I. Name and address of the controllerII. Contact details of the Data Protection OfficerIII. Rights of the data subjectIV. HostingV. Use of cookiesVI. Contact by emailVII. Company profilesVIII. Use of company profiles on professional networks
Website
IX. General information on data processing on the websiteX. Provision of the website and creation of log filesXI. Integration of plugins via external service providers
App
XII. Data processing in the flowkey appXIII. Provision of the app and creation of log filesXIV. RegistrationXV. NewsletterXVI. Contact formXVII. Orders and subscriptionsXVIII. PaymentXIX. Shipping service providersXX. Plugins via external service providersXXI. GeotargetingXXII. Partner offers
General
I. Name and address of the controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:flowkey GmbHAlt-Moabit 10310559 BerlinGermany+49 30 208 499 28[email protected]https://www.flowkey.com
II. Contact details of the Data Protection Officer
The Data Protection Officer of the controller is:DataCo GmbHSandstraße 3380335 MunichGermany+49 89 7400 45840www.dataguard.de
III. Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
Right of access to information about the processing of your data (Art. 15 GDPR).
Right to rectification of inaccurate data (Art. 16 GDPR).
Right to erasure of your personal data (Art. 17 GDPR).
Right to restriction of processing of your personal data (Art. 18 GDPR).
Right to data portability (Art. 20 GDPR).
Right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
Right to object (Art. 21 GDPR): Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. Where we process your data for direct marketing purposes, you may object to this processing at any time without giving reasons. You can send your objection to [email protected].
IV. Hosting
The website and our app are hosted on servers operated by service providers commissioned by us. Our providers include in particular:
Netlify, Inc., 2325 3rd Street, Suite 296, San Francisco, California 94107, USA (website).
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg, Luxembourg (website and app infrastructure; processing in the EU and, where applicable, in third countries).
The servers automatically collect and store information in so-called server log files that your browser transmits automatically when you visit the website or use the app. This includes in particular:
Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing device
Date and time of the server request
IP address
These data are not merged with other data sources. The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free provision, stability, security and optimisation of the website and app.
V. Use of cookies
1. Description and scope of data processing
When you visit our website, cookies or similar technologies are used (e.g. local storage or server-side interfaces). Cookies are files that are stored in the internet browser or by the internet browser on the user's computer system. Information stored on the user's device may include unique identifiers (e.g. a user ID), enabling recognition and allocation.The German Telecommunications Digital Services Data Protection Act (TDDDG) applies to the storage of information on the end user's terminal equipment and/or access to information already stored on the terminal equipment. Where setting and reading cookies is technically necessary, this is done on the basis of Section 25(2) No. 2 TDDDG in order to ensure the functionality of our website.Where cookies or similar technologies are not technically necessary, they are used exclusively on the basis of your explicit consent via our cookie banner. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) and Art. 7 GDPR. You can withdraw your consent at any time with effect for the future or grant it again by adjusting your cookie settings.If personal data is processed following the storage of and access to information, the GDPR applies. The following sections provide details.
2. Cookie banner (two-level approach)
Our cookie banner has two levels:
Level 1: first layer – only the legally required minimum information (GDPR/TDDDG compliant and user-friendly).
Level 2: second layer – full transparency including third-country transfers and server-side interfaces/APIs.
You can change your settings at any time via the "Cookie Settings" button.
3. Categories of cookies/services
We distinguish between the following categories:
Strictly necessary services (always active).
Functional services (optional).
Analytics/performance services (optional).
Marketing services (optional).
4. Strictly necessary services (always active)
These services are required for operating and securing the website and cannot be disabled.
Intercom
Parent company: Intercom.io
Address: Intercom R&D Unlimited Company, 3rd Floor, Stephens Court, 18-21 Saint Stephen's Green, Dublin 2, Ireland; Intercom, Inc., 55 2nd Street, 4th Fl., San Francisco, CA 94105, USA; Intercom Software UK Limited, Level 9, The Warehouse, 207-211 Old St, London, EC1V 9NR, UK; Intercom Software Australia Pty Ltd, 285A Crown St, Surry Hills NSW 2010, Australia.
