This policy explains how ThomasMedia handles personal information in connection with the Retention Flow website and services.
1. Who we are
ThomasMedia is a Dutch sole proprietorship, registered with the Chamber of Commerce under number 89782771. Address: Zaanenlaan 191, 2023 SM Haarlem, the Netherlands. ThomasMedia is the service provider behind this website and the controller for the processing described below. Retention Flow is not a separate legal entity.
Website: www.retentionflow.co. For privacy questions and requests, contact hello@retentionflow.co.
2. Information and purposes
Enquiries and appointments. We process the name, business details, contact details, appointment information and messages you provide to respond and arrange conversations. For an individual entering a business contract, the basis is taking requested steps before a contract. For representatives of companies, it is our legitimate interest in responding to business enquiries and maintaining business relationships.
Client services. We use business contact details, project instructions, approvals, correspondence and necessary account-access information to deliver agreed work. The basis is contract performance for individual business clients, and our legitimate interest in providing services and communicating with representatives for company clients. Use platform access invitations rather than sending passwords by email.
Billing. We process billing details, invoices and payment records for contract performance and compliance with tax and accounting obligations.
Applications. We process contact details, CVs, portfolios and correspondence to assess applications and communicate with applicants. The basis is steps towards a possible contract and, where applicable, our legitimate interest in recruitment. Keeping an unsuccessful application for future vacancies requires separate consent.
Website delivery and security. Hosting systems may process IP addresses, requested pages, timestamps, browser details and error or security records. The purpose is delivering the website, resolving faults and protecting it against misuse, based on our legitimate interest in operating a secure service.
3. Client customer data
When working in a client's Klaviyo account, we may handle subscriber details, consent status, purchase history and email activity under that client's instructions. The client generally acts as controller, and ThomasMedia acts as processor where it works solely on the client's behalf. This processing is governed by a separate data processing agreement, not this website policy alone.
If you are a customer of one of our clients, contact that brand about your data. We assist the client with applicable requests under the relevant agreement.
4. Providers and recipients
Information is shared where necessary for the relevant service or a legal obligation. GoDaddy supplies hosting and business email. Calendly provides the embedded booking calendar and processes appointment information. WhatsApp handles communications when you choose that contact method. Klaviyo is used in client email-marketing projects, subject to the client's account arrangements.
Suppliers acting as processors require appropriate processing agreements. Providers may also process information for their own purposes, under their own privacy notices. Social-media links take you to external services; those services receive information when you visit them. Authorities may receive information where disclosure is legally required.
5. International processing
Our providers may process information outside the European Economic Area. Such transfers require an applicable legal basis, for example an adequacy decision covering the recipient or standard contractual clauses and any necessary additional safeguards. The applicable arrangement depends on the provider, service and recipient entity. Contact hello@retentionflow.co for the arrangements applicable to your information and a copy of relevant safeguards, subject to appropriate redactions.
6. How long information is kept
- Enquiries without an engagement: up to 12 months after the last substantive contact, unless an ongoing discussion requires continued retention.
- Unsuccessful applications: four weeks after the recruitment process ends. With separate consent, up to one year for future opportunities, or until consent is withdrawn earlier.
- Client contact details and ordinary project correspondence: throughout the engagement and up to two years afterwards, unless accounting requirements, a dispute or another documented obligation requires longer retention.
- Client-owned personal data: returned or deleted according to the data processing agreement, including arrangements for backup expiry and legally required records.
- Tax and accounting records: generally seven years, calculated under the applicable Dutch fiscal rules, or longer if a specific legal obligation requires it.
- Technical records: only for the operational or security purpose for which they are held. Incident-related records may be retained until investigation and any associated claim are resolved. Hosting-provider records are subject to the applicable service settings and obligations; you can request the relevant details from us.
Information needed for a legal claim may be retained for the applicable claim period. Such retention is limited to the information necessary for that purpose.
7. Cookies and external services
Our own website code does not include advertising pixels, first-party analytics or a newsletter signup form. The illustrated signup example does not collect data. Our booking page embeds Calendly, so opening that page connects your browser to Calendly and shares technical information such as your IP address and browser details. The embedded service may use cookies and similar technologies under Calendly's privacy and cookie settings. See Calendly's Privacy Notice. WhatsApp and social links open external services whose privacy and cookie notices apply there.
The hosting platform may process technical information needed to deliver and protect the website. If we introduce optional analytics, advertising or other non-essential tracking, we will update this notice and request consent where required before it is activated.
8. Your rights
Subject to the applicable conditions, you may request access, correction, deletion, restriction or portability of your information. You may object to processing based on legitimate interests and to direct marketing. Where we rely on consent, you can withdraw it at any time without affecting prior lawful processing.
Email hello@retentionflow.co. We may request proportionate information to verify identity. Do not send a copy of your identity document unless specifically necessary and requested. We generally respond within one month; if a lawful extension is needed, we explain it within that month.
You may complain to the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority.
9. Providing information and updates
You do not have to make an enquiry or application. Without relevant contact and project information, however, we may be unable to respond, assess an application or provide requested work. Certain billing information is required by law.
We update this policy when our processing changes. The version date appears above. Material changes will be communicated where required.