Thank you for your interest in our website. The protection of your personal data is important to us. Below you find information regarding the handling of your data that is collected through your use of our website. Your data will be processed in accordance with the legal data protection regulations.
Contact persons and responsibilities
cflox GmbH
Gaußstraße 190c
22765 Hamburg
Germany
T +49 40 22 86 97 85
info@cflox.com
Contact details of the data protection officer
DDSK GmbH
Annalena Arndt
Dr.-Klein-Straße 29
88069 Tettnang
Germany
T +49 7542 949 21 06
datenschutz@cflox.com
ddsk.de
When contacting the data protection officer, please name the company to which your inquiry relates. Please refrain from enclosing sensitive information, such as a copy of an ID card, with your request.
Definition of personal data
In principle, our data protection declaration should be simple and understandable for everyone. For this reason, our data protection declaration generally uses the official terms of the General Data Protection Regulation (GDPR). The official definitions are explained in Art. 4 GDPR.
Access to and storage of information in terminal equipment
By using our website, information (e.g. IP address) may be accessed or stored (e.g. cookies) in your terminal equipment. This access or storage may involve further processing of personal data within the meaning of the GDPR.
In cases where such access to information or such storage of information is absolutely necessary for the technically error-free provision of our services, this is done on the basis of Section 25 para. 1 s. 1, para 2 No. 2 TTDSG.
In cases where such a process serves other purposes (e.g. the needs-based design of our website), this will only be carried out on the basis of Section 25 para. 1 TTDSG with your consent in accordance with Art. 6 para. 1 s. 1 lit. a GDPR. The consent can be revoked at any time for the future. The requirements of the GDPR and the Federal Data Protection Act (BDSG) apply to the processing of your personal data.
For more information on the processing of your personal data and the relevant legal bases in this context, please refer to the following sections on the specific processing activities on our website.
Web hosting
This website is hosted by an external service provider (hoster). The hosting of this website takes place in Dresden, Germany. Personal data collected on this website is stored on the hoster's servers. This may include IP addresses, contact requests, meta and communication data, website accesses and other data generated via a website.
We collect the listed data in order to ensure a smooth connection of the website and a technically error-free provision of our services. The processing of this data is absolutely necessary to provide you with the website. The legal basis for the processing of the data is our legitimate interest in the correct presentation and functionality of our website in accordance with Art. 6 para. 1 s. 1 lit. f GDPR.
We have concluded an order processing agreement with the provider in accordance with the requirements of Art. 28 GDPR, in which we oblige the provider to protect our customers' data and not to pass it on to third parties.
Server log files
When you visit our website, it is technically necessary that data is transmitted to our web server via your internet browser. The following data is recorded during a running connection for communication between your internet browser and our web server:
- Visited domain
- The date and time of the request
- Page from which the file was requested
- Access status (file transferred, file not found, etc.)
- The web browser, system language, operating system, and device type used
- IP address of the requesting computer
- The amount of data transferred
We collect the listed data to ensure a smooth connection setup of the website and to be able to guarantee a technically error-free provision of our services. The processing of this data is absolutely necessary to provide you with the website. In addition, the log file is used to evaluate system security and stability as well as for administrative purposes. The legal basis for the processing of the data is our legitimate interest in the protection and functionality of our website according to Art. 6 para. 1 s.1 lit. f GDPR.
For reasons of technical security, in particular to defend against attempted attacks on our web server, we may store this data for a short period of time. After seven days at the latest, the data is anonymized by shortening the IP address at domain level, so that it is no longer possible to establish a link to the individual user.
In addition, the data may be processed in anonymized form for statistical purposes. This data is never stored together with other personal data of the user, compared with other data or passed on to third parties.
Use of cookies
Our website uses so-called "cookies". Cookies are small text files that are stored either temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your terminal device. Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your terminal device until you delete them yourself or an automatic solution is provided by your web browser.
Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or language settings). Other cookies are used to evaluate user behavior or display advertising.
The processing of data through the use of strictly necessary cookies is based on a legitimate interest pursuant to Art. 6 para. 1 s. 1 lit. f GDPR in the technically error-free provision of our services. For details on the processing purposes and legitimate interests, please refer to the explanations on the specific data processing.
The processing of personal data through the use of other cookies is based on consent pursuant to Art. 6 para 1 s. 1 lit. a GDPR. The consent can be revoked at any time for the future. Insofar as such cookies are used for analysis and optimization purposes, we will inform you separately about this within the framework of this data protection declaration and obtain consent in accordance with Art. 6 para. 1 s. 1 lit. a GDPR.
