Contact privacy notice

pursuant to Art. 14 GDPR (collection of personal data not from the data subject)

Last updated: 20 October 2026

1. Controller

FlowQ Beratungs- & Servicegesellschaft mbH
Zeppelinstraße 73
81669 Munich

Managing Director: Christian Lüters

Phone: +49 (0) 89 2000 0719
Email: datenschutz@flowq.de
Website: www.flowq.de

Commercial register: Amtsgericht Munich, HRB 280425
VAT ID No.: DE 357 711 561

2. Purpose of the data processing

We process your personal data solely for the purpose of initial business outreach in a B2B context. Specifically, this means:

• Contacting decision-makers (e.g. heads of sales, managing directors) at B2B companies in the DACH region
• Subject matter: sales prioritisation and data-driven market monitoring
• Contact is made on the basis of a professional relevance check of your professional profile

Contact comprises at most one initial message and a single follow-up (no earlier than after 7 days). It is not recurring advertising or a newsletter.

3. Categories of personal data processed

We process only business contact data connected with your professional activity:

• First name and surname
• Business e-mail address
• Professional position or function
• Name and size of your company
• Business telephone number (where publicly available)
• URL of your professional LinkedIn profile

We process no private contact data, no data from social networks of a private nature and no special categories of personal data within the meaning of Art. 9 GDPR.

4. Source of the data

Your data was not collected from you directly but researched from publicly available sources, professional networks and commercial data providers. These include in particular:

• Professional networks (e.g. LinkedIn)
• Company websites (e.g. team pages, legal notice)
• Commercial register entries and comparable public directories
• Published press releases and professional articles

5. Legal basis for the processing

Your data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest).

Our legitimate interest lies in making business contact with decision-makers whose professional profile is thematically relevant to a professional exchange on sales prioritisation and data-driven market monitoring.

Balancing of interests: Before making contact, we carried out a balancing exercise between our business interest and your interests worthy of protection. In doing so, we took the following into account:

• Only business (not private) contact data is processed.
• The data is professional data from publicly available sources, professional networks and commercial data providers.
• The contact is directly connected with your professional function.
• The scope of the contact is limited to a maximum of two messages.
• An objection is complied with without undue delay, and at the latest within one month (Art. 12(3) GDPR).

We take the view that, in these circumstances, your interests worthy of protection do not override ours. You have the right at any time to object to this assessment (see section 9).

6. Recipients and disclosure of the data

Your data is not sold to third parties or disclosed for marketing purposes.

The following categories of recipients may gain access to your data in the course of the processing:

Note on third-country transfer (USA)

For the technical dispatch of emails we use a service provider based in the USA. The data is transferred on the basis of EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Supplementary technical and organisational measures (TLS encryption, access restriction) have been implemented to ensure an adequate level of data protection.

To manage contacts we use the CRM system HubSpot of HubSpot, Inc., USA. The data is stored in a data centre in the EU. Because access by the company in the USA, for example in the context of support, remains possible, the transfer relies on the EU-US Data Privacy Framework (adequacy decision of the European Commission) and, in addition, on EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

You can request a copy of the standard contractual clauses from us (datenschutz@flowq.de).

7. Storage period

Your personal data is stored as follows:

• Where contact is successful and a business relationship follows: For the duration of the business relationship plus statutory retention periods (as a rule 6 or 10 years under the HGB (German Commercial Code) / AO (German Fiscal Code)).
• Without a response: Deletion no later than 6 months after the last contact.
• Upon objection: Deletion without undue delay, and at the latest within one month (Art. 12(3) GDPR), after receipt of your objection. Your e-mail address is placed on an internal suppression list (do-not-contact list) to ensure that you are not contacted again. The suppression list contains only name, company and e-mail address and serves only this purpose.
• Where the purpose lapses: Immediate deletion once the purpose of the processing no longer applies.

8. Automated decision-making

There is no automated decision-making within the meaning of Art. 22 GDPR. In particular, no profiling measures are carried out that produce legal effects or similarly significantly affect you.

The persons contacted are selected on the basis of a professional relevance check involving human participation.

9. Your rights as a data subject

You have the following rights under the GDPR. To exercise them, an informal notice to datenschutz@flowq.de or by post to the address stated above is sufficient.

Right of access (Art. 15 GDPR)

You have the right to request information on whether and which personal data we process about you, as well as information on the purpose of the processing, the categories of data, the recipients and the planned storage period.

Right to rectification (Art. 16 GDPR)

You have the right to request the rectification without undue delay of inaccurate personal data or the completion of incomplete personal data.

Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data where one of the grounds set out in Art. 17 GDPR applies, in particular where the data is no longer necessary for the purpose of the processing or you object.

Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing, for example where you contest the accuracy of the data or the processing is unlawful.

Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.

Right to object (Art. 21 GDPR)

You have the right to object at any time to the processing of your personal data, insofar as the processing is based on Art. 6(1)(f) GDPR (legitimate interest).

Upon receipt of your objection, we will cease processing your data without undue delay and delete your data without undue delay, and at the latest within one month (Art. 12(3) GDPR). Your e-mail address is placed on our internal suppression list so that you are not contacted again.

How to object:

• By e-mail to: datenschutz@flowq.de
• By replying to the e-mail you received (a simple "No thank you" or "Please do not contact me again" is sufficient)
• By post to the address stated above

An objection is possible without stating reasons and is free of charge for you.

Right to lodge a complaint with the supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Phone: +49 (0) 981 / 180093-0
Email: poststelle@lda.bayern.de
Website: www.lda.bayern.de

10. Duty to provide information pursuant to Art. 14(3) GDPR

This privacy notice is made available to you at the latest within one month after your data is collected, as a rule in the course of the initial contact by e-mail. The information is provided by a link to this page (flowq.de/en/privacy-contact/).

11. Contact for data protection enquiries

For all questions on data protection and on the exercise of your rights, please contact:

FlowQ Beratungs- & Servicegesellschaft mbH
For the attention of Christian Lüters (data protection)
Zeppelinstraße 73
81669 Munich

Email: datenschutz@flowq.de
Phone: +49 (0) 89 2000 0719

We will respond to your enquiry without undue delay, and at the latest within one month (Art. 12(3) GDPR).

This privacy notice relates exclusively to the processing of personal data in the course of initial business outreach. The general privacy policy for the use of our website can be found at flowq.de/en/privacy/.