Legal

Privacy Policy

Last updated: 12 October 2026

1. Data protection at a glance

Scope of application

This privacy notice applies to all offerings from flow office GmbH: the websites flow-office.eu and omvin.ai, and the software Flow Office or OMVIN at app.flow-office.eu (hereinafter the “App”). If we use a service for only some of these offerings, the service heading will state where it is used. Services without such an indication are used across all offerings.

General information

The following information provides a simple overview of what happens to your personal data when you visit our websites or use our app. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please see our privacy policy listed below this text.

Data collection on our websites and in the app

Who is responsible for data collection?

Data processing is carried out by the operator of the websites and the app. You can find their contact details in the “Information about the data controller” section of this privacy notice.

How do we collect your data?

Your data is collected, firstly, when you provide it to us. This may include, for example, data that you enter in a contact form. Other data is collected automatically by our IT systems, or with your consent, when you visit our websites or use the app. This is primarily technical data (e.g. your internet browser, operating system or the time you viewed the page). This data is collected automatically as soon as you access one of our websites or open the app.

What do we use your data for?

Some data is collected to ensure that our websites and app function correctly. Other data may be used to analyse your user behaviour or measure our adverts.

What rights do you have regarding your data?

You have the right to obtain information about the origin, recipients and purpose of your stored personal data at any time and free of charge. You also have the right to request the rectification or erasure of this data. If you have given consent to the processing of your data, you may withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time regarding this and any other questions relating to data protection.

Analytics tools and third-party tools

When you visit our websites, your browsing behaviour may be statistically analysed. This only happens with your consent. You can find detailed information about the tools used in the following privacy policy.

2. Hosting

We host our websites and app with the following providers:

Amazon Web Services (AWS) (app and flow-office.eu)

The provider is Amazon Web Services EMEA SARL, German Branch, Marcel-Breuer-Straße 12, 80807 Munich (hereinafter “AWS”). We host the app and the website flow-office.eu with AWS in its data centre in Frankfurt am Main; flow-office.eu is also delivered via the Amazon CloudFront content delivery network. When you access the app or flow-office.eu, AWS collects various log files, including your IP address. For details, please see AWS’s privacy notice: https://aws.amazon.com/de/privacy/. AWS is used on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in ensuring that our app and website are as reliable as possible. Where consent has been requested, processing is carried out solely on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s terminal equipment (e.g. for device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Order processing

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes personal data only in accordance with our instructions and in compliance with the GDPR.

Hetzner (omvin.ai and app)

The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter “Hetzner”). The omvin.ai website is hosted on Hetzner servers in Germany. When you visit omvin.ai, Hetzner collects various log files, including your IP addresses. Hetzner also provides us with optional, additional customer-specific cloud or dedicated servers for the app, on which customer-specific data can be stored and processed. For details, please see Hetzner’s privacy policy: https://www.hetzner.com/de/legal/privacy-policy/. Hetzner is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible and in providing reliable, customer-specific server infrastructure.

Order processing

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes personal data only in accordance with our instructions and in compliance with the GDPR.

Email hosting (Domainfactory)

For sending and receiving emails (e.g. when you contact us by email), we use the services of Domainfactory GmbH, c/o WeWork, Neuturmstraße 5, 80331 Munich (hereinafter df.eu). When processing emails, df.eu processes personal data such as email addresses, email content and metadata, including IP addresses. For details, please see df.eu’s privacy policy: https://www.df.eu/de/datenschutz/. We use df.eu on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in reliable and secure email communications.

Order processing

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes personal data only in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory information

Privacy policy

The operators of these websites take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this Privacy Policy. When you use our websites or app, various types of personal data are collected. Personal data is data that can be used to identify you personally. This Privacy Policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done. Please note that data transmitted over the internet (e.g. when communicating by email) may be vulnerable to security breaches. It is not possible to protect data completely from access by third parties.

