Let's Talk

Legal

Privacy Policy

Leadflow Consulting FZCO
IFZA Business Park, DDP, Premises Number 62412-001
Dubai Silicon Oasis, Dubai, United Arab Emirates · PO Box 342001
Email: info [at] lukaslanx [dot] com
Last updated: September 2026

1. Data Controller

The data controller within the meaning of the GDPR is Leadflow Consulting FZCO, IFZA Business Park, DDP, Premises Number 62412-001, Dubai Silicon Oasis, Dubai, UAE. Email: info [at] lukaslanx [dot] com

The company is operated from the UAE. For users in the EU/EEA, the GDPR applies pursuant to Art. 3(2) (targeting principle).

2. Principles of Data Processing

We only process personal data to the extent necessary to provide our website and services. Legal bases:

This website does not use tracking or analytics (see section 10).

3. Hosting (Cloudflare)

Our website is hosted by: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

When you visit the site, Cloudflare processes: IP address, date/time, requested URL, HTTP status, browser/OS information. Legal basis: Art. 6(1)(f) GDPR. Data transfer is based on EU Standard Contractual Clauses (SCCs). More info: cloudflare.com/privacypolicy.

4. Email Communication (Hetzner)

Business emails are processed via Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Storage exclusively in Germany. Legal basis: Art. 6(1)(f) GDPR.

5. Scheduling (Calendly)

For discovery calls we use Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA. Data processed: name, email, requested time slot, form details. Legal basis: Art. 6(1)(b) GDPR. Data transfer based on SCCs. More info: calendly.com/legal/privacy-notice.

The booking widget is loaded from Calendly's servers as soon as you use the scheduling feature on our site. In the process, your IP address is transmitted to Calendly. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in simple appointment scheduling.

6. Online Meetings (Google Meet)

For client meetings we use Google Ireland Limited, Gordon House, Barrow Street, Dublin 4. Data processed: name, email, IP address, device data, meeting metadata, audio/video data. Legal basis: Art. 6(1)(b) GDPR. Transfer to the USA based on SCCs.

7. Meeting Recordings (Fireflies.ai)

For transcriptions we use Fireflies.ai, Inc. (USA). Participants are informed in advance. Legal basis: Art. 6(1)(a) + (b) GDPR. Transfer to the USA based on SCCs. More info: fireflies.ai/privacy-policy.

8. Accounting (Zoho)

For invoicing and contract management we use Zoho Corporation Pvt. Ltd. Data processed: name, contact details, invoicing and payment information. Legal basis: Art. 6(1)(b) + (c) GDPR. The data is stored in a data centre in the USA, transfer is based on SCCs. A data processing agreement is in place. More info: zoho.com/privacy.

9. Access to Microsoft and Google Accounts for Our Services

For certain services, clients can voluntarily connect their Microsoft 365 or Google Workspace account via an OAuth connection. Depending on what the client authorizes, we access: emails (read and send for Microsoft, send-only for Google), calendar entries, contacts, and files in Drive, Sheets, Docs, or OneDrive and SharePoint that the client grants access to for that use.

This data is processed exclusively to provide the features the client has booked, for example displaying appointments, sending emails on the client's behalf, or displaying and editing documents. Legal basis is Art. 6(1)(b) GDPR (performance of a contract). This data is not shared with or sold to third parties.

Access tokens are stored encrypted. The client can revoke the connection at any time via their Microsoft or Google account security settings; no further access is possible after revocation.

10. Cookies and Tracking

Our website does not set any analytics or marketing cookies and does not use tracking services (no Google Analytics, no Meta Pixel, no LinkedIn Insight Tag). Only the technically necessary data required to deliver the site is processed (see section 3). A cookie banner is therefore not required. Fonts are served from our own server, no connection to Google Fonts is made. For embedded videos on individual subpages, see section 14.

11. Newsletter and Free Downloads (get.lukaslanx.com)

On our campaign pages at get.lukaslanx.com you can request free materials and subscribe to our newsletter. Data processed: email address, name, chosen language, campaign, time of sign-up and of confirmation. Sign-up uses a double opt-in procedure, you are added to the list only after confirming by email. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the unsubscribe link in every email or by contacting us.

Contact data is stored with Supabase Inc., 970 Toa Payoh North, Singapore, in a data centre in Frankfurt am Main (EU). Confirmation, download and newsletter emails are sent via Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France. The pages themselves are delivered through Cloudflare (see section 3). Both providers are bound as processors under Art. 28 GDPR. More info: supabase.com/privacy, brevo.com/legal/privacypolicy.

12. Business Outreach and Contact Data Research

To prepare business contacts we process professional contact data of decision makers in companies (name, position, company, business email address, phone number, LinkedIn profile). The data comes from publicly accessible sources such as company websites, commercial registers and professional networks, and from the B2B database Apollo.io (ZenLeads Inc., 440 N Barranca Ave #4750, Covina, CA 91723, USA). Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in approaching suitable companies in a B2B context. Data transfer to the USA is based on SCCs. More info: apollo.io/privacy-policy.

This notice fulfils our obligation under Art. 14 GDPR towards persons whose data we did not collect from them directly. You may object to this processing at any time (Art. 21 GDPR), a short message to the address given in section 1 is sufficient. Your data will then no longer be used for outreach.

13. AI-assisted Processing

When handling enquiries, proposals and client projects, texts may be processed by AI systems. Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest). We process special categories of personal data under Art. 9 GDPR with these systems only on the basis of a separate agreement. Providers used:

14. Embedded Videos

Individual subpages (client areas, demos) contain embedded videos from Vimeo (Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA). When these pages are opened and the videos are played, data, in particular your IP address, is transmitted to Vimeo. Transfer safeguard: Vimeo is certified under the EU-U.S. Data Privacy Framework, with SCCs applying in addition. Legal basis: Art. 6(1)(f) GDPR. The videos on the About page are self-hosted and delivered through the same infrastructure as this website (see section 3). No data is transmitted to any further third parties in the process.

15. Data Transfer to the UAE

As a Dubai-based company, we process certain data in the UAE. Since no EU adequacy decision exists, the transfer relies on Art. 46 GDPR (SCCs) or Art. 49(1)(b) GDPR (performance of a contract).

16. Retention Period

Personal data is deleted once the purpose of processing no longer applies. Tax-relevant records are subject to a statutory retention period of 7 years.

17. Your Rights (GDPR)

Requests to: info [at] lukaslanx [dot] com

Last updated: September 2026, Leadflow Consulting FZCO