Flow With Purpose

Privacy and Cookie Policy

Last updated: 2 September 2026

I take your privacy seriously. This page tells you what personal information I collect, why, how long I keep it, and what your rights are. Written in plain language rather than legalese, because you should be able to actually read it.

Who is responsible for your data

I am. My full name is Jonathan Mithran Sunderraj, and I operate Flow With Purpose as a sole proprietor registered in Luxembourg. I am the data controller for all personal information collected through this site and through the programmes I offer.

You can reach me at jonathanmithran@flowwithpurpose.co for any question about how your data is handled. I read every message personally.

What personal information I collect

Only what you give me, and only what I need to work with you.

When you use the contact or application form

Your first name, last name, email address, city, country, and whatever you write to me in the message field.

When you book an introductory call via Calendly

Your name, email, chosen call time, and any note you add when booking.

When you enrol in a programme

Your name, email, billing address, and payment method — collected and processed by Stripe, not stored by me directly. Stripe sends me confirmation of payment.

When you attend a session on Zoom

Your name and email (as they appear in your Zoom account). Every session is recorded. Recordings are shared only with the cohort (for group programmes) or with you personally (for one-to-one work). Recordings are never published or sold. If I ever wish to use a short excerpt for marketing purposes, I will ask you first and only use it with your explicit consent.

Why I collect this information

Different information serves different purposes.

  • Form submissions and Calendly bookings: to respond to your enquiry, arrange a conversation, and consider your application for a programme. The legal basis is your consent, given by submitting the form or making the booking.
  • Enrolment and payment data: to deliver the programme you have enrolled in and meet my obligations to you. The legal basis is the contract between us.
  • Session attendance and recording: to deliver the programme and support cohort continuity when someone misses a session. The legal basis is the contract between us and the legitimate interest of participants in cohort continuity.
  • Communication with alumni or previous participants: if I write to you after a programme ends, it is because you have consented to hear from me. You can withdraw that consent at any time by emailing me.

I do not sell your data. I do not share it with advertisers. I do not use it to build profiles or make automated decisions.

Who else processes your data

I use a small number of third-party services to run this practice. Each of them processes some of your data on my behalf. Each has its own privacy policy that governs how they handle data. Here they are, with links to their policies:

Because some of these services are based in the United States, some of your data is transferred outside the European Union. All of them operate under the EU-US Data Privacy Framework or use Standard Contractual Clauses approved by the European Commission to safeguard that transfer.

How long I keep your data

I keep your information only as long as I need it, following standard retention practice for a coaching practice in Luxembourg.

  • Enquiries and applications that do not lead to enrolment: kept for 12 months, then deleted.
  • Programme participants — enrolment records, application text, session attendance: kept for 3 years after the programme ends, to allow me to remember our work together if you return or refer someone.
  • Session recordings: kept for 90 days after the cohort or one-to-one programme concludes, then deleted, unless you specifically request continued access to your own recording.
  • Financial records: invoices, payments, and receipts are kept for 10 years, as required by Luxembourg tax law.
  • Marketing consent records: if you have given me consent to use a testimonial or recording excerpt, I keep the consent record as long as I use the material, and delete both if you withdraw consent.
  • Correspondence: email exchanges are kept as long as they remain useful, and deleted on request.

You can ask me to delete your data sooner. See “Your rights” below.

Cookies and tracking

This site does not currently use tracking cookies, analytics, or marketing pixels of any kind.

The only cookies that may be set are strictly necessary — for example, session cookies that allow forms to submit correctly, or security cookies that protect against basic attacks. These do not track you across other websites and are essential to the site working.

If this changes in future — for example, if I add privacy-friendly analytics to understand which pages are useful — I will update this policy and, where legally required, add a cookie consent banner so you can decide.

Your rights under GDPR

You have several rights over your personal data. You can exercise any of these by emailing me at jonathanmithran@flowwithpurpose.co.

  • Access: ask me for a copy of the personal data I hold about you.
  • Rectification: ask me to correct anything that is wrong.
  • Erasure: ask me to delete your data. I will do this unless I am legally required to keep it (for example, tax records).
  • Restriction: ask me to stop using your data while a question about it is being resolved.
  • Portability: ask me to send your data to you or to another provider in a machine-readable format.
  • Objection: object to my use of your data on grounds of legitimate interest.
  • Withdraw consent: where consent is the legal basis, withdraw it at any time. This does not affect the lawfulness of processing before you withdrew.

I will respond within 30 days.

If you believe I have not handled your data correctly, you have the right to complain to Luxembourg’s data protection authority: Commission nationale pour la protection des données (CNPD). Their address is 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg.

Security

I take reasonable care to protect your data. My email and Google account are protected by two-factor authentication. Payment data never touches my systems — Stripe handles it directly. Session recordings are stored in access-controlled cloud storage and shared only with the cohort they belong to.

No system is perfect. If a breach ever occurs that puts your data at material risk, I will inform you within 72 hours and inform the CNPD as required by law.

Changes to this policy

If I make material changes to this policy, I will note the update at the top of this page and, where required, contact you directly. The date at the top of this policy shows when it was last revised.

Questions

Any question about anything on this page — write to me at jonathanmithran@flowwithpurpose.co and I will answer personally.