Information about the responsible entity

The controller responsible for processing data on our websites and in the app is:

flow office GmbH
Beethovenstrasse 8
67098 Bad Dürkheim

Phone: +49 6351 124506
Email: info@flow-office.eu (for OMVIN: info@omvin.ai)

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data (e.g. names, email addresses or similar).

Retention period

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you make a legitimate request for erasure or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing your personal data (e.g. tax or commercial retention periods); in the latter case, the data will be deleted once these grounds no longer apply.

General information on the legal bases for data processing

If you have consented to the processing of your data, we process your personal data on the basis of Article 6(1)(a) GDPR or Article 9(2)(a) GDPR where special categories of personal data are processed pursuant to Article 9(1) GDPR. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Article 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your terminal equipment (e.g. via device fingerprinting), data processing is additionally carried out on the basis of Section 25(1) TDDDG. Consent may be withdrawn at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Article 6(1)(b) GDPR. We also process your data where this is necessary to comply with a legal obligation, on the basis of Article 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR. The legal bases applicable in each individual case are set out in the following sections of this privacy policy.

Information on Data Transfers to the USA and Other Third Countries

Among other things, we use tools from companies based in the USA or other third countries that are not secure in terms of data protection law. When these tools are active, your personal data may be transferred to and processed in these third countries. We would like to point out that a level of data protection comparable to that in the EU cannot be guaranteed in these countries. For example, US companies are obliged to disclose personal data to security authorities without you, as the data subject, being able to take legal action against this. It therefore cannot be ruled out that US authorities (e.g. intelligence services) may process, analyse and permanently store your data located on US servers for surveillance purposes. We have no influence over these processing activities.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You may withdraw consent you have already given at any time. The lawfulness of the data processing carried out up to the point of withdrawal shall remain unaffected by the withdrawal.

Right to object to data collection in certain cases and to direct marketing (Article 21 GDPR)

IF THE PROCESSING OF DATA IS CARRIED OUT ON THE BASIS OF ARTICLE 6(1)(E) OR (F) OF THE GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21(1) OF THE GDPR). WHERE YOUR PERSONAL DATA ARE PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ARTICLE 21(2) OF THE GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement. This right to lodge a complaint shall be without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to receive data that we process automatically on the basis of your consent or in fulfilment of a contract, either yourself or through a third party, in a commonly used, machine-readable format. If you request that the data be transferred directly to another data controller, this will only be done where technically feasible.

Access, erasure and rectification

Under the applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipients, and the purpose of the data processing and, where applicable, the right to have this data corrected or erased. You may contact us at any time regarding this and any other questions relating to personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You may contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

  • If you dispute the accuracy of the personal data we hold about you, we will generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
  • If the processing of your personal data was/is unlawful, you may request the restriction of data processing instead of erasure.
  • If we no longer need your personal data, but you require it for the exercise, defence or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of its erasure.
  • If you have objected pursuant to Article 21(1) of the GDPR, a balancing exercise must be carried out between your interests and ours. Until it has been established whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, that data — other than for storage — may only be processed with your consent, for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser’s address bar changing from “http://” to “https://” and by the padlock symbol in the address bar. When SSL or TLS encryption is enabled, the data you send to us cannot be read by third parties.

Objection to marketing emails

We hereby object to the use of contact details published in accordance with legal notice requirements for the purpose of sending unsolicited advertising or informational materials. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising being sent, for example by spam email.

