timeframes.

Where WebsiteFlow acts as processor for a client, we will inform the client of relevant incidents in accordance with the applicable processor arrangements and statutory requirements.

22. Data from other sources

WebsiteFlow may receive personal data from clients, business relations, partners, suppliers, referrers, public registers, company websites, professional platforms and other lawful sources.

Where personal data are not obtained directly from the data subject, we provide the legally required information within the applicable timeframe, unless a statutory exception applies, the data subject already has the information or another permitted exception applies.

23. Confidentiality of client information

Information that clients or business relations provide to WebsiteFlow may, in addition to personal data, also contain confidential business information. Privacy law and contractual confidentiality are not the same thing.

Any additional confidentiality obligations apply only to the extent that they arise from law or have been expressly agreed in writing. This privacy statement does not in itself create any additional confidentiality obligation that goes beyond applicable law or a separate agreement.

24. External websites, services and embeds

Websiteflow.online may contain links to websites, applications, social media platforms, calendars, videos, maps, fonts or other third-party services.

When you follow an external link or activate an external service, that third party may process personal data in accordance with its own terms and privacy policy. WebsiteFlow does not necessarily determine how such independent third parties organise their data processing and is not responsible for this to the extent that the law does not provide otherwise.

We advise you to consult the privacy policy of the relevant third party.

25. Minors

The website and services of WebsiteFlow are primarily aimed at businesses, organisations, professionals and adult business users and are not specifically intended for children.

We do not knowingly collect personal data from children for commercial purposes without an appropriate legal basis. If it becomes apparent that such data have been processed without a valid basis, we may delete them or take other appropriate measures.

26. Automated decision-making

WebsiteFlow does not in principle make decisions based solely on automated processing that have legal consequences for a data subject or similarly significantly affect them.

If such decision-making is introduced in the future and additional statutory information or safeguard obligations apply, we will comply with them.

27. Rights of data subjects

Depending on applicable law and the circumstances, you may have the right, among other things, to:

• receive information about the processing of your personal data;
• request access to personal data that we process about you;
• have inaccurate or incomplete personal data corrected;
• request the deletion or destruction of personal data;
• in certain cases, request restriction of processing;
• in certain cases, object to processing;
• withdraw your consent where processing is based on consent;
• in certain cases, receive or have transferred personal data in a structured, commonly used and machine-readable format;
• request human review where applicable law grants specific rights in the case of solely automated decision-making;
• lodge a complaint with a competent supervisory authority.

These rights are not absolute. WebsiteFlow may restrict, defer or refuse a request where applicable law permits this, for example due to statutory retention obligations, the rights and freedoms of others, trade secrets, an ongoing dispute, legal claims, security interests or another statutory exception.

28. Exercising your rights

Requests can be sent to hello@websiteflow.online.

In order not to provide personal data to unauthorised persons, WebsiteFlow may request reasonable information to verify your identity. We may also ask you to further specify a request where this is necessary to handle it efficiently and carefully.

We respond to requests within the timeframe required under applicable law. Under the GDPR, this is in principle within one month, subject to a legally permitted extension. Under Swiss law, a request is in principle handled within the applicable statutory timeframe.

To the extent permitted by law, WebsiteFlow may refuse a request or charge a fee where a request is manifestly unfounded, excessive, repetitive or otherwise abusive.

29. Right to object to direct marketing

Where personal data are used for direct marketing, you may object to this at any time.

Following a valid objection, we will no longer use your personal data for those direct marketing purposes, except for data minimally necessary to respect your unsubscription or where another processing is based on an independent legal basis.

30. Withdrawal of consent

Where processing is based on your consent, you may withdraw that consent with effect for the future.

Withdrawal does not affect the lawfulness of processing prior to the withdrawal. Withdrawal of consent also does not affect processing based on another valid legal basis.

31. Complaints

For privacy questions or complaints, we ask you to first contact us preferably via hello@websiteflow.online, so that we can investigate the matter.

Under Swiss law, you may, depending on the situation, contact the Federal Data Protection and Information Commissioner (FDPIC/EDÖB).

Where the GDPR applies to the relevant processing, you may also lodge a complaint with the competent data protection authority in the European Economic Area, in particular in the country where you habitually reside, work or where the alleged infringement took place.

32. Statutory obligations and protection of rights

WebsiteFlow may retain, use or disclose personal data where this is reasonably necessary to comply with applicable laws and regulations, court orders or lawful requests from competent authorities.

We may also process data where this is necessary to protect our agreements, general terms and conditions, intellectual property rights, claims, property, systems, employees, clients or other legitimate interests, or to prevent or investigate fraud, misuse and security incidents.

33. Reorganisations and transfer of the business

If WebsiteFlow, Flowstate Capital GmbH or relevant activities are wholly or partially reorganised, financed, sold, transferred, merged or contributed to another company, personal data may, to the extent lawful, be shared with involved advisers, financiers, potential counterparties and successors in title.

We may require appropriate confidentiality and security measures in this context. The succeeding party may further process personal data for purposes compatible with the original processing and applicable law.

34. No sale of personal data as a commodity

WebsiteFlow does not sell personal data as an independent commodity to data brokers.

The foregoing does not prevent personal data from, to the extent permitted by law, forming part of a business transaction as described in this privacy statement, or from service providers processing data in connection with the delivery of their services.

35. Changes to this privacy statement

WebsiteFlow may amend this privacy statement from time to time, for example due to changes in legislation, services, suppliers, technical infrastructure or business operations.

The current version is published on websiteflow.online with a new version date. If a change has material consequences and applicable law requires additional notification or consent, we will take appropriate measures.

We advise you to consult the privacy statement periodically.

36. Contact

For questions, requests or complaints about the processing of personal data, you can contact:

• Flowstate Capital GmbH
• operating under the name WebsiteFlow
• Heinzenbergstrasse 1
• 7421 Summaprada
• Switzerland
• UID: CHE-175.192.007
• Email: hello@websiteflow.online
• Website: websiteflow.online