Skip to content

Privacy policy

Last updated: 18 October 2026

This privacy policy explains which personal data we process when you visit this website, write to us, book an appointment or request consultant profiles and guides. It sets out the purpose and legal basis of the processing, how long we keep the data and what rights you have. This English version is a translation. If it differs from the German version, the German version applies.

Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

FlixConsulting GmbH
Weismüllerstraße 45
60314 Frankfurt am Main
Deutschland

Email: info [at] flixconsulting [dot] com

Further information about our company is available in our Legal notice.

Data protection officer

We are not required to appoint a data protection officer (Art. 37 GDPR, Section 38 of the German Federal Data Protection Act, BDSG). If you have questions about data protection, please contact us directly. Our contact details are listed above under “Controller”.

Visiting the website and server logs

This website runs on servers in a data centre in Germany. When you open a page, your browser sends technically necessary data to our server. The server stores the following in log files (server logs):

  • your IP address. It is stored in full until the daily log rotation, so for no more than 24 hours. After that, the server shortens it: for IPv4 by the last byte, for IPv6 by the last block.
  • date and time of the request
  • the requested address (URL)
  • the HTTP status code and the amount of data transferred
  • the page you came from (referrer), if your browser sends it
  • browser and operating system as reported by your browser (user agent)

To protect our forms against abuse, we limit the number of requests per IP address (rate limit). For this, the server keeps the full IP address in memory for no more than 24 hours. It does not store it permanently.

Purpose: We need this data to deliver the website, keep it secure and stable, and detect errors or attacks. To fend off attacks, for example by blocking individual addresses, we need the full IP address for a short time.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.

Retention: Server logs are deleted automatically after 14 days. If we need individual entries to investigate a security incident, we keep them until the incident has been resolved.

Encryption

This website transmits all content in encrypted form (TLS). You can tell by the “https://” in your browser’s address bar. Third parties cannot read the information you enter in forms while it is in transit.

Cookies and browser storage

This website does not set cookies for advertising, analytics or tracking. We only store in your browser what a function you have requested needs:

  • Colour scheme: If you switch between the light and dark design, your browser stores your choice in local storage (localStorage, entry “theme”). The entry remains until you delete it. It is not sent to us.
  • Your choice on audience measurement: Your browser stores your decision from the consent banner in local storage (entry “consent”) so that we do not ask you again on every page. We ask again after 12 months.
  • Access to protected content: After you have confirmed your email address, we set a cookie. It unlocks consultant profiles and guides for 30 days and then expires. See “Access to consultant profiles and guides” for details.

The legal basis for storing and reading this information is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), because both are strictly necessary for the function you have requested. We process the personal data linked to the access cookie on the basis of your consent (Art. 6(1)(a) GDPR).

You can delete or block cookies and local storage in your browser at any time. The website remains usable; only an unlocked access ends.

Audience measurement with Umami

If you consent, we measure how this website is used with Umami, an open-source software. We ask you with a banner on your first visit. Without your consent, your browser does not load the measurement script and Umami records nothing. You can use the website in full without consenting.

We run Umami ourselves on a server in Germany. The measurement data is not passed on to any third party.

Umami does not set cookies and does not store IP addresses. It records:

  • pages viewed, page titles and the page you came from (referrer)
  • browser, operating system, device type, screen size and language setting
  • approximate location (country, region, city), which Umami derives from the IP address
  • time of the visit and individual events, for example a click on the link to book an appointment

To group the page views of one visit, Umami creates an identifier (hash) from the IP address, browser details and a secret value that changes every month. The IP address cannot be recovered from this identifier. We cannot link the measurement data to any person and do not combine it with other data.

Purpose: We want to understand which content is read and how visitors find the website, so that we can improve it.

Legal basis: your consent. Section 25(1) TDDDG applies to reading information from your browser, Art. 6(1)(a) GDPR to the further processing.

Withdrawal: You can withdraw your consent at any time with effect for the future. To do so, click “Privacy settings” at the bottom of the page and select “Decline”. Processing carried out before the withdrawal remains lawful. If your browser sends the “Do Not Track” signal, Umami does not record your visit even with your consent.

Retention: Measurement data is deleted after 24 months.

Fonts and third-party content

We serve all fonts, images and scripts from our own server. When you visit the website, your browser does not connect to any third-party servers, such as Google Fonts or content delivery networks. We do not embed videos, maps, social media plugins, chat windows or advertising.

Contact form and email

You can reach us via the contact form or by email. We then process:

  • in the form: name, company, email address and your request, plus anything else you choose to provide
  • by email: your email address, the content of your message and the technical details of the email, for example the time and the sending server

The form sends your message as an email to our mailbox. Until the email has been delivered, your request is stored as a file on our web server, usually for a few seconds. We then delete it there. No third-party form service is involved. To prevent spam, we use a field that is invisible to people and the rate limit described above, not a CAPTCHA.

If a business relationship results from your request, we transfer your contact details to our CRM system (see “HubSpot”).

Purpose: We answer your request and, where applicable, prepare a proposal or an engagement.

Legal basis: Art. 6(1)(b) GDPR if your request is aimed at a contract. Otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering requests.

Retention: Once your request has been fully dealt with and no engagement results, we delete it six months after the last message. Statutory retention obligations take precedence. For example, we keep business letters for six years (Section 257 of the German Commercial Code, HGB; Section 147 of the German Fiscal Code, AO).

