Imprint

Provider identification

This website is operated by flustix GmbH. The company is legally represented by its managing director, Malte Biss.

Registration

VAT ID: DE311839341
Charlottenburg Local Court (Amtsgericht Charlottenburg)
HRB 186148 B

Address

FLUSTIX GmbH
Kronprinzendamm 20
10711 Berlin

Contact

Phone: +49 (0) 30 3982 0696 0
E-mail: contact@flustix.com

Liability

This website is compiled with the greatest possible care. Nevertheless, no guarantee can be given for the accuracy and correctness of the information it contains. Any liability for damages arising directly or indirectly from the use of this website is excluded, unless caused by intent or gross negligence. Where this website links to internet pages operated by third parties, FLUSTIX GmbH accepts no responsibility for their content.

FLUSTIX GmbH is neither obliged nor generally willing to participate in dispute resolution proceedings before a consumer arbitration board (§ 36 German Consumer Dispute Resolution Act, VSBG).

For the out-of-court settlement of consumer disputes, the European Union has set up an online platform (“ODR platform”) that you can turn to. You can find the platform at http://ec.europa.eu/consumers/odr/.

Responsible for content

FLUSTIX GmbH
Kronprinzendamm 20
10711 Berlin
Germany

Trademarks

Unless otherwise stated, all trademarks on this website are protected under trademark law in favour of FLUSTIX GmbH and/or the artists. This applies in particular to label names, logos and emblems.

Design & Development

Dan Sax – Head of Design & Marketing @ flustix
d.sax@flustix.com

1. Controller

The controller responsible for data processing on this website is:

FLUSTIX GmbH
Kronprinzendamm 20
10711 Berlin
Germany

Represented by its managing director, Malte Biss.
Phone: +49 (0) 30 3982 0696 0
E-mail: contact@flustix.com

For privacy-related questions, please contact contact@flustix.com.

2. Principles of data processing

We process personal data only to the extent necessary to provide a functional website and our content. The legal bases are in particular Art. 6(1) GDPR: consent (lit. a), performance of a contract or pre-contractual measures (lit. b), compliance with a legal obligation (lit. c) and the safeguarding of our legitimate interests (lit. f).

3. Hosting

This website is hosted by a service provider in Germany:

Mittwald CM Service GmbH & Co. KG
Königsberger Straße 4–6
32339 Espelkamp, Germany

The provider processes, on our behalf, the data generated when you visit the website. This is based on a data processing agreement (Art. 28 GDPR); the servers are located in Germany. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

The certification database runs on the subdomain datenbank.flustix.com. It is hosted by the same provider under the same conditions; when you open the database pages, data (such as company logos) is loaded from there, producing the same server log files as described above.

4. Server log files

When you access the website, the server automatically collects information that your browser transmits and that is technically necessary to display the website and to ensure its stability and security:

• IP address of the accessing device
• date and time of access
• page or file requested
• referring page (referrer)
• browser and operating system used

This data is stored only briefly and then deleted. It is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR.

5. Cookies and local storage

This website does not use tracking cookies for audience measurement and does not use a cookie banner. Cookies are stored in two cases only:

• “mtm_consent_removed” is set if you object to measurement via the opt-out function (see “Objection to audience measurement”). It stores your decision permanently.
• “flx_wp_frei” is set by our server in two cases: once you have completed the form before downloading a whitepaper or a study, or once you have opened a link that unlocks the documents without a form (for both, see “Downloading whitepapers and studies”). It contains nothing but the value “1”, no personal data, and expires after one year. It ensures that you do not have to complete the form again for further documents, including when you later open a document directly via its address.

In addition, the website places a few technically necessary entries in your browser’s local storage. There are exactly three:

• “flx-hinweis-gesehen” records that you have acknowledged the privacy notice at the bottom of the screen, so that it does not reappear on every page view. This entry remains until you clear your browser data.
• “scrollTarget” remembers, when you click a menu item, which section of the target page you wanted to jump to.
• “blogUebersicht” remembers your selection in the blog overview, that is the search term, category and page number, so that you return to the same place after reading an article.

Your browser deletes the last two entries as soon as you close the tab.

The local storage entries remain on your device and are transmitted neither to us nor to third parties. The two cookies are sent by your browser to our own server with every request; they do not reach third parties. Neither the cookies nor the entries contain an identifier by which a person could be recognised, and they are not used to analyse your behaviour. Under Section 25(2) TDDDG no consent is required for them, because they are strictly necessary to provide the functions you have requested.

6. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in your browser's address bar.