4. Data collection on our websites and in the app

Cookies

Our websites use so-called “cookies”. Cookies are small data files and do not cause any damage to your device. They are either stored on your device temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser. In some cases, cookies from third-party companies may also be stored on your device when you visit our website (third-party cookies). These enable us or you to use certain services provided by the third party (e.g. cookies for processing payment services). Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping basket function or the display of videos). Other cookies are used to analyse user behaviour or display adverts. Cookies that are required to carry out the electronic communication process, to provide certain functions requested by you (e.g. the shopping basket function) or to optimise the website (e.g. cookies for measuring website traffic) (necessary cookies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies in order to provide its services in a technically error-free and optimised manner. If consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG); consent may be withdrawn at any time. You can configure your browser to inform you when cookies are being set and to allow cookies only on a case-by-case basis, to accept cookies in certain cases or generally reject them, and to activate the automatic deletion of cookies when you close your browser. If cookies are disabled, the functionality of this website may be restricted. Where cookies from third-party companies or cookies for analysis purposes are used, we will inform you of this separately in this privacy policy and, where applicable, request your consent.

Consent to Google Analytics (only on flow-office.eu)

<msg>For Google Analytics (see “Analytics Tools and Advertising”), we obtain your consent through a separate notice that appears the first time you visit flow-office.eu. We provide this notice ourselves; no connection is made to a third party and no data is transmitted to third parties. We store your decision in your browser’s local storage (localStorage) under the name “flowoffice:dsgvo-analytics-consent”. This entry contains only the value “accepted” (consent given) or “declined” (consent not given) – no identifier and no personal data. Under Section 25(2)(2) of the TDDDG, this storage does not require consent because it is strictly necessary to implement your decision; the legal basis for the associated processing is Article 6(1)(c) of the GDPR, as we must be able to demonstrate that consent has been given or refused. Google Analytics is not loaded unless you have given your consent. If you withdraw your consent, we will deactivate Google Analytics and delete the cookies set by Google Analytics. You can withdraw or subsequently give your consent at any time via “Cookie Settings”.

Consent to ad measurement (only on omvin.ai)

For the Facebook Pixel and Facebook Conversion API (see “Analytics tools and advertising”), we obtain your consent through a separate notice displayed on your first visit to omvin.ai. We provide this notice ourselves; no connection to a third party is established and no data is transmitted to third parties. We store your choice in a cookie named “omvin_consent” on your device. This cookie contains only the value “granted” (consent given) or “denied” (consent not given) – no identifier or personal data – and is automatically deleted after six months; we will then ask you again. Under section 25(2)(2) TDDDG, storing this cookie does not require consent because it is strictly necessary to implement your choice; the legal basis for the associated processing is Article 6(1)(c) GDPR, as we must be able to demonstrate that consent was given or refused. Until you have given consent, the Facebook Pixel and Facebook Conversion API will not be loaded and no connection to Meta will be established. You can withdraw or subsequently give your consent at any time via “Cookie settings” in the footer of any page.

With your consent, we also record whether you set up a trial account after clicking “Try now”. When you click, we store the cookie identifiers set by Meta (_fbp, _fbc), your IP address, your browser identifier and the page you visited on our server under a randomly generated identifier for 90 days. This identifier is passed to the trial account at app.flow-office.eu and from there to our payment service provider, Paddle. If you set up a trial account or your subscription starts, Paddle notifies us, and we send the event, together with the stored identifiers and your email address and name in hashed form, to Meta via the Facebook Conversion API. None of this processing takes place without your consent.

This consent mechanism applies solely to the measurement of interactions on omvin.ai. The separate sections “Meta Instant Forms on Facebook and Instagram” and “Facebook Conversion API (omvin.ai and Meta Instant Forms)” apply to data you provide directly in a Meta Instant Form on Facebook or Instagram, as well as to the subsequent CRM status feedback.

Server log files

The provider of these pages automatically collects and stores information in so-called server log files, which your browser automatically sends to us. This information includes:

  • Browser type and browser version
  • operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Time of server request
  • IP address

This data is not combined with data from other sources. This data is collected on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring the technically fault-free presentation and optimisation of their website – server log files must therefore be collected.

