Privacy Policy of User Flow LT UG (haftungsbeschränkt)

1.Controller

The controller within the meaning of Article 4 (7) GDPR for the processing of personal data in connection with the use of the website user-flow.de, the web-based application app.user-flow.de and all services offered through them is:

User Flow LT UG (haftungsbeschränkt)
Alt-Möllner-Straße 37–42, Gebäude B
23879 Mölln
Germany

Managing Directors: Maximilian Laurentius Turowski, Hendrik Lembicz (jointly authorised to represent the company)
Register court: Amtsgericht Lübeck, HRB 27853 HL
VAT identification number: DE464567308

Email: info@user-flow.de
Website: https://user-flow.de
CRM application: https://app.user-flow.de

Where the terms "User Flow", "we", "us" or "our" are used in this Privacy Policy, they always refer to User Flow LT UG (haftungsbeschränkt).

For all questions regarding the processing of personal data and the exercise of your data protection rights, you may contact us at any time using the contact details above.

Data protection officer. A data protection officer has not currently been appointed. Whether a statutory obligation to appoint one exists is currently being assessed. Should an appointment be made, the contact details will be published here. Until then, the contact options stated above are available for all data protection matters.

Note: This Privacy Policy applies both to the public website of User Flow and to the CRM application, unless otherwise provided below.

2.Scope

This Privacy Policy applies to all digital services offered by User Flow LT UG (haftungsbeschränkt) insofar as personal data is processed in the course of their use.

It applies in particular to the following offerings:

• the corporate website at https://user-flow.de including all subpages and the blog provided there,
• the web-based CRM application at https://app.user-flow.de,
• all functions, modules and services within the CRM application,
• all communication channels between users and User Flow, in particular by email and via official support channels,
• and future extensions of the Platform, insofar as reference is made to them in this Privacy Policy or they refer to this Privacy Policy.

This Privacy Policy applies regardless of whether our services are used via a desktop computer, a notebook, a tablet, a smartphone or any other internet-enabled device.

It likewise applies regardless of the country in which a user is located. Personal data is processed exclusively in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection provisions of the Federal Republic of Germany and the European Union.

Our services are directed at users in various countries. For this reason, we provide this Privacy Policy in German and in English. In the event of differences of interpretation or translation discrepancies between the language versions, the German version shall prevail exclusively.

This Privacy Policy describes both processing operations in which User Flow acts as controller and processing operations that User Flow carries out on behalf of its customers.

Where User Flow processes personal data exclusively on behalf of a customer, that customer remains the controller within the meaning of the GDPR. In such cases, processing by User Flow is additionally governed by the data processing agreement concluded between User Flow and the respective customer and by the customer's documented instructions.

The respective privacy provisions of third-party providers or operators of supported third-party platforms apply additionally to their independent processing operations.

3.Definitions

For the sake of clarity, the following terms are used consistently throughout this Privacy Policy.

Where personal designations are used in the masculine form only, this serves readability alone. Such designations refer equally to persons of all genders.

3.1 User Flow

User Flow means the software platform operated by User Flow LT UG (haftungsbeschränkt), including the corporate website at user-flow.de, the web-based CRM application at app.user-flow.de and all associated functions, modules and services.

3.2 User

Users are all persons who access the website or the CRM application or who use the services of User Flow.

3.3 Contracting Party

The Contracting Party is the person who has concluded the user agreement with User Flow. Only entrepreneurs within the meaning of section 14 of the German Civil Code (BGB) may be Contracting Parties.

3.4 Invited User

An Invited User is a person who has been invited by a Contracting Party within the Platform and who uses a user account exclusively within that Contracting Party's organisational structure.

Independent registration without a prior invitation by a Contracting Party is technically impossible. Invited Users are not contracting parties of User Flow.

3.5 Agency

An Agency is a Contracting Party that manages one or more Creators within User Flow and may engage further users for this purpose.

3.6 Creator

A Creator is the person or company whose account on a supported third-party platform is managed within User Flow.

A Creator may manage their account themselves or transfer its management in whole or in part to an Agency.

3.7 Chatter

A Chatter is an Invited User who performs communication tasks within User Flow.

Chatters receive access exclusively to the areas assigned to them by the respective Contracting Party and hold only the permissions granted to them.

3.8 Fan

Fans are users of supported third-party platforms with whom Creators or Chatters communicate or interact within the Platform.

Fans are not users of User Flow in the strict sense. However, personal data of Fans may be processed in the course of using the software insofar as this is necessary to provide the functions offered.

3.9 Supported third-party platforms

Supported third-party platforms are external online platforms operated by independent third-party providers that can be connected to User Flow.

User Flow is neither the operator nor the provider of these third-party platforms and does not determine their independent data processing.

A supported third-party platform is connected exclusively at the instigation of the respective user, in order to provide the desired functions within User Flow.

Depending on the technical configuration and the available functions of the respective third-party platform, different types of personal data may be processed, displayed or synchronised. The specific scope depends on the functions used by the user and the technical possibilities of the respective third-party platform.

A current overview of the supported third-party platforms is available at https://user-flow.de. The overview may change in the course of the further development of the Platform.

3.10 CRM

CRM (Customer Relationship Management System) refers to the web-based software provided by User Flow.

The CRM serves in particular to manage Creator accounts, organise communication processes, analyse activities and provide further product-related functions.

3.11 Personal data

Personal data means any information relating to an identified or identifiable natural person.

This includes in particular names, email addresses, IP addresses, user identifiers, communication data, location data, online identifiers and other information that can be attributed directly or indirectly to a natural person.

3.12 Processing

Processing means any operation performed on personal data, whether or not by automated means.

This includes in particular collecting, storing, organising, structuring, retrieving, using, transmitting, synchronising, archiving, restricting, erasing or destroying personal data.

3.13 Controller

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3.14 Processor

A processor is a natural or legal person who processes personal data on behalf of a controller and, as a rule, in accordance with the controller's documented instructions.

User Flow acts as a processor for its customers insofar as personal data is processed within the CRM application in accordance with the respective customer's instructions.

In addition, User Flow engages external processors of its own, in particular for hosting, server and database infrastructure, email dispatch, payment processing, technical security, network and proxy infrastructure, error analysis and translation services.

The specific allocation of data protection roles depends on the actual configuration of the respective processing operation.

3.15 Bot

A Bot refers to optional automation functions within User Flow which, depending on the supported third-party platform, may assist various workflows.

These may include in particular functions for discovering, organising and managing profiles, for creating and managing lists, and for the automated execution of communication or interaction processes.

The Bot is used exclusively at the instigation of the respective user.

3.16 Translator

The Translator is an optional function within User Flow for the automated translation of communication content.

Where users use this function, the content required to carry out the translation is transmitted to a translation service engaged for this purpose.

The Translator is used exclusively at the instigation of the respective user.

3.17 Platform Display

The Platform Display is the function that displays the user interface of a connected supported third-party platform embedded within the interface of User Flow.

4.Principles of data processing

The protection of personal data is of great importance to User Flow. All processing of personal data takes place exclusively in accordance with applicable data protection provisions, in particular the GDPR and other applicable statutory provisions.

In developing, operating and further developing our services, we take care to process personal data only to the extent necessary to provide our services.

4.1 Lawfulness of processing

Personal data is processed exclusively where there is a legal basis for doing so.

Depending on the processing operation, processing takes place in particular

• to perform a contract or to take steps prior to entering into a contract (Article 6 (1) (b) GDPR),
• on the basis of legal obligations (Article 6 (1) (c) GDPR),
• on the basis of legitimate interests of User Flow or of a third party (Article 6 (1) (f) GDPR),
• or on the basis of consent given voluntarily (Article 6 (1) (a) GDPR), where such consent is required.

The applicable legal basis is explained separately for each processing operation in the sections below.

4.2 Purpose limitation

Personal data is processed exclusively for the purposes described in this Privacy Policy.

Processing for other purposes takes place only where there is an independent legal basis for doing so or where the data subject has expressly consented.

4.3 Data minimisation

We process only such personal data as is necessary for the provision, secure operation and continuous further development of our services.

Where individual information may be provided voluntarily, we expressly point this out.

4.4 Accuracy of data

We endeavour to keep personal data up to date and factually accurate.

Users may correct inaccurate or outdated data at any time within the available functions or contact our support for this purpose.

4.5 Storage limitation

Personal data is generally stored only for as long as is necessary for the respective processing purpose.

Beyond that, storage may take place where statutory retention obligations exist, where legitimate interests justify further storage, or where the data subject has consented.

The specific retention periods and the criteria for determining them are explained in section 18 and in the respective sections.

4.6 Integrity and confidentiality

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access, disclosure or other unlawful processing.

Further information can be found in section 20 ("Data security").

4.7 Transparency

It is important to us to explain comprehensibly which personal data is processed, why this takes place and what rights data subjects have.

