Privacy
Privacy statement
In Flow Institute processes personal data with care and in line with the General Data Protection Regulation (GDPR, in Dutch the AVG). This statement explains what we collect, why, and what rights you have.
Last updated: September 2026
Who is responsible
In Flow Institute. For privacy questions, contact welcome@inflow-institute.com.
What we collect
Through the contact form we collect your name, email address, organisation, role and the content of your message. Through the newsletter and retreat waitlist we collect your email address. Our hosting provider processes technical data such as IP address and browser type in server logs.
Why we process it
To answer your enquiry and to prepare or perform an agreement, on the legal basis of your request and our legitimate interest in running the institute. Newsletter and waitlist emails are processed on the basis of your consent, which you can withdraw at any time.
How long we keep it
Enquiry data is kept no longer than necessary to answer your enquiry and to maintain the contact that follows from it. Newsletter and waitlist data is kept until you unsubscribe. Financial records are kept for seven years, as Dutch tax law requires.
Who we share it with
We share data only with processors that support the website and our communication, such as our hosting and database provider and our email provider. Each has a data processing agreement with us. We do not sell personal data.
Your rights
You may request access to, correction of, or deletion of your data, restrict or object to processing, and request data portability. Send your request to welcome@inflow-institute.com. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Security
Data is transmitted over an encrypted connection and stored with access controls. If a data breach occurs, we act in line with our legal obligations.
