Privacy notice.

Last updated: 11 October 2026

Who is responsible

StepOneFlow, operated by Kristian Sainovic in Belgium, is responsible for the personal data described here (the "controller" under the GDPR). For any privacy question, email kristiansainovic@gmail.com.

What we collect, and why

When	What	Why and legal basis
You email us, or send the chat, task or booking form	Your name, email address, company, phone number if you give it, your message and the times you choose	To answer you, schedule a call and prepare a proposal. Steps you ask for before a possible contract (GDPR art. 6(1)(b)) and our legitimate interest in answering enquiries (art. 6(1)(f)).
We have a call	Your name and email address in the Microsoft Teams invite, or your phone number for a phone call	To hold the call you asked for (art. 6(1)(b)). Calls are not recorded.
You become a client	Contact and billing details, contracts and invoices	To deliver the work and meet accounting and tax obligations (art. 6(1)(b) and (c)).
You visit the site	Technical data such as IP address, browser and time of the request, in the hosting provider's server logs	To keep the site secure and working (art. 6(1)(f)). Kept for a short period only.

The chat on this site

The chat assistant runs entirely in your browser and answers from a fixed list of questions. What you type is not sent anywhere and is not stored. Only if you choose "Send to the team" does your email app open with the message, which you then send yourself.

Cookies and tracking

This site sets no cookies and uses no analytics, advertising or tracking tools. Fonts are hosted on the site itself, so no data goes to font services.

Who else sees your data

We never sell your data. We use a few service providers who process data on our behalf, under data-processing terms:

• Our email provider, which stores the emails you send us.
• Microsoft, for Teams video calls and calendar invites.
• The company that hosts this website, for the server logs above.
• Our accountant, for invoices once you are a client.

Some of these providers may process data outside the European Economic Area. In that case the transfer is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Enquiries that do not lead to work: deleted within two years of the last contact.
• Client records, contracts and invoices: as long as Belgian accounting and tax law requires.
• Server logs: a short period, set by the hosting provider.

Your rights

You can ask to see, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Email kristiansainovic@gmail.com and we answer within one month.

You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be.

Changes

If we change how we handle data, we update this page and the date at the top.