Contact form (flow-office.eu and omvin.ai)

If you send us enquiries via the contact form, the information you provide in the enquiry form, including the contact details you enter there, will be stored by us for the purpose of processing the enquiry and in case of any follow-up questions. We will not pass this data on without your consent. The processing of this data is based on Article 6(1)(b) GDPR, provided that your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective processing of enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), if this has been requested; consent may be withdrawn at any time. The data you enter in the contact form will remain with us until you ask us to delete it, withdraw your consent to its storage or the purpose for storing the data no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions—in particular retention periods—remain unaffected.

Meta instant forms on Facebook and Instagram

We run adverts on Facebook and Instagram using so-called instant forms (“Lead Ads”). When you submit one of these forms, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), collects the data you enter and passes it on to us.

In our current form, we collect your full name, email address, telephone number, company name and the number of people who work at your company. Company size is requested in the following ranges: “1–5”, “6–10”, “11–20” and “More than 20”.

We use this data to process your enquiry, contact you by phone or email as requested, arrange a no-obligation appointment and assess whether our offer is right for your company. The leads are retrieved from Meta via an API and stored in our internal OMVIN admin area.

Processing is carried out to take steps prior to entering into a contract, on the basis of Article 6(1)(b) GDPR, where your enquiry relates to the potential conclusion of a contract. In addition, processing is based on our legitimate interest in handling business enquiries efficiently and tailoring our offering to businesses, in accordance with Article 6(1)(f) GDPR.

The company size you provided will not result in your request being rejected. We also receive requests from companies with 1–5 people and can process them. This information affects only our internal categorisation and the optimisation of our advertising campaigns. No decision is made solely by automated means that produces legal effects concerning you or similarly significantly affects you.

We store the data you provide for as long as necessary to process your request and deal with any follow-up questions. The data will then be deleted or anonymised unless we are required by law to retain it or other legally permissible grounds apply for keeping it for longer.

The collection of the lead within Facebook or Instagram is also subject to Meta’s Privacy Policy. Information about how Meta processes data can be found at: https://www.facebook.com/privacy/policy/.

Where we and Meta are jointly responsible for collecting and transmitting the data, Meta’s joint controller arrangements apply: https://www.facebook.com/legal/controller_addendum.

Meta may also process data in the US and other third countries. According to Meta, transfers are based in particular on the European Commission’s Standard Contractual Clauses and the other safeguards cited by Meta. For more information, see: https://www.facebook.com/legal/EU_data_transfer_addendum.

Enquiry by email, telephone or fax

If you contact us by e-mail, telephone or fax, your enquiry, including all personal data arising from it (name, enquiry), will be stored and processed by us for the purpose of dealing with your request. We will not pass on this data without your consent. The processing of this data is based on Art. 6 para. 1 lit. b GDPR, insofar as your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in effectively dealing with enquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), where this has been requested; consent may be withdrawn at any time. The data you send to us in contact enquiries will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your request has been fully dealt with). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

5. Analytics tools and advertising

Google Analytics (only on flow-office.eu)

This website uses features of the Google Analytics web analytics service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables the website operator to analyse the behaviour of website visitors. The website operator receives various usage data, such as page views, time spent on the website, operating systems used and the user’s origin. This data is assigned to a pseudonymous identifier (Client ID), which is stored in a cookie on your device. We can also use Google Analytics to record your scrolling movements and clicks (for example, on outgoing links). Google Analytics uses technologies that enable users to be recognised for the purpose of analysing user behaviour (for example, cookies). The information collected by Google about your use of this website is generally transferred to and stored on a Google server in the USA. This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time. The transfer of data to the USA is based on the European Commission’s standard contractual clauses. You can find details here: https://privacy.google.com/businesses/controllerterms/mccs/.

Retention period

Data collected at user and event level as part of Google Analytics are automatically deleted after 14 months.

Browser plug-in

You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de. You can find more information about how Google Analytics handles user data in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Order processing

We have entered into a data processing agreement with Google and fully comply with the strict requirements of the German data protection authorities when using Google Analytics.

