This is the website's general Privacy Policy, covering hosting, cookies, analytics, social media, and the newsletter. It is distinct from the App Privacy Policy, which covers the mobile app specifically.
The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can personally identify you. Detailed information on data protection can be found in our privacy policy below.
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. Their contact details can be found in the "Note on the Responsible Party" section of this privacy policy.
How do we collect your data?
Some data is collected because you provide it to us, for example data you enter in a contact form. Other data is collected automatically, or after your consent, by our IT systems when you visit the website, primarily technical data (e.g. browser, operating system, or time of page access).
What do we use your data for?
Some data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior. Where contracts can be concluded or initiated via the website, transmitted data is also processed for contract offers, orders, or other service requests.
What rights do you have regarding your data?
You have the right, at any time, to receive free information about the origin, recipients, and purpose of your stored personal data. You also have the right to request correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request restriction of processing of your personal data, and the right to lodge a complaint with the relevant supervisory authority.
When you visit this website, your browsing behavior may be statistically evaluated, primarily through analysis programs. Detailed information on these programs is provided below.
We host the content of our website with the following provider:
WIX
The provider is Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel ("WIX").
WIX is a tool for building and hosting websites. When you visit our website, WIX analyzes user behavior, visitor sources, visitor region, and visitor numbers. WIX stores cookies in your browser required for displaying the website and ensuring security (necessary cookies).
Data collected via WIX may be stored on various servers worldwide, including in the USA. Details can be found in WIX's privacy policy: wix.com/about/privacy
Data transfer to the USA and other third countries is based, according to WIX, on the EU Commission's Standard Contractual Clauses or comparable safeguards under Art. 46 GDPR. Details: wix.com/about/privacy-dpa-users
Use of WIX is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable possible presentation of our website. Where consent has been requested, processing is based exclusively on Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device.
WIX holds a certification under the "EU-US Data Privacy Framework" (DPF). More information: dataprivacyframework.gov/participant/5626
Data Processing Agreement
We have concluded a data processing agreement (DPA) for use of the above service, a legally required contract ensuring that the provider processes our website visitors' personal data only on our instructions and in compliance with GDPR.
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy. This privacy policy explains what data we collect and what we use it for, as well as how and for what purpose.
We point out that data transmission over the internet (e.g. via email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.
The party responsible for data processing on this website is:
Sofia Hoyos Carmona
Bardroffstr. 18a
63739 Aschaffenburg
Phone: 015780470526
Email: walnutflow@gmail.com
The responsible party is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
Unless a more specific storage period is mentioned in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate deletion request or revoke consent, your data will be deleted unless we have other legally permissible reasons for storage (e.g. tax or commercial law retention periods).
Where you have given consent, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR. Where your data is necessary for contract fulfillment, we process it on the basis of Art. 6(1)(b) GDPR. Where necessary to fulfil a legal obligation, on the basis of Art. 6(1)(c) GDPR. Processing may further be based on our legitimate interest under Art. 6(1)(f) GDPR.
We use tools from companies based in countries without an adequate level of data protection, as well as US tools whose providers are not DPF-certified. When these tools are active, your personal data may be transferred to and processed in these countries, without a level of protection comparable to the EU being guaranteed.
In the course of our business activities, we work with various external parties. We only share personal data with external parties where necessary for contract fulfillment, where legally required, where we have a legitimate interest under Art. 6(1)(f) GDPR, or where another legal basis permits it.
Many data processing operations are only possible with your express consent. You may withdraw consent already given at any time. The lawfulness of data processing carried out before the withdrawal remains unaffected.
Where data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data. Where your data is processed for direct marketing, you have the right to object at any time to processing for such marketing purposes (Art. 21(2) GDPR).
In case of GDPR violations, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, workplace, or place of the alleged violation.
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format.
You have the right, within applicable legal provisions, to free information about your stored personal data, its origin and recipients, and the purpose of processing, and if applicable a right to correction or deletion of this data.
You have the right to request restriction of processing of your personal data, including if you dispute the accuracy of the data, if processing was unlawful, if you need the data to assert legal claims, or while an objection under Art. 21(1) GDPR is pending.
This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, recognizable by "https://" and the lock symbol in your browser bar.
Our websites use "cookies," small data packages that do not harm your device. They are stored either temporarily (session cookies) or permanently (persistent cookies). Cookies may be first-party (from us) or third-party. Necessary cookies are stored on the basis of Art. 6(1)(f) GDPR; where consent was requested, processing is based on Art. 6(1)(a) GDPR and § 25(1) TDDDG.
The website provider automatically collects and stores information in server log files that your browser automatically transmits: browser type and version, operating system, referrer URL, hostname of the accessing computer, time of server request, IP address. This data is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR.
If you send us inquiries via a contact form, your details including contact information are stored with us for the purpose of processing the inquiry, and are not shared without your consent. Legal basis: Art. 6(1)(b) GDPR (where contract-related) or Art. 6(1)(f) GDPR (legitimate interest). Data remains with us until you request deletion or the purpose no longer applies.
