Data privacy

I. Overview
1. Scope
2. Data controller
3. Data protection officer
4. Data Security

II. Data processing in detail
1. General information on data processing
2. Use of our website services
3. Newsletter, studies, white papers, on-demand recordings
4. Live webinars and digital events
5. Emails to existing customers
6. Social media pages
7. Lead generation via LinkedIn
8. Online appointment booking via Microsoft Bookings
9. User surveys
10. Distribution of information to the press
11. Use of AI Tools in Marketing  
12. Tracking 
13. Customer support, contact  
14. Employment applications 
15. Accessing iTMS Log-in pages
16. Video surveillance at our headquarters

III. Rights as a data subject
1. Right to object
2. Right of access
3. Right to rectification
4. Right to erasure (“Right to be forgotten”)
5. Right to restriction of processing
6. Right to data portability
7. Right to withdraw consent
8. Right to appeal

In this section of the data protection declaration, you will find information regarding the scope of application, the parties responsible for data processing, the data protection officer, and data security.

1. Scope

The data processing activities carried out by 4flow can generally be divided into two categories:

• For the purposes of contract settlement, all data necessary for the execution of a contract with 4flow shall be processed. For cases in which external service providers are also party to settlement of a contract, your data will be transmitted to those parties to the extent necessary for the execution of their duties.
• Upon your use of websites or applications belonging to 4flow, various information is exchanged between your end-user device and our servers. This information may also include personal data. The information gathered in this process can be used to, among other things, optimize our website.
• This data privacy policy also serves as a data privacy notice for video surveillance at our headquarters, as indicated by a corresponding notice with a link to this data privacy policy

This data protection declaration applies to the following offerings:

• Our online offerings available at www.4flow.de; www.4flow.de; www.4flow.com; www.4flow.cn; www.4flow.com.br; www.4flow.fr
• All other cases in which you are referred to this data protection declaration by one of our offerings (e.g. websites, subdomains, mobile applications, web services or integrations on third party sites), regardless of the way in which you access or use that offering. These offerings, in aggregate, shall hereinafter be referred to as our “services”.

2. Data controller

The party responsible for data processing in the context of our Services is:

4flow SE
Hallerstrasse 1
D-10587 Berlin, Germany
T: +49 (0)30 39740-0
E:contact@4flow.com

3. Data protection officer

You can contact our data protection officer as follows:

DS EXTERN GmbH
Mr. Marc Althaus
Frapanweg 22
D-22589 Hamburg, Germany
https://www.dsextern.de/anfragen

 4. Data Security

We employ technical and organizational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security measures are continually improved in line with technological developments.

II. Data processing in detail 

In this section of the data protection declaration, we will inform you in detail about how your personal data is processed in the context of our services. For the sake of providing an overview, we have divided the corresponding items according to specific functions of our services. During normal use of our services, it may be the case that various functions – and the corresponding data processing – take place sequentially or simultaneously. 

1. General information on data processing 

a. No obligation of provision 

There is no contractual or legal obligation for the provision of personal data. You are not obligated to provide such data. 

b. Consequences of non-provision 

There is no contractual or legal obligation for the provision of personal data. You are not obligated to provide such data. 

c. Consent 

In various cases, you have the option to grant us your consent to further process your personal data (or parts thereof) in the manners listed below. In such cases, we will in particular inform you – in the context of the corresponding declaration of consent – of the modalities and extent of such consent, as well as of the purposes for which the processing will take place. 

d. Transmission of personal data to third countries 

If we transmit data to third countries – that is, countries outside of the European Union – then such transmission shall take place exclusively in accordance with the legally established permissibility requirements. These permissibility requirements are defined in Articles 44 through 49 of the GDPR. 

e. Hosting with external service providers 

Our data processing takes place largely in the context of hosting service providers who supply us with storage space and processing capacity in their data centers. These service providers also process personal data on our behalf upon our request to do so. Either these service providers process data exclusively within the EU, or we have guaranteed an appropriate degree of data protection based on the EU standard contractual clauses for the transfer of personal data. 

