Privacy Policy — Advaflow OÜ
This Privacy Policy explains how Advaflow OÜ processes personal data when you visit advaflow.eu or contact us about our planned products and pilot opportunities. It covers the current information website and related enquiries.
The website does not currently provide customer accounts, assessments, AI conversations, payments, live coaching or on-site registration. Descriptions of planned products do not mean those features are available. We will update this notice before introducing processing connected with new features.
1. Who is responsible for your data?
Advaflow OÜ is the controller responsible for the processing described in this notice.
- Estonian registry code: 17592016
- VAT number: EE103026172
- Registered office and postal address: Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b, 10115, Estonia
- Contact and privacy enquiries: contactus@advaflow.eu (please use “Privacy” in the subject for data protection requests)
Other companies using Adva-related brands do not automatically receive your information or become joint controllers simply because they share a brand relationship.
2. What information do we process?
- Website and security information: your IP address, requested page or resource, request date and time, browser and device information supplied with the request, response status and technical error information. A referring page may be included where your browser sends it. These data support page delivery, troubleshooting and security.
- Enquiry correspondence: your email address, any name or organisation you provide, your message and attachments, product interests, preferred language and our replies.
- Privacy requests and disputes: your request, relevant correspondence, proportionate identity-verification information where needed, and records of how the request or complaint was handled.
Information comes from you, your browser and the technical services used to deliver the website and correspondence. We do not research your identity on social networks or enrich enquiries with personality profiles.
3. Why do we process information?
| Purpose | Legal basis under the GDPR |
|---|---|
| Deliver the website, maintain its reliability and investigate technical faults or abuse | Article 6(1)(f): our legitimate interest in operating a functioning, secure website and protecting visitors and our systems. |
| Respond to your request about products or pilot participation | Article 6(1)(b) where you request steps towards a possible contract with you. Article 6(1)(f) for general enquiries and correspondence with representatives of organisations: our legitimate interest in responding to requested communications. |
| Handle complaints and establish, exercise or defend legal claims | Article 6(1)(f): our legitimate interest in resolving disputes and protecting legal rights; Article 6(1)(c) where a specific legal obligation applies. |
| Respond to data protection requests and comply with binding legal obligations | Article 6(1)(c), including obligations under the GDPR. Limited evidence needed to defend a claim may be retained under Article 6(1)(f). |
Where we rely on legitimate interests, we consider your rights and reasonable expectations and limit processing to what is necessary. You can ask us for further information about the relevant assessment and exercise your right to object as explained below.
4. Contact by email and interest in the pilot
Contact buttons use an email link that opens your email application with a suggested subject and message. The website does not send that message automatically or store a registration. You decide whether to send the email. You can also write directly to contactus@advaflow.eu.
We use your message to respond to your enquiry and carry out any follow-up you request. Sending an enquiry does not create a customer account, reserve a pilot place or subscribe you to a general marketing mailing list. We do not currently operate a newsletter or advertising programme.
Providing information by email is voluntary. We need a reply address and enough context to answer your question. Please do not send identity documents, health information, detailed personal assessments or unnecessary information about other people. If you send unnecessary sensitive material, we limit access and remove or redact it where appropriate; it is not used for personality analysis or model training.
5. Hosting, backups and recipients
The website server is hosted with Hetzner in Germany. Backups are also stored with Hetzner in Germany. Hetzner supplies the infrastructure used to serve the website and store backup copies, including technical data contained in those systems. Hetzner’s information on data protection is available at hetzner.com/legal/privacy-policy.
Access to personal data is limited to authorised people and service providers who need it for the purposes described in this notice. Relevant recipients are:
- Hosting and backup infrastructure providers, as identified above.
- Email delivery and mailbox service providers involved in receiving and responding to your messages. This category is separate from website hosting; confirming the website server location does not establish the location of all email processing.
- Professional advisers where necessary for a specific legal matter, and authorities where disclosure is required or otherwise lawfully justified.
Service providers processing personal data on our behalf must be subject to the applicable data protection arrangements. We do not sell personal data. We do not disclose enquiries to coaches, advertising networks or AI model providers as part of the current website service.
6. Where is information processed?
The website hosting and backup locations covered by this notice are in Germany, within the European Union. Email communications also involve the email services used by the sender and recipient; the hosting location alone is not a claim that every stage of email transmission or provider support takes place in Germany.
Any transfer by us or a processor acting on our behalf to a country outside the European Economic Area must meet the applicable GDPR transfer requirements. Where such a transfer is involved, it must be covered by an applicable adequacy decision or appropriate safeguards, such as the relevant European Commission Standard Contractual Clauses and any necessary supplementary measures. You may contact us for information about recipients, locations and applicable safeguards, including a copy subject to justified redactions. A future change to our processing arrangements will be reflected in this notice as required.
