Privacy policy

1. Controller

Represented by Filip Radotović, Managing Director. Further details are in the legal notice.

2. In brief

• We don't use cookies or tracking tools. We measure the number of visits anonymously with Cloudflare Web Analytics (section 4).
• The fonts are hosted on our server; the website does not connect to Google Fonts.
• The demo calculator on the home page only requests place search, route and map from third-party services once you use it; nothing is sent to us in the process (section 5).
• We only receive personal data from you when you send us an inquiry, write to us or book an appointment.
• The statement “Your data stays in the EU” on the home page refers to the BusFlow instances we run for coach operators. The details below apply to this website.

3. Hosting and server log files

This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages) and delivered through Cloudflare's network. When you open a page, the server processes technically necessary data: IP address, date and time, the requested address, the previously visited page (referrer), browser and operating system, and an approximate location derived from the IP address.

The purpose is to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website. Cloudflare processes the data on our behalf. For the transfer to the USA, the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework applies (Art. 45 GDPR), under which Cloudflare is certified.

4. Visitor statistics

To see how many visitors the website has and which pages they read, we use Cloudflare Web Analytics, a service of our hosting provider Cloudflare, Inc. (address in section 3). The service does not use cookies and stores nothing in your browser. Individual visitors are not recognised: no profile or fingerprint is built from the IP address, the browser identifier or any other data.

The following is recorded: time, page opened, previously visited page (referrer), the country derived from the IP address, operating system, browser and device type, and page load times. We only see aggregated figures; we cannot tell who an individual visitor is.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the website based on how it is used. For the transfer to the USA, the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework applies (Art. 45 GDPR). You can object to the recording, for example by disabling JavaScript or using a content blocker.

5. Demo calculator

In the “What gets faster” section of our home page you can price a coach trip with your own sample rates. As long as you enter nothing there, no connection is made to the services listed below. Only when you type a place or click “Calculate the fare” does your browser send requests directly to these services:

• Place search: Photon (komoot GmbH, Germany). The place names you enter (from the third character, as you type), your IP address and browser details are transmitted. komoot privacy policy
• Route: the public OSRM demo server router.project-osrm.org, operated by FOSSGIS e.V. (Germany). The coordinates of departure and destination, your IP address and browser details are transmitted.
• Map: map tiles from tile.openstreetmap.org of the OpenStreetMap Foundation (Cambridge, United Kingdom). The displayed map section, your IP address and browser details are transmitted. For the United Kingdom, an adequacy decision of the European Commission applies (Art. 45 GDPR). OpenStreetMap Foundation privacy policy

These providers process the data under their own responsibility and their own privacy policies. We receive neither data nor reports from them.

Passengers, dates, trip type and your sample rates stay in your browser. The browser keeps the sample rates in session storage (sessionStorage) so they are still there for the next calculation; they are deleted at the latest when you close the tab. Nothing is sent to us. We serve the Leaflet map library from our own server.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show you the calculation you triggered yourself. If you do not want to send data to these services, do not use the demo calculator; everything else on the website works without it.

6. Inquiry for a first meeting

When you use our inquiry form, we process your details: company name, full name, email address, optionally phone number and country of head office, details about your coach business (number of coaches, services, how you create offers today, desired start, what you already have), your preferred way of talking and your note.

The purpose is to process your inquiry and prepare the first meeting. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and your consent under Art. 6(1)(a) GDPR, which you give with the checkbox in the form. You can withdraw your consent at any time with effect for the future, for example by email to info@flow-solutions.hr.

Sending via Formspree

The form sends your details to our inbox via the service Formspree (Formspree, Inc., USA). Formspree stores the submitted inquiry on Amazon Web Services servers in the USA and processes it on our behalf. The transfer to the USA is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

If automatic sending fails, your email program opens with a prepared message to us. You send that message yourself, through your own email provider.

Temporary storage in your browser

So that your answers are not lost between the two steps, your browser keeps them in session storage (sessionStorage), starting with the first step on the home page. Nothing is sent to us in the process. After successful sending the storage is cleared, otherwise at the latest when you close the tab. This storage is strictly necessary for the inquiry you requested, so it does not require consent.

Required details and retention

Required fields are marked in the form; without them we cannot process the inquiry. All other details are voluntary. We delete the inquiry once it has been fully dealt with and no statutory retention obligations prevent it. If we conclude a contract, the retention periods under commercial and tax law apply.

7. Email

We run our mailbox info@flow-solutions.hr on Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). When you write to us or we reply to your inquiry, Microsoft processes the messages on our behalf. The legal basis is Art. 6(1)(b) GDPR, and for general inquiries Art. 6(1)(f) GDPR. A transfer to Microsoft Corporation in the USA cannot be ruled out; it is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

8. Booking an appointment and the conversation

The “Book an online meeting” button takes you to Microsoft Bookings. There you enter your name, email address and optionally your phone number and a note. Microsoft processes this data on our behalf so that we can confirm the appointment. We hold the conversation via Microsoft Teams or by phone. The legal basis is Art. 6(1)(b) GDPR. More in Microsoft's privacy statement.

9. Links to other websites

When you follow a link to another website, for example mikanovic.de, that provider's privacy policy applies there.

10. Your rights

At any time you have the following rights:

• access to your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR).

To exercise them, write to info@flow-solutions.hr.

11. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. You can also contact the supervisory authority in the country where you live or work.

12. Encryption

This website is only delivered over an encrypted connection (HTTPS). The inquiry form also sends your details encrypted.

13. No automated decision-making

We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles.

14. Changes

We update this policy when the website or the law changes.

As of: October 2026