Facebook Pixel (only on omvin.ai)

This website uses Facebook’s visitor action pixel to measure conversions. This service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected is also transferred to the USA and other third countries. This allows the behaviour of visitors to be tracked after they have been redirected to the provider’s website by clicking on a Facebook advertisement. This enables the effectiveness of Facebook advertisements to be evaluated for statistical and market research purposes and future advertising measures to be optimised. The data collected is anonymous to us as the operator of this website, and we cannot draw any conclusions about the identity of users. However, Facebook stores and processes the data, making it possible to link it to the relevant user profile and for Facebook to use it for its own advertising purposes, in accordance with the Facebook Data Policy. This allows Facebook to display advertisements on Facebook pages and outside Facebook. As the operator of this website, we cannot influence how this data is used. This service is used on the basis of your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time. The transfer of data to the USA is based on the European Commission’s Standard Contractual Clauses. Further details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381. Where personal data is collected on our website using the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Article 26 GDPR). This joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook. Any processing by Facebook after the data has been transferred is not part of our joint responsibility. Our respective obligations have been set out in an agreement on joint processing. The wording of the agreement is available at: https://www.facebook.com/legal/controller_addendum. Under this agreement, we are responsible for providing privacy information when using the Facebook tool and for implementing the tool on our website in a way that complies with data protection law. Facebook is responsible for the data security of its products. You can exercise your data subject rights (e.g. requests for access) in relation to data processed by Facebook directly with Facebook. If you exercise your data subject rights with us, we are obliged to forward your request to Facebook. Further information about protecting your privacy can be found in Facebook’s privacy notices: https://de-de.facebook.com/about/privacy/. You can also disable the “Custom Audiences” remarketing feature in your ad settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged in to Facebook to do so. If you do not have a Facebook account, you can disable interest-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.

We use Meta Pixel's automatic advanced matching. Details you enter in forms on this website (email address, telephone number, first name and surname) are hashed in your browser and sent to Meta so that events can be matched to a Meta account. We record clicks on telephone numbers and email addresses on this website as a ‘Contact’ event.

Facebook Conversion API (omvin.ai and Meta Instant Forms)

We use Meta's Conversions API. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). The Conversions API enables us to transmit certain events to Meta server-side, measure the effectiveness of our adverts and optimise future campaigns.

Events on omvin.ai

For interactions on omvin.ai, we use the Conversions API only if you have previously consented to advertising measurement. Depending on the interaction, we may transmit the following events:

  • a submitted contact enquiry (“lead”)
  • the start of setting up a test account (“InitiateCheckout”)
  • setting up a trial account (“StartTrial”)
  • the start of a paid subscription (“Subscribe”)

For attribution purposes, the time of the event, the page visited, your IP address, your browser’s user agent, identifiers set by Meta, and your email address, name or telephone number in hashed form may in particular be transmitted. The processing is based on your consent pursuant to Article 6(1)(a) GDPR and, insofar as information is stored on or accessed from your device, pursuant to Section 25(1) TDDDG. You may withdraw your consent at any time via the cookie settings.

Status updates for Meta instant forms

When you submit an instant form in one of our Facebook or Instagram ads, Meta sends us a unique Lead ID. We use this Lead ID to report back to Meta via the Conversions API whether we received the lead and whether it was classified as a qualified business lead based on the company size provided.

We use the following phases:

  • “MetaLead” for every lead we receive
  • “MetaQualifiedLead” also for companies with at least 6 people

Companies with 1–5 people are not reported back to Meta as a qualified lead. We will still receive your enquiry and can deal with it.

With this CRM feedback, we only transmit:

  • the lead ID generated by Meta
  • the timing of the feedback
  • the event phase “MetaLead” or “MetaQualifiedLead”
  • the source attribution “OMVIN Admin”

The exact value of the company size provided, the company name, the name of the person making the request, the email address and the telephone number are not sent to Meta again with this CRM feedback. However, Meta can match the lead ID to the form lead already collected on Facebook or Instagram and thus to the relevant Meta account.