Should questions remain despite this Privacy Policy, data subjects may contact us at any time using the contact options stated in section 1.

5.Visiting the website

When you visit our website https://user-flow.de, certain information is automatically processed that is technically necessary to provide the website, ensure its stability and security and to analyse and remedy errors.

This data is processed regardless of whether you register or subsequently use our services.

5.1 Data processed

When our website is accessed, the following personal data may in particular be processed automatically:

• IP address of the requesting device,
• date and time of access,
• time zone,
• pages and files accessed,
• HTTP status code,
• referrer URL (the previously visited website, where transmitted by the browser),
• browser type and browser version,
• operating system used,
• browser language settings,
• device information,
• access logs (server logs),
• and other technically necessary connection data.

This data is not combined with other personal data unless this is necessary to ensure the security of our systems or on the basis of legal obligations.

5.2 Purposes of processing

Processing takes place in particular for the following purposes:

• provision and delivery of our website,
• ensuring the functionality of our systems,
• ensuring IT security,
• detecting and preventing attacks or misuse,
• error analysis and technical maintenance,
• stability and performance optimisation,
• documentation of security-relevant events,
• enforcement and defence of legal claims, where necessary.

5.3 Legal basis

Processing takes place on the basis of Article 6 (1) (f) GDPR.

Our legitimate interest lies in providing our website securely, stably, functionally and protected against attacks.

Where individual processing operations take place on the basis of legal obligations, processing additionally takes place on the basis of Article 6 (1) (c) GDPR.

5.4 Retention period

Server log data is stored only for the period necessary to ensure the security and stability of our systems.

Longer storage takes place exclusively

• where statutory retention obligations exist,
• where this is necessary to investigate security incidents,
• or where this is necessary to assert, exercise or defend legal claims.

5.5 Website hosting

The corporate website user-flow.de is hosted by IONOS SE. Further information can be found in section 17.

5.6 Cloudflare Turnstile

To protect our website and the registration process against automated access and abusive requests, we use Cloudflare Turnstile.

Cloudflare Turnstile serves to distinguish between human users and automated requests and thereby to ensure the security and availability of our services.

In the course of its use, technical connection data, information about the browser and device used, the IP address and other technically necessary information may in particular be processed.

Processing takes place on the basis of Article 6 (1) (f) GDPR. Our legitimate interest lies in protecting our website and CRM application against abusive use, automated attacks and other security-relevant incidents.

Further information can be found in section 17.

5.7 Obligation to provide data

The provision of the technical data mentioned in this section is technically necessary for the operation of our website.

Without this data, our website cannot be provided, or can be provided only to a limited extent.

6.Cookies and technical storage

User Flow uses cookies and comparable technical storage mechanisms exclusively where this is technically necessary for the operation of the website, for login, for the use of the CRM application and for the security of the Platform.

We do not currently use any analytics, statistics, tracking or marketing technologies, either on the website or in the CRM application. In particular, no reach measurement, no conversion tracking and no interest-based advertising takes place. For this reason, no cookie consent is required for the use of our services and no consent banner is used.

Cookies are small text files stored on the user's device. Comparable technical storage mechanisms may in particular be used in the user's browser to provide sessions, language settings or security-relevant information.

6.1 Technically necessary cookies

User Flow uses technically necessary cookies to provide the basic functions of the website and the CRM application.

These include in particular cookies or comparable storage mechanisms for

• login and authentication,
• management of active sessions,
• ensuring system security,
• storing technical settings,
• preventing misuse,
• providing protected areas within the CRM application.

These cookies are necessary for the website and the CRM application to function properly.

6.2 Session cookies and authentication

After successful login, session cookies or comparable technical storage mechanisms may be set.

These serve to recognise the user while using the CRM application and to keep them logged in.

Session cookies lose their effect upon expiry of their validity, upon logout or upon termination of the session.

6.3 Local storage and comparable storage technologies

Where technically necessary, User Flow also uses the browser's local storage or comparable storage technologies.

This may in particular be necessary to provide technical settings, session information or security-relevant information within the CRM application.

6.4 Storage mechanisms in connection with the Platform Display

In connection with the embedded display of supported third-party platforms (section 9.9), technically necessary cookies or comparable storage mechanisms of the respective third-party platform may be used.

These serve exclusively to establish and maintain the connection to the respective third-party platform initiated and authorised by the user. The respective third-party platform's own privacy provisions apply to its processing.

6.5 Legal bases

The storage of information on the user's device or access to information already stored there takes place in accordance with section 25 of the German Digital Services Data Protection Act (TDDDG).

Since the cookies and comparable storage mechanisms we use are strictly necessary to provide a digital service expressly requested by the user, they are used on the basis of section 25 (2) no. 2 TDDDG.

The subsequent processing of personal data takes place on the basis of Article 6 (1) (b) GDPR where it is necessary for the performance of the user agreement, or on the basis of Article 6 (1) (f) GDPR where it serves the secure, stable and functional provision of the website or CRM application.

6.6 Future changes

Should analytics, statistics or marketing technologies be used in the future, this will take place exclusively following prior consent pursuant to section 25 (1) TDDDG in conjunction with Article 6 (1) (a) GDPR by means of a consent procedure implemented at that time. This Privacy Policy will be amended accordingly.

6.7 Obligation to provide data

The use of technically necessary cookies is required in order to provide the website and the CRM application in full.

Where technically necessary cookies are disabled in the browser, individual functions may not be usable or may be usable only to a limited extent.

7.Registration of a user account

Use of the CRM application app.user-flow.de requires the creation of a user account.

Concluding a contract requires that the user acts in the exercise of their commercial, freelance or other independent professional activity. User Flow is directed exclusively at entrepreneurs within the meaning of section 14 BGB.

By completing registration, the user confirms that they are of legal age.

7.1 Data processed

The following personal data may in particular be processed during registration:

• email address,
• password (exclusively in hashed form),
• display name or username,
• company name and legal form,
• VAT identification number, tax number or comparable information evidencing commercial activity,
• address and billing details,
• role and permissions within the Platform,
• date and time of registration,
• IP address at the time of registration,
• information about consent to the applicable Terms and to the Data Processing Agreement as well as about the provision of the applicable Privacy Policy, in each case including the version number,
• technical registration information,
• and other data necessary to create and manage the user account.

Processing takes place exclusively to the extent necessary to set up and manage the user account.

7.2 Purposes of processing

Processing takes place in particular for the following purposes:

• creation and management of the user account,
• authentication of the user,
• verification of entrepreneur status,
• provision of the services booked,
• management of roles and permissions,
• billing and invoicing, including the correct VAT treatment,
• evidencing consent to our Terms and to the Data Processing Agreement as well as the provision of this Privacy Policy,
• fulfilment of statutory documentation obligations,
• protection of the registration process against automated registrations and abusive use,
• prevention of misuse and fraud,
• ensuring the security of our Platform,
• processing of support requests,
• carrying out technical maintenance measures.

7.3 Legal basis

Processing takes place on the basis of Article 6 (1) (b) GDPR insofar as it is necessary for the performance of the user agreement.

Where individual processing operations serve to fulfil legal obligations, in particular commercial and tax law obligations, processing additionally takes place on the basis of Article 6 (1) (c) GDPR.

The storage of consent to our Terms and to the Data Processing Agreement and of the provision of this Privacy Policy additionally takes place on the basis of our legitimate interest pursuant to Article 6 (1) (f) GDPR in being able to evidence that valid consent was given.

7.4 Inviting further users

Contracting Parties may invite further users within the Platform, in particular Chatters.

An invitation is sent to the email address specified by the Contracting Party. The invited user then creates their user account independently.

Independent registration without a prior invitation by a Contracting Party is technically impossible.

Invited Users do not become contracting parties of User Flow. When setting up their user account, they consent to the terms of use applicable to them; the applicable Privacy Policy is made available to them at the same time.

The respective Contracting Party is the controller for the processing of Invited Users' personal data within the Platform. User Flow processes this data as a processor. Insofar as User Flow processes Invited Users' data for the provision and security of the Platform itself, in particular access credentials, authentication and log data, User Flow is the controller in that respect.

7.5 Documentation of consent

During registration, every user must expressly consent to the applicable General Terms and Conditions. Contracting Parties must additionally consent expressly to the Data Processing Agreement.

The applicable Privacy Policy is made available to the user. Consent to the Privacy Policy is not obtained; it is information, not a contractual term.

The following information is stored in this context:

• date and time of consent,
• IP address,
• version of the Terms accepted,
• version of the Data Processing Agreement accepted,
• version of the Privacy Policy provided.

This data serves exclusively to evidence the consent given.

7.6 Retention period

Data processed during registration is stored for the duration of the existing user account.

After the end of the contractual relationship, the user account is initially archived. Personal account data is stored for up to 24 months after the end of the contract in order to allow the former user to have the user account restored on request.