f. Transmission to government agencies 

We transmit personal data to government agencies (including law enforcement agencies) in cases that such transmission is necessary for the fulfillment of our legal obligations [legal basis: Article 6, Section 1, Item c) of the GDPR] or for the assertion, exercise or defense of legal claims [legal basis: Article 6, Section 1, Item f) of the GDPR]. 

g. Duration of retention 

We do not retain or store your data longer than strictly necessary for the relevant processing purposes. In the case that such data is no longer needed for the fulfillment of contractual or legal obligations, the data is regularly deleted unless its limited retention is otherwise necessary. Grounds for such retention include: 

• The fulfillment of commercial and tax law-related retention obligations
• The preservation of evidence for legal disputes in the context of statutes of limitation 

It is additionally possible for us to continue to store your data, insofar as you have provided your explicit consent for us to do so. 

h. Data categories 

Account data: Login ID/user name and password 

Personal master data: Title, salutation, gender, first name, last name, date of birth, company affiliation, position 

Address data: Street address, address suffix (if applicable), ZIP code, city, country 

Contact data: Telephone number(s), fax number(s), email address(es), participation at events 

Registration data: Information about the service through which you have registered; time stamps and technical information relating to your registration, confirmation and deregistration; data you provide during the registration process 

Order data: Products ordered, prices, payment and delivery information    

Payment data: Account data, credit card data, and data corresponding other payment services such as Paypal    

Access data: Date and time of your visit to our service; the website from which the accessing system was referred to our website; accessed pages upon use; data for session identification (session ID); furthermore, the following information corresponding to the computer system accessing the services: internet protocol address used (IP address), browser type and version, type of device, operating system and similar technical information 

Employment application data: Curriculum vitae, degrees, supporting documents, work samples, certificates, pictures, motivation letter, residence permit (if applicable) 

Data according to Article 9 of the GDPR: Data according to Article 9 of the GDPR are not actively collected. An unsolicited receipt of this information cannot be prevented. There is no further processing of this data. 

2. Use of our website 

This section describes how we process your personal data when you use our websites. In particular, we would like to inform you that the transmission of access data to external content providers (see item “2a-b.”) is unavoidable due to technical limitations with regard to information transfer on the internet. 

3. Newsletter studies, white papers, on-demand recordings 

On our websites, we offer a wide variety of newsletters, email communications and downloads available on the basis of user consent. We process your personal data in the context of subscription to our newsletter or of request of other documents as follows: 

4. Live webinars, digital and physically events 

We frequently host live webinars and other digital events on the basis of user consent. We process your personal data in the context of promotion and registration for live webinars and digital events as follows: 

 Here you can find the page where you can unsubscribe. 

5. Emails to existing customers 

We send marketing emails to our existing customers in accordance with the requirements laid out in Article 7, Section 3 of the German law against unfair business practices (UWG) and make use of personal data in the following way: 

6. Social media pages 

Facebook 

We have a fan page on the social network “Facebook” under the URL https://www.facebook.com/4flowglobalcareers, which is operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland (“Meta”). You can find Meta´s data protection policy here: https://www.facebook.com/about/privacy 

Access to and interaction on our Facebook fan page leads to personal data processing, regardless of whether or not you have a Facebook profile. If you are logged into your Facebook profile when you access our Facebook fan page, Facebook and/or its affiliated companies may combine the information of your visit to our Facebook fan page with your personal profile information. This could be used to create user profiles. If you would like to avoid this type of profile creation, please log out of your Facebook account before visiting our Facebook fan page. 

Meta provides us with statistical data about the use of our Facebook fan page with the “Facebook Insights” function. The data includes information such as gender, age, location, page views, interactions and information about paid activities, reach, accounts reached, impressions and impressions per day. Important to note: We cannot identify individual users based on the data from our Facebook page. The use of data generated by “Facebook Insights” is based on Article 5, Section 1f of the GDPR. Our legitimate interest consists of making our Facebook fan page more attractive and providing content based on user interests. 

