Privacy Policy

Last updated: 27 September 2026

At Flow by Caroline, your privacy matters. This Privacy Policy explains what personal information is collected through this website, why it is used, who may process it and the rights you have under applicable data protection law.

1. Who is responsible for your data?

The data controller is:

Caroline Thomas, trading as Flow by Caroline Self-employed professional established in Spain Calle Bolivia, 35422 Moya, Las Palmas, Spain Email: hello@flowbycaroline.com Website: flowbycaroline.com

Full business identification information is available in the Legal Notice.

For any questions about this Privacy Policy or the use of your personal information, please contact me using the email address above.

2. What information do I collect?

When you contact me through the website enquiry form, I may collect:

  • your name
  • your email address
  • your business name and/or website, if you choose to provide it
  • information you provide about your business, processes, challenges or requirements
  • any other information you voluntarily provide in your enquiry or subsequent communications

Please do not include sensitive personal information in the enquiry form unless it is genuinely necessary for your enquiry.

Technical information necessary for the operation and security of the website may also be processed by the website's hosting and infrastructure providers.

3. Why do I use your information?

Information submitted through the website is used to:

  • receive and respond to your enquiry
  • understand what you are asking for and whether I may be able to help
  • communicate with you about your enquiry
  • arrange and conduct conversations about potential services
  • prepare proposals or information you request
  • take steps towards entering into a contract with you, where appropriate
  • maintain necessary business and administrative records
  • protect the website and business from misuse, fraud or security threats
  • comply with applicable legal obligations

I will not use an enquiry submitted through this website to automatically enrol you in unrelated marketing communications.

4. Legal basis for processing

Depending on the circumstances, your personal information may be processed because it is necessary to take steps at your request before entering into a contract, or because I have a legitimate interest in responding to enquiries, communicating with potential clients and operating and protecting my business.

Where processing is required to comply with a legal obligation, that obligation will provide the relevant legal basis.

Where consent is specifically requested for a particular purpose, you may withdraw that consent at any time.

5. Who has access to your information?

I do not sell your personal information.

I may use carefully selected service providers to operate Flow by Caroline. These providers may process personal information on my behalf where necessary to provide their services.

These may include providers of:

  • website hosting and infrastructure
  • email services
  • customer relationship management and email automation
  • secure data storage and business software
  • IT and security services

For example, information submitted through the website enquiry form is transferred to ActiveCampaign, which I use to manage enquiries and related communications.

Where required, service providers act under appropriate data-processing arrangements and may only process information in accordance with the applicable agreement and data protection law.

Personal information may also be disclosed where required by law or where reasonably necessary for the establishment, exercise or defence of legal claims.

6. Where your information is stored

Personal information processed by Flow by Caroline is stored and processed within the European Union (EU) or European Economic Area (EEA).

I select service providers and configure the services I use so that personal information relating to Flow by Caroline is stored within the EU/EEA.

If this changes in the future and personal information needs to be transferred outside the EU/EEA, I will ensure that any such transfer complies with applicable data protection law and that appropriate safeguards are in place where required.

I will also update this Privacy Policy to reflect any material change in how or where personal information is processed.

7. How long will I keep your information?

Personal information is kept only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting or administrative requirements.

If you make an enquiry but do not become a client, the information may be retained for a reasonable period so that I can respond to your enquiry, understand previous correspondence if you contact me again, and maintain appropriate business records.

If you become a client, relevant information may need to be retained for longer to provide the services and comply with legal, tax, accounting and contractual obligations.

When information is no longer required, it will be deleted or anonymised where appropriate.

8. Your data protection rights

Depending on the circumstances, you may have the right to:

  • access the personal information held about you
  • rectify information that is inaccurate or incomplete
  • request the erasure of your personal information
  • request restriction of processing
  • object to certain processing
  • request portability of your personal information where applicable
  • withdraw your consent at any time where processing is based on consent

These rights are subject to the conditions and exceptions established by applicable law.

To exercise any of these rights, contact:

I may need to request information necessary to confirm your identity before processing a request.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) if you believe that your personal information has been processed in breach of data protection law.

9. Automated decision-making

Flow by Caroline does not currently use personal information submitted through this website to make decisions about you based solely on automated processing that produce legal or similarly significant effects.

10. Security

Reasonable technical and organisational measures are used to protect personal information against unauthorised access, alteration, disclosure, loss or misuse.

However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.

11. Third-party websites

This website may contain links to third-party websites.

Flow by Caroline is not responsible for the privacy practices, content or security of third-party websites. If you follow an external link, you should review that website's own privacy information.

12. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes to the website, services, technology used or applicable legal requirements.

The latest version will always be published on this page and the Last updated date will be changed accordingly.

13. Contact

If you have any questions about this Privacy Policy or how your personal information is handled, please contact:

Caroline Thomas
Flow by Caroline
Email: hello@flowbycaroline.com