Thank you for your interest in our website. The protection of your personal data is important to us. Below you find information regarding the handling of your data that is collected through your use of our website. Your data will be processed in accordance with the legal data protection regulations. Insofar as links are provided to other websites, we have neither influence nor control over the linked content and the applicable data protection regulation. We recommend checking the data protection declarations on the linked websites to determine whether and to what extent personal data is collected, processed, used, or made available to third parties.

Contact persons and responsibilities

cflox GmbH
Große Brunnenstraße 122
22763 Hamburg

T +49 40 22 86 97 85

Contact details of the data protection officer

Dominik Fünkner
Leopoldstr. 21
80802 München

Definition of personal data

In principle, our data protection declaration should be simple and understandable for everyone. For this reason, our data protection declaration generally uses the official terms of the General Data Protection Regulation (GDPR). The official definitions are explained in Art. 4 GDPR.

Data processing by visiting our website

When you visit our website, it is technically necessary that data is transmitted to our web server via your internet browser. The following data is recorded during a running connection for communication between your internet browser and our web server:

  • Visited domain
  • The date and time of the request
  • Page from which the file was requested
  • Access status (file transferred, file not found, etc.)
  • The web browser, system language, operating system, and device type used
  • IP address of the requesting computer
  • The amount of data transferred

We collect the listed data to ensure a smooth connection to the website and to enable a comfortable use of our website by the users. In addition, the log file serves the purpose of evaluating system security and stability, as well as providing administrative functions. The legal basis for the temporary storage of data or log files is Art. 6 para. 1 s. 1 lit. f GDPR.

For reasons of technical security, in particular to prevent attempts to attack our web server, these data may be temporarily stored by us. It is not possible for us to draw conclusions about individual persons on the basis of this data. After seven days at the latest, the data is made anonymous by shortening the IP address at domain level, so that it is no longer possible to establish a reference to the individual user. The data is not evaluated in anonymous form except for statistical purposes. The data is not combined with data from other data sources.

Contact form and contact by e-mail

If you send us enquiries via contact form or e-mail, your details from the enquiry form or e-mail, including the contact data you have provided there, will be stored for the purpose of processing the enquiry and in the event of follow-up questions. You are required to provide an e-mail-address to contact us. Your name and telephone number are optional. Under no circumstances will we pass on this data without your consent. The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Art. 6 para. 1 s. 1 lit. f GDPR and, if applicable, Art. 6 para. 1 s. 1 lit. b GDPR, provided that your request is aimed at concluding a contract. Your data will be deleted after final processing of your inquiry, provided that there are no legal storage obligations that require the contrary. You can object to the processing of your personal data at any time in the case of Art. 6 para. 1 s. 1 lit. f GDPR.

Google Analytics

This website uses Google Analytics, an internet analysis service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies" and web beacons. The information generated in relation to the use of this website is transferred by default to a Google server in the USA and stored there. We use Google Analytics only with IP anonymization enabled. This means that Google will reduce the IP-address of users within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area, in order to make a connection to any personal information impossible. Google Inc., based in the USA, is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU. Processing is carried out in accordance with Art. 6 para. 1 s. 1 lit. f GDPR and § 15 Para. 3 TMG respectively on the basis of our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes.

On behalf of the operator of this website, Google will use this information to analyze your use of the website and to generate reports on website activity. Google also uses this information to provide other services related to the use of the website and the internet to the website operator. The IP-address sent by your browser as part of Google Analytics is not combined with other Google data. The terms of use of Google Analytics and information on data protection can be accessed via the following links: and at

You can prevent cookies from being saved by adjusting the settings of your browser software accordingly. However, we must point out that in this case you may not be able to use all functions of this website without restrictions. You can also prevent Google from collecting the data generated by the cookie and analyzing your use of the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available at

Information on the handling of user data at Google Analytics can be found in Google's data protection declaration:


Our website uses cookies, which are stored by the browser on your device and which contain certain settings for the use of the website (e.g. for the current session). Cookies serve to make our website more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer and saved by your browser. Most of the cookies we use are so-called session cookies, which are automatically deleted after closing the browser. Other cookies remain stored on your end-device until you delete them or until the storage period expires. These cookies enable us to recognize your browser the next time you visit our website.

