Website Privacy Policy

(Last update: March 2020)
At FLEX Capital, we are particularly committed to protecting your personal data. This Website Privacy Policy describes processing operations and types of data we collect from you, and explains how we further use that data and with whom we share it. The Privacy Policy also describes what measures we take to protect your personal information and how you can contact us with questions about our privacy practices. Any changes to this Privacy Policy will be posted here. Therefore, please check FLEX Capital's Privacy Policy periodically when you visit the FLEX Capital website.

1. responsible party/contact

The responsible provider of the www.flex.capital website ("Website") is FLEX Capital Management GmbH ("we" or "FLEX Capital"). Our principal place of business is located at Münzstraße 21, 10178 Berlin, Germany.
FLEX Capital is responsible for the collection, processing and use of personal data of website visitors ("you" or "users") for the purposes of the General Data Protection Regulation ("GDPR"). If you have any questions or concerns about this website, the way we process your personal data, or any other questions about the Privacy Policy, please contact us by email at privacypolicy@flex.capital. Our full contact details can be found on the website.

This Privacy Policy informs users about the data processing operations and use of personal data. A current version of the Privacy Policy is available on the Website.

2. Personal data

2.1 Collection, processing and use of personal data

In principle, you can visit our website for informational use. We are entitled to process your personal data if you provide it to us directly and the legal conditions are met, e.g. if you contact us by e-mail or via the contact form, if this is necessary for technical reasons or if we receive the data from a third party source, e.g. from a company for which you work.

Personal data is data that can directly identify you either individually or in combination with other data. Sensitive personal data is only processed by us if you have provided it to us directly.

When you visit the website, your browser sends various data to our servers. This information is necessary to establish and maintain the connection. However, this data is not combined with other data about you. Your browser automatically sends the following data to our servers:

• IP address
• Date and time of the request
• Requested data volume
• Request successful/unsuccessful
• Previous and subsequently visited browser website
• Version of the browser software
• Operating system and operating system version

We use your personal data

• to provide you with our services and information
• to provide periodic company news
• to invite you to events
• to send you information about news
• to improve our services and communication with you
• for the purposes of employment, partnership or the provision or retention of services
• to send you invoices or reminders
• to process your inquiries and requests
• for other purposes for which processing is necessary and lawfully legitimate.

This personal data may be shared

• with third party providers, such as cloud CRM providers or hosting solutions providers
• with professional advisors, such as accountants, lawyers or other consultants
• with other companies within the FLEX Capital group

The period for which FLEX Capital stores personal data depends on the purposes for which it was processed and the requirements of applicable legal retention obligations (HGB, AO, SGB I-XII, etc.) or regulations.

In accordance with data protection laws, our legal basis for storing the personal data you provide is that this storage is necessary for our legitimate interest in managing and promoting our company pursuant to Art. 6 (1) lit. f) DSGVO.

According to Art. 6 DSGVO, further reasons for the processing and storage of personal data may be:

• that users consent to the collection, processing and use of personal data pursuant to Art. 6 (1) a) DSGVO.
• that the processing of personal data is necessary for the performance of a contract or for the implementation of pre-contractual measures pursuant to Art. 6 para. 1 lit. b) DSGVO.

The processing of your personal data is subject to the requirements of the DSGVO in conjunction with BDSG-neu.

2.2 Sensitive personal data or special category personal data

Different rules apply to data about racial and ethnic origin, political opinions or beliefs, religious or other similar beliefs, trade union membership, physical or mental health, sexual orientation, and any criminal offences committed, convictions or legal proceedings relating to actual or potential criminal offences. These types of personal data are referred to as sensitive or special category personal data. Please do not send us sensitive personal data as we generally do not need it.