7. Audience measurement with Matomo (cookieless)

To analyse and improve our website, we use the open-source software Matomo. We host Matomo ourselves. The data is processed exclusively on our own server in Germany (stats.flustix.com) and is not shared with third parties.

Matomo is configured in a data-minimising way:

• No tracking cookies are set and no persistent identifiers are stored on your device.
• Nor are any characteristics of your device read out, such as screen resolution, colour depth or installed browser extensions. Only the information your browser transmits anyway when a page is requested is evaluated.
• Your IP address is shortened before storage (the last 2 bytes are removed) and is not stored in full. The full IP address is used only briefly for approximate geolocation and is then discarded.
• No cross-site tracking takes place.
• The referrer URL is anonymised; only the domain of the referring website is stored.
• Campaign parameters contained in links, such as source, medium, campaign and content variant, may be evaluated for aggregated measurement of our marketing activities.
• Clicks on certain internal navigation anchors and external calls to action, such as appointment booking, quote request, database or LinkedIn links, may be recorded in Matomo as generic events. No full destination URLs, URL parameters or visible link texts are transmitted.
• The “Do Not Track” setting of your browser is respected where it is technically transmitted.

The data collected may include, for example, the pages accessed, the origin of the visit, campaign parameters, generic click events, the approximate region, and the browser and device type your browser reports itself. The purpose is statistical analysis of website usage in order to measure reach, evaluate campaigns in aggregated form and improve the website.

If you access our website via a campaign link, for example from LinkedIn, campaign parameters contained in the URL, such as source, medium, campaign and content variant, may be evaluated. We use these parameters exclusively for aggregated measurement of our marketing activities and not to identify individual persons.

As this measurement neither stores information on your device nor accesses information already stored there, no consent under Section 25 TDDDG (the German implementation of the ePrivacy Directive) is required. The legal basis for the subsequent processing is our legitimate interest in privacy-friendly, needs-based analysis of our website (Art. 6(1)(f) GDPR). The raw data collected is deleted after no more than 180 days.

On the booking page we additionally record whether a time was clicked and whether a booking was completed. Only the type of event is transmitted, not the chosen appointment and no contact details.

8. Objection to audience measurement (opt-out)

You can object to being measured by Matomo at any time with effect for the future. Simply clear the box below.

Your objection is then stored on your device in a cookie named “mtm_consent_removed”. This cookie is the only one that can arise in connection with audience measurement at all. It is created solely by your objection and serves only to honour it on future visits. Such storage requires no consent under Section 25(2) TDDDG, because it is strictly necessary to carry out the wish you have expressly stated.

9. Measuring the success of our ads (without cookies)

We run ads on Google Ads and LinkedIn. To find out which ad led to an enquiry, we use neither a tracking pixel nor an advertising tag from these providers on this website.

Where an ad leads to this website, the advertising systems append an identifier to the address of the landing page when you click (“gclid” for Google, “li_fat_id” for LinkedIn). This identifier is passed on within our website in the address and is taken over when you submit a form. It is not stored on your device and not read from it: no cookies are set and no information from your browser’s local storage is used. No consent under section 25 TDDDG is required for this.

If you arrive without such an identifier, for example via a search engine or a link on another website, we pass on in the same way only the name of the website you came from (for example google.com), without path and without search term. Your browser sends this information with every page request anyway. It is taken over with a form you submit and shows us which routes lead enquiries to us. The legal basis is our legitimate interest in this analysis (Art. 6(1)(f) GDPR).

Links that we send or print ourselves, for example in emails, newsletters, PDF documents or behind QR codes, carry a short word in the address that only names the type of link (for example “von=newsletter” or “von=pdf”). It is the same for all recipients of such a link and does not allow any conclusions about you as a person. It is passed on within our website in the same way, is not stored on your device and is taken over with a form or an appointment booking you submit. It shows us which of our own routes lead enquiries to us. Here too, the legal basis is our legitimate interest in this analysis (Art. 6(1)(f) GDPR).

If such an enquiry turns into a qualified business contact, we report this back to the advertising system concerned. To Google Ads we transmit only the click identifier, the time and an internal reference number. No details about you as a person are transmitted. We do not declare any consent to Google; the value we send is “unspecified”.

LinkedIn’s own lead forms are a separate matter: if you request a document there, you fill in a form belonging to LinkedIn, not one on this website. Your details are collected by LinkedIn, on the basis of the consent you give there; this website is not involved. LinkedIn then passes the details to our CRM system (see “Contacting us”). If a qualified business contact results, we report this back to LinkedIn. The match is made using a SHA-256 hashed version of your email address as well as name, company and role, where you provided them to LinkedIn. These details come from that same form and therefore go back to where they came from.