Where no reactivation takes place within this period, the personal data is erased or anonymised, unless statutory retention obligations or other legitimate interests preclude erasure.

Statutory retention obligations, in particular commercial and tax law requirements, remain unaffected.

7.7 Obligation to provide data

The provision of the personal data required during registration is a prerequisite for setting up and using a user account.

Without this data, no user account can be created and the CRM application cannot be used.

8.Referral programme

Contracting Parties may participate in a referral programme operated by User Flow, where this function is offered. Invited Users are not eligible to participate.

8.1 Data processed

The following personal data may in particular be processed in connection with participation:

• user and customer identifier,
• referral code and referral link,
• attribution between the referring and the referred Contracting Party,
• time of attribution or registration,
• information about referred contracts and subscriptions,
• number of attributed active Contracting Parties and the resulting commission tier,
• commission entitlements and commission status,
• tax information of the participant, in particular VAT identification number or information on the small business regulation,
• billing and payout information, including statements issued under the self-billing procedure,
• and information to prevent misuse or impermissible multiple attributions.

8.2 Purposes and legal basis

Processing takes place to operate the referral programme, to attribute referred Contracting Parties, to calculate, bill and pay out commissions, and to prevent misuse and fraud.

The legal basis is Article 6 (1) (b) GDPR insofar as processing is necessary for the performance of the agreement on participation in the referral programme.

Where processing serves to fulfil commercial and tax law obligations, in particular in the context of the self-billing procedure, it takes place on the basis of Article 6 (1) (c) GDPR.

Where processing serves the prevention of misuse and fraud or the defence of legal claims, it additionally takes place on the basis of Article 6 (1) (f) GDPR.

8.3 Retention period

The data is stored for the duration of participation and beyond, insofar as this is necessary for existing commission entitlements, billing, statutory retention obligations or the assertion, exercise or defence of legal claims.

Where payments or credits are processed via a payment service provider, the information in section 17 applies additionally.

9.Connecting and displaying a third-party platform account

Using the essential functions of the CRM application requires connecting an existing third-party platform account.

The connection is established exclusively at the express instigation of the respective user.

User Flow does not itself provide a Creator platform but serves exclusively as an independent software solution for managing, organising and analysing workflows in connection with existing third-party platform accounts.

Using the corresponding functions therefore requires that the user holds an authorised third-party platform account or has been authorised to use that account by its account holder.

Logging in to the User Flow user account takes place independently of logging in to the respective third-party platform, via User Flow's own authentication infrastructure.

Where users connect their third-party platform account within the CRM application, separate authentication against the systems of the respective third-party platform takes place. This serves exclusively to establish and maintain the connection between the respective third-party platform account and the CRM application.

To provide the connection technically, our own servers, technical intermediary services and network and proxy infrastructures are used. Depending on the function used, communication may take place directly between the user's browser and the respective third-party platform or via technical systems of User Flow.

Where users carry out actions within the CRM application, for example sending messages, retrieving content or using other functions of supported third-party platforms, the data required for this is transmitted to the respective third-party platform.

For real-time functions, in particular for updating communication content, direct technical connections may be established between the user's browser and the respective third-party platform.

9.1 Data processed

The following personal data may in particular be processed in connection with the connection of a third-party platform account:

• access credentials of the third-party platform account, insofar as required for technical authentication,
• technical authentication information,
• account identifier,
• Creator ID,
• username,
• profile information,
• settings of the connected account,
• technical synchronisation information,
• information about the time of connection,
• information about the connection status,
• technical connection information in connection with the use of network or proxy infrastructures,
• and other data necessary to provide the connected functions.

The data actually processed depends on the functions used and on the interfaces made available by the respective third-party platform.

In connection with the embedded display of third-party platform functions, technical session information, temporary access tokens, connection information and technically necessary cookies or comparable storage mechanisms may additionally be processed.

These serve exclusively to establish and maintain securely the authorised connection to the respective third-party platform and to provide the desired functions within the CRM application.

9.2 Purposes of processing

Processing takes place in particular for the following purposes:

• establishing and maintaining the connection between User Flow and the respective third-party platform account,
• authentication against the technical interfaces of the respective third-party platform,
• synchronisation of the data required to use the CRM functions,
• provision of the booked functions within the CRM application,
• embedded display of the interface of supported third-party platforms,
• error analysis,
• ensuring stable operation of the Platform,
• detection of technical disruptions,
• ensuring system security,
• use of technical network and proxy infrastructures for the secure and stable provision of the Platform functions.

9.3 Legal basis

Processing takes place on the basis of Article 6 (1) (b) GDPR, as it is necessary for the performance of the user agreement and the provision of the functions requested by the users.

Where individual processing operations additionally serve to ensure the security or stability of our systems, processing additionally takes place on the basis of our legitimate interest pursuant to Article 6 (1) (f) GDPR.

9.4 Storage of access credentials

Where storing the access credentials required for authentication is necessary for the permanent use of individual functions, these are stored exclusively in encrypted form.

Access to this information is technically restricted and possible exclusively to the extent required.

Access credentials and authentication information are processed exclusively server-side, insofar as this is necessary to establish or maintain the connection to the respective third-party platform.

Where temporary access tokens or session tickets are used, these serve exclusively to establish the secure technical connection and are used only for the period required for this purpose.

9.5 Synchronisation with the third-party platform

After a successful connection, data may be synchronised between User Flow and the connected third-party platform account, insofar as this is necessary for the functions used.

The scope of synchronisation depends on the functions activated and on the technical possibilities made available by the third-party platform.

9.6 Responsibility

User Flow is not the operator of the supported third-party platforms.

The respective operator is solely responsible for the processing of personal data within the respective third-party platform.

Where personal data is processed or synchronised between third-party platforms and User Flow in the course of using the CRM application, such processing takes place exclusively within the scope of the use of our services initiated by the user.

The privacy provisions of the respective third-party platform remain unaffected.

9.7 Retention period

Data processed in connection with the connection of a third-party platform account is stored for the duration of the existing user account.

After the end of the contractual relationship, the retention and erasure periods described in section 18 apply.

9.8 Recipients of the data

Where necessary for the provision of our services, personal data in connection with the technical connection of the third-party platform account may be processed by technical service providers supporting User Flow in operating the Platform, in particular providers of network or proxy infrastructures.

Any transfer of personal data beyond this takes place exclusively on the basis of a statutory permission or express consent.

9.9 Platform Display

User Flow provides a function that displays the user interface of a connected supported third-party platform embedded within the interface of User Flow.

The display takes place exclusively at the instigation of the respective user and exclusively for accounts that the user is authorised to use. It is accessible only to users to whom the respective Contracting Party has granted a corresponding permission.

In the embedded display, content is loaded directly from the respective third-party platform and displayed in the user's browser. In doing so, the respective third-party platform may process the user's technical connection data, in particular IP address, browser and device information as well as technically necessary cookies or comparable storage mechanisms.

User Flow has no influence over the extent to which the respective third-party platform processes this data independently. The respective third-party platform is solely responsible for such processing; its privacy provisions apply.

The legal basis for User Flow providing the display function is Article 6 (1) (b) GDPR.

9.10 Obligation to provide data

The provision of the data required for the connection is a prerequisite for using all functions that require a connection to a third-party platform account.

Without such a connection, essential functions of the CRM application cannot be used.

10.Processing of CRM data

After a third-party platform account has been successfully connected, User Flow processes the personal data necessary to provide the CRM functions.

Processing takes place exclusively within the scope of the functions used by the respective user and of the permissions assigned to them.

10.1 Data processed

The following categories of personal data may in particular be processed in the course of using the CRM application:

Master data

• alias
• nickname
• user identifiers
• Creator attributions
• internal attributions within the Platform

CRM data

• list memberships
• individual tags
• internal notes
• status information
• self-created information
• internal categorisations
• reminders
• markings
• priorities
• individual CRM entries

Subscription and contract information

• start of a subscription
• status of a subscription
• price of a subscription
• automatic renewal
• other subscription-related information

Revenue information

• total revenue of a Fan
• most recent purchase amount
• highest single payment
• other statistical revenue information
• cross-platform aggregated revenue and performance information where several supported third-party platforms are connected within the CRM application

Activity data

• communication history
• times of interactions
• internal status changes
• processing histories
• attributions within the CRM application
• online status information, where provided by the respective third-party platform

Other information added by the user

Where users add or store their own information within the CRM application, this data is also processed insofar as this is necessary to provide the respective function.

10.2 Purposes of processing

Processing takes place in particular for the following purposes:

• provision of the CRM application,
• organisation of Creator accounts,
• management of communication processes,
• management of Fan relationships,
• provision of individual CRM functions,
• structuring and categorisation of contacts,
• management of internal workflows,
• provision of statistical overviews,
• improvement of usability,
• error analysis,
• ensuring stable operation of the Platform,
• cross-platform consolidation and display of the information available within the CRM application where several supported third-party platforms are connected.