Description: We use Intercom to provide customer support.
Address: 38 Avenue John F. Kennedy, 1855 Luxembourg, Luxembourg
Description: We use AWS Kinesis to record user events (e.g. registration, purchases, learning progress) and to provide the app/website technically. Without this processing, we could not provide essential contractual features (e.g. purchase confirmations, password reset).
Address: 9 rue de la Pierre Levée, 75011 Paris, France
Description: Prismic is a headless CMS for editorial management and delivery of website content via an API. Prismic itself does not store cookies on your device.
Address: 101 Townsend St, San Francisco, CA 94107, USA
Description: Cloudflare operates a content delivery network (CDN) to deliver content faster and more reliably and to defend against attacks. In rare cases, technically necessary cookies may be set for security purposes.
Address: 38 Avenue John F. Kennedy, L-1855 Luxembourg, Luxembourg
Description: We use AWS to securely provide and maintain our website and app infrastructure (hosting, databases, security functions). AWS is not used for analytics or marketing purposes.
Address: 475 Brannan St, Suite 300, San Francisco, CA 94107, USA
Description: Fastly operates a CDN for fast delivery of static content. Fastly does not set cookies itself and processes personal data (e.g. IP address) only to the extent technically necessary.
Provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland
Description: We use Stripe to process online payments (e.g. credit card, Apple Pay, Google Pay). Stripe processes, among other things, payment information, IP address, device information and transaction data. Stripe may use technically necessary cookies/similar technologies for secure payment processing, authentication and fraud prevention.
Third-country transfer: Personal data may be transferred to countries outside the EU, in particular the USA. Transfers are based on the EU–U.S. Data Privacy Framework and, where required, on Standard Contractual Clauses pursuant to Art. 46 GDPR.
Provider: MongoDB, Inc., 1633 Broadway, 38th Floor, New York, NY 10019, USA (e.g. MongoDB Atlas).
Description: We use MongoDB as a database service to store and process usage and account data to the extent necessary for providing our services.
Third-country transfer: Processing in the USA may occur. In this case, transfers are based on the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses pursuant to Art. 46 GDPR.
Functional services enable additional convenience and personalization features (e.g. remembering settings). If you do not allow this category, certain functions may be limited.These services are used exclusively on the basis of your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG).
YouTube (embedded videos)
Provider: YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
Description: We embed YouTube videos on our website. When an embedded video loads, your browser establishes a connection to YouTube/Google servers. This may include your IP address, browser information and — if you are logged into a YouTube/Google account — a link between your account and the page visit. YouTube also uses cookies and similar technologies. Where possible, we use the privacy-enhanced embedding mode (youtube-nocookie.com), in which cookies are only set when you interact with the video.
Third-country transfer: Transfer to the USA is possible. Transfers are based on the EU–U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses pursuant to Art. 46 GDPR.
Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent).
6. Analytics/performance services (optional)
These services help us understand how users interact with our website in order to improve content and functionality. They are used exclusively on the basis of your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG).
Google Analytics
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
Description: Analysis of user behaviour (e.g. pages visited, time spent, devices/browsers) based on pseudonymous identifiers. Google Analytics 4 does not log or store IP addresses. We have concluded a data processing agreement with Google.
Third-country transfer: Data may be transferred to Google LLC in the USA. Transfers are based on the EU–U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses pursuant to Art. 46 GDPR.
These services help us measure advertising campaigns and show you relevant ads. Technical data (e.g. IP address, browser information, referrer URL) and pseudonymised identifiers (e.g. hashed email addresses) may be processed. Part of the processing takes place via server-side interfaces (conversion APIs), e.g. those of Meta, Google, X, Taboola and OpenAI. These server-side transfers also only take place if you have consented to the "Marketing" category. These services are used exclusively on the basis of your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG), which you can withdraw at any time with effect for the future via "Cookie Settings".Where the providers listed below also process the collected data for their own purposes (e.g. to deliver and improve their advertising services), we and the respective provider are jointly responsible for collecting and transmitting the data via the pixel or conversions API (Art. 26 GDPR). The provider is solely responsible for any subsequent processing. You can exercise your data subject rights against us as well as against the provider.