In some cases, cookies are used to simplify website processes by saving settings (e.g. the provision of already selected options). If personal data is also processed by individual cookies implemented by us, the processing is carried out in accordance with Art. 6 para. 1 s. 1 lit. a GDPR, if we ask for your consent and you give it, in accordance with Art. 6 para. 1 s.1 lit. b GDPR, if the use of cookies is necessary to carry out the contract or in accordance with Art. 6 para. 1 s. 1 lit. f GDPR is necessary to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit.

The processing of data through the use of cookies depends on your revocable consent. Before you give your consent, only those cookies are set that are necessary for the operation of our website. We use these essential cookies to ensure the functionality of our website in accordance with your and our interests.

At the bottom of our website you can call up your settings again and deselect cookies at any time.

Further you can configure your browser in such a way that you are informed about the settings of cookies and only allow cookies in individual cases, excluding the acceptance of cookies for certain cases or in general deactivating cookies and activating the automatic deletion of cookies when closing the browser. The cookie settings can be managed using the following links for the respective browser.

Internet Explorer:

You can also individually manage the cookies of many companies and features used for advertising. Use the corresponding user tools, available at or

Most browsers also offer a so-called "Do-Not-Track function" with which you can specify that you do not want to be "tracked" by websites. When this feature is enabled, your browser tells advertising networks, websites, and applications that you do not want to be tracked for behavior-based advertising. Information and instructions on how to edit this function are available from the links below, depending on the provider of your browser:

Google Chrome:
Mozilla Firefox:
Internet Explorer:

You can also prevent scripts from being loaded by default. NoScript allows you to run JavaScripts, Java and other plug-ins only on trusted domains of your choice. For information and instructions on how to edit this feature, contact your browser vendor (e.g. for Mozilla Firefox at:

Please note that when cookies are deactivated, the functionality of this website may be limited.

Embedded content

Individual pages of our website contain embedded YouTube videos. These videos are stored on YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland of the Google LLC group, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.

We integrate the videos in the so-called “extended data protection mode”. This way, none of your data will be transferred to YouTube before you have started playing the video. As soon as you play a video, data about your use will be transmitted to YouTube and if necessary processed without our influence. We ourselves do not process any data about your use of the embedded content.

Further information on YouTube's data protection declaration and data protection level can be found at and

The legal basis is Art. 6 para. 1 s. 1 lit. a GDPR, provided we ask for your consent and you give it, Art. 6 para. 1 s.1 lit. b GDPR, if the use of external media for the implementation of the contract or in accordance with Art. 6 para. 1 s. 1 lit. f GDPR is necessary to safeguard our legitimate interests.

Social media

Below you find information about how we handle your information collected through your use of our social media sites on social networks and platforms.

If your personal data are processed by a provider listed below, this provider is responsible for the data processing within the meaning of the GDPR. For the assertion of your data subject rights, we point out that these can be most effectively asserted by the respective providers. Only these have access to the data collected. If you still need help, feel free to contact us at any time.

We have online presences on the social media platforms of the following providers:

  • LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
  • XING SE, Dammtorstraße 29-32, 20354 Hamburg, Germany

Information on how to contact the data protection officer of the respective provider can be found here:

LinkedIn Ireland Unlimited Company:


Information on the privacy policies of the respective provider is provided here:

LinkedIn Privacy Policy:
Privacy Shield:

XING Privacy Policy:

We are responsible for the data processing within the meaning of the GDPR insofar as the data transmitted to us by you via one of the social media platforms is processed by us. You can reach our data protection officer using the specified contact details (number 2).

Typically, personal information is processed on the Company's website for market research and promotional purposes. For this purpose, a cookie is set in your browser, which allows the respective provider to recognize you when you visit a website. Using the collected data, usage profiles can be created. These are used to serve advertisements within and outside the platform that are allegedly in line with your interests. Furthermore, the usage profiles can also store data independently of the devices you are using. This is usually the case if you are a member of each platform and logged in to it.