10.3 Legal basis

Processing takes place on the basis of Article 6 (1) (b) GDPR insofar as it is necessary for the performance of the user agreement and the provision of the CRM functions.

Where individual processing operations serve to ensure the security or stability of the Platform, processing additionally takes place on the basis of our legitimate interest pursuant to Article 6 (1) (f) GDPR.

Where the personal data processed does not relate to the Contracting Party of User Flow but in particular to Fans, Creators, Invited Users or other data subjects, the substantive legal basis for processing is determined by the respective controlling customer. User Flow processes this data exclusively on the basis of the data processing agreement and the customer's documented instructions.

10.4 Storage of CRM data

CRM data is stored for the duration of the existing user account.

After the end of the contractual relationship, personal CRM data is initially archived.

Unless statutory retention obligations or other legitimate interests preclude this, personal CRM data is erased or anonymised at the latest 24 months after the end of the contract.

Data whose continued storage is necessary on the basis of statutory obligations or for the assertion, exercise or defence of legal claims is exempt from erasure.

10.5 Recipients of the data

Within the CRM application, only those persons to whom corresponding permissions have been assigned receive access to personal data.

In addition, technical service providers may process personal data exclusively to the extent necessary for the operation of the Platform.

10.6 Obligation to provide data

The processing of the data described in this section is necessary in order to provide the CRM application and its functions.

11.Processing of communication data

An essential component of the CRM application is the management and display of communication processes between connected platform accounts and their Fans.

Where the user uses the corresponding functions, User Flow processes communication data relating to the conversations conducted via the respective third-party platform.

11.1 Data processed

Communication content

• text messages,
• image messages,
• other media content,
• message histories,
• and other content transmitted within the communication.

Communication metadata

• time the message was sent,
• time the message was received,
• status information (e.g. read or delivered),
• user identifiers involved,
• technical message information,
• attributions within the CRM application,
• information about which user sent or processed a message via which connected account.

Communication-related CRM data

• internal notes,
• attributions,
• reminders,
• status information,
• tags,
• list memberships,
• and other organisational information.

11.2 Purposes of processing

Processing takes place in particular for the following purposes:

• provision of the chat functions within the CRM application,
• display of existing communication histories,
• synchronisation of communication data,
• support of communication between Creators, Agencies, Chatters and Fans,
• organisation of communication processes,
• traceability of processing operations within the Contracting Party's organisation,
• error analysis,
• ensuring stable operation of the Platform,
• ensuring system security.

11.3 Legal basis

Processing takes place on the basis of Article 6 (1) (b) GDPR insofar as it is necessary for the performance of the user agreement and the provision of the communication functions.

Where individual processing operations serve security, error analysis or technical development, processing additionally takes place on the basis of our legitimate interest pursuant to Article 6 (1) (f) GDPR.

Where the personal data processed does not relate to the Contracting Party, the substantive legal basis is determined by the respective controlling customer. User Flow processes this data exclusively on the basis of the data processing agreement and the customer's documented instructions.

11.4 Storage of communication data

Communication data is stored for the duration of the existing user account.

After the end of the contractual relationship, personal communication data is initially archived and erased or anonymised at the latest 24 months after the end of the contract, unless statutory retention obligations or other legitimate interests preclude this.

11.5 Access permissions

Only those users to whom corresponding permissions have been assigned within the Platform receive access to communication data.

Access to communication data of other Contracting Parties or of Creators not assigned to the user is excluded.

User Flow uses a role-based permission system for this purpose (section 15).

11.6 Recipients of the data

Personal communication data is processed exclusively to the extent necessary to provide the respective functions.

Where technical service providers are engaged for this purpose, their processing takes place exclusively within the framework of processing on behalf.

Where the user uses the translation function, communication content is transmitted to the translation service engaged; section 13 governs the details.

11.7 Special categories of personal data

Communication content may in individual cases contain information from which special categories of personal data within the meaning of Article 9 GDPR may emerge. This may include in particular information about the sex life or sexual orientation of a natural person.

Where communication content contains special categories of personal data, the respective controlling customer is responsible for ensuring that, in addition to a legal basis under Article 6 GDPR, an applicable exception under Article 9 (2) GDPR exists.

User Flow does not determine whether or which special categories of personal data are included in communication content by users. Where User Flow acts as a processor, processing takes place exclusively in accordance with the documented instructions of the respective controller.

User Flow does not pursue any purpose of its own in processing this content and does not evaluate communication content to create personal profiles or for its own marketing purposes.

User Flow does not evaluate communication content to create its own personality profiles, behavioural profiles or marketing profiles of Fans, Chatters or other data subjects. No use for training AI models by User Flow takes place.

12.Further modules of the CRM application

In addition to the core functions described in sections 10 and 11, the CRM application comprises further modules. Which modules are available in each case depends on the scope of services booked and on the information published at user-flow.de.

The processing operations described below take place exclusively where the user uses the respective module.

The legal basis is in each case Article 6 (1) (b) GDPR insofar as processing is necessary to provide the contractually agreed functions, and additionally Article 6 (1) (f) GDPR insofar as it serves security, stability or error analysis. Where the data does not relate to the Contracting Party, section 10.3 applies accordingly.

12.1 Media management (Media Vault)

The Media Vault module enables access to media within the connected third-party platform as well as the uploading of the user's own media via User Flow.

Where media is managed within the connected third-party platform, it is not permanently stored by User Flow but merely passed through technically and displayed.

Where users upload media via User Flow, it is stored on User Flow's infrastructure and may be managed, attributed and transferred to connected third-party platforms by authorised users.

The media content itself, technical metadata such as file name, file size, format and time of upload, the attribution to Creator accounts and categories, and information about which user uploaded or used a media item are processed in this context.

Uploaded media may contain personal data and, in individual cases, special categories of personal data within the meaning of Article 9 GDPR. Section 11.7 applies accordingly. The Contracting Party is responsible for ensuring that it holds the necessary rights in uploaded content and that persons depicted have consented to the respective use, where such consent is required.

12.2 Publication of content (Posting)

The Posting module enables the scheduled or automated publication of content on connected third-party platforms.

The content to be published, the times of scheduled and actual publication, the attribution to the respective Creator account, status information and information about which user initiated a publication are processed.

The respective third-party platform's operator is solely responsible for the processing of published content by that platform.

12.3 Automated message sequences (Triggers and Scripts)

The Triggers module enables the automated sending of messages at set times or upon the occurrence of certain events, for example on a stored date of birth or upon a new subscription.

The Scripts module enables the storage of predefined communication sequences and message templates.

The templates and sequence definitions stored by the user, the trigger criteria including the information required for this purpose about Fans such as date of birth, subscription status or interaction events, the attribution to recipients and status information about executed processes are processed.

The Contracting Party is responsible for the lawfulness of the automated contact; section 14.5 applies accordingly.

12.4 Scheduling (Shifts)

The Shifts module enables the planning and organisation of work assignments within the Contracting Party's organisation.

Planned working times, attributions of users to shifts and Creator accounts, availability information, absences and notes added by the Contracting Party are processed.

This data regularly relates to persons working for the Contracting Party. Section 12.6 applies.

12.5 Business evaluations (Accounting)

The Accounting module determines business performance indicators on the basis of the revenue data available via the connected accounts and the percentages stored by the Contracting Party, in particular revenue and result overviews per Creator account and period.

Revenue and transaction data of the connected accounts, the participation and distribution keys stored by the Contracting Party, the key figures calculated from them, and attributions to Creator accounts and to persons working for the Contracting Party are processed.

Where this gives rise to remuneration or participation information relating to individual persons, section 12.6 applies.

12.6 Activity-related evaluations

The CRM application provides functions that allow the Contracting Party to trace and evaluate the activity of persons working for it within the Platform.

These include in particular:

• the recording and evaluation of active usage times (section 12.7),
• the traceability of which user sent or processed which message via which connected account,
• the graphical display of activity distributions across daily and weekly periods,
• the calculation of performance indicators, in particular revenue per unit of time,
• and the attribution of revenue to individual users and periods.

Responsibility. The respective Contracting Party is solely the controller for these processing operations. It decides whether and to what extent it uses these functions. User Flow merely provides the functions technically and processes the data as a processor in accordance with the Contracting Party's instructions.

Obligations of the Contracting Party. The Contracting Party is responsible for ensuring that a sound legal basis exists for the use of these functions. Where the persons evaluated are employees, the requirements of employee data protection apply, in particular section 26 of the German Federal Data Protection Act (BDSG) and, where applicable, existing co-determination rights of employee representatives. The Contracting Party is further responsible for informing the data subjects about the nature, scope and purpose of the evaluations.

