With this data protection information, we inform you about our handling of your personal data and about your rights under the European General Data Protection Regulation (GDPR). Schüttflix GmbH (hereinafter referred to as "we" , "us" or “SFLX” ) is responsible for data processing.

1. General information

1. Contact Information

If you have any questions or suggestions regarding this information or would like to contact us to assert your rights, please send your request to: 

Schüttflix GmbH

Langer Weg 5

33332 Gütersloh

Phone: +49 5241 60130-0

E-mail: legal@schuettflix.com

1.  Legal basis

The data protection term "personal data" refers to all information that relates to an identified or identifiable person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and national data protection provisions. . Data processing by us only takes place on the basis of legal permission. We only process personal data with your consent. 6 (1) (a) GDPR), to fulfill a contract to which you are a party or at your request to carry out pre-contractual measures (Art. 6 (1) (b) GDPR), to fulfill a legal obligation (Art. 6(1)(c) GDPR) or if processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (Art. 6(1)(f) GDPR). If you apply for an open position in our company, we will also process your personal data to decide on the establishment of an employment relationship ( Art. 6 para. 1 letter b GDPR).

3. Duration of storage

If no explicit storage period is specified when the data is collected (e.g. as part of a declaration of consent), your personal data will be deleted as soon as it is no longer required to fulfill the purpose for which it was stored, unless statutory retention obligations (e.g. retention obligations under commercial and tax law) or compelling reasons worthy of protection which outweigh your interests, rights and freedoms prevent deletion, or the further processing of the data by us serves to assert, exercise or defend our rights and legal claims.

4. Categories of recipients of the data

We use processors in the context of processing your data. The processing operations carried out by such processors include service providers that we use for the operation, administration and design of the Schüttflix platform and for the processing of contracts, in particular payments, as well as for advertising purposes. A processor is a natural or legal person, public authority, agency or other organization which processes personal data on behalf of the controller. Processors do not use the data for their own purposes, but carry out data processing exclusively for the controller and are contractually obliged to guarantee suitable technical and organisational measures for data protection. We may also transfer your personal data to institutions such as postal and delivery services, payment service providers and banks, tax consultants/auditors or the tax authorities.

If you conclude contracts for the delivery of bulk goods or other services via the Schüttflix platform or post corresponding offers, we will pass on the order details and your contact details to:

• our trading partners,

• suppliers,

• freight forwarders,

• carriers and

• other companies

 that we use to fulfill orders.

5. Data transfer to third party countries

Our data processing may involve the transfer of certain personal data to third countries, i.e. countries in which the GDPR is not applicable. Such a transfer is permissible if the European Commission has determined that an adequate level of data protection exists in such a third country. If there is no such adequacy decision by the European Commission, personal data will only be transferred to a third country if there are suitable guarantees in accordance with Art. 46 GDPR or if one of the requirements of Art. 49 GDPR is met.

If there is no adequate decision and nothing else is specified below, we use the EU standard data protection clauses as suitable guarantees for the transfer of personal data to third countries. You have the option of obtaining or viewing a copy of these EU standard data protection clauses. Please contact us at the address stated under section Contact Information.  

If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Art. 49 para. 1 letter a GDPR.

6. Data Processing when exercising your rights

If you exercise your rights in accordance with Art. 15 to 22 GDPR, we will process the personal data transmitted for the purpose of implementing these rights and in order to be able to provide evidence of this. For the purpose of granting information and its preparation will only be processed for this specific purpose and for the purposes of data protection monitoring and will otherwise restrict processing in accordance with Art. 18 GDPR.

This processing is based on the legal basis of Art. 6 para. 1 lit. c GDPR in conjunction withArt. 15 to 22 GDPR. 

7. Your Rights

As a person whose personal data is processed, you have the right to assert your data subject rights against us. In particular, you have the following rights:

• In accordance with Art. 15 GDPR, you have the right to request information as to the extent to which we process your personal data.

• You have the right to request that we rectify your data in accordance with Art. 16 GDPR.

• You have the right to demand that we delete your personal data in accordance with Art. 17 GDPR .

• You have the right to restrict the processing of your personal data in accordance with Art. 18 GDPR.

• In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller.

• If you have granted us consent to process your data separately, you may revoke this consent at any time in accordance with Art. 7 (3) GDPR. Such a revocation does not affect the legality of the processing that was carried out on the basis of the consent until the revocation.

• If you are of the opinion that the processing of your personal data violates the provisions of the GDPR, you have the right to submit  a complaint with a supervisory authority in accordance with Art. 77 GDPR.