Google Marketing Platform
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Description: Measuring and managing advertising campaigns; transmission to the USA is possible.
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Description: Measuring campaign success and delivering targeted advertising. Pseudonymised identifiers (e.g. hashed email addresses) may also be processed. Data may also be transmitted server-side via the Meta Conversion API; third-country transfers (in particular to the USA) are possible.
Provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.
Description: We use the X Pixel and the X Conversions API to measure the success of our advertising campaigns on X and to show our ads to people who have visited our website. This records which actions you take on our website (e.g. page views, registration, starting a subscription) after interacting with one of our ads on X. The data is transmitted to X via the pixel in your browser and server-side via the Conversions API.
Data processed: IP address, device and browser information, referrer URL, pseudonymised identifiers (cookie identifiers), conversion events.
Third-country transfer: Data may be transferred to X Corp., USA. Transfers are based on the EU–U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on Standard Contractual Clauses pursuant to Art. 46 GDPR.
Storage period: Data transmitted to X is stored and deleted in accordance with X's privacy policy.
Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent).
Taboola Pixel
Provider: Taboola.com Ltd. (incorporated in Israel), 16 Madison Square West, 7th Floor, New York, NY 10010, USA. EU representative: Lionheart Squared (Europe) Ltd., Dublin, Ireland.
Description: We use the Taboola Pixel to measure the success of our ads in Taboola's recommendation network and to show targeted ads to people who have visited our website. For this purpose, cookies and entries in your browser's local storage are used to record which actions you take on our website (e.g. page views, registration, purchases). Taboola also uses this information for its own purposes, such as tailoring content and ads in its network to you across devices, and may share it with advertising and data partners.
Data processed: IP address, browser information, referrer URL, cookie identifiers, conversion events.
Third-country transfer: Data is transferred in particular to Israel and the United Kingdom (each covered by an EU Commission adequacy decision) and to the USA (EU–U.S. Data Privacy Framework or Standard Contractual Clauses pursuant to Art. 46 GDPR).
Storage period: Taboola retains the data for no longer than 13 months after your last interaction.
Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent).
OpenAI Ads Pixel & Conversions API
Provider: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.
Description: We use the OpenAI Pixel and the OpenAI Conversions API to measure whether users take certain actions on our website (e.g. registration, starting a subscription) after clicking one of our ads in ChatGPT. For this purpose, a click identifier is stored in a cookie on our domain and, when a conversion occurs, transmitted to OpenAI together with technical data, including server-side via the Conversions API.
Data processed: Click identifier, cookie identifier, IP address, browser information, conversion events.
Third-country transfer: Data is transferred in particular to the USA. Transfers are based on the EU–U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on Standard Contractual Clauses pursuant to Art. 46 GDPR.
Storage period: The cookie containing the click identifier is only stored for as long as necessary to attribute a conversion to an ad click. Further storage by OpenAI is governed by OpenAI's privacy policy.
Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent).
8. Storage duration, withdrawal and objection
Cookies are stored on the user's device and transmitted from there to our website. You have full control over the use of cookies. By changing your browser settings, you can disable or restrict the storage of cookies. Please note that browser settings only apply to the browser you use.You can withdraw your consent at any time via "Cookie Settings". This does not affect the lawfulness of processing carried out up to the point of withdrawal.Note: In Safari (from version 12.1), cookies are automatically deleted after seven days. This may also affect opt-out cookies.
VI. Contact by email
You can contact us via the email address provided on our website and in our app. In this case, the personal data transmitted with the email will be stored and used exclusively to process your request.The legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to your request). If the contact aims at concluding or performing a contract, Art. 6(1)(b) GDPR is an additional legal basis.The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected, usually when the conversation with the user has ended.