No evaluation by User Flow. User Flow does not evaluate this data for its own purposes and does not create its own performance or behavioural profiles. No consolidation across several Contracting Parties takes place.

12.7 Activity and time tracking

These functions serve exclusively to document the actual use of the CRM application and to produce statistical evaluations for the Contracting Party and authorised users.

Recording takes place exclusively during active use of the CRM application. No recording takes place outside active use. In particular, no keystrokes are logged, no screen recordings are made and no mouse movements are monitored. User Flow does not carry out any background monitoring of devices.

The following are processed in particular:

• start of an active usage session,
• end of an active usage session,
• duration of individual usage sessions,
• total duration of use within freely selectable periods,
• times of activity interruptions,
• user identifier of the respective user,
• attribution to the respective Creator,
• statistical key figures calculated from these.

The following evaluations may in particular be produced on this basis: total chat time, average chat time, revenue within a selected period, average revenue per hour and other statistical performance indicators.

Where no user activity is detected over an extended period, active time tracking may be interrupted automatically. Time tracking resumes only once user activity is detected again.

Section 12.6 applies accordingly to this processing.

12.8 Analysis and statistics functions

To provide various evaluation and analysis functions, User Flow processes personal data that arises in connection with the use of the CRM application or is synchronised with the connected third-party platform accounts.

This includes in particular revenue and sales data, subscription data, communication statistics as well as aggregated overviews, charts, evaluations, key figures, trend analyses, comparative periods, individually selectable statistical periods and cross-platform consolidated evaluations where several supported third-party platforms are connected.

The statistical evaluations serve exclusively for use within the CRM application. No decision based solely on automated processing, including profiling, within the meaning of Article 22 GDPR is taken by User Flow.

12.9 Retention period

The retention and erasure periods set out in section 18 apply to the data described in this section. It is stored for the duration of the existing user account, initially archived after the end of the contractual relationship and erased or anonymised at the latest 24 months after the end of the contract, unless statutory retention obligations or other legitimate interests preclude this.

13.Processing when using the Translator

13.1 General

User Flow optionally provides a translation function (the "Translator").

The Translator serves exclusively to support communication within the CRM application and enables the translation of communication content between different languages.

The Translator is used exclusively at the instigation of the respective user. The function may be activated, deactivated or left unused at any time.

To carry out the translation, User Flow uses an external AI service. The service provider engaged is set out in section 17.

13.2 Data processed

Where the Translator is used, the following personal data may in particular be processed:

• communication content to be translated,
• technically necessary context information, insofar as required to improve translation quality,
• language information,
• technical request and response information,
• times of processing,
• technically necessary identifiers,
• the volume of translated content for the purpose of billing by word quota.

Only such information as is necessary to carry out the respective translation is transmitted to the translation service engaged.

The transmitted texts may contain personal data of users, Creators, Chatters or Fans where such information forms part of the content to be translated. In individual cases they may contain special categories of personal data within the meaning of Article 9 GDPR; section 11.7 applies accordingly.

13.3 Purposes of processing

Processing takes place in particular for the following purposes:

• provision of the translation function,
• support of communication between users of different languages,
• technical execution of the requested translation,
• determination of the scope of use for billing purposes,
• ensuring a stable and functional translation service,
• error analysis.

13.4 Legal bases

Processing takes place on the basis of Article 6 (1) (b) GDPR insofar as the use of the Translator forms part of the services requested by the user or owed under the contract.

Where User Flow processes personal data on behalf of a customer, the use of the Translator additionally takes place on the basis of the data processing agreement between User Flow and the respective customer and the documented instructions of the respective controller.

13.5 Privacy-friendly configuration

Where technically supported by the translation service engaged, User Flow uses privacy-friendly configuration and processing settings in order to limit the storage or other further use of transmitted content to what is necessary.

Further details on the service provider engaged and the settings applied can be found in section 17.

13.6 No use for training purposes

No use of the transmitted content for training AI models by User Flow takes place. For the contractual arrangements with the service provider engaged, see section 17.

13.7 Retention period

Translation content may be stored temporarily insofar as this is necessary for the technical provision of the translation function, to avoid repeated translations or to ensure consistent use within an active usage session.

For billing purposes, the volume of translated content is stored for the duration of the billing period and beyond insofar as statutory retention obligations exist.

Section 18 applies in all other respects.

14.Processing when using the Bot

14.1 General

User Flow optionally provides automated functions to support workflows in connection with supported third-party platforms (the "Bot").

The Bot may in particular be used to record and organise profiles that are publicly accessible or accessible to the connected account within supported third-party platforms, and to carry out communication and interaction processes in accordance with the user's specifications.

The specific scope of functions depends on the supported third-party platforms, the technical possibilities of the platform concerned, the scope of services booked and the settings selected by the user.

The Bot is used exclusively at the instigation of the respective user. Once activated, the Bot may execute the processes configured by the user continuously or recurrently until the respective automation is paused, ended or deactivated.

All actions carried out by the Bot take place within the configuration specified by the user and in the name of the connected third-party platform account. User Flow does not thereby appear as an independent sender or communication partner towards the data subjects.

14.2 Recording of profiles

Within the lead function, profiles available on supported third-party platforms may be recorded and attributed to the user's account.

Recording takes place according to the criteria determined by the user and may in particular take place via the platform's internal search, via publicly accessible profile and discovery areas, via subscriber or follower lists of other Creators, and via comment and interaction areas.

Only the username and the user identifier (user ID) of the respective profile are recorded and stored, together with technical status information about the recording and processing operation.

The recorded data is stored within the CRM application and attributed to the respective Contracting Party.

14.3 Further data processed

In addition, the following personal data may in particular be processed when using the Bot:

• communication content and communication metadata,
• comments and other interaction content,
• lists, attributions and organisational information,
• information about persons already recorded, contacted or managed,
• information that a person has been excluded from further contact,
• message, comment or communication templates stored by the user,
• search, selection and configuration settings,
• status information on automated processes,
• times and results of executed actions,
• technical connection, session and platform information.

The Bot processes only such information as is available within the respective third-party platform, accessible to the connected account, provided by the user or generated in the course of using the Bot.

14.4 Control by the user

The user decides on their own responsibility whether, when and to what extent the Bot is used.

The user determines in particular which supported third-party platform accounts are connected, which automation functions are activated and which settings, search criteria, content or templates are used for execution.

Activated automations may be paused, ended or deactivated at any time. Deactivation ends the further execution of the respective automation. Information already processed or stored within the CRM application is not thereby automatically erased; section 18 applies in this regard.

14.5 Responsibility and information obligations

The respective Contracting Party is the controller for the processing of personal data in the course of using the Bot. It determines the purposes of processing, the selection criteria, the persons addressed and the content used.

User Flow provides the technical infrastructure and the automation functions selected by the user and processes the data as a processor in accordance with the Contracting Party's documented instructions. User Flow does not independently determine which specific persons are addressed, which content is sent or which interactions are carried out.

Information obligation under Article 14 GDPR. Where personal data is not collected from the data subject themselves, the controller is generally subject to an information obligation under Article 14 GDPR. The Contracting Party is responsible for complying with this obligation or for assessing and documenting whether an exception under Article 14 (5) GDPR applies.

Within the available functions, User Flow provides technical means for this purpose, in particular the option of excluding persons from further contact.

Lawfulness of contact. The Contracting Party is further responsible for ensuring that the contact initiated by it is permissible under the provisions applicable to it, in particular under the rules on unreasonable nuisance by electronic mail and under the terms of use of the respective third-party platform.

14.6 Objection and exclusion from further contact

The Platform provides functions allowing individual persons to be excluded from further automated contact.

Data subjects who wish to object to further contact may contact the respective controlling Contracting Party. Where they contact User Flow, we forward the objection to the respective controller or process it in coordination with them.

The Contracting Party is obliged to comply with an objection without undue delay.

14.7 Communication and interactions via third-party platforms

Where the Bot sends messages, publishes comments or carries out other interactions, this takes place via the connected third-party platform account and within the configuration made by the user.

The processes carried out via the Bot may be stored or displayed on the respective third-party platform and within the CRM application.

The respective third-party platform's own terms and privacy notices apply additionally to processing by that platform. User Flow has no influence over how the respective third-party platform independently processes, stores or uses the information transmitted or published there.

14.8 Lists and organisational information

In the course of using the Bot, usernames, user identifiers, status information, attributions and other organisational information may be stored in lists or comparable overviews within the CRM application.

Such storage may in particular be necessary in order to recognise persons already recorded, to attribute ongoing or completed processes, to avoid repeated or unwanted processing, to display the status of communication and interaction processes, and to provide the workflows selected by the user technically.

14.9 Recipients and technical infrastructure

To provide the Bot functions, personal data may be transmitted to or retrieved from the connected third-party platform.

