Privacy Policy
Controller
Create2Flow GbR
Heegbarg 9, 22391 Hamburg, Germany
Represented by: Livia Rocha Christiansen & Enno Maurice Paul Bluhm
Email: contact@createtoflow.com
General
We process personal data in accordance with GDPR & BDSG, exclusively:
- to provide our website
- to communicate with clients and prospects
- to fulfil contractual obligations
- to analyse website visitors (currently inactive – see "Analytics" section)
No registration is required to use the website.
Hosting (Server Logs)
Our website is hosted by Hostinger (UAB Hosting, Švitrigailos g. 34, Vilnius, Lithuania, EU). When you visit our website, your browser automatically transmits technical data stored in server logs:
- IP address (anonymised)
- Date and time of access
- Requested URL
- Browser type and version
- Operating system
- Referrer URL
Purpose: Technical operation and security of the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Contact Form (Web3Forms)
When you contact us via our contact form, your data is transmitted to and processed by Web3Forms (web3forms.com), which forwards it to us by email.
We process the following data:
- Name
- Email address
- Project details (optional)
- Message / enquiry
Purpose: Processing your enquiry and preparing a quote.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).
Note: Web3Forms processes data according to its own privacy policy available at web3forms.com. By submitting the form, you agree to this processing.
Contract and Project Data
For client projects we process:
- Name / company
- Billing address
- Payment information
- Project materials (images, texts, logos, credentials etc.)
Purpose: Project execution.
Legal basis: Art. 6(1)(b) GDPR.
Local Storage
Our website stores technically necessary preferences locally in your browser (localStorage). No cookies are set. Only the following is stored:
- Your theme preference (light or dark mode)
- Your language preference (German/English)
- A technical timestamp for spam prevention in the contact form
- Your cookie consent decision (analytics accepted or declined)
This data does not leave your browser, is not transmitted to us, and contains no personal data. No consent is required.
Analytics
We use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for anonymised analysis of user behaviour on our website.
Purpose: Analysis of page views, user behaviour, and traffic sources to improve our offering.
Legal basis: Art. 6(1)(a) GDPR (consent). Google Analytics is only loaded if you have actively accepted via the cookie consent banner. You can withdraw your consent at any time by clearing your browser's local storage or by contacting us at contact@createtoflow.com.
Data transfer: Collected data is transmitted to Google servers, which may be located in the USA. Google LLC is certified under the EU–US Data Privacy Framework.
Retention period: 14 months (as configured in our GA4 settings).
Further information: Google Privacy Policy.
Retention & Deletion
We store personal data only as long as necessary:
- Business and invoice data: 10 years (statutory retention obligation)
- Project and communication data: until project completion + internal retention period
- Contact enquiries: 6–12 months
Your Rights
You have the right to:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object (Art. 21 GDPR)
- Withdraw consent (Art. 7(3) GDPR)
To exercise your rights, contact us at:contact@createtoflow.com
Security
Our website uses:
- SSL/TLS encryption (HTTPS)
- Security headers (CSP, HSTS, X-Frame-Options etc.)
- Spam protection in the contact form (honeypot + rate limiting)
- GDPR-compliant hosting (Hostinger, EU)
Changes
We reserve the right to update this privacy policy when new tools or features are introduced. The current version is always available on this page.
Last updated: April 2026