The data protection supervisory authority responsible for us is the:

Landesbeauftragte für Datenschutz und Informationsfreiheit NRW

Kavalleriestraße 2-4

40213 Düsseldorf

Germany

Telefon: 0211/38424 – 0

E-Mail: POSTSTELLE@LDI.NRW.DE

8. Right of revocation

In accordance with Art. 21 (1) GDPR, you have the right to revoke processing that is based on the legal basis of Art. 6 (1) (e) or (f) GDPR, for legitimate concerns relating to your particular situation, to file an objection. If we process personal data about you for the purpose of direct marketing, you can object to this processing in accordance with Art. 21 (2) and (3) GDPR.

1. Data processing on our website

When you use the website, we collect information that you provide by yourself. 

In addition certain information about your browsing on the website is automatically collected by us during your usage of the website. Under data protection law, the IP address is also considered personal data. An IP address is assigned to every device connected to the Internet by the Internet provider so that it can send and receive data.

1. Processing of Server-Log-Files

When you visit the Schüttflix website, certain access data and device information is automatically transmitted to us and temporarily stored in so-called log files. This may include:

• Your IP address,

• your device ID,

• the date and time of access

• the time zone,

• the amount of data transferred/the completeness of the data exchange/ possible breakdown of the website

• the website from which you accessed our website

• your operating system and the version of your operating system.

We need this data for the following purposes:

• to technically enable the operation of the website and the app,

• to make the website and the app available to you and

• to ensure the security and stability of the website and app, i.e. to prevent and eliminate misuse and malfunctions.

The access/device data does not enable us to identify you as a person. Insofar as they do, we do not use it to identify you as a person. We do not store access/device data for longer than is necessary to fulfill the aforementioned purposes.

The processing is carried out to safeguard our legitimate interests and is based on the legal basis of Art. 6 para. 1 letter f GDPR. Processing is necessary to ensure the functionality, error-free operation and security of our website.

The stored data will be deleted after a maximum of 7 days unless there is a justified suspicion of unlawful use based on concrete evidence and further examination and processing of the information is necessary for this reason. We store server log files that are collected within the Schüttflix app for 30 days.  We are not able to identify you as a data subject based on the stored information. 

Art. 15 to 22 GDPR therefore do not apply pursuant to Art. 11 para. 2 GDPR unless you provide additional information that enables you to be identified in order to exercise your rights set out in these articles.

1. Contact Details and Requests

Our website contains various contact forms that you can use to send messages and request quotes. The forms are provided by HubSpot or Jotform, a service of HubSpot Inc (USA) or Jotform Ltd (UK). For such integration, it is technically necessary to process your IP address so that the content can be sent to your browser.  If you send us a contact request, the content data that you provide to us via the form will also be processed. The providers act as processors and are contractually obliged to process the data only for our purposes. The transfer of your data is encrypted (recognizable by the "https" in the address line of the browser). All data fields marked as mandatory are required to process your request. If you do not provide this data, we will not be able to process your request. The provision of further data is voluntary. Alternatively, you can also send us a message via the contact E-Mail address. We process the data for the purpose of responding to your request. If you contact us via a contact form and enter your e-mail address, a user account will be created and the communication content stored in order to better process this and future inquiries. We also use Hubspot to send E-Mails.

If your request is aimed at the conclusion or execution of a contract with us, Art. 6 para. 1 letter b GDPR is the legal basis for data processing. Otherwise, we process the data on the basis of our legitimate interest in contacting inquiring persons. The legal basis for data processing is then Art. 6 para. 1 letter f GDPR.

This may result in the transfer of personal data to the USA. Please note the information in the section "Data transfer to third countries".

Further information on data protection at Jotform can be found at: https://www.jotform.com/de/gdpr-compliance/

Further information on data protection at Hubspot can be found at: https://legal.hubspot.com/de/privacy-policy

1. Registration

In order to use the Schüttflix platform, registration via the website is required. The required information can be found in the registration form. The provision of the information marked as mandatory is mandatory in order for the registration to be completed. The data provided will be processed for the purpose of providing the service. 

The processing is based on the legal basis of Art. 6 para. 1 letter b GDPR. 

Further information on data processing in our Schüttflix platform can be found in this privacy policy under III.

1. Cookies

We use cookies and similar technologies ("cookies") on our website. Cookies are small data records that are stored by your browser when you visit a website. This identifies the browser used and can be recognized by web servers. You have full control over the use of cookies through your browser. You can delete cookies at any time in the security settings of your browser. You can object to the use of cookies through your browser settings in principle or for certain cases.