Depending on the technical configuration, hosting, server, network, proxy, security and other technical service providers may additionally be involved in the processing. Sections 16 and 17 govern the details.

14.10 Retention period

Personal data processed in the course of using the Bot is stored for as long as is necessary to provide the functions activated by the user, to manage ongoing or completed processes, or for further use within the CRM application.

In particular, lists, attributions, communication information and status data generated in the course of using the Bot may be stored permanently within the active customer account insofar as this forms part of the functions desired by the user.

After the end of the contractual relationship or of the processing on behalf, erasure, return or anonymisation is governed by section 18 and by the existing contractual arrangements and documented instructions of the respective controller.

By way of derogation, technical status and log data may be stored for a limited period insofar as this is necessary to ensure system security, for error analysis, for the prevention of misuse or for the assertion, exercise or defence of legal claims.

15.Role and permission system

User Flow uses a role-based permission system to ensure that personal data is accessible only to those users who require it to perform their respective tasks.

15.1 Roles within the Platform

Within the Platform, the Contracting Party may use pre-configured roles as well as create its own roles and determine their permissions freely.

Configurable elements include in particular:

• the name, description and colour marking of the role,
• access to individual areas and modules of the Platform,
• the scope of permitted actions within those areas,
• the scope of data access, in particular the restriction to the respective user's own data or the extension to all data within the Contracting Party's account,
• administrative rights regarding Creator accounts, further users and the roles themselves,
• and access to particularly sensitive functions, in particular the Platform Display and the disconnection of connected Creator accounts.

In addition, when inviting a user, the Contracting Party determines which Creator accounts that user may access.

Which areas and permissions are configurable in detail depends on the scope of functions of the Platform available at the time.

15.2 Granting of permissions

Permissions are granted, changed and withdrawn exclusively by the respective Contracting Party.

The Contracting Party may adjust or completely withdraw permissions at any time.

User Flow processes only such personal data as is necessary to implement the respective permissions.

Access to data of other Contracting Parties is excluded in all cases.

15.3 Administrator access

For error analysis, maintenance, technical support or the processing of support requests, it may in individual cases be necessary for authorised administrators of User Flow to access user accounts.

Such access takes place exclusively where this is necessary to perform contractual obligations, to remedy errors, to ensure the security of our systems or at the express request of the respective user.

Administrators receive no access beyond what is necessary for the respective purpose.

All administrator access is logged and may in particular include information about the time of access, the administrator accessing and the user account concerned.

User accounts are accessed exclusively by expressly authorised administrators. No unauthorised or unprompted access to user accounts takes place.

15.4 Purposes and legal basis

The processing of personal data within the role and permission system takes place in particular to manage user accounts, to implement individual access rights, to ensure data security, to prevent unauthorised access, to process support requests, for error analysis and to ensure secure operation of the Platform.

Processing takes place on the basis of Article 6 (1) (b) GDPR insofar as it is necessary to provide the contractually agreed functions, and additionally on the basis of Article 6 (1) (f) GDPR insofar as it serves the security or protection of our systems.

16.Recipients of personal data

User Flow discloses personal data exclusively where this is necessary to provide the services offered, where a legal obligation exists, or where another data protection legal basis permits it.

16.1 Technical service providers (processors)

To provide the CRM application, User Flow engages various technical service providers. These process personal data exclusively on behalf of User Flow and on the basis of corresponding data processing agreements pursuant to Article 28 GDPR.

These include in particular the following categories of service providers:

• hosting, server and storage service providers
• database providers
• email service providers
• payment service providers
• infrastructure and security service providers
• software and development service providers
• monitoring and logging service providers
• network and proxy service providers
• providers of translation and AI services

The specific service providers engaged are set out in section 17.

A current overview of the sub-processors engaged by User Flow is available at https://user-flow.de. Contracting Parties are informed of intended changes in accordance with the Data Processing Agreement and may object to them.

16.2 Recipients within the Contracting Party's organisation

In the course of using the CRM application, personal data may be processed within the organisational structure established by the respective Contracting Party, in particular by users invited by it.

These recipients receive access exclusively to the data expressly assigned to them within the role and permission system.

Where a Contracting Party engages persons located outside the European Union or the European Economic Area and these persons access personal data within the Platform, this constitutes a transfer to a third country for which the respective Contracting Party is responsible as controller. User Flow merely provides the technical infrastructure in this respect.

16.3 Supported third-party platforms

Where the user uses functions that require communication with a connected third-party platform, the data required for this is transmitted to that third-party platform. Its operator is solely responsible for its independent processing.

16.4 Legal obligations

Personal data is also disclosed where User Flow is obliged to do so on the basis of statutory provisions.

This concerns in particular transfers to courts, law enforcement authorities, supervisory authorities, tax authorities and other public bodies, where a statutory obligation exists.

16.5 Corporate restructuring

In the event of a corporate restructuring, merger, sale of parts of the business or a comparable transaction, personal data may be transferred to the companies involved or their advisers, insofar as this is necessary to carry out the respective transaction and the data protection requirements are complied with.

16.6 No disclosure for advertising purposes

User Flow does not sell personal data to third parties.

No disclosure of personal data for third parties' own advertising purposes takes place.

16.7 Legal bases

Where personal data is disclosed to recipients, this takes place in particular on the basis of Article 6 (1) (b) GDPR (performance of a contract), Article 6 (1) (c) GDPR (legal obligation), Article 6 (1) (f) GDPR (legitimate interest) or on the basis of corresponding consent pursuant to Article 6 (1) (a) GDPR.

17.Service providers engaged

17.1 General

Which personal data is processed by a service provider depends on the function used and on the specific scope of the technical integration.

Where service providers process personal data on behalf of User Flow, this takes place on the basis of a data processing agreement pursuant to Article 28 GDPR.

Where a transfer of personal data to a third country takes place in connection with a service provider, the provisions of section 19 apply additionally.

17.2 Hetzner Online GmbH

Purpose. Provision and operation of the server, hosting, storage and database infrastructure of the CRM application app.user-flow.de. This includes in particular the operation of the application servers, the operation of the database infrastructure, the storage of files and application data, technical data backup and recovery, and the provision of the infrastructure required for secure operation of the Platform.

Data processed. Depending on the function used, in particular user account and registration data, CRM data, communication data, Creator and Fan data, role and permission information, analysis and statistics data, activity and time-tracking data, uploaded media, technical connection data, IP addresses, server and security logs, database content, and backups.

Place of processing. Germany.

Legal bases. Article 6 (1) (b) GDPR insofar as processing is necessary to provide the contractually owed services; Article 6 (1) (f) GDPR insofar as processing serves the secure, stable and economical operation of our technical infrastructure.

17.3 IONOS SE

Purpose. Hosting of the corporate website user-flow.de.

Data processed. Technical connection data, IP addresses, server and access logs and the data listed in section 5.1.

Place of processing. Germany.

Legal basis. Article 6 (1) (f) GDPR. Our legitimate interest lies in the secure and stable provision of our website.

17.4 Stripe Payments Europe Ltd.

Purpose. Processing of payments, management of subscriptions and handling of payment-related processes.

Data processed. In particular name and contact details, customer number, billing data, payment information, payment method selected, payment amount, currency, payment status, information about subscriptions, transaction identifiers, technical connection information, information for fraud and misuse prevention, and commission- or discount-related billing information in connection with the referral programme.

Full payment details are entered and processed directly via the payment service provider. User Flow receives exclusively the information required to attribute, confirm and manage the respective payment or subscription.

Legal bases. Article 6 (1) (b) GDPR; Article 6 (1) (c) GDPR insofar as processing serves the fulfilment of commercial or tax law obligations; Article 6 (1) (f) GDPR insofar as processing serves fraud prevention and the security of payment processing.

Note. User Flow may change the payment service provider engaged. Section 17.12 applies.

17.5 Resend

Purpose. Dispatch of transactional and system-related emails, in particular registration confirmations, password reset emails, user invitations, security-relevant notifications, contract and subscription information, technical notices and support and service messages.

Data processed. Email address, name where available, user or account attribution, content of the respective email, time of dispatch, delivery status, technical dispatch information and information about failed deliveries or bounces.

Provider. According to the provider information currently published, Plus Five Five, Inc.

Legal bases. Article 6 (1) (b) GDPR insofar as dispatch is necessary for the performance of the user agreement; Article 6 (1) (f) GDPR insofar as dispatch serves the security, administration or technical provision of our services.

17.6 Cloudflare Turnstile

Purpose. Protection of the website, the registration process and other input or login processes against automated access, abusive requests and security-relevant attacks.

Data processed. IP address, date and time of the request, browser and device information, operating system information, technical connection data, HTTP headers, information about interaction with the website, security and verification results, and technically necessary identifiers and tokens.