VII. Company profiles
We maintain company profiles on social networks (e.g. Instagram, X, YouTube). We provide information there and enable communication. If you perform actions on our profiles (e.g. comments, posts, likes), you may make personal data publicly available.As we do not have full influence over the data processing carried out by the respective platform operators, we cannot provide binding information on the purpose and scope of processing by the platform operators. Please refer to the privacy notices of the respective providers.The legal basis for processing personal data for communicating with customers and interested parties is Art. 6(1)(f) GDPR. Where we carry out analyses/lead campaigns or competitions, this is based on your consent (Art. 6(1)(a) GDPR).Instagram: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. Information: https://help.instagram.com/519522125107875X: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Information: https://x.com/en/privacyYouTube: YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. Information: https://policies.google.com/privacy?gl=DE&hl=en
VIII. Use of company profiles on professional networks
We maintain company profiles on professional networks, in particular:
XING SE, Dammtorstraße 30, 20354 Hamburg, Germany (privacy policy: https://privacy.xing.com/de/datenschutzerklaerung)These profiles are used, among other things, for applications, information/PR and active sourcing. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in communication and public relations).
Website
IX. General information on data processing on the website
We generally process personal data only insofar as this is necessary to provide a functional website and our content and services. Processing is usually carried out only with the user's consent. Exceptions apply where obtaining prior consent is not possible for factual reasons and processing is permitted by law.Depending on the purpose, the legal bases are Art. 6(1)(a) (consent), (b) (contract/pre-contractual measures), (c) (legal obligation), (d) (vital interests) or (f) GDPR (legitimate interests).Personal data will be erased or restricted as soon as the purpose of storage ceases to apply, unless statutory retention obligations prevent this.
X. Provision of the website and creation of log files
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. This includes, in particular, browser type/version, operating system, internet service provider, IP address, date and time of access, and referrer and destination URLs.Temporary storage of the IP address is necessary to deliver the website. Storage in log files serves to ensure functionality, optimisation and the security of our systems. The legal basis is Art. 6(1)(f) GDPR. Log files are generally deleted after no later than seven days or the IP address is anonymised, unless longer retention is required for security reasons.
XI. Integration of plugins via external service providers
We use third-party providers (e.g. plugins, content delivery networks and embedded video services such as YouTube) on our website. The specific services, purposes, legal bases and third-country transfers are described in Section V ("Use of cookies") and in the information linked there for each provider.Where consent is required, the service is only loaded after you have given your consent via the cookie banner (Art. 6(1)(a) GDPR; Section 25(1) TDDDG). Technically necessary integrations are carried out on the basis of Art. 6(1)(f) GDPR and Section 25(2) No. 2 TDDDG.
App
XII. Data processing in the flowkey app
Below we inform you about the data protection provisions applicable to the flowkey app for Android and iOS ("App"). The app is provided by flowkey GmbH ("flowkey", "we" or "us").The app is used to provide our services on a mobile device. In this context, the following personal data may be processed in particular:
Name
Email address
Usage data
Purchase history
User ID
Device ID
Approximate location
Crash data
Data is transmitted via a TLS-secured channel.The purposes of processing are the provision of the service, ensuring functionality, improving the app, and—where you have given consent—marketing and analytics purposes.The legal bases are in particular Art. 6(1)(b) GDPR (contract performance) and—for optional analytics/marketing services—Art. 6(1)(a) GDPR (consent).
XIII. Provision of the app and creation of log files
Each time our app is accessed, our system automatically collects technical data (e.g. operating system, IP address, date and time of access). These data are stored in log files and processed separately from other personal data.Purposes are delivery of the app, ensuring functionality, optimisation and system security. The legal basis is Art. 6(1)(f) GDPR. Log files are generally deleted after no later than seven days or the IP address is anonymised, unless longer retention is required for security reasons.