2.3 International transfer of personal data

FLEX Capital may transfer Personal Data to a country outside your country of residence, including countries outside the EEA. In the event that FLEX Capital transfers personal data to third parties outside the EEA, we will endeavor to ensure that such transfers are made in compliance with data protection laws, for example, by entering into data transfer agreements or a contract for commissioned data processing involving the EU Standard Contractual Clause with the recipient. In addition, pursuant to Art. 45 GDPR, a transfer of personal data to a third country or an international organization may take place if the Commission has decided that the third country, a territory or one or more specific sectors within that third country or the international organization concerned ensures an adequate level of protection or if the exceptional circumstances pursuant to Art. 49(1) GDPR apply.

2.4 Data protection during recruitment

In connection with seeking employment with us, FLEX Capital may collect personal data, your resume, application form, interview materials and opinions about you. This data will be retained by us for the purpose of evaluating your potential employment. Data you provide to us for this purpose may be shared with selected third parties to evaluate you for employment. In particular, you should note that your application will be subject to review. This may involve checking your references and the qualifications stated on your application by contacting the relevant office. We may also process sensitive personal data in the process.

If your application for employment is unsuccessful, we may retain the data only for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person, but in any case no longer than necessary for these purposes.

The basis for the processing of your personal data is thereby your consent, the fulfillment of our pre-contractual obligations and our legitimate interest pursuant to Art. 6 para.1 lit. a), b), f) DSGVO and Art. 9 para. 1 lit. a), b), e), g) DSGVO.

3. Cookies

3.1 Use of cookies

When you visit our website, we use cookies to facilitate and improve your experience with our website. Cookies are small text files that are stored in your browser. These cookies do not contain any personal data. We use persistent cookies so that we can recognize you when you revisit our website. A persistent cookie remains stored in your browser.

Certain functions of our website cannot be performed without cookies. These are considered "absolutely necessary". You can still block these cookies by changing your browser settings. However, please note that our website may not function properly if you do so.

Cookies are small text files that are stored on your hard drive and through which certain information flows to the entity that sets the cookie. Cookies cannot execute programs or transmit viruses to your computer. They are used to make our website more user-friendly and effective overall and to continuously improve our website and tailor it to your interests and needs.

For more information about cookies, please visit www.aboutcookies.org or href="http://www.allaboutcookies.org/">www.allaboutcookies.org.

The legal basis for the use of cookies is our legitimate interest pursuant to Art. 6 para. 1 lit. f) DSGVO.

3.2 Plug-ins, services, content and technologies of third parties

3.2.1 Use of social media plug-ins

We currently use the following social media plug-ins: Xing, LinkedIn. We offer you the option to connect directly to the provider of the plug-in via the button. In the case of Xing, the IP address is anonymized immediately after collection according to the information provided by the respective provider in Germany.

Personal data is transmitted from you to the respective plug-in providers, Xing or LinkedIn, and processed there (in the case of US providers in the USA). We have no influence on the data collected and the data processing operations, nor are we fully aware of the scope of the data collection, the purposes of the processing or the storage periods. We also have no information about the deletion of the collected data by the plug-in provider.

The plug-in provider stores the data collected about you as user profiles and uses them for purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) in order to display demand-oriented advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact the respective plug-in provider to exercise this right. The plug-ins allow you to interact with social networks and other users so that we can improve our services and make them more interesting for you as a user.

The data exchange takes place regardless of whether you have a user account with the plug-in provider and are logged in with them. If you are logged in with the plug-in provider, your data collected by us will be directly assigned to your existing user account with the plug-in provider. If you press the activated button and link to the page, for example, the plug-in provider will also store this information in your user account and share it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this will help you avoid being assigned to your profile by the plug-in provider.

For more information on the purpose and scope of data collection and processing by the plug-in provider, please refer to the following privacy statements of these providers. There you will also find further information about your rights in this regard and setting options for protecting your data.

Addresses of the respective plug-in providers and URL with their data protection information:

New Work SE, Gänsemarkt 43, 20354 Hamburg, Germany; http://www.xing.com/privacy.