Legal basis. Article 6 (1) (f) GDPR. Our legitimate interest lies in protecting our website and CRM application against automated registrations, attacks, spam and other abusive use.

17.7 Decodo (UAB "Data troops")

Purpose. Provision of network and proxy infrastructures for technical communication with supported third-party platforms. These are used in particular to provide and stabilise the connection to supported third-party platforms initiated by the user and to transmit the requests required for this purpose.

Data processed. Depending on the function used, in particular IP addresses, connection and network data, date and time of technical requests, target address or service addressed, data volumes transferred, technical request and response information, session and authentication information, third-party platform identifiers, and content insofar as it forms a technical part of the respective transmission.

Decodo receives no independent access to the User Flow user account. Processing takes place within the framework of the technical transmission of the connections initiated by the user.

Legal bases. Article 6 (1) (b) GDPR insofar as the proxy infrastructure is necessary to provide the functions requested by the user; Article 6 (1) (f) GDPR insofar as its use serves the stable, secure and technically reliable operation of the Platform.

17.8 SpaceXAI LLC (Grok API)

Provider. SpaceXAI LLC ("SpaceXSI"), United States of America. The service is offered under the product name "Grok".

Purpose. Technical execution of automated translations within the CRM application (Translator).

A transfer takes place exclusively where the respective user uses a translation function or has activated a corresponding automatic translation function. Where the translation function is not used, no transfer takes place.

Data processed. Message content to be translated, texts entered by the user, source and target language, technical request information, time of the request and technically necessary identifiers.

The transmitted texts may contain personal data of users, Creators, Chatters or Fans where such information forms part of the content to be translated. In individual cases they may contain special categories of personal data within the meaning of Article 9 GDPR; section 11.7 applies accordingly.

Storage by the provider. According to the information published by the provider, requests and responses transmitted via the interface are stored in encrypted form for a period of 30 days in order to allow abusive use to be investigated in case of suspicion, and are subsequently deleted automatically.

No use for training purposes. According to the provider's information, inputs and outputs transmitted via the interface are not used to train models without express permission. User Flow has not granted such permission. No use of the content for training AI models by User Flow takes place either.

Place of processing and third-country transfer. Processing takes place in the United States of America. The provider does not offer exclusive processing within the European Union for this service. This therefore constitutes a transfer to a third country; section 19 applies additionally.

Legal basis. Article 6 (1) (b) GDPR insofar as the translation function forms part of the service booked and requested by the user. Where User Flow processes personal data on behalf of a customer, use additionally takes place within the framework of the data processing agreement and the controller's documented instructions.

Note. The Translator is an optional function. Users who wish to avoid the transfer of communication content to the translation service may leave the function deactivated; the remaining functions of the CRM application are unaffected.

User Flow intends to change the translation service engaged. Section 17.12 applies; this Privacy Policy will be amended before any such change.

17.9 Sentry

Purpose. Detection, analysis and remedying of technical errors within the Platform (error monitoring).

Data processed. Technical error messages and program flow information, time of the error, function affected, browser, device and operating system information, IP address, and user and account identifiers.

Error messages may additionally contain content that was being processed at the time of the error, and may therefore include personal data of users, Creators, Chatters or Fans.

Place of processing. European Union.

Legal bases. Article 6 (1) (b) GDPR insofar as error remediation is necessary to provide the contractually owed services; Article 6 (1) (f) GDPR. Our legitimate interest lies in detecting and remedying technical errors and ensuring stable and secure operation of the Platform.

Error messages are stored only for the period required for error analysis.

17.10 GitHub

Purpose. Management, versioning and further development of the source code as well as support for technical development and deployment processes.

Data processed. User and contact data of developers, commit and version information, technical configuration information, error descriptions, development documentation, technical logs and other information required for software development.

Productive user, CRM and communication data is not stored in GitHub as a matter of course. Where technical information is exceptionally processed in the course of error analysis, it is to be anonymised or pseudonymised as far as possible before transfer.

Legal basis. Article 6 (1) (f) GDPR. Our legitimate interest lies in the secure development, maintenance, versioning and continuous improvement of our software.

17.11 Support channels

Support requests are processed primarily via the ticket system made available within the Platform. The data processed in this context is stored on the infrastructure described in section 17.2.

In addition, User Flow offers individual customers support via the Telegram messenger service at their request. Where support requests are handled via Telegram, the provider of the messenger service processes the content, usage and connection data transmitted in doing so under its own responsibility and in accordance with its own privacy provisions. User Flow has no influence over this.

The use of Telegram is voluntary. We ask that no personal data of Fans, Creators or Invited Users and no sensitive content be transmitted via this channel. The ticket system and the email address stated in section 1 are available for confidential matters.

Legal basis. Article 6 (1) (b) GDPR and Article 6 (1) (f) GDPR; our legitimate interest lies in providing efficient customer support via the channel requested by the customer.

17.12 Changes to the service providers engaged

User Flow may change technical service providers or engage further service providers insofar as this is necessary for secure, economical or technical operation, further development or the provision of new functions.

A change or addition of service providers takes place exclusively in compliance with applicable data protection requirements. Where a new service provider is engaged as a processor, a data processing agreement pursuant to Article 28 GDPR is concluded before processing begins.

Contracting Parties are informed of intended changes to sub-processors in accordance with the Data Processing Agreement. The current overview is available at https://user-flow.de.

This Privacy Policy will be amended where a change or addition of a service provider results in material changes to the processing described.

18.Retention period and erasure of personal data

User Flow processes personal data only for as long as is necessary for the respective processing purposes or where statutory, contractual or data protection grounds justify further storage.

The specific retention period depends in particular on whether User Flow processes personal data as controller or as a processor on behalf of a customer.

18.1 Storage during the contractual relationship

Personal data is stored for the duration of the existing contractual relationship insofar as this is necessary to provide the services used.

This may in particular include user account and registration data, contract and subscription information, CRM data, communication data, Creator, Chatter and Fan data, uploaded media, analysis and statistics data, activity and time-tracking data, role and permission information, and technical connection and security data.

18.2 Processing as controller

Personal data that User Flow processes to perform and administer its own contractual relationship may initially be archived after the end of the contract.

This may in particular include user account and registration data, master data of the Contracting Party, contract and subscription information, information on participation in the referral programme, invoicing and payment information, evidence of consent to the Terms and to the Data Processing Agreement, support and contract communication, security and misuse information, and technical administrative information.

Archiving serves in particular the processing of subsequent support or contractual queries, the restoration of a user account at the former user's request, the fulfilment of statutory documentation and retention obligations, the assertion, exercise or defence of legal claims, the prevention of misuse and fraud, and the orderly operation of the Platform.

During archiving, the data is no longer used for the active provision of the Platform.

Unless statutory retention obligations or other lawful grounds for storage preclude this, such data is erased or anonymised at the latest 24 months after the end of the contractual relationship.

18.3 Data processed on behalf of a customer

Where User Flow processes personal data on behalf of a customer, the storage, return and erasure of that data is governed by the data processing agreement concluded between User Flow and the respective customer and by the customer's documented instructions.

This may in particular include CRM data, Fan data, communication content, third-party platform data, Creator and Chatter data, uploaded media, internal notes, lists and attributions, analysis and statistics data, activity and time-tracking data, and content processed by Bot or translation functions.

After the end of the processing on behalf, this data is erased or returned in an agreed format at the choice and on the instruction of the respective controller, unless a statutory obligation to continue storing it exists.

18.4 Data export after the end of the contract

After a termination takes effect, the Contracting Party has a period of 30 calendar days during which it may retrieve and export the data concerning it. On request, this period is extended by a further 30 calendar days.

The General Terms and Conditions govern the details.

18.5 Technical transition and erasure periods

Erasure may require a reasonable processing time for technical and organisational reasons.

During such a transition period, the personal data concerned is no longer used for the active provision of services and access is limited to the technically and organisationally necessary group of persons.

18.6 Statutory retention obligations

Where commercial, tax or other statutory retention obligations exist, the personal data affected is stored until the expiry of the respective statutory periods.

During this time, the data is processed exclusively for the purposes provided for by law. After expiry of the respective retention period, the data is erased or anonymised.

18.7 Backups

Personal data may be contained temporarily in technical backups.

Backups serve exclusively to restore systems and data in the event of technical disruptions, security incidents or data loss. The personal data contained in backups is not used for other purposes as a matter of course.

Backups are created hourly, stored in encrypted form and automatically overwritten or deleted after one week. Following erasure in the productive systems, personal data may therefore still be contained in existing backups for up to one week.

Where a backup has to be restored, data already erased or due for erasure is removed again from the productive system within the technical possibilities.

18.8 Anonymisation

Where further use of information for statistical, technical or operational purposes is permissible and necessary, personal data may be anonymised.

After successful anonymisation, it must no longer be possible to establish a personal reference by reasonable means. Mere pseudonymisation does not constitute anonymisation and does not replace a required erasure.