Since we are, together with Meta, responsible for using your data on our Facebook page, we have a written agreement with Meta, which you can read here: https://www.facebook.com/legal/terms/page_controller_addendum. 

As a data subject, you have the rights mentioned in this data protection declaration. You can invoke your right to us or to Meta directly at https://www.facebook.com/help/contact/540977946302970. If you invoke your right to us, we will forward your requests to this Facebook site, as per our agreement with Meta. 

XING 

We maintain a profile on the social network XING at: https://www.xing.com/companies/4flow. XING is operated by New Work SE. Information on what personal data is processed by XING when you access our website can be found at: https://privacy.xing.com/de/datenschutzerklaerung. 4flow SE does not collect any personal data when you access our profile on XING. 

LinkedIn 

We maintain a profile on the social network LinkedIn at: https://de.linkedin.com/company/4flow. LinkedIn is a service operated by LinkedIn Ireland Unlimited Company. Information on what personal data is processed by LinkedIn for what purposes when you access our website can be found at https://www.linkedin.com/legal/privacy-policy. 4flow SE does not collect any personal data when you visit our profile on LinkedIn. 

YouTube 

On our website, we embed videos from YouTube, a platform operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For privacy reasons, no third-party content is loaded and the third-party provider receives no information when you access our website. Only once you have given consent via our banner is third-party content loaded. At this point, the provider receives information that you have accessed our site as well as the technically necessary usage data. The provider is then also able to implement tracking technologies. We have no influence on further data processing by the third party. Your consent covers the loading of third-party content. Embedding occurs based on your consent, provided you have given it via our banner. 

Please note that embedding certain video services may result in your data being processed outside the EU/EEA (particularly in the USA). If this is the case, the following table provides information on the level of data protection. 

Please note that the embedding of certain video services may result in your data being transferred outside the EU or the EEA. The transfer of personal data to the US cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework, and standard contractual clauses have been entered into. 

7. Lead generation via LinkedIn 

How we process your personal data for lead generation via the social network LinkedIn: 

8. Online appointment booking via Microsoft Bookings 

On our website we use Microsoft Bookings for online appointment booking. Microsoft Bookings is software provided by Microsoft Ireland Operations Limited. The connection to the service is only established when you call up the online booking function via a link or button on our website, in an email or in the newsletter. To make an appointment, your entries in the form are transferred to Microsoft. For more information on the purpose and scope of data collection and its processing by Microsoft Bookings, please refer to Microsoft's privacy policy at https://privacy.microsoft.com/de-de/privacystatement. 

The data you entered when making an appointment online, but at least your name, e-mail address and telephone number, will be processed. The legal basis for the processing of your data in relation to the "Microsoft Bookings" service is Art. 6 para. 1 lit. a) GDPR (your consent), Art. 6 para. 1 lit. b) GDPR (in the context of contractual relationships), and Art. 6 para. 1 lit. f) GDPR (our legitimate interest). The legitimate interest results from our claim to offer you a user-friendly website with a wide range of functions and to give you the opportunity to make an appointment with us quickly and easily at any time if required. 

Please note that you are not obliged to use Microsoft Bookings to make an appointment. If you do not wish to use the service, please use another of the contact options offered to make an appointment. 

You have the option to revoke your consent to data processing or to object to the use of the data at any time. In this case, the intended contact is no longer possible or communication that has already begun can no longer be continued. The data will be deleted as soon as it is no longer required to achieve the purpose. 

Audio and video conferences with Microsoft Copilot in Microsoft Teams Meetings 

If you communicate with us via video or audio conference, your personal data that you provide for the audio and video conference will be collected and processed. This may include the name of the participant, duration of the conference, start and end (time) of participation in the conference, number of participants and other “contextual information” in connection with the communication process (metadata). 

