Privacy policy

1. Controller

Represented by Filip Radotović, Managing Director. Further details are in the legal notice.

2. In brief

• We don't use cookies or tracking tools. We measure the number of visits anonymously with Vercel Web Analytics (section 4).
• The fonts are hosted on our server; the website does not connect to Google Fonts.
• We only receive personal data from you when you send us an inquiry, write to us or book an appointment.
• The statement “Your data stays in the EU” on the home page refers to the BusFlow instances we run for coach operators. The details below apply to this website.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a page, the server processes technically necessary data: IP address, date and time, the requested address, the previously visited page (referrer), browser and operating system, and an approximate location derived from the IP address.

The purpose is to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website. Vercel processes the data on our behalf. For the transfer to the USA, the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework applies (Art. 45 GDPR), under which Vercel is certified.

4. Visitor statistics

To see how many visitors the website has and which pages they read, we use Vercel Web Analytics, a service of our hosting provider Vercel Inc. (address in section 3). The service does not use cookies. Visitors are distinguished by a hash calculated from the request, which is discarded after 24 hours; IP addresses are not stored for the statistics.

The following is recorded: time, page opened, previously visited page (referrer), filtered URL parameters, approximate location (country, region, city), operating system, browser and device type. We only see aggregated figures; we cannot tell who an individual visitor is.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the website based on how it is used. For the transfer to the USA, the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework applies (Art. 45 GDPR). You can object to the recording, for example by disabling JavaScript or using a content blocker.

5. Inquiry for a first meeting

When you use our inquiry form, we process your details: company name, full name, email address, optionally phone number and country of head office, details about your coach business (number of coaches, services, how you create offers today, desired start, what you already have), your preferred way of talking and your note.

The purpose is to process your inquiry and prepare the first meeting. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and your consent under Art. 6(1)(a) GDPR, which you give with the checkbox in the form. You can withdraw your consent at any time with effect for the future, for example by email to info@flow-solutions.hr.

Sending via Formspree

The form sends your details to our inbox via the service Formspree (Formspree, Inc., USA). Formspree stores the submitted inquiry on Amazon Web Services servers in the USA and processes it on our behalf. The transfer to the USA is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

If automatic sending fails, your email program opens with a prepared message to us. You send that message yourself, through your own email provider.

Temporary storage in your browser

So that your answers are not lost between the two steps, your browser keeps them in session storage (sessionStorage), starting with the first step on the home page. Nothing is sent to us in the process. After successful sending the storage is cleared, otherwise at the latest when you close the tab. This storage is strictly necessary for the inquiry you requested, so it does not require consent.

Required details and retention

Required fields are marked in the form; without them we cannot process the inquiry. All other details are voluntary. We delete the inquiry once it has been fully dealt with and no statutory retention obligations prevent it. If we conclude a contract, the retention periods under commercial and tax law apply.

6. Email

We run our mailbox info@flow-solutions.hr on Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). When you write to us or we reply to your inquiry, Microsoft processes the messages on our behalf. The legal basis is Art. 6(1)(b) GDPR, and for general inquiries Art. 6(1)(f) GDPR. A transfer to Microsoft Corporation in the USA cannot be ruled out; it is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

7. Booking an appointment and the conversation

The “Book an online meeting” button takes you to Microsoft Bookings. There you enter your name, email address and optionally your phone number and a note. Microsoft processes this data on our behalf so that we can confirm the appointment. We hold the conversation via Microsoft Teams or by phone. The legal basis is Art. 6(1)(b) GDPR. More in Microsoft's privacy statement.

8. Links to other websites

When you follow a link to another website, for example mikanovic.de, that provider's privacy policy applies there.

9. Your rights

At any time you have the following rights:

• access to your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR).

To exercise them, write to info@flow-solutions.hr.

10. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. You can also contact the supervisory authority in the country where you live or work.

11. Encryption

This website is only delivered over an encrypted connection (HTTPS). The inquiry form also sends your details encrypted.

12. No automated decision-making

We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles.

13. Changes

We update this policy when the website or the law changes.

As of: September 2026