Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

FLOWSTATE GmbH
(a limited liability company under German law)
represented by the managing directors:
Uwe Stöckmann · Sven Ihmels · Moritz Löhnig

c/o TechHub.K67 gGmbH
Kasernenstr. 67
40213 Düsseldorf
Germany

Email: info@flowstate365.de
Phone: +49 1520 6693 668

Registered in the commercial register of the Düsseldorf Local Court (Amtsgericht Düsseldorf), North Rhine-Westphalia, under HRB 113940. VAT ID No.: DE464799870.

2. Contact for data protection matters

For questions regarding data protection, the processing of your data, or the exercise of your rights, please contact:

Uwe Stöckmann
Email: info@flowstate365.de

We are currently not required to appoint a data protection officer pursuant to Section 38 of the German Federal Data Protection Act (BDSG).

3. Scope of this Privacy Policy

This Privacy Policy provides information about the nature, scope and purposes of the processing of personal data in connection with the visit to our website flowstate365.de, contacting us, the initiation of business relationships, the waitlist registration as well as the application process.

It relates exclusively to the publicly accessible website. Separate data protection provisions apply to the use of the FLOWSTATE finance platform in the logged-in area, which customers receive within the scope of the respective usage agreement.

4. Overview of services used

To provide and operate this website, we use the following external service providers. Data processing agreements pursuant to Art. 28 GDPR are in place with all providers. The processing of personal data takes place exclusively within the European Union.

• Vercel Inc. (hosting, EU region Frankfurt)
• Supabase Inc. (database and file storage, EU region Frankfurt)
• Resend Inc. (sending of internal notifications, EU region Ireland)
• Microsoft Corporation (Microsoft 365 email mailbox)
• Cal.com GmbH (external appointment booking, Germany)

Further details on each service can be found in the following sections.

5. Accessing the website and server log files

When you access our website, technically required access data is processed by our hosting service provider. This includes:

• IP address (shortened or pseudonymized)
• date and time of the request
• content and URLs accessed
• referrer URL
• browser type, browser version and operating system
• language settings of the browser

The processing serves the technical provision of the website, the safeguarding of stability and system security as well as the defense against attacks and misuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of our website).

Server log files are automatically deleted after 30 days at the latest, unless there are indications of a specific security incident.

6. Hosting (Vercel)

This website is hosted by:

Vercel Inc.
440 N Barranca Ave #4133
Covina, CA 91723, USA

Your data is processed exclusively in the European region (Frankfurt, Germany). Vercel Inc. is certified under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses are in place. A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in high-performance and secure hosting).

7. Waitlist registration

Via the waitlist form on our website, interested parties can express their interest in FLOWSTATE and reserve a place for future product access.

Data processed:

• first name and surname
• business email address
• company
• position
• company size
• module interest (Financial Performance, Transaction or Turnaround)
• phone number (optional)

The purpose of the processing is to make contact in preparation for a possible business relationship and to provide information about product availability. The legal basis is Art. 6(1)(b) GDPR (performance of pre-contractual measures) as well as Art. 6(1)(f) GDPR (legitimate interest in efficient management of interested parties).

The data is stored in our Supabase database in the EU region Frankfurt (see Section 11).

Retention period: Waitlist data is deleted as soon as the purpose has been achieved (contact has been made or a customer account has been created), but no later than 24 months after the last contact, provided that no contractual relationship comes about.

8. Application process

Via our application form, you can apply for open positions at FLOWSTATE.

Data processed:

• full name
• email address
• phone number
• earliest start date
• CV and references (PDF upload)
• cover letter (PDF upload, optional)
• LinkedIn profile URL (optional)

The documents may contain further personal data that you voluntarily provide to us, including, where applicable, special categories of personal data within the meaning of Art. 9 GDPR.

The purpose of the processing is exclusively the conduct of the application process. The legal basis is Section 26(1) of the German Federal Data Protection Act (BDSG) in conjunction with Art. 88 GDPR (data processing for the purposes of the employment relationship). Insofar as special categories of personal data are processed, this is done on the basis of Section 26(3) BDSG.

The application documents are stored in our Supabase database and in the associated file storage (EU region Frankfurt).

Retention period: If you are not hired, application documents are deleted no later than 6 months after the conclusion of the process. This period results from possible claims under the German General Equal Treatment Act (AGG). In the event of employment, the documents are transferred to the personnel file and are subject to the retention periods applicable there.

