Data privacy

The guidelines of the EU General Data Protection Regulation (hereinafter GDPR) are applicable throughout Europe. We would like to inform you of the ways in which our company processes your personal data in accordance with the requirements of this regulation (see Articles 13 and 14 of the GDPR). If you have questions or comments about this data protection declaration, you are welcome to contact the persons listed under items 2 and 3 below via email.

You can change the privacy settings you have made at any time here.

Content overview:

I.    Overview
1.    Scope
2.    Responsible party
3.    Data protection officer

II.    Data processing in detail
1.    General information on data processing
2.    Use of our website services
3.    Newsletter, studies, white papers, on-demand recordings 
4.    Live webinars and digital events 
5.    Emails to existing customers
6.    Employment applications
7.    Social media pages
8.    Lead generation via LinkedIn
9.    Customer support, contact
10.  Online appointment booking via Microsoft Bookings
11.  User surveys
12.  Distribution of information to the press
13.  Accessing iTMS Log-in pages
14.  Tracking

III.    Rights of affected persons
1.    Right to object
2.    Right to information
3.    Right to correction
4.    Right to deletion (“Right to be forgotten”)
5.    Right to restriction of processing
6.    Right to data transferability
7.    Right to withdraw consent
8.    Right to appeal
 

I.    Overview

In this section of the data protection declaration, you will find information regarding the scope of application, the parties responsible for data processing, the data protection officer, and data security.

1.    Scope

The data processing activities carried out by 4flow can generally be divided into two categories:

• For the purposes of contract settlement, all data necessary for the execution of a contract with 4flow shall be processed. For cases in which external service providers are also party to settlement of a contract, your data will be transmitted to those parties to the extent necessary for the execution of their duties.
• Upon your use of websites or applications belonging to 4flow, various information is exchanged between your end-user device and our servers. This information may also include personal data. The information gathered in this process can be used to, among other things, optimize our website.

This data protection declaration applies to the following offerings:

• our online offerings available at www.4flow.de; www.4flow.com; www.4flow.cn; www.4flow.com.br; www.4flow.fr 
• all other cases in which you are referred to this data protection declaration by one of our offerings (e.g. websites, subdomains, mobile applications, web services or integrations on third party sites), regardless of the way in which you access or use that offering. These offerings, in aggregate, shall hereinafter be referred to as our “services”.

2. Responsible party

The party responsible for data processing – that is, the party who makes decisions with regard to the purpose for which and method with which personal data is processed by our company – in the context of our services is:

4flow   
Hallerstrasse 1
D-10587 Berlin, Germany
T +49 (30) 39740-100
contact@4flow.com

3. Data protection officer

You can contact our data protection officer as follows:

DS EXTERN GmbH
Mr. Marc Althaus
Frapanweg 22 
D-22589 Hamburg, Germany
https://www.dsextern.de/anfragen

II.   Data processing in detail

In this section of the data protection declaration, we will inform you in detail about how your personal data is processed in the context of our services. For the sake of providing an overview, we have divided the corresponding items according to specific functions of our services. During normal use of our services, it may be the case that various functions – and the corresponding data processing – take place sequentially or simultaneously.

1.    General information on data processing

a.    No obligation of provision

There is no contractual or legal obligation for the provision of personal data. You are not obligated to provide such data.

b.   Consequences of non-provision

There is no contractual or legal obligation for the provision of personal data. You are not obligated to provide such data.

c.    Consent

In various cases, you have the option to grant us your consent to further process your personal data (or parts thereof) in the manners listed below. In such cases, we will in particular inform you – in the context of the corresponding declaration of consent – of the modalities and extent of such consent, as well as of the purposes for which the processing will take place.

d.    Transmission of personal data to third countries

If we transmit data to third countries – that is, countries outside of the European Union – then such transmission shall take place exclusively in accordance with the legally established permissibility requirements. These permissibility requirements are defined in Articles 44 through 49 of the GDPR.