7. How long do we keep information?
Retention depends on the purpose and the records concerned. We use the following criteria to decide when information should be deleted or, where appropriate, irreversibly anonymised:
| Category | Retention and deletion criteria |
|---|---|
| Enquiries and related correspondence | Kept while we answer the enquiry and complete follow-up you request. After the matter is closed, we consider whether the correspondence is still needed for a continuing discussion, a specific complaint or a legal claim. Information with no remaining purpose is deleted; an expression of interest is not treated as permission for indefinite marketing retention. |
| Technical access and security records | Kept to the extent needed to diagnose faults, detect abuse and investigate security events. The relevant factors are whether a fault or incident remains unresolved and whether specific records are needed as evidence. Records no longer needed for those purposes are deleted or anonymised. |
| Privacy requests, complaints and dispute evidence | Kept until the request or complaint has been handled and, where necessary, for the applicable legal limitation period or duration of proceedings. Continued retention is limited to the evidence needed for that obligation or dispute. |
| Backup copies | Retained through the backup replacement cycle needed to recover from data loss or corruption. Older copies are removed as they are superseded and no longer needed for recovery or a specific legal hold. Data removed from active systems may remain in restricted backups until those copies are replaced or deleted. If a backup is restored, relevant deletion requests must be reapplied before the restored data return to routine use. |
A legal obligation or a specific dispute may justify longer retention of particular records, with restricted access. It does not justify keeping all correspondence or technical data indefinitely. Contact us if you would like information about retention of a particular record or to request deletion.
8. Cookies, analytics and external services
The current website code does not set cookies, use local or session storage, load analytics or advertising tools, embed third-party content, or load external fonts. Language selection works through language-specific URLs. Clicking an email link opens your email application; it does not submit a web form.
Serving the website still involves technical processing, such as the IP address needed to deliver a page. The absence of analytics cookies does not mean no personal data are processed. External websites linked from this notice and your email provider have their own privacy information.
If we later introduce optional analytics, advertising, embedded services or other non-essential access to information on your device, we will explain that processing and obtain consent where required before activating it.
9. AI, profiling and future services
The current website does not submit visitor information or email enquiries to external LLMs for analysis, generate personality profiles, or make automated decisions with legal or similarly significant effects. There are no active online assessments, AI coaching sessions, customer payment flows or organisation-funded programmes on this website.
Before introducing these services, we will explain the relevant data, purposes, legal bases, providers, retention and choices. Descriptions of planned products are not permission to process information for those future purposes.
AdvaFlow is not intended for employee selection, candidate screening or employment decisions. Its planned purpose is self-awareness, personal development and better collaboration.
10. Security
We use technical and organisational measures appropriate to the nature and risk of the processing, including restricted access, secure configuration and backup arrangements. No internet system can guarantee absolute security. If a personal data breach occurs, we assess it and notify the competent authority and affected individuals where the GDPR requires this.
11. Your rights
Subject to the conditions and exceptions in the GDPR, you may request access to your personal data and a copy, correction, erasure, restriction of processing, and portability of data you provided where processing is automated and based on consent or contract.
You may object, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop the relevant processing unless we demonstrate overriding compelling legitimate grounds or need the information for legal claims. If personal data are processed for direct marketing, your right to object to that marketing is unconditional.
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. The current website does not require optional marketing or analytics consent. Rights are not absolute: information may need to be retained, for example, to comply with a legal obligation or defend a legal claim.
Send requests to contactus@advaflow.eu. We normally respond within one month. For complex or multiple requests, we may extend by up to two further months, explaining the extension within the first month. Requests are normally free. A fee or refusal is possible only under the GDPR’s conditions, with reasons and information about complaint rights. If we have reasonable doubts about identity, we request only proportionate additional verification.
12. Complaints
You may complain to a data protection supervisory authority, particularly in the EEA country of your habitual residence, workplace or the alleged infringement. In Estonia, this is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate): aki.ee/en. You do not have to contact us first to exercise this right.
13. Children and changes to this notice
Our planned standard services are intended for adults aged 18 or over. This information website does not enrol children or collect assessment responses. Please contact us if you believe a child has sent personal information that should be removed.
We update this notice when our processing changes and identify the effective date. We provide additional information before introducing new purposes or features where required. Publishing an updated notice does not itself create consent or another legal basis. Previous versions may be requested using the contact details above.