Privacy Policy

Last updated: 11 August 2026

1. Controller

The controller responsible for processing personal data on this website is:

Muhammad Ali Shan

trading as Flow & Code

Friedrichstraße 128

10117 Berlin

Germany

Email: hello@flowandcode.com

If you have questions about how your personal data is processed or wish to exercise your data protection rights, you can contact us at the email address above.

2. Personal data we process

Depending on how you use our website and services, we may process:

• Name
• Email address
• Company and professional information
• Information you provide in an enquiry
• Information you provide when discussing a potential project
• Information provided when booking a call
• Website usage and interaction information
• IP address
• Browser, device and technical information
• Information processed through necessary website technologies
• Analytics information where you have provided the required consent

We only process personal data that is relevant for the respective purpose.

3. How we use personal data

We process personal data for the following purposes:

• Responding to enquiries
• Discussing potential projects
• Arranging and conducting calls
• Preparing proposals and agreements
• Providing our services
• Communicating with clients and prospective clients
• Managing our business relationship with clients
• Operating and securing our website
• Understanding website usage and improving our website
• Measuring marketing and website performance where consent has been provided
• Preventing misuse, fraud and security incidents
• Complying with legal and accounting obligations

4. Legal bases

Depending on the circumstances, we process personal data on the following legal bases under Article 6 GDPR:

Consent

Where you have given consent, for example for non-essential analytics technologies.

Contract and pre-contractual measures

Where processing is necessary to respond to an enquiry, discuss a potential engagement, prepare a proposal or perform a contract.

Legitimate interests

Where processing is necessary for our legitimate business interests, such as operating and securing our website, communicating with business contacts, preventing misuse and improving our services, provided that those interests are not overridden by your rights and freedoms.

Legal obligations

Where processing is necessary to comply with applicable legal, tax, accounting or other statutory obligations.

5. Website hosting and Cloudflare

Our website is hosted and delivered using infrastructure provided by Cloudflare.

Cloudflare may process technical information necessary to deliver, secure and operate the website, including IP addresses, request information, security information and other technical data.

Cloudflare may process information in countries outside the European Economic Area where necessary for the provision of its services.

6. Google Analytics

We use Google Analytics 4 (GA4) to understand how visitors use our website and to improve our website and services.

GA4 may process information such as:

• Page views
• Website interactions
• Device and browser information
• Traffic source information
• Approximate geographic information
• Other technical and usage information

Analytics is not necessary for the basic operation of our website. Where consent is required, analytics technologies are activated only after the relevant consent has been provided.

You can change or withdraw your analytics consent at any time through Cookie Preferences.

7. Calendly

We use Calendly to allow visitors and prospective clients to schedule calls with us.

When you book a call, Calendly may process information such as your name, email address, appointment details and other information you provide through the booking process.

Calendly stores user and invitee data in data centres located in the United States. Calendly states that transfers of personal data from the EEA are supported by applicable legal transfer mechanisms, including the EU-U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses.

Calendly's processing is also subject to its own privacy terms.

8. Email and communication

We use Zoho for business email and communication.

If you contact us by email, we process the information you provide in order to respond to your enquiry, communicate with you and, where applicable, manage a business relationship.

This may include your name, email address, company information and the contents of your communication.

9. Business and project communication

When working with clients, we may use third-party business, project-management, communication, file-storage or collaboration tools.

The specific tools used for a project depend on the client's requirements and the agreed project setup.

Where such tools process personal data on our behalf, we take appropriate steps to establish the required contractual and data-protection arrangements.

Clients may also provide access to their own systems, software and platforms. In such cases, personal data may be processed within those systems solely as necessary to perform the agreed services.

10. Recipients and service providers

We may share or provide access to personal data with service providers that support our business and website, including providers for:

• Website hosting and infrastructure
• Website security
• Analytics
• Appointment scheduling
• Email and communication
• Project collaboration
• File storage
• Business administration
• Other technical services required to provide our services

We do not sell personal data.

11. International data transfers

Some service providers we use may process personal data outside the European Economic Area.

Where personal data is transferred outside the EEA, we rely on an applicable legal transfer mechanism where required, such as an adequacy decision, the EU-U.S. Data Privacy Framework or appropriate Standard Contractual Clauses.

The applicable mechanism depends on the provider and processing activity.

12. Retention

We retain personal data only for as long as necessary for the relevant purpose.

The retention period depends on:

• The nature of the information
• The purpose of processing
• Whether a business relationship exists
• Applicable legal and accounting obligations
• Statutory retention periods
• The establishment, exercise or defence of legal claims

When personal data is no longer required and no legal obligation requires us to retain it, we delete or anonymise it.

13. Your rights

Subject to applicable law, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data
• Request restriction of processing
• Object to certain processing
• Request data portability where applicable
• Withdraw consent where processing is based on consent

To exercise your rights, contact:

hello@flowandcode.com

You also have the right to lodge a complaint with a competent data protection supervisory authority.

14. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration or destruction.

However, no method of transmission or storage over the internet can be guaranteed to be completely secure.

15. Changes to this Privacy Policy

We may update this Privacy Policy when our services, technology, data-processing practices or legal obligations change.

The current version will always be available on this page together with its last updated date.

16. Contact

Muhammad Ali Shan

trading as Flow & Code

Friedrichstraße 128

10117 Berlin

Germany

Email: hello@flowandcode.com