You can set your browser so that you are
- be informed about the setting of cookies,
- allow cookies only in individual cases,
- exclude the acceptance of cookies for certain cases or in general,
- activate the automatic deletion of cookies when closing the browser.
Cookie settings can be managed under the following links for the respective browsers:
You can also manage cookies of many companies and functions used for advertising individually. To do this, use the appropriate user tools, available at
https://www.aboutads.info/choices/ or http://www.youronlinechoices.com/uk/your-ad-choices
Most browsers also offer a so-called "do-not-track" function. When this function is activated, the respective browser tells advertising networks, websites and applications that you do not want to be "tracked" for the purpose of behavior-based advertising and the like.
You can get information and instructions on how to edit this feature, depending on your browser provider, from the links below:
Additionally, you can prevent loading of so-called scripts by default. "NoScript" allows JavaScripts, Java and other plug-ins to run only on trusted domains of your choice. Information and instructions on how to edit this function can be obtained from the provider of your browser (e.g. for Mozilla Firefox at: https://addons.mozilla.org/en-GB/firefox/addon/noscript/).
Please note that if you disable cookies, the functionality of our website may be limited.
Consent Management (Borlabs)
In order to manage cookies in a data protection compliant manner, we use the software solution of the company Borlabs- Benjamin A. Bornschein, Georg- Wilhelm-Str. 17, 21107 Hamburg, Germany.
When visiting our website, an essential cookie is stored in the user's browser, in which the consent given or the revocation of consent is stored. This data is not passed on to the provider of Borlabs cookie.
With Borlabs, we provide you with a so-called cookie banner, through which you can give us your consent to the use of cookies. The cookie banner informs you about the use of cookies when you first visit our website and asks for your consent to the use of cookies. Until you give your consent, all non-essential cookies that we use on our website are automatically blocked. You have the option to reject unwanted cookies via the cookie banner and still continue to use the website.
In particular, the Borlabs cookie is necessary to comply with the legal requirements of data protection law. We do not use the user data collected by the cookies to create user profiles. The legal basis for the processing is our legitimate interest in observing the rejection of cookies and/or the revocation of your consent to the use of cookies, pursuant to Art. 6 para. 1 s. 1 lit. f GDPR.
The collected data will be stored until you request us to delete it or delete the Borlabs cookie yourself, or until the purpose for storing the data no longer applies. Mandatory legal retention periods remain unaffected. Details on the data processing of Borlabs Cookie can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/.
The privacy policy of Borlabs can be found here: https://borlabs.io/privacy/
Change cookie settings
You can revoke or change your cookie settings at any time. To do so, call up the "Cookie settings" again. You can find this at any time in the footer of our website.
Sending applications (Personio)
Your personal data provided as part of the application process will be processed via our applicant management system Personio. By submitting your application, you agree to our data protection regulations.
Applicant data is processed on the basis of § 26 para. 1 sentence 1 of the Federal Data Protection Act, new version (BDSG-new) and Article 6 Paragraph 1 lit. a, b and f GDPR.
The application process requires applicants to provide us with their personal data. If we offer an online form, the necessary applicant data is marked, otherwise it results from the job advertisements and basically includes personal information, postal and contact addresses and the documents belonging to the application such as cover letter, curriculum vitae, references and certificates. In addition, applicants can voluntarily provide us with additional information.
Insofar as special categories of personal data within the meaning of Art. 9 Para. 1 GDPR are voluntarily communicated as part of the application process, they are also processed in accordance with Art. 9 Para. 2 lit. b GDPR (e.g. severe disability or marital status). Insofar as special categories of personal data within the meaning of Art. 9 Para. 1 GDPR are requested from applicants as part of the application process, they are also processed in accordance with Art. 9 Para. 2 lit professional practice is required).
If made available, applicants can send us their applications using an online form on our website. The data is transmitted to us in encrypted form using state-of-the-art technology. We use the software from Personio SE & Co. KG, Seidlstraße 3, 80335 Munich to transmit applications using the online form.
If you send an application directly by email to recruiting@cflox.com, the encryption depends on your email service provider.
Responsible employees of our company can access the aforementioned applicant system in order to be able to fill vacant positions with suitable candidates.
In the event of a successful application, the data provided by the applicants can be processed by us for the purposes of the employment relationship. Otherwise, if the application for a job offer is not successful, the applicant's data will be deleted within the statutory deletion periods. Applicant data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time.
Data from applicants will be deleted after 6 months in the event of a rejection. If you have been awarded a position as part of the application process, the data from the applicant data system will be transferred to our personnel information system.