The use of cookies is in part technically necessary for the operation of our website and is therefore permitted without the user's consent. We may also use cookies to offer special functions and content and for analysis and marketing purposes. These may also include cookies from third-party providers (so-called third-party cookies). We only use such technically unnecessary cookies with your consent in accordance with Art. 6 (1) (a) GDPR. Information on the purposes, providers, technologies used, stored data and the storage duration of individual cookies can be found in the cookie settings of our Consent Management Tool.

1. Consent Management Tool

This website uses the consent management tool Cookiefirst from Digital Data Solutions B.V. (Netherlands, EU) to control cookies and the processing of personal data.

The consent banner enables users of our website to give their consent to certain data processing operations or to withdraw their consent. By confirming the "Agree" button, you consent to the use of the associated cookies. 

The banner also helps us to provide evidence of the declaration of consent. For this purpose, we process information about the declaration of consent and other log data relating to this declaration. Cookies are also used to collect this data. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis arises from our legal obligation to document your consent (Art. 6 para. 1 letter c in conjunction with Art. 7 para. 1 GDPR).

You can revoke your consent for cookies here: https://app.cookiefirst.com

1. Google Ads

We use the online advertising program Google Ads from Google Ireland Limited (Ireland, EU) on our website, through which we place advertisements on the Google search engine. If you reach our website via a Google Ad, Google places a cookie on your end device ("conversion cookie"). A different conversion cookie is assigned to each Google Ads customer so that the cookies are not tracked across the websites of different Ads customers. The information collected with the help of the cookie is used to create conversion statistics. This tells us the total number of users who have clicked on one of our Google ads. However, we do not receive any information with which users can be personally identified.

The setting of cookies and the further processing of personal data described here takes place with your consent. The legal basis for data processing in connection with the Google Analytics service is therefore Article 6(1)(a) GDPR. You can revoke this consent at any time via our Consent Management Tool with effect for the future.

Further information on data protection at Google can be found in Google's privacy policy at https://policies.google.com/privacy#infocollect.

1. Google Marketing Services

We use the Google Analytics service of the provider Google Ireland Limited (Ireland, EU) on our website.

Google Analytics is a web analytics service that allows us to collect and analyze data about user behavior on our website. Google Analytics enables us to measure interaction data from different devices and from different sessions. This allows us to put individual user actions into context and analyze long-term relationships. Google Analytics uses cookies for this purpose, which enables us to analyze the use of our website. Personal data in the form of IP addresses, device identifiers and information about interaction with our website is also processed. Some of this data is information that is stored on the device you are using. In addition, further information is stored on your device via the cookies used.

Google Ireland will process the data collected in this way on our behalf in order to evaluate the use of our website by users, to compile reports on the activities within our website and to provide us with further services associated with the use of our website and the use of the Internet. Pseudonymous user profiles can be created from the processed data.

We also use the Google Analytics advertising functions (remarketing). This function enables us, in conjunction with Google's cross-device functions, to display advertisements in a more targeted manner and to present users with advertisements tailored to their interests. Remarketing is used to show users ads and products for which interest has been identified on other websites in the Google network. The function allows us to link advertising target groups created via Google Analytics Remarketing with the cross-device functions of Google Ads. In this way, interest-based, personalized advertising messages that have been adapted to a user depending on previous usage and surfing behavior on one device (e.g. cell phone) can also be displayed on another of the user's devices (e.g. tablet or PC).

If you have given your consent, Google will link your web and app browsing history to your Google account for this purpose. In this way, the same personalized advertising messages can be displayed on every device on which you sign in with your Google account. The aggregation of the data collected in your Google Account is based solely on your consent, which you can give or withdraw from Google. For these linked services, data is then collected for advertising purposes via Google Analytics. To support the remarketing function, Google Analytics collects the Google-authenticated IDs of users, which are temporarily linked to our Google Analytics data. This is used to define and create target groups for cross-device advertising.

The setting of cookies and the further processing of personal data described here takes place with your consent. The legal basis for data processing in connection with the Google Analytics service is therefore Article 6(1)(a) GDPR. You can revoke this consent at any time via our Consent Management Tool with effect for the future.

We only use Google Analytics with activated IP anonymization. This means that the IP address of users is shortened by Google Ireland within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. The IP address transmitted by the user's browser is not merged with other data. The IP address is truncated on servers in the EU.

The data on user actions is stored for a period of 14 months and then automatically deleted. Data whose storage period has expired is automatically deleted once a month.

Further information on how Google uses data from websites or apps for advertising purposes can be found in Google's information at: www.google.com/policies/technologies/ads/.