9. Contacting us by email and telephone

If you contact us by email, by telephone or via the contact channels mentioned in Section 1, we process the data you provide in order to handle your inquiry and for further communication with you.

Data processed:

• name and contact details
• content of your inquiry
• other data that you voluntarily provide to us

The legal basis is Art. 6(1)(b) GDPR, insofar as your inquiry is directed at the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in efficient communication).

Retention period: The data is deleted as soon as it is no longer required for the purpose of its processing, unless statutory retention obligations prevent deletion.

10. Appointment booking (Cal.com)

To arrange meetings, we link to an external booking service on our contact page. When you click the booking link, you are redirected to our booking provider's page, where you can book the appointment. No data is transmitted to the booking provider on our own website.

Provider:
Cal.com GmbH
Registered in the commercial register
Germany

During the booking process on cal.com, the data you enter (name, email, desired appointment, optionally further information) is processed by Cal.com. The legal basis for the further processing by us after a booking has been made is Art. 6(1)(b) GDPR (pre-contractual measures) as well as Art. 6(1)(f) GDPR.

Cal.com GmbH is a German company; the processing takes place within the EU. A data processing agreement pursuant to Art. 28 GDPR is in place with Cal.com. Further information can be found in Cal.com's privacy policy at cal.com/privacy.

11. Database and file storage (Supabase)

For the storage of the data transmitted via our forms as well as the application documents, we use the service Supabase:

Supabase Inc.
970 Toa Payoh North
Singapore

Your data is processed exclusively in the European region (Frankfurt, Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with Supabase. Supabase Inc. is certified under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses are in place.

The legal basis for use is Art. 6(1)(f) GDPR (legitimate interest in scalable, secure and efficient data processing).

12. Sending of internal notifications (Resend)

For sending internal notifications, for example upon receipt of new waitlist registrations or applications, we use:

Resend Inc.
2261 Market Street #5039
San Francisco, CA 94114, USA

Your data is processed exclusively in the European region (Ireland). A data processing agreement pursuant to Art. 28 GDPR is in place with Resend. Resend Inc. is certified under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses are in place.

The legal basis for use is Art. 6(1)(f) GDPR (legitimate interest in efficient internal communication).

13. Email mailbox (Microsoft 365)

Incoming emails, including the notifications from our forms as well as direct contact inquiries, are processed and stored in our business email mailbox at Microsoft 365.

Provider:
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052-6399, USA

The processing takes place in data centers within the European Union. Microsoft Corporation is certified under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses are in place. The data processing agreement is part of the Microsoft Product Terms (Data Protection Addendum).

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in professional business communication).

14. Audience measurement (Vercel Analytics)

To analyze the use of our website, we use Vercel Analytics. This service records visitor numbers, pages accessed, referrers and aggregated device information without setting cookies or storing persistent identifiers on your device. The measurement data is not attributed to individual persons.

Provider: Vercel Inc. (see Section 6). The data processing takes place in the European region. Consent is not required, as no information within the meaning of Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is stored on or read from your device.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the analysis and improvement of our website).

15. No use of cookies, tracking and analytics

Our website deliberately refrains from using technologies that require consent:

• No cookies are used that are not necessary for the technical functioning of the website.
• No tracking or marketing pixels are used (no Google Analytics, no Meta Pixel, no LinkedIn Insight Tag).
• No social media plugins or widgets are embedded. Links to our profiles on LinkedIn are mere references; data is only transmitted upon an active click.
• Fonts and icons are loaded exclusively locally from our server. There is no connection to third-party providers (e.g. Google Fonts).
• There are no external videos, maps or embedded third-party content on our website.

For this reason, our website does not require a cookie consent banner.

16. Rights of data subjects

Subject to the statutory requirements, you have the following rights:

• right of access to the data stored about you (Art. 15 GDPR)
• right to rectification of inaccurate data (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to certain processing operations (Art. 21 GDPR)
• right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, simply send an informal message to info@flowstate365.de.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW)
Kavalleriestr. 2–4
40213 Düsseldorf
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Web: ldi.nrw.de

17. Right to object

Insofar as we process personal data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to the processing on grounds relating to your particular situation.

You can submit your objection informally to info@flowstate365.de.

18. Data security and changes

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, unauthorized disclosure, alteration or destruction. Our security measures are reviewed regularly and adapted to the state of the art.

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place on this website.

We reserve the right to adapt this Privacy Policy with effect for the future, in particular in the event of legal, technical or organizational changes to our website or our services. The respective current version is available on this page.

Last updated: September 2026