Furthermore, all technical data required to process the online communication is processed. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker and the type of connection. 

If content is exchanged, uploaded or made available in any other way within the tool, this is also stored on the servers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared while using the service. 

Further information on data processing can be found in the Microsoft Teams privacy policy: https://privacy.microsoft.com/de-de/privacystatement. 

Conclusion of a contract for order processing 

We have concluded an order processing contract with the provider of Microsoft Teams and implement the requirements of the data protection authorities when using Microsoft Teams. 

Purpose and legal basis 

The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6 para. 1 sentence 1 lit. b GDPR). Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). If consent has been requested, the tools are used on the basis of this consent; consent can be withdrawn at any time with effect for the future. 

Storage duration 

The data collected directly by us via the video and conference tools will be deleted from our systems as soon as you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory retention periods remain unaffected. We have no influence on the storage period of your data that is stored by the operators of the conference tools for their own purposes. For details, please contact the operators of the conference tools directly. 

9. User surveys 

10. Distribution of information to the press 

You can find what we do with your personal data in the context of distributing information to the press here: 

11. Use of AI Tools in Marketing 

As part of our marketing and communication activities, we may use AI-powered tools. These tools support us, for example, in creating and optimising content, analysing usage and interaction data, personalising marketing activities, and planning and evaluating campaigns. Personal data is processed by such tools only insofar as this is necessary for the purposes stated above and a legal basis under data protection law exists. In doing so, we pay particular attention to data minimisation, purpose limitation and transparency. Where external service providers process personal data on our behalf, this is carried out on the basis of a corresponding data processing agreement pursuant to Art. 28 GDPR. If personal data is transferred to third countries, in particular the United States, such transfers take place only in compliance with the statutory requirements for international data transfers. No decision based solely on automated processing that produces legal effects or similarly significantly affects data subjects is made as part of our marketing activities. Further information on the providers used, the data processed, the purposes of processing, storage periods and any transfers to third countries can be found in the relevant sections of this Privacy Policy. 

12. Tracking 

In this section, we describe how we use tracking technology to process your personal data for the purposes of analysis and service optimization. 

The description of the tracking procedure also contains information about how you can hinder or refuse such data processing. Please note that the so-called “opt-out” (that is, the refusal of such processing) is generally documented using cookies. If you use our services with a new end-user device or browser, or if you have deleted the cookies in your existing browser, you must complete the opt-out process again. 

The corresponding tracking procedures process your personal data in a solely pseudonymous form. A connection with a concretely identified natural person – that is, a consolidation of the collected data with information about the person to whom the relevant pseudonym is assigned – does not take place. 

Purposes of processing 

The use of tracking to analyze user behavior helps us to verify the effectiveness of our services, optimize those services, accommodate the needs of the user, and rectify errors. Additionally, such analysis serves to establish statistical reference values (coverage, intensity of use, user browsing be-havior) on the basis of uniform standard processes, which in turn yields values that can be applied and compared across the entire market. 

Legal basis for processing 

The storage of cookies or access to information already stored on your device is based on your consent pursuant to Section 25, Paragraph 1 of the German Telecommunications-Digital-Services-Data-Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG). The subsequent processing of the personal data collected in this way is based on Article 6, Paragraph 1, Sentence 1, Letter a) of the General Data Protection Regulation (GDPR). 

Data protection policy for using Google Analytics 

This website uses features of the Google web analytics service, provided by Google Inc., 1600 Amphitheater Parkway Mountain View, CA 94043, USA.Google Analytics uses cookies. These are text files that are stored on your computer and enable analysis of your use of the website. Information regarding your use of the website is generated by the cookie and routinely transferred to a Google server in the USA where it is stored.More information on how user data is used by Google analytics can be found in Google’s privacy policy. 