The purpose of the feedback is to assess the quality of the enquiries generated by our adverts and to target the delivery of future adverts towards users whom Meta considers more likely to become a qualified business lead. In doing so, Meta may carry out profiling based on the data it holds.

Processing is carried out on the basis of our legitimate interest in optimising the cost-effectiveness of our advertising, avoiding unsuitable advertising contacts and targeting our offering at the intended business audience, in accordance with Article 6(1)(f) GDPR. You may object to this processing, on grounds relating to your particular situation, in accordance with Article 21 GDPR.

The feedback has no legal or similarly significant effects on your specific request. In particular, it does not determine whether we receive or process your request. It affects only the measurement and future delivery of our advertisements.

Meta also processes the data transmitted for its own purposes in accordance with Meta’s privacy policy. This may involve transferring data to the USA and other third countries. For more information, please visit: https://www.facebook.com/privacy/policy/, https://www.facebook.com/legal/controller_addendum and https://www.facebook.com/legal/EU_data_transfer_addendum.

Where we and Meta are jointly responsible for collecting and transmitting the data, Meta’s arrangements on joint controllership apply. Data subject rights relating to processing carried out by Meta may also be exercised directly with Meta.

Order processing

We have entered into a data processing agreement (DPA) with the above-mentioned provider. This is a contract required under data protection law which ensures that the provider processes the personal data of visitors to our website only on our instructions and in compliance with the GDPR.

Facebook Custom Audiences (only on omvin.ai)

We use Facebook Custom Audiences. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. When you visit or use our websites and apps, make use of our free or paid offers, transmit data to us or interact with our company’s Facebook content, we collect your personal data. If you give us your consent to use Facebook Custom Audiences, we will transmit this data to Facebook, which can use it to display suitable advertising to you. In addition, target groups can be defined using your data (Lookalike Audiences). Facebook processes this data as our processor. Details can be found in Facebook’s terms of use: https://www.facebook.com/legal/terms/customaudience. This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time. Data transfers to the USA are based on the European Commission’s standard contractual clauses. Details can be found here: https://www.facebook.com/legal/terms/customaudience and https://www.facebook.com/legal/terms/dataprocessing.

6. Plugins and tools (flow-office.eu and omvin.ai)

Google reCAPTCHA

We use Google reCAPTCHA v3 on our websites. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is used to check whether submissions to our contact forms are made by a person or an automated programme. To do this, reCAPTCHA analyses the behaviour of the website visitor and generates a score. Information about your device, browser and usage behaviour may be transmitted to Google and processed there. The transfer of data to the USA is based on the European Commission’s standard contractual clauses. You can find details here: https://www.google.com/recaptcha/about/. For further information, please see Google’s privacy policy: https://policies.google.com/privacy?hl=de and terms of service: https://policies.google.com/terms?hl=de.

We only load reCAPTCHA when you submit a contact form, not merely when you visit the page. reCAPTCHA is used on the basis of Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in preventing spam and automated enquiries. Where appropriate consent has been requested, processing is carried out solely on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. for device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

7. Our social media presence

Data processing by social networks

We maintain publicly accessible profiles on social networks. The social networks we use in detail can be found below. Social networks such as Facebook, Twitter, etc. can generally analyse your user behaviour comprehensively when you visit their website or a website containing integrated social media content (e.g. Like buttons or advertising banners). Visiting our social media profiles triggers numerous data-processing operations relevant to data protection. In detail: If you are logged into your social media account and visit our social media profile, the operator of the social media portal may associate this visit with your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data is collected, for example, via cookies stored on your device or by recording your IP address. The operators of the social media portals can use the data collected in this way to create user profiles in which your preferences and interests are stored. This enables interest-based advertising to be displayed to you both within and outside the respective social media profile. If you have an account with the respective social network, interest-based advertising may be displayed on all devices on which you are or have been logged in. Please also note that we cannot track all processing operations on the social media portals. Depending on the provider, the operators of the social media portals may therefore carry out further processing operations. For details, please refer to the terms of use and privacy policies of the respective social media portals.