e.    Hosting with external service providers

Our data processing takes place largely in the context of hosting service providers who supply us with storage space and processing capacity in their data centers. These service providers also process personal data on our behalf upon our request to do so. Either these service providers process data exclusively within the EU, or we have guaranteed an appropriate degree of data protection based on the EU standard contractual clauses for the transfer of personal data.

f.    Transmission to government agencies

We transmit personal data to government agencies (including law enforcement agencies) in cases that such transmission is necessary for the fulfillment of our legal obligations [legal basis: Article 6, Section 1, Item c) of the GDPR] or for the assertion, exercise or defense of legal claims [legal basis: Article 6, Section 1, Item f) of the GDPR].

g.    Duration of retention

We do not retain or store your data longer than strictly necessary for the relevant processing purposes. In the case that such data is no longer needed for the fulfillment of contractual or legal obligations, the data is regularly deleted unless its limited retention is otherwise necessary. Grounds for such retention include:

• The fulfillment of commercial and tax law-related retention obligations
• The preservation of evidence for legal disputes in the context of statutes of limitation

It is additionally possible for us to continue to store your data, insofar as you have provided your explicit consent for us to do so.

h.    Data categories

Account data: Login ID/user name and password

Personal master data: Title, salutation, gender, first name, last name, date of birth, company affiliation, position

Address data: Street address, address suffix (if applicable), ZIP code, city, country

Contact data: Telephone number(s), fax number(s), email address(es), participation at events

Registration data: Information about the service through which you have registered; time stamps and technical information relating to your registration, confirmation and deregistration; data you provide during the registration process

Order data: Products ordered, prices, payment and delivery information   

Payment data: Account data, credit card data, and data corresponding other payment services such as Paypal   

Access data: Date and time of your visit to our service; the website from which the accessing system was referred to our website; accessed pages upon use; data for session identification (session ID); furthermore, the following information corresponding to the computer system accessing the services: internet protocol address used (IP address), browser type and version, type of device, operating system and similar technical information

Employment application data: Curriculum vitae, degrees, supporting documents, work samples, certificates, pictures, motivation letter, residence permit (if applicable)

Data according to Article 9 of the GDPR: Data according to Article 9 of the GDPR are not actively collected. An unsolicited receipt of this information cannot be prevented. There is no further processing of this data.

2.    Use of our website

This section describes how we process your personal data when you use our websites. In particular, we would like to inform you that the transmission of access data to external content providers (see item “2a-b.”) is unavoidable due to technical limitations with regard to information transfer on the internet.

3. Newsletter studies, white papers, on-demand recordings

On our websites, we offer a wide variety of newsletters, email communications and downloads available on the basis of user consent. We process your personal data in the context of subscription to our newsletter or of request of other documents as follows:

4. Live webinars and digital events

We frequently host live webinars and other digital events on the basis of user consent. We process your personal data in the context of promotion and registration for live webinars and digital events as follows:

 Here you can find the page where you can unsubscribe.

5. Emails to existing customers

We send marketing emails to our existing customers in accordance with the requirements laid out in Article 7, Section 3 of the German law against unfair business practices (UWG) and make use of personal data in the following way:

6. Employment applications

During an ongoing application for employment, we process your personal data in the following way:

7. Social media pages

Facebook

We have a fan page on the social network “Facebook” under the URL https://www.facebook.com/4flowglobalcareers, which is operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland (“Meta”). You can find Meta´s data protection policy here: https://www.facebook.com/about/privacy

Access to and interaction on our Facebook fan page leads to personal data processing, regardless of whether or not you have a Facebook profile. If you are logged into your Facebook profile when you access our Facebook fan page, Facebook and/or its affiliated companies may combine the information of your visit to our Facebook fan page with your personal profile information. This could be used to create user profiles. If you would like to avoid this type of profile creation, please log out of your Facebook account before visiting our Facebook fan page.