Browser Plugin 

You can prevent cookies from being saved by activating a setting on your browser software; 4flow would like to kindly inform you that if you do this, you might not be able to fully utilize all functions of this website. You can furthermore prevent Google from capturing and processing data related to your use of the website (including your IP address), as well as the processing of this data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en 

Objection to data collection 

You can opt out collection of your data by Google Analytics by clicking on the following link. An opt-out cookie will be set, preventing your data from being collected: Disable Google Analytics 

Data processing 

4flow has an agreement with Google in regard to data processing and fully implements the strict requirements of the German data protection authorities when using Google Analytics. 

Anonymous data collection 

4flow uses IP address anonymization on this website. This means that within member states of the European Union and other states belonging to the European Economic Area, your Google IP address is abbreviated. Only in exceptional cases will a full IP address be transferred to a Google server in the USA to be stored. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to perform additional services connected with use of the website and the Internet in respect of the website operator. The IP address provided by your browser as part of Google analytics will not be merged with other Google data. 

In the case that you would like to decline interest-based advertisement, you can also visit the website www.youronlinechoices.com, click on “Your Ad Choices”, and follow the instructions to individually or completely deactivate the use of your data for the purposes interest-based advertising by the service providers listed there. You will continue to receive advertisements, but they will no longer be interest-based. 

Data protection declaration for the use of Mouseflow 

This website uses Mouseflow: a website analytics tool that provides session replay, heatmaps, funnels, form analytics, feedback surveys, and similar features/functionality. Mouseflow may record your clicks, mouse movements, scrolling, form fills (keystrokes) in non-excluded fields, pages visited and content, time on site, browser, operating system, device type (desktop/tablet/phone), screen resolution, visitor type (first time/returning), referrer, anonymized IP address, location (city/country), language, and similar meta data. Mouseflow does not collect any information on pages where it is not installed, nor does it track or collect information outside your web browser. If you'd like to opt-out, you can do so at https://mouseflow.com/opt-out. If you'd like to obtain a copy of your data, make a correction, or have it erased, please contact us first or, as a secondary option, contact Mouseflow at privacy@mouseflow.com. 

For more information, see Mouseflow’s Privacy Policy at https://mouseflow.com/legal/company/privacy-policy/ 

For more information on Mouseflow and GDPR, visit https://mouseflow.com/legal/gdpr/. For more information on Mouseflow and CCPA/VCDPA visit https://mouseflow.com/legal/ccpa. 

Data protection policy for using Guideflow Product Demos 

When you use Guideflow product demos (for example, interactive demo guides or quick product walkthroughs), personal data is processed only to the extent necessary to provide and optimize the demo features and to follow up with you. 

Your data is transferred to HubSpot via our embedded HubSpot forms if you explicitly consent to this. HubSpot acts as a CRM service provider and stores your data in a secure, GDPR‑compliant environment. 

What data is collected? 

The Guideflow demo pages and HubSpot forms may collect the following information: 

• Name, email address, phone number (if provided), company name, job title, and any other fields you complete in the form.
• Information about your demo usage (for instance, interactions with specific steps, time spent, progress in the demo flow), if this is linked to your identity and you have consented to it. 

These data are processed in Guideflow and in HubSpot to analyze demo interactions, improve the user experience, and contact you with relevant product or service information. 

Legal basis and consent 

We process your personal data based on your explicit consent, which you give via the consent checkbox in the HubSpot form. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal. 

Data may also be processed where we have a legitimate interest, for example, to optimize the demos or to ensure technical stability. In such cases, we always ensure that your interests and fundamental rights are appropriately protected. 

Data transfer to HubSpot 

The data you enter in the form are automatically sent to HubSpot. Within HubSpot, your data are stored and processed according to the privacy and security settings configured there. HubSpot complies with GDPR requirements and offers tools for consent management, as well as for deletion or anonymization of your data upon request. 

Where data are transferred to third countries (for example, outside the EU), this is typically done under Standard Contractual Clauses (SCCs). 