If you come to this website via a link from LinkedIn, for example from a post or an ad with campaign details in the address, and submit a form here, the same applies: if a qualified business contact results, we report this back to LinkedIn, matched using a SHA-256 hashed version of your email address as well as name, company and role, where you provided them in the form.

The legal basis for these reports is our legitimate interest in measuring the success of our own advertising (Art. 6(1)(f) GDPR, see Recital 47). The recipients are Google Ireland Limited and LinkedIn Ireland Unlimited Company, both established in the European Union. Access by their respective US parent companies cannot be ruled out; the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR apply to this.

You may object to this processing at any time (Art. 21 GDPR), informally by email to the address given above. We will then not report anything back. Independently of that, you can remove the identifier from your browser’s address bar before submitting a form; the enquiry will then be transmitted without it.

10. Contacting us

If you contact us by email or telephone, we process your details in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry).

Contact form: you can send us a message on our contact page. We collect the details you enter: first and last name, email address, company and your message, and optionally position and telephone number.

The form is not embedded from a third party. Merely opening the page transfers no data to third parties and sets no third-party cookies. When you submit the form, your details first go to our own server. From there we forward them to our customer relationship system HubSpot, where we store them to handle your enquiry, and additionally by email to our own mailbox.

We also send a confirmation of your enquiry to the email address you provide. It contains the documents and links belonging to your enquiry and is part of handling it, not advertising. You receive it once per submission; it does not sign you up to any newsletter.

Our confirmation emails contain a 1×1 pixel image and links that are routed through our own server zentrale.flustix.com. When your email client displays the message and loads that image, and when you click one of the links, we store the time, the browser identification and the destination of the link as well as the IP address of the request shortened to its first three parts, tied to the respective confirmation email and therefore to your email address. This tells us whether our confirmations arrive and are read and which documents are used. The shortened IP address serves solely to recognise requests from our own company and from security filters so that they are not counted as reading. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in communication with you that works. The data stays on our own server; no third-party service is involved, and nothing is passed on to third parties. The entries are dropped on a rolling basis, at the latest after 2,000 further confirmation emails. You can object to this by blocking images in your email client and typing the address of a link in directly instead of clicking it. You may also send us a short reply, and we will remove the entry.

HubSpot is operated by HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA. We use the European instance of the service; data is stored on servers within the European Union, although access from the USA cannot be ruled out. The basis is a data processing agreement under Art. 28 GDPR, which forms part of HubSpot's terms of service and includes the EU Commission's standard contractual clauses for transfers to third countries. For details see HubSpot's privacy policy: https://legal.hubspot.com/privacy-policy

The legal basis for processing the form details is your consent under Art. 6(1)(a) GDPR, given when you submit the form, and Art. 6(1)(b) GDPR where your enquiry concerns a contract. You may withdraw your consent at any time with effect for the future, for example informally by email to contact@flustix.com. This does not affect the lawfulness of processing carried out before the withdrawal.

We delete your enquiry as soon as it is no longer required for the stated purpose, at the latest once the underlying matter has been concluded and no statutory retention obligations apply.

11. Downloading whitepapers and studies

Some documents, namely our whitepapers, studies and individual information papers, are provided in exchange for contact details. We ask for first and last name, email address and company; the telephone number is optional. The purpose is to provide the requested document and to be able to respond to your enquiry about it.

The legal basis is Art. 6(1)(b) GDPR, as the processing serves to fulfil your request and to initiate a possible contractual relationship, supplemented by Art. 6(1)(f) GDPR based on our legitimate interest in addressing prospective customers.

The details are not stored on our server. It receives them and forwards them directly to our customer management system HubSpot; details on this, including transfers to third countries, can be found under “Contacting us” and “Transfer to third countries”. We additionally receive an email notification so that no enquiry is lost.

So that you do not have to enter your details again for a further download, our server sets a cookie named “flx_wp_frei” after submission (see “Cookies and local storage”). It contains no personal data, only a note that the form was completed. It expires after one year. You can delete it at any time by clearing your browser data. If you open one of these documents directly via its address without that cookie being present, our server redirects you to the Download Center and shows the form there.

Our server also sets the same cookie when you open an unlock link. We send such links in our confirmation emails and use them in advertisements so that you do not have to provide details a second time that you have already given us. The link itself contains a key but no information about you. If you open it from a confirmation email, that click is attributed to the email as described under “Contacting us”. After it is opened, we reload the same page without that key.

With the download you also sign up for our newsletter; the form points this out before you submit it. You can unsubscribe at any time, including right after the download. Details under “Newsletter”.