Meta provides us with statistical data about the use of our Facebook fan page with the “Facebook Insights” function. The data includes information such as gender, age, location, page views, interactions and information about paid activities, reach, accounts reached, impressions and impressions per day. Important to note: We cannot identify individual users based on the data from our Facebook page. The use of data generated by “Facebook Insights” is based on Article 5, Section 1f of the GDPR. Our legitimate interest consists of making our Facebook fan page more attractive and providing content based on user interests.

Since we are, together with Meta, responsible for using your data on our Facebook page, we have a written agreement with Meta, which you can read here: https://www.facebook.com/legal/terms/page_controller_addendum.

As a data subject, you have the rights mentioned in this data protection declaration. You can invoke your right to us or to Meta directly at https://www.facebook.com/help/contact/540977946302970. If you invoke your right to us, we will forward your requests to this Facebook site, as per our agreement with Meta.

XING

We maintain a profile on the social network XING at: https://www.xing.com/companies/4flow. XING is operated by New Work SE. Information on what personal data is processed by XING when you access our website can be found at: https://privacy.xing.com/de/datenschutzerklaerung. 4flow SE does not collect any personal data when you access our profile on XING.

LinkedIn

We maintain a profile on the social network LinkedIn at: https://de.linkedin.com/company/4flow-ag. LinkedIn is a service operated by LinkedIn Ireland Unlimited Company. Information on what personal data is processed by LinkedIn for what purposes when you access our website can be found at https://www.linkedin.com/legal/privacy-policy. 4flow SE does not collect any personal data when you visit our profile on LinkedIn.

8. Lead generation via LinkedIn

How we process your personal data for lead generation via the social network LinkedIn:

9.  Customer support, contact

We process your personal data for customer service purposes, use of the contact form, booking-form for appointments or other forms of contacts, as follows:

10. Get in touch with 4flow

Online appointment booking via Microsoft Bookings

On our website we use Microsoft Bookings for online appointment booking. Microsoft Bookings is software provided by Microsoft Ireland Operations Limited. The connection to the service is only established when you call up the online booking function via a link or button on our website, in an email or in the newsletter. To make an appointment, your entries in the form are transferred to Microsoft. For more information on the purpose and scope of data collection and its processing by Microsoft Bookings, please refer to Microsoft's privacy policy at https://privacy.microsoft.com/de-de/privacystatement.

The data you entered when making an appointment online, but at least your name, e-mail address and telephone number, will be processed. The legal basis for the processing of your data in relation to the "Microsoft Bookings" service is Art. 6 para. 1 lit. a) GDPR (your consent), Art. 6 para. 1 lit. b) GDPR (in the context of contractual relationships), and Art. 6 para. 1 lit. f) GDPR (our legitimate interest). The legitimate interest results from our claim to offer you a user-friendly website with a wide range of functions and to give you the opportunity to make an appointment with us quickly and easily at any time if required.
Please note that you are not obliged to use Microsoft Bookings to make an appointment. If you do not wish to use the service, please use another of the contact options offered to make an appointment.

You have the option to revoke your consent to data processing or to object to the use of the data at any time. In this case, the intended contact is no longer possible or communication that has already begun can no longer be continued. The data will be deleted as soon as it is no longer required to achieve the purpose.

Audio and video conferences with Microsoft Copilot in Microsoft Teams Meetings

If you communicate with us via video or audio conference, your personal data that you provide for the audio and video conference will be collected and processed. This may include the name of the participant, duration of the conference, start and end (time) of participation in the conference, number of participants and other “contextual information” in connection with the communication process (metadata).

Furthermore, all technical data required to process the online communication is processed. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker and the type of connection.

If content is exchanged, uploaded or made available in any other way within the tool, this is also stored on the servers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared while using the service.

Further information on data processing can be found in the Microsoft Teams privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

Conclusion of a contract for order processing

We have concluded an order processing contract with the provider of Microsoft Teams and implement the requirements of the data protection authorities when using Microsoft Teams.

