Leadflow Consulting FZCO
IFZA Business Park, DDP, Premises Number 62412-001
Dubai Silicon Oasis, Dubai, United Arab Emirates · PO Box 342001
Email: me [at] lukaslanx [dot] com
Last updated: May 2026
1. Data Controller
The data controller within the meaning of the GDPR is Leadflow Consulting FZCO, IFZA Business Park, DDP, Premises Number 62412-001, Dubai Silicon Oasis, Dubai, UAE. Email: me [at] lukaslanx [dot] com
The company is operated from the UAE. For users in the EU/EEA, the GDPR applies pursuant to Art. 3(2) (targeting principle).
2. Principles of Data Processing
We only process personal data to the extent necessary to provide our website and services. Legal bases:
- Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures
- Art. 6(1)(f) GDPR — legitimate interest
- Art. 6(1)(a) GDPR — consent (for tracking and analytics)
3. Hosting (Cloudflare)
Our website is hosted by: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.
When you visit the site, Cloudflare processes: IP address, date/time, requested URL, HTTP status, browser/OS information. Legal basis: Art. 6(1)(f) GDPR. Data transfer is based on EU Standard Contractual Clauses (SCCs). More info: cloudflare.com/privacypolicy.
4. Email Communication (Hetzner)
Business emails are processed via Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Storage exclusively in Germany. Legal basis: Art. 6(1)(f) GDPR.
5. Scheduling (Calendly)
For discovery calls we use Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA. Data processed: name, email, requested time slot, form details. Legal basis: Art. 6(1)(b) GDPR. Data transfer based on SCCs. More info: calendly.com/privacy.
6. Online Meetings (Google Meet)
For client meetings we use Google Ireland Limited, Gordon House, Barrow Street, Dublin 4. Data processed: name, email, IP address, device data, meeting metadata, audio/video data. Legal basis: Art. 6(1)(b) GDPR. Transfer to the USA based on SCCs.
7. Meeting Recordings (Fireflies.ai)
For transcriptions we use Fireflies.ai, Inc. (USA). Participants are informed in advance. Legal basis: Art. 6(1)(a) + (b) GDPR. Transfer to the USA based on SCCs. More info: fireflies.ai/privacy.
8. Accounting (Zoho)
For invoicing and contract management we use Zoho Corporation Pvt. Ltd. Data processed: name, contact details, invoicing and payment information. Legal basis: Art. 6(1)(b) + (c) GDPR. A data processing agreement is in place. More info: zoho.com/privacy.
9. Access to Microsoft and Google Accounts for Our Services
For certain services, clients can voluntarily connect their Microsoft 365 or Google Workspace account via an OAuth connection. Depending on what the client authorizes, we access: emails (read and send for Microsoft, send-only for Google), calendar entries, contacts, and files in Drive, Sheets, Docs, or OneDrive and SharePoint that the client grants access to for that use.
This data is processed exclusively to provide the features the client has booked, for example displaying appointments, sending emails on the client's behalf, or displaying and editing documents. Legal basis is Art. 6(1)(b) GDPR (performance of a contract). This data is not shared with or sold to third parties.
Access tokens are stored encrypted. The client can revoke the connection at any time via their Microsoft or Google account security settings; no further access is possible after revocation.
10. Cookies and Consent
Our website uses technically necessary cookies for operation. Analytics and marketing services (Google Analytics 4, Meta Pixel, LinkedIn Insight Tag) are only activated after explicit consent via the cookie banner. Consent can be withdrawn at any time.
11. Data Transfer to the UAE
As a Dubai-based company, we process certain data in the UAE. Since no EU adequacy decision exists, the transfer relies on Art. 46 GDPR (SCCs) or Art. 49(1)(b) GDPR (performance of a contract).
12. Retention Period
Personal data is deleted once the purpose of processing no longer applies. Tax-relevant records are subject to a statutory retention period of 7 years.
13. Your Rights (GDPR)
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawal of consent at any time with effect for the future
Requests to: me [at] lukaslanx [dot] com
Last updated: May 2026 — Leadflow Consulting FZCO