Privacy Policy
I. General information
The information in this privacy policy applies to the processing of personal data on our website and is intended to inform you about the purposes of processing, recipients, legal bases, storage periods, and your rights. We only process the personal data of our users to the extent that this is necessary to provide a functioning website and our content and services. Personal data is any data that can be related to you personally, such as your name, address, or email address. “Processing of data” refers in particular to the collection, storage, use, and transmission of your data.
To the extent that we obtain the consent of the data subject for processing operations involving personal data, Art. 6 (1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is party, Art. 6 (1)(b) GDPR serves as the legal basis. This also applies to processing operations required for the implementation of pre-contractual measures.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1)(c) GDPR serves as the legal basis.
In the event that the vital interests of the data subject or of another natural person require the processing of personal data, Art. 6 (1)(d) GDPR serves as the legal basis.
If processing is necessary to protect a legitimate interest of our company or of a third party, and if the interests, fundamental rights, and fundamental freedoms of the data subject do not override that interest, Art. 6 (1)(f) GDPR serves as the legal basis for the processing.
The personal data of data subjects is erased or blocked as soon as the purpose of storage no longer applies. Storage may continue beyond this point where required by law. Data is also blocked or erased when a storage period prescribed by the aforementioned provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.
Further information on the legal bases for processing and on storage periods for specific categories of personal data can be found in the relevant subsection below.
Information on the rights available to you can be found under III.
II. Data controller
The controller within the meaning of the General Data Protection Regulation, the national data protection laws of the member states, and other data protection provisions is:
flame GmbH
Fuggerstr. 1
81373 Munich
Germany
Tel.: +49 89 18 94 97 0
Email: info@hello-flame.com
www.hello-flame.com
III. Rights of the data subject
If personal data concerning you is processed, you are a data subject within the meaning of the GDPR and you have the following rights against us:
1. Right of access
You may request confirmation as to whether personal data concerning you is being processed by us. Where such processing is taking place, you may request information from us on the following:
(1) the purposes for which the personal data is processed;
(2) the categories of personal data being processed;
(3) the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
(4) the envisaged period for which the personal data concerning you will be stored or, if concrete details are not possible, the criteria used to determine that period;
(5) the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
(6) the existence of a right of complaint to a supervisory authority;
(7) all available information as to the source of the data, where the personal data is not collected from the data subject;
(8) the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
You have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
2. Right to rectification
You have a right to rectification and/or completion where the personal data processed concerning you is inaccurate or incomplete. Rectification must be carried out without undue delay.
3. Right to restriction of processing
Under the following conditions, you may request the restriction of the processing of personal data concerning you:
(1) if you contest the accuracy of the personal data concerning you, for a period enabling us to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
(3) we no longer need the personal data for the purposes of processing, but you need it for the establishment, exercise, or defence of legal claims; or
(4) if you have objected to the processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether our legitimate grounds override your grounds.
Where processing of personal data concerning you has been restricted, such data may – with the exception of its storage – only be processed with your consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state.
Where processing has been restricted under the above conditions, you will be informed by the controller before the restriction is lifted.
4. Right to erasure
a) Obligation to erase
You may request that we erase personal data concerning you without undue delay, and we are obliged to erase such data without undue delay, provided that one of the following grounds applies:
(1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
(2) You withdraw the consent on which the processing was based pursuant to Art. 6 (1)(a) or Art. 9 (2)(a) GDPR, and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
(4) The personal data concerning you has been processed unlawfully.
(5) Erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the member states to which we are subject.
(6) The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.
b) Information to third parties
Where we have made the personal data concerning you public and are obliged pursuant to Art. 17 (1) GDPR to erase it, we shall take reasonable measures, including technical measures, taking into account the technology available and the cost of implementation, to inform data controllers processing that personal data that you, as the data subject, have requested that they erase any links to, or copies or replications of, that personal data.
c) Exceptions
The right to erasure does not apply to the extent that processing is necessary
(1) to exercise the right of freedom of expression and information;
(2) to comply with a legal obligation requiring processing under Union law or the law of the member states to which we are subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in us;
(3) for reasons of public interest in the area of public health pursuant to Art. 9 (2)(h) and (i) and Art. 9 (3) GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to under a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the establishment, exercise, or defence of legal claims.
5. Right to notification
If you have exercised your right to rectification, erasure, or restriction of processing against us, we are obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right to be informed by us of these recipients.
6. Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, provided that
(1) the processing is based on consent pursuant to Art. 6 (1)(a) GDPR or Art. 9 (2)(a) GDPR, or on a contract pursuant to Art. 6 (1)(b) GDPR, and
(2) the processing is carried out by automated means.
In exercising this right, you further have the right to have the personal data concerning you transmitted directly by us to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
The right to data portability does not apply to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
7. Right to object
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is based on Art. 6 (1)(e) or (f) GDPR; this also applies to profiling based on these provisions.
We will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.
Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by means of automated procedures using technical specifications.
8. Right to withdraw your data protection consent
You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.
9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for entering into, or the performance of, a contract between you and us,
(2) is authorised by Union or member state law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and your legitimate interests, or
(3) is based on your explicit consent.
However, such decisions must not be based on special categories of personal data under Art. 9 (1) GDPR, unless Art. 9 (2)(a) or (g) GDPR applies and suitable measures have been taken to safeguard your rights, freedoms, and legitimate interests.
With regard to the cases referred to in (1) and (3), we take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
IV. Visiting the website and log files
1. Scope of the processing of personal data
Each time our website is accessed, our system automatically collects the following data and information from the computer system of the accessing device.
(1) Information on the browser type and version used
(2) The user's operating system
(3) The user's internet service provider
(4) The user's IP address
(5) Date and time of access
(6) Websites from which the user's system reached our website
(7) Websites accessed by the user's system via our website
This data is stored in the log files of our system.
This data is not combined with other personal data, nor is it evaluated for analytics purposes. The log files are evaluated solely for the operation and security of the website.
2. Legal basis for the processing of personal data
The legal basis for the collection and storage of the data is Art. 6 (1)(f) GDPR.
3. Purpose of the data processing
The temporary storage of the IP address is necessary to enable the website to be displayed to you. For this purpose, the IP address must remain stored for the duration of the session. The remaining data is collected for technical reasons in order to ensure the stability and security of the website.
This also gives rise to our legitimate interest in the processing pursuant to Art. 6 (1)(f) GDPR.
4. Storage period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended.
5. Right to object and means of removal
The collection of data to provide the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.
V. Cookies
Our website itself does not set any cookies. Neither for analytics nor for marketing purposes, and no strictly necessary ones either. Nor do we use comparable techniques that store or read information on your device, such as local storage or session storage.
Cookies are set only on those pages that embed the HubSpot meeting scheduler described under VI. These cookies originate from HubSpot and serve to handle the booking process and to recognise returning visitors.
You can prevent cookies from being stored, or delete cookies that have already been set, in your browser settings. This has no effect on any other page of our website, as no cookies are used there.
VI. Meeting scheduling via HubSpot
On individual pages of our website we embed the meeting scheduling service HubSpot Meetings. The provider is HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA, represented for customers in the European Economic Area by HubSpot Ireland Limited, Dublin, Ireland.
When you open a page with an embedded scheduler, your browser establishes a connection to HubSpot's servers. In doing so, your IP address and technical details about your browser and operating system are transmitted to HubSpot. HubSpot may set cookies in this context. If you book a meeting, we additionally process the details you provide, usually your name, email address, company and preferred time.
The legal basis for embedding the service is Article 6(1)(f) GDPR. Our legitimate interest lies in offering a straightforward way to arrange a meeting. The legal basis for processing the details you enter is Article 6(1)(b) GDPR, as this serves the performance of pre-contractual measures.
A transfer to the United States cannot be ruled out. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework. In addition, we have concluded a data processing agreement with HubSpot that incorporates the Standard Contractual Clauses of the European Commission.
The data will be deleted as soon as it is no longer required for the purpose for which it was collected and no statutory retention periods apply.
If you would prefer to avoid this transfer, please send us an email at info@hello-flame.com instead of booking a meeting.
VII. Contacting us by email
You can contact us using the email address provided on this website. In that case we process your email address, your name and the details you provide in your message.
The legal basis is Article 6(1)(b) GDPR where your enquiry is directed at concluding a contract, and otherwise Article 6(1)(f) GDPR. Our legitimate interest lies in responding to your enquiry.
We store your message until the matter has been concluded and no statutory retention periods apply. You may object to further storage at any time.
VIII. Hosting
Our website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The data generated when you visit the website, in particular the log file data referred to under IV, is processed on IONOS servers. The servers are located in Germany; no transfer to a third country takes place.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the website. A data processing agreement pursuant to Article 28 GDPR is in place with IONOS.