Purpose and legal basis

The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6 para. 1 sentence 1 lit. b GDPR). Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). If consent has been requested, the tools are used on the basis of this consent; consent can be withdrawn at any time with effect for the future.

Storage duration

The data collected directly by us via the video and conference tools will be deleted from our systems as soon as you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory retention periods remain unaffected. We have no influence on the storage period of your data that is stored by the operators of the conference tools for their own purposes. For details, please contact the operators of the conference tools directly.

11.    User surveys

12.    Distribution of information to the press

You can find what we do with your personal data in the context of distributing information to the press here:

13.    Accessing iTMS Log-in pages

The following information describes how your personal data is processed when you access iTMS Log-in pages.

14.    Tracking

In this section, we describe how we use tracking technology to process your personal data for the purposes of analysis and service optimization.

The description of the tracking procedure also contains information about how you can hinder or refuse such data processing. Please note that the so-called “opt-out” (that is, the refusal of such processing) is generally documented using cookies. If you use our services with a new end-user device or browser, or if you have deleted the cookies in your existing browser, you must complete the opt-out process again.

The corresponding tracking procedures process your personal data in a solely pseudonymous form. A connection with a concretely identified natural person – that is, a consolidation of the collected data with information about the person to whom the relevant pseudonym is assigned – does not take place.

Purposes of processing
The use of tracking to analyze user behavior helps us to verify the effectiveness of our services, optimize those services, accommodate the needs of the user, and rectify errors. Additionally, such analysis serves to establish statistical reference values (coverage, intensity of use, user browsing be-havior) on the basis of uniform standard processes, which in turn yields values that can be applied and compared across the entire market.

Legal basis for processing
Consent in accordance with Article 6, Section 1, Item 1a) of the GDPR.

Data protection policy for using Google Analytics

This website uses features of the Google web analytics service, provided by Google Inc., 1600 Amphitheater Parkway Mountain View, CA 94043, USA.Google Analytics uses cookies. These are text files that are stored on your computer and enable analysis of your use of the website. Information regarding your use of the website is generated by the cookie and routinely transferred to a Google server in the USA where it is stored.More information on how user data is used by Google analytics can be found in Google’s privacy policy.

Browser Plugin

You can prevent cookies from being saved by activating a setting on your browser software; 4flow would like to kindly inform you that if you do this, you might not be able to fully utilize all functions of this website. You can furthermore prevent Google from capturing and processing data related to your use of the website (including your IP address), as well as the processing of this data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en

Objection to data collection

You can opt out collection of your data by Google Analytics by clicking on the following link. An opt-out cookie will be set, preventing your data from being collected: Disable Google Analytics

Data processing

4flow has an agreement with Google in regard to data processing and fully implements the strict requirements of the German data protection authorities when using Google Analytics.

Anonymous data collection

4flow uses IP address anonymization on this website. This means that within member states of the European Union and other states belonging to the European Economic Area, your Google IP address is abbreviated. Only in exceptional cases will a full IP address be transferred to a Google server in the USA to be stored. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to perform additional services connected with use of the website and the Internet in respect of the website operator. The IP address provided by your browser as part of Google analytics will not be merged with other Google data.

In the case that you would like to decline interest-based advertisement, you can also visit the website www.youronlinechoices.com, click on “Your Ad Choices”, and follow the instructions to individually or completely deactivate the use of your data for the purposes interest-based advertising by the service providers listed there. You will continue to receive advertisements, but they will no longer be interest-based.

Data protection declaration for the use of Leadfeeder

We use Leadfeeder, provided by Liidio Oy, located at Mikonkatu 17 C, Helsinki 00100, Finland as a tool for generating commercial leads and for visitor analysis. This means the service helps generate leads by analyzing what businesses visit certain websites. For this purpose, first party cookies and IP tracking technologies are used. The following data is collected and processed by the tool: websites visited, date and time of visit, IP addresses, referrer URLs, browser information, device operating systems, device information and domain names. Leadfeeder accesses the list of website visitors' IP addresses provided by Google Analytics in the evaluation and links the list of IP addresses with information about the companies found on the Internet for these IP addresses. Due to a shortening of web visitor IP addresses that occurs using Google Analytics, no direct personal reference is made. When reviewing the linked company information, personal references can only be made based on presumption.