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; within the EU.

LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; outside the EU http://www.linkedin.com/legal/privacy-policy. LinkedIn has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

The legal basis for the use of social media plug-ins is our legitimate interest pursuant to Art. 6 para. 1 lit. f) DSGVO.

3.2.2 Integration of Google Maps

In addition, we use Google Maps API on our website to visually display the address of our office. When using Google Maps, Google also collects, processes and uses data on the use of the map functions by visitors. This occurs regardless of whether Google provides a user account through which you are logged in or whether there is no user account. If you are logged in to Google, your data will be directly assigned to your account. If you do not want the assignment with your profile at Google, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

For more information on the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider's privacy policy. There you will also find further information on your rights in this regard and setting options for protecting your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

The legal basis for the use of Google Maps is our legitimate interest pursuant to Art. 6 para. 1 lit. f) DSGVO.

3.2.3 Eventbrite

We use Eventbrite for event advertising and bookings. Please note that Eventbrite is a third-party service that is not owned or managed by FLEX Capital Management GmbH. For more information, please see Eventbrite's privacy policy.

Eventbrite operates in the US and subscribes to the EU-US Privacy Shield, which requires subscribers to comply with European data protection standards. For more details, please visit:

Eventbrite Terms of Use: https://www.eventbrite.de/support/articles/de/Troubleshooting/nutzungsbedingungen-von-eventbrite?lg=de
Eventbrite privacy policy: https://www.eventbrite.de/support/articles/de/Troubleshooting/datenschutzrichtlinien-von-eventbrite?lg=de

The legal basis for the use of Google Maps is our legitimate interest pursuant to Art. 6 para. 1 lit. f) DSGVO.

3.3 Web analysis

Our website uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. In the event that IP anonymization is activated on this website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage.

The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

This website uses Google Analytics with the extension "anonymizeIp ()". This means that IP addresses are processed in abbreviated form, thus excluding the possibility of personal references. Insofar as the data collected about you is related to a person, this is therefore immediately excluded and the personal data is thus immediately deleted.

We use Google Analytics to analyze and regularly improve the use of our website. The statistics obtained enable us to improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has subjected itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

Third-party provider information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. User terms: http://www.google.com/analytics/terms/de.html,

Privacy Policy Overview: http://www.google.com/intl/de/analytics/learn/privacy.html, and Privacy Policy: http://www.google.de/intl/de/policies/privacy.

This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your Google customer account under "My Data", "Personal Data".

The legal basis for the use of Google Analytics is our legitimate interest pursuant to Art. 6 (1) f) DSGVO. The legitimate interest is derived from the maintenance and presentation of our services, as well as the analytical evaluation of visitor flows.

3.4 Newsletter

With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers. The advertised services are named in the declaration of consent.

For the registration to our newsletter we use the so-called double opt-in procedure. This means that after your registration, we will send you an e-mail to the e-mail address you provided, in which we ask you to confirm receipt of the newsletter. In addition, we store the IP addresses you use as well as the registration and confirmation data. The purpose of this procedure is to prove your registration and, if necessary, to clarify a possible misuse of your personal data.

After your confirmation, we store your e-mail address for the purpose of sending you the newsletter.

The legal basis is your consent in accordance with Art. 6 Para. 1 lit. a) DSGVO.

You can revoke your consent to receive the newsletter at any time and unsubscribe. You can declare the revocation by clicking on the link contained in every newsletter email or by sending an email to privacypolicy@flex.capital.

We would like to point out that we evaluate your user behavior when sending the newsletter. For this evaluation, the emails sent contain so-called web beacons or tracking pixels. For the evaluation, we link the data and the web beacons with your e-mail address and an individual ID. The data is collected exclusively under a pseudonym, so that the IDs are not linked with your other personal data, a direct personal reference is excluded. The data is stored as long as you have subscribed to the newsletter. After you unsubscribe, we store the data purely statistically and anonymously. Furthermore, it is not possible to trace your data if you have deactivated the display of images in your e-mail program by default. In this case, the newsletter will not be displayed in full and you may not be able to use all the features. If you choose to display the images manually, the above tracking will occur.