12. Free EmpCo Claim Check

You can submit environmental claims for review through our EmpCo Claim Check form. We ask for the product concerned, the claims themselves, where they are used, as well as first and last name, email address and company; position, country, telephone number and a preferred date are optional. The purpose is to produce the assessment report you requested and to send it to you.

The legal basis is Art. 6(1)(b) GDPR, as the processing serves to fulfil your request and to initiate a possible contractual relationship, supplemented by Art. 6(1)(f) GDPR based on our legitimate interest in addressing prospective customers.

Uploaded documents: for each claim you may optionally attach supporting material, such as photos of packaging, test reports or datasheets. Image files and PDF up to 10 MB per file are permitted. These files are stored on our server in a directory that cannot be reached through any web address and are used solely to produce your assessment report. They are not passed on to third parties; in particular they are not transferred to our customer management system. They are deleted no later than 90 days after receipt. We will delete them sooner at your request; an email to contact@flustix.com is sufficient.

Please do not upload material containing personal data of third parties or trade secrets unless it is necessary for the review.

Your remaining details are transferred to our customer management system HubSpot as with our other forms; see “Contacting us” for details. The uploaded files themselves are excluded from this.

By submitting the Claim Check you also sign up for our newsletter; the form points this out. You can unsubscribe at any time. Details under “Newsletter”.

The form is not embedded from a third party. Merely opening the page transfers no data to third parties and sets no third-party cookies.

13. Newsletter

On our “Newsletter” page you can subscribe to our newsletter with news on certification, trustmarks and regulation. We collect your first and last name, your business email address and your company, and optionally your job title and country.

For a download (see “Downloading whitepapers and studies”) and for the Claim Check (see “Free EmpCo Claim Check”), signing up is part of the free offer: by submitting the form you also sign up for the newsletter. We point this out in the respective form before you submit it. In the contact form and for enquiries about individual trustmarks, signing up is voluntary and only happens if you tick the box for it.

The same applies to the forms in our LinkedIn ads through which you request a document: the newsletter checkbox is mandatory there. LinkedIn transfers the details from the form (first and last name, business email address, company, job title and country) to our customer management system HubSpot (see “Contacting us”). We take the sign-up from there. LinkedIn’s privacy policy also applies to filling in the form on LinkedIn.

If you sign up on our “Newsletter” page, we use the so-called double opt-in procedure: you receive an email with a confirmation link, and only once you open it and confirm the sign-up on the following page do we send you the newsletter. If you sign up with a download, the Claim Check, a form in our LinkedIn ads or the box in an enquiry, the sign-up applies immediately. To be able to prove the sign-up, we store the time of sign-up and, where applicable, of confirmation, for sign-ups on our website the IP address, the page on which you signed up and the wording of the notice you agreed to.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, via the unsubscribe link in every issue or informally by email to contact@flustix.com. The lawfulness of the processing carried out until the withdrawal remains unaffected.

We send the newsletter from our own server zentrale.flustix.com via the email service Amazon Simple Email Service (Amazon SES). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Processing takes place in data centres in Frankfurt am Main. It is based on a data processing agreement under Art. 28 GDPR. On a possible transfer to the USA, see “Transfer to third countries”. Further information can be found in the Amazon Web Services privacy notice: https://aws.amazon.com/privacy/

Our newsletters contain a 1×1 pixel image and links that run through our server zentrale.flustix.com. When your email program loads the image or you click a link, we store the time, the browser identifier, the target of the link and the IP address shortened to its first three parts, linked to your email address. This shows us which topics are read so that we can shape the newsletter accordingly. The shortened IP address serves only to avoid counting requests from our own office and from security filters as reads. This evaluation is part of the newsletter you consented to. You can avoid it by preventing your email program from loading images and not clicking the links, or by unsubscribing.

We synchronise your sign-up and your unsubscription with our customer management system HubSpot (see “Contacting us”) so that an unsubscription applies everywhere. We also note there when you last received a newsletter.

We store your email address for the newsletter for as long as you receive it. After you unsubscribe, it stays on a suppression list so that we do not write to you again by mistake. We keep the records of sign-up and confirmation for as long as we need to be able to prove the consent.

14. Booking an appointment

On our “Book a slot” page you can pick a free time for a first consultation. The calendar is kept at HubSpot, but it is displayed through our own server.

Free times: our server requests the available times from HubSpot and shows them to you on flustix.com. Your browser does not connect to HubSpot for this, and no data about you is transmitted to HubSpot at this point.