The legal basis for the analysis of visitors to our website is article 6, paragraph 1f of the GDPR. Our legitimate interest lies in the possibility to contact new customers. You can object to the storage of a user profile or data concerning your use of our site by Leadfeeder at any time.

You can find more information on Leadfeeder's privacy policy here: www.leadfeeder.com/privacy

Data protection declaration for thw use of Mouseflow

This website uses Mouseflow: a website analytics tool that provides session replay, heatmaps, funnels, form analytics, feedback surveys, and similar features/functionality. Mouseflow may record your clicks, mouse movements, scrolling, form fills (keystrokes) in non-excluded fields, pages visited and content, time on site, browser, operating system, device type (desktop/tablet/phone), screen resolution, visitor type (first time/returning), referrer, anonymized IP address, location (city/country), language, and similar meta data. Mouseflow does not collect any information on pages where it is not installed, nor does it track or collect information outside your web browser. If you'd like to opt-out, you can do so at https://mouseflow.com/opt-out. If you'd like to obtain a copy of your data, make a correction, or have it erased, please contact us first or, as a secondary option, contact Mouseflow at privacy@mouseflow.com.

For more information, see Mouseflow’s Privacy Policy at https://mouseflow.com/legal/company/privacy-policy/

For more information on Mouseflow and GDPR, visit https://mouseflow.com/legal/gdpr/. For more information on Mouseflow and CCPA/VCDPA visit https://mouseflow.com/legal/ccpa.

All relevant information about the tracking procedures in use can be found here in the Usercentrics Consent Management Tool.

III.    Rights of affected persons

1.    Right to object
In the case that we process your personal data to generate direct advertising, you have the right to assert your objection at any time and with future effect to such processing of your personal data for the purposes of said advertising;

You also have the right to assert your objection at any time and with future effect, for reasons arising from your particular situation, to the processing of your personal data which occurs according to Article 6, Section 1, Items e) or f) of the GDPR; the exercise of your right to objection carries no related monetary costs.

You can reach us using the contact data listed in I.2.

2.    Right to information
You have the right to be informed as to whether we do or have processed your personal data, which data is affected in particular, as well as other information as established in Article 15 of the GDPR.

3.    Right to correction
You have the right to demand that we immediately correct any of your personal data that is inaccurate (Article 16 of the GDPR). Subject to consideration of the purposes of the processing, you have the right to demand the completion of any incomplete personal data, including by way of an amendatory declaration.

4.    Right to deletion (“Right to be forgotten”)
You have the right to demand that we immediately delete your personal data, so long as one of the grounds listed in Article 17, Section 1 of the GDPR applies and the processing of such data is not necessary for the purposes enumerated in Article 17, Section 3 of the GDPR.

5.    Right to restriction of processing
You have the right to demand restriction of the processing of your personal data if one of the requirements enumerated in Article 18, Section 1, Item a) through d) of the GDPR is met.

6.    Right to data transferability
You have the right to obtain the personal data you have made available to us in a structured, well-established and machine-readable format. Furthermore, you have the right to transfer or otherwise provide such data to another responsible party, with no hindrance from us, such that we will undertake immediate transmission of said data to the party named, insofar as such transmission is technically possible. This provision shall apply in all cases in which the basis for data processing consists in a declaration of consent or contract and in which the data will be processed in an automated way. Accordingly, this provision shall not apply to data available solely in hard copy form.

7.    Right to withdraw consent
Insofar as the processing of your personal data is predicated upon your declaration of consent, you have the right to withdraw that consent at any time. The legal permissibility of processing based upon your declaration of consent prior to such withdrawal shall remain unaffected.

8.    Right to appeal
You have the right to appeal to a regulatory authority.