If you contact us by email, phone, or fax, your inquiry including all resulting personal data is stored for the purpose of processing your request, and is not shared without your consent. Same legal bases as the contact form.
This website uses elements from social media (e.g. Facebook, X, Instagram, Pinterest, XING, LinkedIn, Tumblr), integrated via the "Shariff" solution: a direct connection to the provider's server is only established after you activate the element by clicking (consent, Art. 6(1)(a) GDPR, § 25(1) TDDDG).
Facebook / Instagram
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Upon activation, a direct connection is made to the Facebook/Instagram server; they receive your IP address and information about your visit. We and Meta are jointly responsible (Art. 26 GDPR) for data collection and transfer. Data transfer to the US is based on Standard Contractual Clauses; Meta is DPF-certified.
X (formerly Twitter)
Provider: X Corp., San Francisco (or Twitter International Unlimited Company, Dublin for users outside the US). Upon activation, a direct connection is made to the X server. Use is based on your consent; X is DPF-certified.
Newsletter Data
If you wish to subscribe to our newsletter, we require an email address as well as information allowing us to verify you are the owner of the provided email address and consent to receiving the newsletter. This data is used exclusively for sending the requested information and is not shared with third parties. Processing is based on your consent (Art. 6(1)(a) GDPR), revocable at any time via the "unsubscribe" link.
After unsubscribing, your email address may be stored in a blacklist to prevent future mailings (legitimate interest, Art. 6(1)(f) GDPR), for an indefinite period.
YouTube (Enhanced Privacy Mode)
Provider: Google Ireland Limited, Dublin. Videos are embedded in enhanced privacy mode; no cookies are set, but Local Storage elements are used for recognition. Legitimate interest (Art. 6(1)(f) GDPR) or consent where requested.
Vimeo (No Tracking)
Provider: Vimeo Inc., New York. Vimeo is configured so that no user activity is tracked and no cookies are set. Legitimate interest (Art. 6(1)(f) GDPR).
Google Fonts (Locally Hosted)
Google Fonts are installed locally; no connection to Google servers takes place.
Font Awesome
Provider: Fonticons, Inc., Cambridge, USA. Your browser loads fonts from Font Awesome servers upon page load; Font Awesome becomes aware of your IP address. Legitimate interest (Art. 6(1)(f) GDPR).
MyFonts
Provider: Monotype Imaging Holdings Inc., Woburn, USA. Your IP address is anonymized immediately after transmission, according to Monotype. DPF-certified.
Google Maps
Provider: Google Ireland Limited, Dublin. Your IP address is stored and transmitted to Google servers in the US to use Google Maps. Legitimate interest or consent; Standard Contractual Clauses; DPF-certified.
Bing Maps
Provider: Microsoft Corporation, Redmond, USA. Your IP address is stored and transmitted to Microsoft servers in the US. Legitimate interest or consent; Standard Contractual Clauses.
Use of OpenAI / ChatGPT
We use ChatGPT (OpenAI Ireland Ltd., Dublin) to help prepare blog posts, landing page text, or similar content. No personal data of website visitors is transmitted to OpenAI; we only provide abstract keywords or anonymized drafts. Should we deploy an AI chat widget in the future where visitors enter their own messages, we will clearly indicate this and obtain consent before transmitting inputs to OpenAI. Legal basis for editorial use: legitimate interest (Art. 6(1)(f) GDPR).
OpenAI processes data on servers in the USA and, for European customers, within the EU (since May 2025). Protection is provided via Standard Contractual Clauses and additional technical measures.
Profiling & Automated Decisions
No fully automated decision-making (Art. 22 GDPR) takes place. ChatGPT serves only as a writing tool with no legal effect on data subjects.
9.1 Wix Analytics
Sets analytics cookies only after user consent, and processes pseudonymized usage data (visitor count, page views, region, device type). Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), revocable via the cookie banner.
9.2 Google Analytics 4 (GA4)
Where activated: data types include IP address (shortened), click path, browser/device info, event data. IP is shortened within the EU/EEA. Retention period: 2–14 months. Processing only after consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data is transferred to the US; Google is DPF-certified or Standard Contractual Clauses apply.
9.3 Google Tag Manager (GTM)
Sets no cookies itself, processes only IP address and aggregate data for error diagnosis, but triggers other tags (e.g. GA4). Legitimate interest (Art. 6(1)(f) GDPR); statistics/marketing tags activate only after consent.
9.4 Google reCAPTCHA v3
Protects forms against abuse (invisible). Analyzes user behavior (mouse movement, time spent) and transmits this data to Google. Legitimate interest (Art. 6(1)(f) GDPR).
10.1 Social Plugin
Provider: LinkedIn Ireland Unlimited Company, Dublin. Upon activation, a connection is made to LinkedIn servers; LinkedIn receives your IP address and visit information. Use only after consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). LinkedIn is DPF-certified.
10.2 LinkedIn Insight Tag
Used to measure success and reach of LinkedIn campaigns (conversion tracking). Data collected: referrer URL, IP address (shortened), device info, timestamp, page views; deleted after 90 days. Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), revocable via the cookie banner or opt-out.