We ourselves collect personal data, when you get in contact with us by using the contact form or a messenger service. Which data is collected, depends on the details you give as well as on the contact data you provide and share. These will be stored for the purpose of processing your inquiry and further questions linked hereto. The data will not be transferred to a third party in any case without your consent. The legal basis for the processing of the data is our legitimate interest on answering your inquiry in accordance with Art. 6 para. 1 s. 1 lit. f GDPR as well as Art. 6 para. 1 s. 1 lit. b GDPR, if your inquiry aims for the conclusion of a contract. If you are requested by the respective providers of the platforms to consent to the processing for a specific purpose, the legal basis of the processing is Art. 6 para. 1 s. 1 lit. a., Art. 7 GDPR. A given consent can be withdrawn at any time with effect for the future.

Data transfer and recipient

We do not sell your personal data to third parties. Your personal data will not be passed on to third parties unless

  • we have explicitly indicated this in the description of the respective data processing,
  • you have given your explicit consent in accordance to Art. 6 para. 1 s. 1 lit. a GDPR,
  • the disclosure pursuant to Art. 6 para. 1 s. 1 f GDPR is necessary to assert, exercise, or defend legal claims and there is no reason to assume that you have an outright interest worthy of protection through not disclosing your data,
  • that a legal obligation exists for the transfer pursuant to Art. 6 para. 1 s. 1 lit. c GDPR,
  • this is required under Art. 6 para. 1 s. 1 lit. b GDPR for the processing of contractual relationships with you, or
  • in the context of the use of social media platforms, if without any potential influence from our side, data processing outside the EU and the European Economic Area takes place by the respective providers.

We also use external service providers, which we have carefully selected and commissioned in writing, to carry out our services. They are bound by our instructions and are regularly checked by us. We have concluded order processing contracts in accordance with Art. 28 GDPR, if necessary. These are service providers for web hosting, sending e-mails, and maintaining our IT systems, etc. The service providers will not pass on data to third parties.

Duration of data storage

The duration of the storage of personal data is determined by the relevant statutory retention periods (eg from commercial law and tax law). After expiry of the respective deadline, the corresponding data will be routinely deleted. If data is required to fulfill the contract or to initiate an agreement or if we have a legitimate interest in the further storage, the data will be deleted if it is no longer required for these purposes or if you have exercised your right of revocation or objection. We have no control over the retention period of your data stored by social media providers for their own purposes.

Rights of the persons concerned

In the following section you will find information on the rights of persons concerned, which are granted to you by the current data protection laws with regard to the entity responsible for the processing of your personal data:

The right to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right of complaint, the origin of your data, if these have not been collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information regarding their details.

The right to immediately request the correction of incorrect or complete personal data stored by us in accordance with Art. 16 GDPR.

The right to request the deletion of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise, or defend legal claims.

The right, pursuant to Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to have it deleted and we no longer need the data, but you need it to assert, exercise, or defend legal claims or you have filed an objection against the processing pursuant to Art. 21 GDPR.

The right, in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, current, and machine-readable format or to request its transfer to another person responsible.

The right to revoke your consent granted pursuant to Art. 7 para. 3 GDPR at any time with effect in the future.

The right to complain to a supervisory authority pursuant to Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state in which we have our registered office or, if applicable, that of your usual place of residence or work.

The right to revoke consent granted pursuant to Art. 7 para. 3 GDPR: You have the right to revoke consent to the processing of data once granted at any time with effect for the future. In the event of revocation, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The revocation of consent shall not affect the legality of the processing carried out on the basis of the consent until revocation.

Right of objection

If your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6 para. 1 s. 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, insofar as this is for reasons arising from your particular situation. If the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right of objection without the requirement to indicate a special situation.

If you wish to exercise your right of revocation or opposition or any of your other rights, send an e-mail to

Subject to alteration

We reserve the right to change this Data Protection Declaration at any time in accordance with the law. If we make significant changes, we will notify you by posting a notice on this website before the change takes effect. We ask you to check this page regularly for current information on our data protection practices.

This is a translation of the German Data Protection Declaration. The German version is authoritative.

Status of this Data Protection Declaration: March 2020