Legal basis

Our social media profiles are intended to ensure as comprehensive an online presence as possible. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on different legal grounds, where applicable, which must be specified by the operators of the social networks (e.g. consent within the meaning of Article 6(1)(a) GDPR).

Controller and exercising rights

When you visit one of our social media presences (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered by your visit. In principle, you may exercise your rights (access, rectification, erasure, restriction of processing, data portability and lodging a complaint) both against us and against the operator of the relevant social media portal (e.g. Facebook). Please note that, despite our joint responsibility with the operators of social media portals, we do not have comprehensive influence over the data processing operations of the social media portals. Our options are largely determined by the respective provider’s corporate policy.

Retention period

The data collected directly by us via our social media presence will be deleted from our systems as soon as you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies will remain on your device until you delete them. Mandatory legal requirements – in particular retention periods – remain unaffected. We have no influence over how long the operators of social networks store your data for their own purposes. For further details, please contact the operators of the social networks directly (e.g. by consulting their privacy policy; see below).

Social networks in detail

Facebook

We have profiles on Facebook for Flow Office (https://www.facebook.com/flowofficedeutschland) and for OMVIN (https://www.facebook.com/profile.php?id=61593749803438). This service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “Meta”). According to Meta, the data collected is also transferred to the USA and other third countries. We have entered into an agreement with Meta on joint processing (Controller Addendum). This agreement specifies which data processing operations we and Meta are responsible for when you visit our Facebook Page. You can view the agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum. You can adjust your advertising preferences yourself in your user account. To do so, click the following link and log in: https://www.facebook.com/settings?tab=ads. The transfer of data to the USA is based on the European Commission’s standard contractual clauses. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381. For details, please see Facebook’s privacy policy: https://www.facebook.com/about/privacy/.

Instagram

We have an Instagram profile for OMVIN (https://www.instagram.com/omvin.ai/). This service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter Meta). According to Meta, the data collected is also transferred to the USA and other third countries. We have entered into an agreement with Meta on joint processing (Controller Addendum). This agreement sets out which data processing activities we and Meta are responsible for when you visit our Instagram profile. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum. Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum. For details, please see Instagram’s privacy policy: https://privacycenter.instagram.com/policy/.

8. Use of Google APIs and Google Workspace data (in-app only)

Limited Use (restricted use)

When you connect the app to your Google Account (e.g. for email, calendar or contacts), we access data in your account via Google APIs with your consent. The app’s use and sharing of information received via Google APIs with other apps complies with the Google API Services User Data Policy, including the Limited Use requirements. The use and sharing of raw or derived user data we receive via Google Workspace APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. You can find the full policy at: https://developers.google.com/terms/api-services-user-data-policy.

What this means in practice

  • We use user data obtained through Google APIs solely to provide or improve the app features you use.
  • We do not share this data with third parties, except where this is necessary to provide or improve these features, for security reasons (e.g. investigating misuse), to comply with applicable laws, or as part of a merger or acquisition, after informing users in advance and obtaining their consent.
  • We do not use this data for advertising purposes.
  • We do not use raw or derived Google Workspace data to train, develop or improve generalised AI or machine-learning models.
  • We do not transmit this data to providers of AI or machine-learning foundation models for training purposes.
  • People do not read this data, except with your explicit consent for specific messages, for security purposes (e.g. investigating abuse), to comply with applicable laws, or when the data has been aggregated and anonymised and is used for internal operational purposes.

You can revoke the app’s access to your Google Account at any time in your Google Account security settings: https://myaccount.google.com/permissions.