You can contact us at any time via recruiting@cflox.com or datenschutz@cflox.com to have your data deleted. Your data will be deleted after the above storage periods have expired.
Your personal data will only be passed on if cflox GmbH is legally obliged to do so or if it is necessary in the event of misuse or clarification. However, this requires concrete indications of illegal or abusive behavior. At the request of a competent authority, we may provide information about this data (inventory data) in individual cases, in particular for the purposes of criminal prosecution.
You can find more information about Personio and Personio’s data protection declaration here: https://www.personio.com/privacy-policy/
HubSpot/HubSpot Forms
On our website, we use the service HubSpot for various purposes. HubSpot is a software company from the USA with an office in Ireland. HubSpot European Office, Ground Floor, Two Dockland Central, Guild St, North Dock, Dublin, D01 K2C5, Ireland.
HubSpot is an integrated software solution that we use to cover various aspects of our online marketing. These include:
Email marketing, contact management (e.g. user segmentation) and contact forms.
The following personal data may be collected, for example:
- IP address,
- geographical location,
- type of browser,
- duration of visit,
- pages viewed,
- information about how often the application is used,
- mobile apps data,
- pages viewed,
- e-mail address,
- first Name,
- surname
We use HubSpot Forms on the basis of our legitimate interest in accordance with Art. 6 Para. 1 lit. f GDPR, whereby our legitimate interest lies in the provision of any contact forms and simplified communication with interested parties. Furthermore, we use the data received through HubSpot Forms to send interest-related information. HubSpot evaluates your user behavior when sending emails or other requested information on our behalf. For this evaluation, the e-mails sent contain so-called tracking pixels. These are one-pixel image files that link to our website and enable us to evaluate your user behavior on a session basis. We record when you read our e-mails, which links you click in them and conclude your personal interests from this. HubSpot stores the information collected in this way on its server so that we can then evaluate it.
The legal basis of the processing is your consent according to Art. 6 Para. 1 lit. a GDPR, which you have given in the Cookie Consent Banner. If you do not want the data mentioned via HubSpot to be collected and processed, you can refuse your consent or revoke it at any time with effect for the future. We use all collected information exclusively to optimize our marketing measures.
Personal data will be kept for as long as it is necessary to fulfill the purpose of the processing. The data is deleted as soon as it is no longer required to achieve the purpose. In the context of processing via HubSpot, data may be transferred to the USA or other third countries. The security of the transfer is secured via so-called standard contractual clauses, which ensure that the processing of personal data is subject to a level of security that corresponds to that of the GDPR. If the standard contractual clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49 Para. 1 lit. a GDPR may serve as the legal basis for the transfer to third countries.
You can find more information on data use by HubSpot, setting and objection options on the HubSpot website:
https://legal.hubspot.com/privacy-policy
Information from HubSpot regarding EU data protection regulations https://legal.hubspot.com/security
Google Analytics 4
- Page views
- First visit to the website
- Start of the session
- Visited web pages
- Your "click path", interaction with the website
- Scrolls (whenever a user scrolls to the end of the page (90%))
- Clicks on external links
- Internal search queries
- Interaction with videos
- file downloads
- Viewed / clicked ads
- language setting
- Your approximate location (region)
- Date and time of the visit
- Your IP address (in abbreviated form)
- Technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
- your internet provider
- the referrer URL (via which website/advertising medium you came to this website)
Appearances in social media
In the following, you will find information on the handling of your data that is collected through your use of our social media appearances on social networks and platforms. Your data will be processed in accordance with the legal regulations.
1 Provider
1.1 Responsible party
If your personal data is processed by a provider listed below, this provider is the data controller within the meaning of the GDPR. For the assertion of your data subject rights, we point out that these can be asserted most effectively with the respective providers. Only they have access to the data collected from you. Should you still require assistance, please feel free to contact us at any time.
We have online presences on the social media platforms of the following providers:
- LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland,
- XING SE, Dammtorstraße 29-32, 20354 Hamburg, Germany.
1.2 Data protection officer
Information on how to contact the data protection officer of the other social media providers can be found here:
- LinkedIn Ireland Unlimited Company:
https://www.linkedin.com/help/linkedin/ask/TSO-DPO - XING SE: Datenschutzbeauftragter@xing.com
2 General information on social media platforms
2.1 Responsible party
The responsible party for data processing within the meaning of the GDPR is the body named at the beginning of this data protection declaration, insofar as data transmitted by you via one of the social media platforms is processed by ourselves.