We use MailChimp (The Rocket Science Group, LLC) to manage email marketing subscriber lists and send emails to our subscribers. The associated privacy policy of MailChimp can be found here: https://mailchimp.com/legal/privacy/

3.5 Contact form

If you use the contact form or send us a service request, the following data may be collected to process the request: Salutation, first name/last name, e-mail address, optionally a mailing ID, your browser version and operating system, as well as the message to be transmitted and your IP address. The data transmitted with the submission of the form will be processed by FLEX Capital. The processing serves exclusively the handling of the respective request. After processing the respective request, the data is archived for documentation purposes until the purpose for which it was collected no longer applies.

Data will not be passed on to third parties for advertising purposes. Your data will not be passed on to other third parties for the purpose of processing the inquiry.

The basis for the processing of your personal data is your consent, the fulfillment of our contractual obligations and our legitimate interest pursuant to, Art. 6 para. 1 lit. a), b), f) DSGVO.

3.6 Nominations "Software Bootstrapper of the Year" Award

If you use the form for nominations for the "Software Bootstrapper of the Year" Award, the following data may be collected for processing the nomination. Salutation, first name/last name, e-mail address, optionally a mailing ID, company name of the nominee, your first name/last name, e-mail address, salutation, your browser version and operating system, as well as the submitted nomination reason and your IP address. The data transmitted with the submission of the form will be processed by FLEX Capital. The processing is exclusively for the purpose of processing the respective nomination. After processing the respective nomination, the data will be archived for documentation purposes until the purpose of collection ceases to apply.

Data will not be passed on to third parties for advertising purposes. Your data will not be passed on to other third parties for the purpose of processing the request.

The basis for the processing of your personal data is your consent, the fulfillment of our contractual obligations and our legitimate interest pursuant to, Art. 6 para. 1 lit. a), b), f) DSGVO.

4. security and external links

FLEX Capital takes all steps necessary to protect your personal information. However, we cannot guarantee the security of any personal information you disclose online. You agree to the security risks of providing information online over the Internet and will not hold FLEX Capital responsible for any breach of security unless caused by FLEX Capital's negligence or willful default.

Our website may contain hypertext links to external websites. We are not responsible for their content. You should read any applicable privacy policy on any such website.

5. Your rights

Individuals whose personal data we process may be entitled to

• To obtain information as to whether personal data in question is being processed.
• to request that they be deleted.
• to request that their processing be restricted.
• request that any inaccurate personal data be corrected.
• exercise their right to data portability.
• exercise their right to withdraw their consent.
• exercise their right to lodge a complaint with a supervisory authority if you believe that the processing of
• their data violates data protection law.

You also have the right to object to the processing of your personal data or, in certain circumstances, to obtain a copy of the personal data in a commonly machine-readable format. Such requests should be addressed to privacypolicy@flex.capital.

Withdrawal of consent to the processing of personal data will result in us no longer continuing the data processing that was based on the consent in the future. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Insofar as we process your data on the basis of legitimate interests pursuant to Art. 6 (1) f) DSGVO, you have the right to object to the processing of your data pursuant to Art. 21 DSGVO, insofar as there are grounds for doing so that arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right of objection, which will also be implemented by us without giving reasons.

We expressly reject the automated creation of profiles and evaluation procedures of our users.

6. Contact

If you have any questions about this website, the way we process your personal data, or the content of this privacy statement, please contact us by email at privacypolicy@flex.capital. Our full contact details can be found on the website.

7. Modification of our privacy policy

We reserve the right to adapt this privacy policy to ensure that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. The new data protection statement will then apply to your next visit. The current version of the privacy policy can be found on our website.