This notice explains which personal data is processed when you visit this website, for what purpose, and what rights you have.
Controller
IIoT-Flow GmbH
Goebenstr. 14
45139 Essen, Germany
Email: [email protected]
Phone: +49 201 85299930
Your rights
You have the right at any time to:
- request information about the personal data we hold about you (Art. 15 GDPR),
- request correction of inaccurate data (Art. 16 GDPR),
- request deletion of your data, unless a statutory retention period applies (Art. 17 GDPR),
- request restriction of processing (Art. 18 GDPR),
- receive your data in a structured, commonly used format or have it transferred to another controller (Art. 20 GDPR),
- object to processing based on legitimate interest (Art. 21 GDPR),
- withdraw any consent given, with effect for the future (Art. 7(3) GDPR),
- lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — the competent authority for IIoT-Flow GmbH is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.
For any of these requests, please contact us at the address above.
Hosting
This website runs on Odoo Online, a cloud service operated by Odoo S.A. (Chaussée de Namur 40, 1367 Ramillies, Belgium). Odoo S.A. processes personal data on our behalf as a processor; the required Art. 28 GDPR data processing agreement is automatically part of the Odoo subscription terms. Legal basis is our legitimate interest in a reliable, professionally operated website (Art. 6(1)(f) GDPR).
Traffic between your browser and our website additionally passes through the content delivery network of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), which we use for secure, stable delivery of the website and protection against attacks. In the process, personal data — in particular your IP address — may be transferred to the USA; the basis for this is the EU Standard Contractual Clauses. Legal basis for the use is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR).
Access data (server log files)
Visiting this website automatically generates technical access data, as is standard for any website (e.g. IP address, date and time of access, page requested, browser and operating system, referring URL). This data supports the technical stability and security of the service and is not combined with other data sources. Legal basis is our legitimate interest in a functioning, secure website (Art. 6(1)(f) GDPR).
Cookies
This website uses strictly necessary cookies: a session cookie to maintain your browser session, a cookie storing your language preference, a cookie recording your time zone, and — once you make a choice in the cookie banner — a cookie storing that choice. These cookies may be used without separate consent under German law (§ 25(2) TDDDG).
This website additionally runs a cookie consent banner. It requests your consent before any non-essential service (e.g. analytics or marketing cookies) is loaded, and blocks such services until you agree. A current overview of the cookie categories in use is available on our Cookie Policy.
Web fonts
This website uses the Inter and Inter Tight fonts. They are not loaded from Google's servers but delivered together with the website via our hosting provider (see the "Hosting" section). Loading a page therefore transfers no personal data to Google or other third parties.
Analytics and tracking
We currently do not use any analytics, statistics, or tracking tools on this website.
Contact form
The contact form lets you provide your name, company, email address, phone number, and your message. We use this information solely to process your inquiry and respond to you. Legal basis is the performance of pre-contractual or contractual measures (Art. 6(1)(b) GDPR) or, where no contract is being anticipated, our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR). Data is deleted once it is no longer needed to process your inquiry and no statutory retention period applies.
Customer portal
Customers can request personal access to our customer portal. There, we process:
- account data: name, email address, and a password (stored by Odoo not in plain text but as a non-reversible hash),
- authentication and session data at login,
- documents shared with you (e.g. quotations, invoices, project documents),
- the message history (chatter) on those documents between you and our team.
Legal basis for account and document data is the performance of our contractual relationship with you (Art. 6(1)(b) GDPR); for login and session data our legitimate interest in secure access and abuse prevention (Art. 6(1)(f) GDPR). Retention follows German commercial and tax record-keeping periods (§§ 147 AO, 257 HGB), 6 to 10 years depending on document type.
Video calls
For scheduled customer calls we use Odoo's built-in video calling feature (Odoo Discuss). The underlying media-relay infrastructure (SFU) is operated by Odoo S.A. within the EU; for connection relaying (TURN) we additionally operate our own server, hosted with a European provider. No data is transferred to countries outside the EU in this context. Legal basis is the performance of the agreed call (Art. 6(1)(b) GDPR).
Retention period
Unless a more specific retention period is stated above, we retain personal data only for as long as necessary for the respective purpose, or as required by statutory retention obligations.
Changes to this notice
We update this privacy notice whenever data processing on this website changes. The version published on this page is always the current one.
Last updated: 24 July 2026