2.2 Our data protection officer
If you have any concerns about data processing carried out by us as the controller, you can reach our data protection officer at the contact details stated at the beginning of this data protection declaration.
3 General data processing on the social media platforms
3.1 Data processing for market research and advertising purposes
As a rule, personal data is processed on the company website for market research and advertising purposes. For this purpose, a cookie is set in your browser, which enables the respective provider to recognize you when you visit a website. By means of the collected data, usage profiles can be created. These are used to display advertisements within and outside the platform that presumably correspond to your interests. Furthermore, data can also be stored in the usage profiles regardless of the devices you use. This is regularly the case if you are a member of the respective platforms and logged in to them.
3.2 Data processing when contacting us
We ourselves collect personal data when you contact us, for example, via a contact form or through a messenger service, such as Facebook Messenger. Which data is collected depends on the information you provide and the contact data you have provided or released. These are stored by us for the purpose of processing the request and in case of follow-up questions. Under no circumstances will we pass on the data to third parties without your consent. The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Art. 6 para. 1 s. 1 lit. f GDPR and, if applicable, Art. 6 para. 1 s. 1 lit. b GDPR if your request is aimed at concluding a contract. Your data will be deleted after final processing of your request, provided that this does not conflict with any statutory retention obligations. We assume that processing is complete if the circumstances indicate that the matter in question has been conclusively clarified.
3.3 Data processing for contract execution
If your contact via a social network or other platform aims at the conclusion of a contract for the delivery of goods or the provision of services with us, we process your data for the performance of the contract or for the implementation of pre-contractual measures or for the provision of the requested services. The legal basis for the processing of your data in this case is Art. 6 para. 1 s. 1 lit. b GDPR. Your data will be deleted if it is no longer required for the performance of the contract or if it is determined that the pre-contractual measures do not lead to the conclusion of a contract corresponding to the purpose of the contact. Please note, however, that it may be necessary to store personal data of our contractual partners even after the conclusion of the contract in order to comply with contractual or legal obligations.
3.4 Data processing based on consent
If you are asked by the respective providers of the platforms for consent to processing for a specific purpose, the legal basis of the processing is Art. 6 para. 1 s. 1 lit. a., Art. 7 GDPR. Consent given can be revoked at any time with effect for the future.
4 Data transfer and recipients
When visiting and using the platforms listed above, a transfer of personal data to the USA or other third countries outside the EU may occur, which is why further protection mechanisms are required in these cases to ensure the level of data protection of the GDPR. For more information on whether and which suitable guarantees the providers can demonstrate for this, please see the list below.
We have no influence on the processing of your personal data by the provider and the handling thereof. Likewise, we do not have any information on this. For more information, please check the privacy policy of the respective provider and, if necessary, use the opt-out / personalization options regarding data processing by the provider:
- LinkedIN
- Privacy Policy: https://www.linkedin.com/legal/privacy-policy
- Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
- According to its privacy policy, LinkedIn uses standard data protection clauses to ensure an adequate level of data protection in accordance with the requirements of the GDPR for data transfers to the USA or other third countries outside the EU: https://www.linkedin.com/legal/privacy-policy and https://www.linkedin.com/help/linkedin/answer/62533?lang=en
- XING
- Privacy Policy: https://privacy.xing.com/en/privacy-policy
- Opt-Out: https://nats.xing.com/optout.html?locale=en_US
- According to its privacy policy, XING uses standard data protection clauses to ensure an adequate level of data protection in accordance with the requirements of the GDPR for data transfers to the USA or other third countries outside the EU: https://privacy.xing.com/en/privacy-policy/who-may-receive-information-about-you/third-countries
External links
The social networks (LinkedIn and XING) are only integrated on our website as a link to the corresponding services. After clicking on the embedded text/image link, you will be redirected to the page of the respective provider. Only after the redirection is user information transmitted to the respective provider. For information on the handling of your personal data when using these websites, please refer to the respective data protection provisions of the providers you use.
Data transfer and recipient
We do not sell your personal data to third parties. Your personal data will not be passed on to third parties unless
- we have explicitly indicated this in the description of the respective data processing,
- you have given your explicit consent in accordance to Art. 6 para. 1 s. 1 lit. a GDPR,
- the disclosure pursuant to Art. 6 para. 1 s. 1 f GDPR is necessary to assert, exercise, or defend legal claims and there is no reason to assume that you have an outright interest worthy of protection through not disclosing your data,
- that a legal obligation exists for the transfer pursuant to Art. 6 para. 1 s. 1 lit. c GDPR,
- this is required under Art. 6 para. 1 s. 1 lit. b GDPR for the processing of contractual relationships with you.