Booking: only once you pick a time do we transmit your first and last name, email address and company, your phone number if you provided one, together with the chosen time and your time zone, to HubSpot, so that the appointment can be created there and an invitation sent to you. This transmission is made by our server, not by your browser. The legal basis is Art. 6(1)(b) GDPR, as the processing serves to carry out the consultation you requested.

Fallback: if HubSpot does not accept a booking made this way, we display HubSpot’s booking page in an embedded frame on our page so that you can complete the appointment there. That frame is loaded only after you click a time, never before. In this case your browser does connect directly to HubSpot, and their privacy notice applies in addition.

Confirmation: after booking, you receive a confirmation email from us with the details of the appointment and the name of the person you will be speaking with. The access link to the video call (Microsoft Teams) is in the calendar invitation, which you receive separately. We send this email from our mailbox contact@flustix.com via Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, on the basis of a data processing agreement under Art. 28 GDPR. A copy of the email is kept in the Sent folder of that mailbox and in our customer relationship system HubSpot. The confirmation contains the tracking pixel and the links through our own server described under “Contacting us”; that section also explains what is stored and how you can object. The legal basis for sending it is Art. 6(1)(b) GDPR.

On transmission to HubSpot and Microsoft and to third countries, see “Transfer to third countries”.

15. QR codes

On printed materials, business cards and packaging we use short QR codes pointing to addresses on this website in the form flustix.com/qrcode/…. Opening such an address forwards you to the stored destination or delivers a contact card as a file.

In doing so we record two things: the time of the request and the family of the operating system used (such as “iOS” or “Android”). Nothing else. In particular we store no IP address, no location and no identifier, and we set neither a cookie nor an entry in your device’s storage for this purpose. This record cannot be attributed to any person, it is not combined with other data, and it is not passed on to third parties.

We use the figures solely to see whether a printed code is being used at all. The legal basis for the forwarding is our legitimate interest in a functioning service under Article 6(1)(f) GDPR.

Independently of this, the server logs the request like any other page view; the section “Server log files” applies to that.

16. External services and links

Our website links to external services: the appointment tool HubSpot Meetings for first calls, the form tool Typeform for certification enquiries, and our profiles on LinkedIn and Instagram.

These contents are not embedded in the website. Data is transferred to the respective providers only when you actively click the corresponding link and open their page. Booking an appointment is an exception: there, HubSpot’s booking page may appear in a frame on our page after you click a time (see “Booking an appointment”). The privacy terms of the respective provider then apply. These providers may be based outside the EU.

17. Transfer to third countries

For the operation of this website (hosting, reach measurement, fonts) we use services and servers located in Germany.

The contact form is an exception: the details entered there are transmitted to HubSpot (see “Contacting us”). The provider is a company based in the USA. Data is stored on servers within the European Union, but access from the USA cannot be ruled out. For that case, the EU Commission's standard contractual clauses apply as a safeguard under Art. 46(2)(c) GDPR; in addition we base the transfer on your explicit consent under Art. 49(1)(a) GDPR, given when you submit the form. The USA does not offer a level of data protection equivalent to European law; in particular, access by US authorities cannot be excluded.

A further exception is the sending of our appointment confirmation via Microsoft 365 (see “Booking an appointment”). Our contracting party is Microsoft Ireland Operations Limited, based in Ireland; its parent company is based in the USA, and access from there cannot be ruled out. The EU Commission's standard contractual clauses under Art. 46(2)(c) GDPR apply to this as well.

A further exception is the sending of our newsletter via Amazon SES (see “Newsletter”). Our contracting party is Amazon Web Services EMEA SARL, based in Luxembourg; processing takes place in data centres in Frankfurt am Main. Its parent company is based in the USA, and access from there cannot be ruled out. The EU Commission's standard contractual clauses under Art. 46(2)(c) GDPR apply to this as well.

If you actively click one of the external links (see “External services and links”), the privacy terms of the respective provider apply, which may be based outside the EU.

18. Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose of the processing no longer applies. If you make a legitimate request for erasure or withdraw consent, your data will be deleted, provided there are no legally permissible grounds for further storage (e.g. retention periods under tax or commercial law); in that case, deletion takes place once those grounds no longer apply.

19. Your rights

With regard to your personal data, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to contact@flustix.com is sufficient.

20. Right to object

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), such as audience measurement with Matomo, you have the right to object at any time on grounds relating to your particular situation.

21. Advertising e-mails

We hereby object to the use of the contact data published under our legal-notice obligation for sending unsolicited advertising and information materials. We expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam e-mails.

22. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The authority responsible for us is:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin, Germany
https://www.datenschutz-berlin.de

23. Currency and amendment of this privacy policy

This privacy policy is currently valid. As our website develops, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy.