Privacy Policy

Flow State · Rokas Gavenavicius · Balaguer, Lleida, Spain
Last updated: 18 October 2026

This policy explains what personal data Flow State collects, why, who it is shared with, and what you can ask me to do with it. It applies to this website, my email list, my Instagram and other social accounts, and the Flow State Inner Circle community.

I am the data controller. I am a sole trader based in Spain, so I work under the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

1. Who I am

I am a coach, not a clinician. Nothing I publish is medical advice. If pain increases, stop and check with a clinician.

2. What I collect, and why

If you email me or join my list

• Your email address — to reply to you and to send training and updates.
• Your first name, if you give it — so the email is not impersonal.
• Whether you opened or clicked — to know which material is useful.

If you buy something

• Your name and email, and what you bought — to deliver it and to support you.
• Payment is handled by the platform you bought through. I do not see or store your card details. The payment processors are the merchants of record for their own transactions.

If you message me on Instagram, Facebook or Threads

• The content of the message, your username and your platform user ID — to reply.
• Comments you leave and your reaction to them — so I can answer publicly and, where you asked for it, send you a private reply.

If you use this website

• Standard server logs — the page requested, the time, and a truncated IP address, kept briefly for security. No advertising trackers and no third-party analytics pixels are used on this site.

If you tell me about your body

Sometimes you tell me about pain, an injury, or a health condition, because that is the whole subject. Information about your health is a special category under GDPR Article 9. I only process it when you have given me explicit consent by sending it to me for coaching, and I use it only to answer you and to plan your training. I never publish it, never sell it, and never share it with anyone except the processors listed below.

3. The legal basis for each use

What I do	Legal basis
Reply to your message	Legitimate interest (Article 6(1)(f)) — you contacted me first
Send you training and offers by email	Your consent (Article 6(1)(a)), or soft opt-in where you bought something from me
Deliver what you bought and support you	Performance of a contract (Article 6(1)(b))
Coaching that involves health information	Your explicit consent (Article 9(2)(a))
Keep accounting records	Legal obligation (Article 6(1)(c)) — Spanish tax law
Keep the site and accounts secure	Legitimate interest (Article 6(1)(f))

4. Who else sees it

I use a small number of services to run this. Each one only receives what it needs:

Service	What it does	Where
GoHighLevel	CRM, email sending, messages, automations	United States
Skool	The Flow State Inner Circle community	United States
Meta (Instagram, Facebook, Threads)	Social accounts and messaging	Ireland / United States
Google (YouTube, Gmail)	Video platform and email	Ireland / United States
Whop	Some product sales	United States
Make and Cloudflare	Automation plumbing and this website	EU / United States

Where a service is outside the EU, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. I do not sell your data, and I do not share it for anyone else's advertising.

5. How long I keep it

• Email list: until you unsubscribe, then removed from active sending within 30 days.
• Messages: up to 3 years, so I can remember your history if you come back.
• Purchase and tax records: as long as Spanish law requires — currently 4 years for tax purposes, 6 for commercial records.
• Server logs: 30 days.

6. Your rights

You can ask me to:

• Show you what I hold about you, and give you a copy.
• Correct anything wrong.
• Delete it — "the right to be forgotten".
• Stop using it for a particular purpose, including marketing.
• Port it to another service in a machine-readable format.
• Withdraw consent at any time, where consent was the basis.

Email rokasgavenavicius07@gmail.com and I will answer within one month. I will never charge you for exercising a data right.

If you are not satisfied, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos — aepd.es.

7. Deleting your data

You can ask me to delete everything I hold about you, at any time, for any reason, at no cost: see how to request deletion. I confirm within 7 days and delete within 30.

8. Unsubscribing

Every email I send has an unsubscribe link. One click and you are out. You can also reply with the word "stop" and I will remove you by hand.

9. Cookies

This website sets no advertising cookies and runs no third-party trackers. If a video is embedded from YouTube, YouTube may set its own cookies once you press play — that is governed by Google's policy, not mine.

10. Children

This is training for adults. I do not knowingly collect data from anyone under 16. If you believe a child has sent me data, tell me and I will delete it.

11. Security

Access to your data is limited to me and to the services above, protected by access controls and two-factor authentication where the provider supports it. Credentials are held in an encrypted store, not in the website code. No system is perfect, and if a breach ever affects your data I will tell you and the authority within 72 hours, as GDPR requires.

12. Changes

If this policy changes materially, I will update the date at the top and, if you are on my list, tell you by email. The current version always lives at this address.