Privacy policy

Last updated: 14 September 2026

1. Controller and Contact Details

This Privacy Policy describes how Flowstate Capital GmbH (operating under the trade name "Flow Estate") processes personal data of visitors to its website and users of its contact form.

Legal entity: Flowstate Capital GmbH Trade name: Flow Estate Address: Heinzenbergstrasse 1, 7421 Summaprada, Graubünden, Switzerland Commercial register / UID: CHE-175.192.007 VAT number: CHE-175.192.007 MWST E-mail: j.vanuden@flowstates.capital

For any questions regarding this Privacy Policy or the processing of your personal data, you can contact us at j.vanuden@flowstates.capital.

2. Scope and Applicable Law

Flowstate Capital GmbH is established in Switzerland. Processing of personal data is therefore governed primarily by the Swiss Federal Act on Data Protection (revFADP). Where visitors from the European Union or European Economic Area are concerned, the General Data Protection Regulation (GDPR) applies in addition, to the extent it is applicable to our processing activities.

3. Personal Data We Process

We process the following categories of personal data:

  • Contact form data: name, e-mail address, organisation, and the content of your message, when you voluntarily submit these through our contact form.
  • Technical access logs: technical access logs generated by our hosting provider in the course of operating the website (e.g., in connection with server requests).

We do not collect any other personal data beyond what is listed above, and we do not knowingly request sensitive personal data through our website.

4. Purposes of Processing

We process the personal data described above for the following purposes:

  • To respond to inquiries submitted through the contact form and to communicate with you regarding your organisation and message.
  • To operate, maintain, and secure our website, including through the technical access logs generated by our hosting provider.

5. Legal Basis for Processing

Under the Swiss FADP, processing is carried out in accordance with the general principles of lawfulness, good faith, and proportionality, based on your voluntary submission of information via the contact form and our legitimate interest in operating and securing our website.

Where the GDPR applies, our legal bases for processing are:

  • Article 6(1)(b) GDPR – processing necessary to respond to your inquiry, which you initiate by contacting us.
  • Article 6(1)(f) GDPR – our legitimate interest in ensuring the functionality, security, and proper operation of our website (technical access logs).

6. Recipients and Processors

We engage the following processors to support the operation of our website and the handling of contact form submissions:

  • Vercel Inc. – provides website hosting services.
  • Supabase (via Lovable Cloud) – provides storage of contact form submissions.

These providers process personal data on our behalf and in accordance with our instructions. We have taken appropriate contractual measures with our processors to ensure the protection of your personal data.

7. Hosting and Location of Data Processing

Our website is hosted on the Vercel global edge network. Contact form data is stored in a Supabase cloud database. As a result, personal data may be processed and stored in data centres located outside Switzerland, including potentially outside the European Economic Area, depending on the infrastructure used by our hosting and storage providers.

Where personal data is transferred outside Switzerland or the EEA, we take appropriate measures to ensure a level of data protection consistent with Swiss and, where applicable, European data protection requirements.

8. Data Retention

We retain personal data submitted via the contact form only for as long as necessary to respond to your inquiry and for any legitimate follow-up correspondence. Technical access logs generated by our hosting provider are retained in accordance with the retention practices of that provider.

9. Your Rights

Depending on the applicable law, you may have the following rights in relation to your personal data:

  • The right to request access to the personal data we hold about you.
  • The right to request rectification of inaccurate personal data.
  • The right to request erasure of your personal data.
  • The right to request restriction of processing.
  • The right to object to processing based on legitimate interests.
  • Where applicable under the GDPR, the right to data portability.

To exercise any of these rights, please contact us at j.vanuden@flowstates.capital.

If you are located in Switzerland, you also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC). If you are located in the European Union or European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority.

10. Data Security

We take reasonable technical and organisational measures to protect the personal data we process against unauthorised access, loss, misuse, or alteration, taking into account the nature of the data and the risks associated with its processing.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date of the last update is indicated below.

Last updated: 2026-09-14

Flowstate Capital GmbH · CHE-175.192.007 · CHE-175.192.007 MWST