18.9 Erasure requests and restrictions

Data subjects may request the erasure of their personal data under the statutory conditions. Such a request may be made using the contact options stated in section 1.

Where User Flow processes the data concerned exclusively on behalf of a customer, the request is forwarded to the respective controller or processed in coordination with them. In such cases, User Flow may not decide on erasure independently without a corresponding instruction, unless a statutory obligation to do so exists.

Immediate erasure may in particular be precluded where statutory retention obligations exist, where the data is necessary for the assertion, exercise or defence of legal claims, where the data forms part of records required by law, where a return to the respective controller is still outstanding, or where further storage is required on the basis of other statutory obligations.

Where erasure cannot take place temporarily, processing is restricted to the extent required by law.

19.Transfers of data to third countries

User Flow processes personal data in principle within the European Union or the European Economic Area.

In certain cases, personal data is transferred to or processed by service providers whose registered office or data processing is located outside the European Union or the European Economic Area.

This currently concerns in particular:

• the use of the translation function (section 17.8). Processing takes place in the United States of America. The provider does not offer exclusive processing within the European Union for this service. Only the content to be translated and the information technically required for this purpose is transferred, and only where the user actively uses the function;
• the dispatch of transactional emails (section 17.5), insofar as the provider processes data outside the European Union;
• the management of the source code (section 17.10);
• support for individual customers via the Telegram messenger service (section 17.11), insofar as this channel is used at the customer's request;
• transfers to supported third-party platforms, insofar as these are operated outside the European Union, as well as access by persons engaged by the Contracting Party outside the European Union (section 16.2).

19.1 Legal bases for international data transfers

Where personal data is transferred to countries outside the European Union or the European Economic Area, this takes place exclusively on the basis of one of the safeguards provided for by law.

These include in particular:

• an adequacy decision of the European Commission pursuant to Article 45 GDPR,
• standard contractual clauses of the European Commission pursuant to Article 46 GDPR,
• binding corporate rules,
• or another legal basis permitted under the GDPR.

19.2 Security measures

Before transferring data to a third country, User Flow assesses whether the statutory conditions for such a transfer are met.

Where necessary, appropriate technical, organisational and contractual measures are taken to ensure an adequate level of data protection.

19.3 Transfers initiated by the customer

Where a Contracting Party engages persons outside the European Union or the European Economic Area, or connects accounts of third-party platforms operated outside the European Union, this constitutes a transfer for which the respective Contracting Party is responsible as controller. Section 16.2 applies.

19.4 Further information

Data subjects may at any time request further information about the safeguards applicable in an individual case for international data transfers using the contact options stated in section 1.

20.Data security

User Flow takes appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access, unauthorised disclosure or other unlawful processing.

The security measures used are continuously reviewed in line with technological developments and adjusted where necessary.

20.1 Technical protective measures

These include in particular:

• encrypted data transmission (TLS/SSL),
• access restrictions on systems and databases,
• role-based permission concepts,
• authentication procedures,
• storage of passwords exclusively in hashed form,
• encryption of particularly sensitive access credentials,
• logging of security-relevant operations,
• encrypted data backups,
• measures to secure and monitor the network and system infrastructure,
• and other security measures in line with the state of the art.

20.2 Organisational measures

User Flow restricts access to personal data to those persons who require it to perform their respective tasks.

All persons who have access to personal data under the authority of User Flow are bound to confidentiality and process this data exclusively on the instructions of User Flow.

Where external service providers process personal data on behalf of User Flow, this takes place exclusively on the basis of a data processing agreement pursuant to Article 28 GDPR.

20.3 Handling of security incidents

User Flow has organisational and technical processes in place for detecting, assessing and handling security-relevant incidents.

Where security incidents are identified, appropriate measures are taken to limit possible effects and to restore the security of our systems.

Where required by law, notifications are made to the competent supervisory authorities or to data subjects in accordance with the GDPR. Where User Flow acts as a processor, User Flow informs the respective controller without undue delay.

20.4 No absolute security

Despite all technical and organisational measures taken, no data transmission over the internet or electronic storage system can provide complete protection against all security risks.

20.5 Reporting security incidents

Should users identify indications of security vulnerabilities, unauthorised access or other security-relevant incidents, User Flow asks that these be reported without undue delay using the contact options stated in section 1.

21.Rights of data subjects

Where personal data is processed, data subjects have the rights described below under the GDPR, subject to the statutory conditions.

Where User Flow processes personal data as controller, these rights may be exercised directly against User Flow.

Where User Flow processes personal data exclusively as a processor on behalf of a customer — this concerns in particular data of Fans, Creators and Invited Users within the CRM application — the respective customer is responsible as controller for handling the data subject request. User Flow supports the controller in accordance with statutory and contractual requirements.

21.1 Right of access

Data subjects have the right to request confirmation as to whether and which personal data is processed, for what purposes processing takes place, to which recipients data has been or will be disclosed, how long the data is stored, and further information pursuant to Article 15 GDPR.

Subject to the statutory conditions, a copy of the personal data undergoing processing is made available.

21.2 Right to rectification

Data subjects have the right to request the rectification without undue delay of inaccurate personal data and the completion of incomplete personal data.

21.3 Right to erasure

Subject to the statutory conditions, there is a right to request the erasure of personal data, in particular where the data is no longer necessary for the original purposes, where consent given has been withdrawn and no other legal basis exists, or where processing is unlawful.

The right to erasure does not exist where statutory retention obligations or other statutory grounds preclude erasure.

21.4 Right to restriction of processing

Subject to the statutory conditions, the restriction of the processing of personal data may be requested.

21.5 Right to data portability

Data subjects have the right to receive the personal data concerning them in a structured, commonly used and machine-readable format or — where technically feasible — to request its transmission to another controller.

21.6 Right to object

Where personal data is processed on the basis of a legitimate interest pursuant to Article 6 (1) (f) GDPR, there is a right to object at any time to such processing on grounds relating to the data subject's particular situation.

User Flow will then no longer process the personal data concerned unless there are compelling legitimate grounds for the processing or the processing serves the assertion, exercise or defence of legal claims.

Objection to contact via automation functions. Persons who have been contacted via the automation functions of a Contracting Party and who wish to object to further contact may contact the respective Contracting Party or User Flow. Section 14.6 applies.

21.7 Withdrawal of consent

Where personal data is processed on the basis of consent, that consent may be withdrawn at any time with effect for the future.

The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

21.8 Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority about the processing of their personal data.

This applies in particular to the supervisory authority of the Member State of their habitual residence, their place of work or the place of the alleged infringement.

The supervisory authority responsible for User Flow is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.

21.9 Exercising data subject rights

To exercise the rights described in this section, User Flow may be contacted at any time.

Where User Flow is itself the controller for the processing concerned, the request will be assessed in accordance with statutory requirements and processed within the statutory periods.

Where the personal data concerned is processed exclusively on behalf of a customer, the request is forwarded to the respective controller or processed in coordination with them.

Before personal data is disclosed, rectified, transferred or erased, an appropriate verification of the identity of the requesting person may be required.

Data subject requests are processed free of charge as a matter of principle. Where requests are manifestly unfounded or excessive, a reasonable fee may be charged or the request may be refused in accordance with statutory provisions.

22.No automated decision-making

No decision based solely on automated processing, including profiling, which produces legal effects concerning data subjects or similarly significantly affects them, is taken by User Flow within the meaning of Article 22 GDPR.

The analysis, statistics and automation functions provided within the CRM application serve exclusively to support users. Decisions about the use of these functions and about their results are taken exclusively by the respective user.

23.Amendments to this Privacy Policy

User Flow reserves the right to amend this Privacy Policy where this becomes necessary due to technical developments, new functions, changed statutory requirements or other data protection requirements.

The current version is available at any time within the Platform and on the website.

Where required by law, users will be informed of material changes in an appropriate manner.

23.1 Applicable version

The version of this Privacy Policy published at the time of the respective processing applies to the processing of personal data.

Earlier versions may be archived internally for evidentiary, documentation and compliance purposes.

24.Data protection contact

Controller within the meaning of the GDPR:

User Flow LT UG (haftungsbeschränkt)
Alt-Möllner-Straße 37–42, Gebäude B
23879 Mölln
Germany

Email: info@user-flow.de

24.1 Data protection enquiries

Questions about data protection and requests to exercise data subject rights may be addressed to User Flow at any time using the contact options stated above.

Enquiries are processed in accordance with statutory requirements.

24.2 Data protection officer

A data protection officer has not currently been appointed. Whether a statutory obligation to appoint one exists is currently being assessed. Should an appointment be made, the contact details will be published here and in section 1.

Irrespective of this, all data protection matters may be addressed to User Flow at any time using the contact options stated above.

Last updated: 10/2026 · Version: 2.01