Privacy Policy

‍Last updated: 14 March 2026.

1. Controller

FlowAway
Lena Bludau
Zollhof 7
90443, Nürnberg, Germany
Email: info@flowaway.org
Website: flowaway.org

2. Overview

FlowAway is a digital marketplace connecting users with independent yoga teachers, wellness facilitators, and movement coaches across Europe. This privacy policy explains what personal data we collect, why we collect it, how we process it, and what rights you have.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Bundesdatenschutzgesetz (BDSG).

3. Data We Collect

From Participants (Users who book sessions)

‍Name and email address – To confirm your booking and communicate with you about your session. Legal basis: Art. 6(1)(b) GDPR (contract performance).

‍Payment information – Processed by our payment providers Stripe and PayPal. FlowAway does not store your credit card or bank details. Legal basis: Art. 6(1)(b) GDPR (contract performance).

‍Booking history – To manage your orders and process any refunds. Legal basis: Art. 6(1)(b) GDPR (contract performance).

‍IP address and browser data – Collected automatically for website functionality and security. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

‍Health information: After booking, Teachers may optionally collect health information (e.g., injuries, pregnancy) via a form. This data is stored on the FlowAway platform and made visible to the Teacher. Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 9(2)(a) GDPR (explicit consent of the participant via the form).

From Teachers

‍Name, email address, and phone number – To manage your account and communicate with you. Legal basis: Art. 6(1)(b) GDPR (contract performance).

‍Bank or PayPal details – To process payouts. Legal basis: Art. 6(1)(b) GDPR (contract performance).

‍Tax ID / Steuernummer – For legal and tax compliance. Legal basis: Art. 6(1)(c) GDPR (legal obligation).

‍Photos, bio, certifications, and social media links – To display your profile on the platform. Legal basis: Art. 6(1)(b) GDPR (contract performance).

4. How We Use Your Data

We use personal data exclusively for:

- Providing and operating the FlowAway marketplace
- Processing bookings and payments
- Communicating with Users and Teachers about their bookings
- Fulfilling legal obligations (e.g., tax, accounting)

‍We do not sell your data. We do not share personal data with third parties for advertising purposes.

5. Data Sharing

We share personal data only with the following categories of recipients, and only to the extent necessary.

With Teachers

When a User books a session, the Teacher receives the User's name and email address for the purpose of session delivery. Teachers are required to handle this data in compliance with GDPR.

With Payment Processors

Payment information is processed by Stripe, Inc. (USA) and PayPal (Europe) S.à r.l. (Luxembourg). These processors handle payment data under their own privacy policies and Data Processing Agreements.

Stripe: https://stripe.com/privacy
PayPal: https://www.paypal.com/webapps/mpp/ua/privacy-full

With Service Providers (Data Processors)

We use the following service providers to operate the platform. Each processes data on our behalf under a Data Processing Agreement (DPA) or Standard Contractual Clauses (SCCs) where applicable.

‍Website and hosting: Webflow, Inc. (USA) – website hosting and CMS. webgo GmbH (Germany) – domain and DNS management.

Communication: Google LLC (USA) – email sending via Gmail.

‍Payments: Stripe, Inc. (USA) – payment processing. PayPal (Europe) S.à r.l. (Luxembourg, EU) – payment processing.

‍Teacher dashboard: Softr (EU) – teacher-facing admin interface.

For US-based providers, data transfers are protected by Standard Contractual Clauses (SCCs) as per Art. 46(2)(c) GDPR, and/or the EU-US Data Privacy Framework where applicable.

Analytics and Marketing: Google Ireland Limited (Ireland) / Google LLC (USA) – website analytics via Google Analytics 4. Meta Platforms Ireland Ltd. (Ireland) / Meta Platforms, Inc. (USA) – conversion tracking and advertising measurement via the Meta Pixel.

6. Cookies

FlowAway uses cookies and similar tracking technologies on our website. We distinguish between technically necessary cookies and cookies that require your consent.

‍Technically necessary cookies
‍These are required for the website to function (e.g., session management, security, consent preferences). They are set on the basis of Art. 6(1)(f) GDPR (legitimate interest) and § 25(2) TTDSG. No consent is required.

‍Cookies and tracking requiring consent
‍The following tools are only activated after you give your explicit consent via our cookie consent banner. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG. You can withdraw your consent at any time with effect for the future via the cookie settings on our website.

‍Google Analytics 4 (GA4)
‍We use Google Analytics 4, a web analytics service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse how users interact with our website. The information generated (including a shortened IP address) is transmitted to and stored by Google on servers that may be located in the United States.We use GA4 with IP anonymization enabled, meaning your IP address is truncated within the EU before being transmitted. We have concluded a Data Processing Agreement with Google in accordance with Art. 28 GDPR. Transfers to the USA are safeguarded by Standard Contractual Clauses (Art. 46(2)(c) GDPR) and Google's certification under the EU-US Data Privacy Framework.The data collected is used to understand how visitors use our website so we can improve it. Data is retained for 14 months. You can find more information in Google's privacy policy at https://policies.google.com/privacy and opt out via the Google Analytics Opt-Out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

‍Meta Pixel (Facebook Pixel)
‍We use the Meta Pixel, a service provided by Meta Platforms Ireland Ltd. ("Meta"), Merrion Road, Dublin 4, Ireland. The Meta Pixel enables us to measure the effectiveness of our advertising on Facebook and Instagram by recording actions you take on our website (e.g., page views, bookings) and to display relevant ads to you and similar audiences on Meta platforms.The Meta Pixel establishes a direct connection to Meta's servers when it loads. Meta may receive information including your IP address, browser details, and events you trigger on our site. This data may be transmitted to servers in the United States. Transfers to the USA are safeguarded by Standard Contractual Clauses (Art. 46(2)(c) GDPR) and Meta's certification under the EU-US Data Privacy Framework.With regard to the collection of data via the Meta Pixel and its transmission to Meta, FlowAway and Meta are joint controllers within the meaning of Art. 26 GDPR. The joint controller agreement between FlowAway and Meta is available at https://www.facebook.com/legal/controller_addendum. For all subsequent processing carried out by Meta, Meta is solely responsible.You can find more information in Meta's privacy policy at https://www.facebook.com/privacy/policy. You can also manage your ad preferences at https://www.facebook.com/settings?tab=ads.

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy.

‍Booking and transaction data – 10 years after the calendar year of the transaction, as required by German tax law (§147 AO, §257 HGB).

‍Teacher data – For the duration of the contractual relationship, plus 10 years for tax and legal obligations.

9. Your Rights

Under the GDPR, you have the following rights:

‍Right of access (Art. 15) – You can request information about what personal data we process about you.

‍Right to rectification (Art. 16) – You can request correction of inaccurate data.

‍Right to erasure (Art. 17) – You can request deletion of your data, unless we are legally required to retain it.

‍Right to restriction (Art. 18) – You can request that we limit how we process your data in certain circumstances.

‍Right to data portability (Art. 20) – You can request your data in a structured, machine-readable format.

‍Right to object (Art. 21) – You can object to processing based on legitimate interest at any time.

‍Right to withdraw consent (Art. 7(3)) – Where processing is based on consent (e.g., newsletter), you can withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at: info@flowaway.org. We will respond within 30 days.

‍Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for FlowAway is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (TLS/SSL), encryption of data at rest by our service providers, access controls limiting who can view personal data, and SPF, DKIM, and DMARC email authentication.

11. Changes to This Policy

We may update this privacy policy from time to time. The current version is always available at flowaway.org/privacy-policy.