9. Artificial intelligence (in the app only)

We offer features based on artificial intelligence (AI) in our app. To provide these features, we use the AI providers listed below. Your data is only transmitted to these providers at your express request and where relevant, namely when you deliberately activate an AI function to generate an AI output (e.g. generated text or an image). No data is transmitted to these providers merely by opening or using the app without an AI function. The data you transmit as part of the AI functions is sent to the respective providers and processed there. We have concluded data processing agreements (DPAs) with all the providers listed below in accordance with Article 28 of the GDPR.

OpenAI

We use the OpenAI service to provide AI features (e.g. text generation and processing). The provider is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (hereinafter “OpenAI”). The data you enter when using the AI features (e.g. text inputs, so-called prompts) is transmitted to OpenAI and processed there. OpenAI also processes your data on servers in the USA. The transfer of data to the USA is based on the European Commission’s standard contractual clauses. This service is used on the basis of your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time. For details, please see OpenAI’s privacy policy: https://openai.com/de-DE/policies/privacy-policy/.

Order processing

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes personal data only in accordance with our instructions and in compliance with the GDPR.

fal.ai

We use the fal.ai service to create and process AI-generated content (e.g. images and other media). The provider is fal – Features & Labels Inc., 2261 Market St. Suite 10467, San Francisco, CA 94114, USA (hereinafter “fal.ai”). The information you submit, as well as the content generated, is transmitted to fal.ai and processed there. The transfer of data to the USA is based on the European Commission’s Standard Contractual Clauses. This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time. For details, please see fal.ai’s privacy policy: https://fal.ai/legal/privacy-policy.

Order processing

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes personal data only in accordance with our instructions and in compliance with the GDPR.

Requesty

To process AI requests across various AI models, we use the LLM gateway service Requesty. The provider is Requesty Ltd. (https://requesty.ai). The data you enter in the AI features (e.g. text inputs, known as prompts) is transmitted to Requesty and forwarded from there to the AI model concerned for processing. Requesty processes the data solely as our processor; Requesty does not store request or response content, and processing may take place in EU data centres (Frankfurt am Main). Where data is transferred to the USA, this is based on the European Commission’s Standard Contractual Clauses. Use of this service is based on your consent under Art. 6(1)(a) GDPR. You may withdraw your consent at any time. For details, please see Requesty’s privacy policy: https://www.requesty.ai/privacy.

Order processing

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes personal data only in accordance with our instructions and in compliance with the GDPR.

OpenRouter

We also use the LLM gateway service OpenRouter to process AI requests using various AI models. The provider is OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, USA (hereinafter referred to as OpenRouter). The data you enter in the AI features (e.g. text inputs, known as prompts) is transmitted to OpenRouter and forwarded from there to the provider of the AI model in question for processing. We use OpenRouter to forward requests exclusively to model providers that do not store request and response content (zero data retention). OpenRouter processes the data solely as our processor and also does not store request and response content; it stores only technical metadata about the request (e.g. the number of tokens processed and the response time). OpenRouter and the connected model providers process the data on servers in the USA. The transfer of data to the USA is based on the European Commission’s Standard Contractual Clauses. This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time. For details, please see OpenRouter’s privacy policy: https://openrouter.ai/privacy.

Order processing

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes personal data only in accordance with our instructions and in compliance with the GDPR.

10. Payment processing (in the app only)

Paddle

Paid subscriptions and in-app purchases are processed via Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom (hereinafter “Paddle”). Paddle acts as the Merchant of Record (reseller), is your contractual partner for the purchase process and processes the purchase data as an independent controller. When a purchase is completed, the data required for payment (name, email address, billing address, VAT identification number, if applicable, and the selected payment method) is transmitted to Paddle. Payment data such as credit card numbers are processed exclusively by Paddle; we do not have access to this data. We receive information from Paddle about the status of the transaction (e.g. completion, renewal, cancellation or refund) in order to manage your access to the service. The processing is carried out for the performance of the contract on the basis of Article 6(1)(b) GDPR. The transfer of data to the United Kingdom is covered by the European Commission’s adequacy decision. For details, please refer to Paddle’s privacy policy: https://www.paddle.com/legal/privacy.