We also use external service providers, which we have carefully selected and commissioned in writing, to carry out our services. They are bound by our instructions and are regularly checked by us. We have concluded order processing contracts in accordance with Art. 28 GDPR, if necessary. These are service providers for web hosting, sending e-mails, and maintaining our IT systems, etc. The service providers will not pass on data to third parties.
Embedded content
1 YouTube
On our website, we embed videos from "YouTube", a social media platform of Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland (hereinafter referred to as "Google"). The legal basis for the processing of your personal data is your consent granted for this purpose pursuant to Art. 6 para. 1 s. 1 lit. a GDPR.
If the playback of embedded YouTube videos is started by your consent, the provider "YouTube" uses cookies to collect information about user behavior. According to information from "YouTube", these are used, among other things, to collect video statistics, to improve user-friendliness and to prevent abusive behavior. If you are logged in to Google, your data is directly assigned to your account when you click on a video. If you do not want the assignment with your profile at YouTube, you must log out before activating the button. Google stores this data as usage profiles and uses them for the purposes of advertising, market research and / or needs-based design of its websites. Such an evaluation is carried out in particular (also for users who are not logged in) for the display of tailored advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. Please contact Google directly for this purpose.
Since a transfer of personal data to the USA takes place, further protection mechanisms are required to ensure the level of data protection of the GDPR. To ensure this, Google uses standard data protection clauses in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the USA to process the data in accordance with the level of protection in Europe. In cases where this cannot be ensured even by this contractual extension, we endeavor to obtain additional regulations and commitments from the recipient in the USA.
Further information on data protection and data use by Google can be found on the following Google website: https://policies.google.com/privacy?hl=en&gl=de
Data security
We take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk in accordance with Art. 32 of the GDPR, taking into account the state of the art, the cost of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons. This website uses SSL encryption for security reasons and to protect the transmission of confidential content.
Duration of data storage
The duration of the storage of personal data is determined by the relevant statutory retention periods (eg from commercial law and tax law). After expiry of the respective deadline, the corresponding data will be routinely deleted. If data is required to fulfill the contract or to initiate an agreement or if we have a legitimate interest in the further storage, the data will be deleted if it is no longer required for these purposes or if you have exercised your right of revocation or objection.
Your rights
In the following section you will find information on the rights of persons concerned, which are granted to you by the current data protection laws with regard to the entity responsible for the processing of your personal data:
The right to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right of complaint, the origin of your data, if these have not been collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information regarding their details.
The right to immediately request the correction of incorrect or complete personal data stored by us in accordance with Art. 16 GDPR.
The right to request the deletion of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise, or defend legal claims.
The right, pursuant to Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to have it deleted and we no longer need the data, but you need it to assert, exercise, or defend legal claims or you have filed an objection against the processing pursuant to Art. 21 GDPR.
The right, pursuant to Article 20 of the GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller.
The right to complain to a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state of our registered office stated above or, if applicable, that of your usual place of residence or workplace for this purpose.
The right to revoke consent given in accordance with Art. 7 para. 3 GDPR: You have the right to revoke consent to the processing of data once given at any time with effect for the future. In the event of revocation, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
Right of objection
If your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6 para. 1 s. 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, insofar as this is for reasons arising from your particular situation. If the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right of objection without the requirement to indicate a special situation.
If you wish to exercise your right of revocation or opposition or any of your other rights, send an e-mail to datenschutz@cflox.com.
External links
Insofar as links are provided to other websites, we have neither influence nor control over the linked content and the applicable data protection regulation. We recommend checking the data protection declarations on the linked websites to determine whether and to what extent personal data is collected, processed, used, or made available to third parties.
Legal obligations
The provision of personal data for the decision on the conclusion of a contract, the fulfillment of a contract or for the implementation of pre-contractual measures is voluntary. However, we can only make the decision in the context of contractual measures if you provide such personal data that is required for the conclusion of the contract, the performance of the contract or pre-contractual measures.
Automated decision making
Automated decision-making or profiling in accordance with Art. 22 GDPR does not take place.
Subject to alteration
We reserve the right to adapt or update this data protection declaration if necessary in compliance with the applicable data protection regulations. In this way, we can adapt it to the current legal requirements and take into account changes to our services, e.g. when introducing new services. The current version applies to your visit.
This is a translation of the German Data Protection Declaration. The German version is authoritative.
Status of this Data Protection Declaration: May 2022