How the data are used 

Your data are used to: 

• Manage your identity and contact details.
• Grant you access to product demos and analyze how you use them.
• Contact you by email or other channels with marketing communication, product information, or service updates, if you have consented to this. 

You can unsubscribe from marketing communications at any time by using the unsubscribe link in each email or by contacting us directly. 

Storage and deletion 

We keep your personal data only as long as necessary for the purposes described above or until you withdraw your consent. Upon request, your data in HubSpot will be anonymized or deleted, unless legal retention obligations prevent this. 

Your rights 

You have the right to access, rectify, erase, restrict processing of, and object to the processing of your personal data, as well as to data portability. You may also object at any time to the processing of your data for direct marketing purposes. 

All relevant information about the tracking procedures in use can be found here in the Usercentrics Consent Management Tool. 

13. Customer support, contact 

We process your personal data for customer service purposes, use of the contact form, booking-form for appointments or other forms of contacts, as follows: 

14. Employment applications 

During an ongoing application for employment, we process your personal data in the following way: 

15. Accessing iTMS Log-in pages 

The following information describes how your personal data is processed when you access iTMS Log-in pages. 

16. Video surveillance at our headquarters: 

This data privacy notice provides you with an overview of the personal data we collect as part of video surveillance in the entrance area of our headquarters. 

We also inform you about your rights and who you can contact if you have any questions or wish to exercise your rights. 

Description and scope of data processing 

The entrance area of our headquarters is monitored by several cameras. The video surveillance system continuously records activities in the monitored areas. The video recordings may capture both 4flow employees and external persons who are in the monitored areas. The recordings, as well as the date and time of recording, are temporarily stored. In certain, precisely defined cases, in particular if a criminal offense is suspected, the recordings are stored separately and can be viewed by authorized employees. 

Purposes and legal basis of data processing 

Video surveillance is carried out to enforce house rules, prevent criminal offenses, and 

assert, exercise, or defend legal claims. The legal basis for video surveillance is Art. 6 (1) lit. f) GDPR, whereby our interests arise from the aforementioned purposes. 

Storage period and deletion of data 

Video recordings are generally deleted after 72 hours at the latest. Longer storage only takes place if there is a specific legal reason, for example in the event of suspicion of a criminal offense or a legal retention obligation. 

Your rights and our contact details 

Information on your rights can be found in Section III. Rights of data subjects. To exercise your rights or if you have any further questions, please contact us using the contact details provided in sections 2 and 3. 

The GDPR grants you certain rights as a data subject when your personal data is processed:

1. Right of access (Article 15 GDPR)

You have the right to obtain confirmation as to whether or not personal data concerning you is being processed. Where that is the case, you have the right to access such data and to the information listed in Article 15 GDPR.

2. Right to rectification (Article 16 GDPR)

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete data.

3. Right to erasure (Article 17 GDPR)

You have the right to obtain the erasure of personal data concerning you without undue delay where one of the grounds set out in Article 17 GDPR applies.

4. Right to restriction of processing (Article 18 GDPR)

You have the right to obtain restriction of processing where one of the conditions in Article 18 GDPR applies, e.g., where you contest the accuracy of the data, for a period enabling the controller to verify it.

5. Right to data portability (Article 20 GDPR)

In certain cases, as set out in Article 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format, or to have those data transmitted to another controller.

6. Right to withdraw consent (Article 7 GDPR)

If processing is based on your consent, you have the right under Article 7(3) GDPR to withdraw your consent to the processing of your personal data at any time. Please note that the withdrawal is effective only for the future. Processing before the withdrawal remains unaffected.

7. Right to object (Article 21 GDPR)

Where data is processed on the basis of Article 6(1)(f) GDPR (processing for legitimate interests) or Article 6(1)(e) GDPR (processing for the performance of a task carried out in the public interest or in the exercise of official authority), you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defense of legal claims.

8. Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

Under Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your data violates data protection law. The right to lodge a complaint may be exercised before a supervisory authority in the member state of your habitual residence, your place of work, or the place of the alleged infringement.