Privacy policy

Who is responsible for your data

CompFlow is the data controller for personal data processed through this website and in the course of our consultancy work. You can reach us for any privacy matter using the details below; we aim to respond to every request within one month, as required by Article 12(3) GDPR.

What we collect and why

We do not collect special categories of personal data (Article 9 GDPR), we do not knowingly collect data from children, and we do not carry out automated decision-making or profiling that produces legal effects for you.

Google Analytics 4

With your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Analytics cookies and identifiers are only set after you accept the analytics category in our cookie banner — nothing is loaded before that. Consent is the legal basis (Article 6(1)(a) GDPR) and you may withdraw it at any time.

We have a Data Processing Addendum in place with Google under Article 28 GDPR. You can also install the Google Analytics Opt-out Browser Add-on to prevent measurement across all websites.

Google Ads and conversion measurement

If you accept the marketing category, we may use Google Ads to measure the effectiveness of our advertising and to show relevant ads on Google's network. This can involve a conversion cookie, remarketing lists, and — where enabled — enhanced conversions, in which a hashed version of an identifier you submitted (such as your email address) is transmitted to Google in irreversible form.

In this context Google acts partly as our processor and partly as an independent controller. Google's own handling of data is described in the Google Privacy Policy; you can manage ad personalisation at Google Ad Settings.

Google Consent Mode v2

Our banner implements Google Consent Mode v2. On first load all four consent signals — analytics_storage, ad_storage, ad_user_data and ad_personalization — default to denied. Google tags are only granted storage access once you make an affirmative choice. Rejecting is as easy as accepting, no dark patterns are used, and no non-essential tag fires beforehand.

Transfers outside the EEA

Data processed by Google may be transferred to servers in the United States. Such transfers rely on the EU–US Data Privacy Framework, under which Google LLC is certified, and on the European Commission's Standard Contractual Clauses together with supplementary technical measures such as encryption in transit and at rest. Despite these safeguards, a transfer to a third country may carry residual risk — for example access requests by local authorities. Where transfers depend on your consent, that consent also covers this transfer under Article 49(1)(a) GDPR.

How long we keep data

Your rights under the GDPR

To exercise any right, email info@compflow.eu. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Kifissias 1-3, 11523 Athens, dpa.gr) or with the supervisory authority of your EU country of residence.

How we protect your data

All project work is carried out exclusively by CompFlow personnel at company premises and is never outsourced, under strict bidirectional non-disclosure agreements. Technical measures include TLS encryption for the website, access control on our computing facilities, and encrypted storage of project data. Access to personal data is limited to staff who need it to perform their role.

Updates to this policy

We review this policy whenever our processing changes and at least annually. Material changes affecting the basis on which we process your data will be announced on this page, and where consent is required we will ask for it again before any new processing begins.