Access to consultant profiles and guides

We provide full consultant profiles and our guides as PDFs after a short registration. One registration unlocks both. We process:

  • name, company, business email address and the reason for your request
  • which profile or guide you requested
  • time of your consent, version of the form and a hash of your IP address as proof of consent
  • the time at which you confirm your email address
  • which profiles and guides you access while your access is unlocked

This is how registration works:

  • After you submit the form, we create a contact for you in our CRM system HubSpot, initially marked as “unconfirmed”.
  • You receive an email with a personal link. It is valid for 7 days.
  • By clicking the link, you confirm your email address. We set a cookie that unlocks access for 30 days.
  • We record each access to a profile or guide on your contact in HubSpot.
  • Guides are provided as PDFs with your name, your company, the date and a document number in the footer. This protects the documents against unauthorised distribution.

Purpose: We provide you with consultant profiles and expert documents and contact you about your request.

Legal basis: your consent under Art. 6(1)(a) GDPR, which you give by ticking the box in the form. We store the proof of consent under Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Withdrawal: You can withdraw your consent at any time with effect for the future, for example by email to us. Processing carried out before the withdrawal remains lawful.

Retention:

  • If you do not confirm your email address, your data is deleted automatically after 30 days.
  • After confirmation, we keep your data until you withdraw your consent, but no longer than 24 months after your last access or contact with us.
  • We keep the proof of consent for up to three years after processing ends.

Providing the information is voluntary. Without it, we cannot unlock access.

Expert updates by email

In the form for guides, you can also tick a box to receive expert updates by email, for example about new guides. This consent is voluntary and separate from access. You get access without it.

The consent only takes effect once you confirm your email address via the link in our email (double opt-in). We send the updates via HubSpot. HubSpot records whether you open an email and which links you click. We use this analysis to improve topics and content. Your consent covers this analysis.

Legal basis: Art. 6(1)(a) GDPR and, for the analysis, also Section 25(1) TDDDG.

Unsubscribing: Every email contains an unsubscribe link. You can also unsubscribe informally by email. After that, you will no longer receive updates.

Retention: until you unsubscribe. We then keep the proof of consent for up to three years.

Booking appointments via HubSpot Meetings

For calls, we link to our booking page on HubSpot Meetings. The booking page is not embedded in our website. Only when you follow the link do you move to a page operated by HubSpot. HubSpot’s privacy notice, including its information on cookies, also applies there: legal.hubspot.com/privacy-policy

When you book an appointment, we process your name, your email address, the selected time and any information you provide voluntarily. The booking is stored in HubSpot and in our calendar. You receive a confirmation by email.

Purpose: We plan and hold the call.

Legal basis: Art. 6(1)(b) GDPR where the call prepares an engagement. Otherwise Art. 6(1)(f) GDPR. Our legitimate interest is simple appointment scheduling.

Retention: as for requests via the contact form.

HubSpot

We use the CRM system HubSpot to manage contacts, requests and appointments. The contracting party for customers in Europe is HubSpot Ireland Limited, One Sir John Rogerson's Quay, Dublin 2, Ireland. We have concluded a data processing agreement with HubSpot under Art. 28 GDPR. HubSpot processes the data only on our instructions.

HubSpot stores our data in data centres in the European Union. The parent company HubSpot, Inc. in the USA may access data, for example for support and maintenance. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework. Transfers to certified companies are covered by an adequacy decision of the European Commission (Art. 45 GDPR). In addition, HubSpot has agreed to the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

We do not embed HubSpot’s tracking script, forms or chat on this website. HubSpot does not set any cookies here. Our server sends your form data directly to HubSpot.

The purpose and legal basis depend on the sections in which we mention HubSpot.

Recipients

We only pass on your data where this is necessary for the purposes described or where we are legally required to do so. Recipients are:

  • IT service providers that operate servers, data centre, mailboxes and calendars for us, as processors under Art. 28 GDPR
  • HubSpot as a processor (see “HubSpot”)
  • tax advisers and lawyers bound by professional secrecy, where this is necessary for our legal obligations or to enforce claims
  • authorities and courts, where we are legally required to do so

We do not sell data and do not pass it on to third parties for advertising purposes.

Transfers to third countries

We process your data in Germany and in the European Union. A transfer to countries outside the EU and the EEA is only possible via HubSpot. The safeguards are described in the section “HubSpot”.

Our pages contain links to other websites. As long as you do not follow a link, we do not transfer any data to their operators. Once you click, the privacy policy of the respective operator applies.

Your rights

You have the following rights in relation to us:

  • access to your stored data (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure of your data (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing (Art. 21 GDPR, see next section)
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise these rights, simply contact us, for example by email to the address given above under “Controller”.

Right to object under Art. 21 GDPR

Where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing, you can object at any time without giving reasons. We will then no longer use your data for this purpose.

You can object informally, for example by email to us.

Complaints to a supervisory authority

If you believe that we are not processing your data lawfully, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
datenschutz.hessen.de

You can also contact the supervisory authority at your place of residence or work.

No automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Changes to this privacy policy

We update this privacy policy when the website, our data processing or the legal situation changes. The version published on this page applies. The date of the last change is shown at the top under “Last updated”.