XIV. Registration
In the app, users can register by providing personal data. In particular, the email address is processed. Registration is necessary to perform a contract or to take pre-contractual steps.The legal basis is Art. 6(1)(b) GDPR. Where consents are obtained during registration (e.g. for newsletters/marketing), the legal basis is Art. 6(1)(a) GDPR.The data will be deleted as soon as it is no longer necessary for performing the contract, unless statutory retention obligations prevent this.
XV. Newsletter
Where we offer a newsletter, it is sent exclusively on the basis of your consent. In the context of registration, we process in particular your email address and, where applicable, name/first name and the date/time of registration.The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time, e.g. via the unsubscribe link in each newsletter. After unsubscribing, we delete the newsletter data unless retention is required for evidence purposes.
XVI. Contact form
If a contact form is provided in the app, the data entered there (e.g. email address and, where applicable, name/first name) are processed exclusively for handling the request.The legal basis is Art. 6(1)(f) GDPR (legitimate interest in processing your request) or Art. 6(1)(b) GDPR if the request is aimed at concluding or performing a contract. The data will be deleted once the conversation has ended unless statutory retention obligations prevent this.
XVII. Orders and subscriptions
We offer digital subscriptions and in-app purchases within the app and via our website. As part of the ordering process, we process order and billing data (e.g. products/subscriptions purchased, transaction data, invoice data) to the extent necessary for contract performance, customer service, fraud prevention and statutory obligations (in particular invoicing/tax).The legal bases are Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (fraud prevention, IT security).
XVIII. Payment
We use payment service providers to process payments. Depending on the payment method selected, payment data are transmitted to the respective provider. After completion of the payment process, we receive payment confirmations/transaction data for invoicing and accounting purposes.The legal basis is Art. 6(1)(b) GDPR. Where technically necessary cookies/similar technologies are used as part of payment processing, the legal basis is Section 25(2) No. 2 TDDDG; additionally Art. 6(1)(f) GDPR (fraud prevention, IT security).
Stripe
Provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland.
Purpose: payment processing, authentication, fraud prevention, stability/security of payment infrastructure.
Third-country transfer: possible (in particular to the USA) based on the EU–U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses (Art. 46 GDPR).
Storage period: Payment and accounting data are stored in accordance with statutory retention obligations (in particular under the German Commercial Code (HGB) and Fiscal Code (AO)) for up to 10 years and are then deleted unless further retention is required.
XIX. Shipping service providers
We currently do not ship physical products via our own webshop. If shipping is nevertheless required in individual cases (e.g. promotional materials), we process shipping data exclusively for delivery and disclose them to the respective shipping provider. The legal basis is Art. 6(1)(b) GDPR (contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient delivery).
XX. Plugins via external service providers
Third-party services may be used in the app (e.g. for support, infrastructure, analytics/marketing). Depending on the service, details, legal bases and third-country transfers are described in Section V ("Use of cookies") and in the provider information linked there. Where consent is required, the corresponding services are only activated after consent (Art. 6(1)(a) GDPR).
XXI. Geotargeting
We use the IP address and, where applicable, other information provided by the user (e.g. postal code, if provided) for regional targeting ("geotargeting") as well as to determine the time zone for time-of-day-based app functions.The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing relevant content and correct app functionalities). Where technically possible, only part of the IP address is read and not stored separately.You can restrict geotargeting, for example, by using a VPN/proxy or by adjusting the settings of your browser/device.
XXII. Partner offers
From time to time, flowkey may share exclusive offers from trusted partners that we think you'll find genuinely useful as a learner.Where you have given your consent, we will use your email address or in-app messaging to send you these offers. We do not share your personal data with any third-party partner in connection with Partner Offers. Any discounts or promotions are communicated via a general code available to all participating flowkey users.The legal basis is Art. 6(1)(a) GDPR (consent). Consent is collected separately via an in-app prompt and is not a condition of using the flowkey Service. You can withdraw your consent at any time via your account settings or the unsubscribe link in any Partner Offer communication, without affecting the lawfulness of prior processing.This privacy policy was created with the support of DataGuard.