1. Meta Pixel 

We use the meta pixel on our website, a meta business tool from Meta Platforms Ireland Limited (Ireland, EU). The meta pixel is a JavaScript code snippet that enables us to track the activities of visitors to our website. This tracking is called conversion tracking. The meta pixel collects and processes the following information (so-called event data) for this purpose:

• Information on the actions and activities of visitors to our website, such as searching for and viewing a product or purchasing a product;

• Specific pixel information such as the pixel ID and the Facebook cookie;

• Information on buttons clicked by visitors to the website;

• Information present in the HTTP headers, such as IP addresses, information about the web browser, the location of the page and the referrer;

• Information on the status of the deactivation/restriction of ad tracking.

Some of this event data are information which is stored on the device that you are using. In addition, the meta pixel also uses cookies to store information on the device you are using. Such storage of information by the meta pixel or access to information that is already stored on your device will only take place with your consent in accordance with the applicable law. 

The event data collected via the meta pixel is used to target our advertising and improve ad placement on meta products such as the social media platforms Facebook and Instagram, to personalize functions and content as well as to improve and secure the meta products. For this purpose, the event data collected on our website using the meta pixel is transmitted to Meta Platforms Ireland Ltd. This collection and transmission of event data is carried out by us and Meta Platforms Ireland Ltd. as joint controllers. We have entered into a joint controllership agreement with Meta Platforms Ireland Ltd. which sets out the allocation of data protection obligations between us and Meta Platforms Ireland Ltd. In this agreement, we and Meta Platforms Ireland Ltd. have agreed, among other things:

• that we are responsible for providing you with all information in accordance with Art. 13, 14 GDPR on the joint processing of personal data;

• that Meta Platforms Ireland Ltd. is responsible for enabling the rights of data subjects under Art. 15 to 20 GDPR with regard to the personal data stored by Meta Platforms Ireland Ltd. following joint processing.

We have also commissioned Meta Platforms Ireland Ltd. to prepare reports on the impact of our advertising campaigns and other online content (campaign reports) and to generate analyses and insights about users and their use of our website, products and services (analyses) on the basis of the event data collected via the meta pixel. For this purpose, we transmit personal data contained in the event data to Meta Platforms Ireland Ltd. The personal data transmitted is processed by Meta Platforms Ireland Ltd. as our processor in order to provide us with the campaign reports and analyses.

You can access the agreement concluded between us and Meta Platforms Ireland Ltd. at https://www.facebook.com/legal/controller_addendum.

Meta Platforms Ireland Ltd. is solely responsible for the subsequent processing of the submitted Event Data. For more information on how Meta Platforms Ireland Ltd. processes personal data, including the legal basis on which Meta Platforms Ireland Ltd. relies and how to exercise your rights against Meta Platforms Ireland Ltd., please refer to Meta Platforms Ireland Ltd.'s Data Policy at https://www.facebook.com/about/privacy.

The collection and transfer of personal data by us to Meta Platforms Ireland Ltd. and the commissioned processing of personal data by Meta Platforms Ireland Ltd. for the creation of analyses and campaign reports will only take place if you have grant your prior consent. The legal basis for the processing of personal data is therefore Article 6(1)(a) GDPR.

1. LinkedIn Insight-Tag

We use the LinkedIn Insight tag on our website, a marketing product of LinkedIn Ireland Unlimited Company (Ireland, EU). For information on LinkedIn Ireland's contact details and the contact details of LinkedIn Ireland's data protection officer, please refer to LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy.

The LinkedIn Insight tag is a JavaScript code snippet that is triggered by LinkedIn when you visit our website and stores a cookie on the device you are using. Such storage of information by LinkedIn Insight tag or access to information that is already stored on your device and any further processing of personal data in connection with the LinkedIn Insight tag will only take place with your consent. The legal basis for collection and transmission of personal data by us to LinkedIn Ireland is therefore Art. 6 para. 1 lit. a GDPR.

We can perform various functions via the LinkedIn Insight tag, which we describe in detail below. 

LinkedIn conversion tracking is an analysis function supported by the LinkedIn Insight tag. The LinkedIn Insight tag enables the collection of data on visits to our website, including URL, referrer URL, IP address, device and browser characteristics (user agent) and timestamp. The IP addresses are shortened or (if they are used to reach members across devices) hashed. LinkedIn does not provide us with any personal data, but only offers reports (in which you are not identified) about the website target group and ad performance. This allows us to measure the effectiveness of LinkedIn ads for statistical and market research purposes.

The direct identifiers of the members are removed by LinkedIn within 7 days in order to pseudonymize the data. LinkedIn then deletes this remaining pseudonymized data within 180 days.

This processing is carried out for the purpose of obtaining information about our website target group and a report on the effectiveness of LinkedIn campaigns. 

We have entered into a joint controller agreement with LinkedIn, which sets out the allocation of data protection obligations between us and LinkedIn. The joint controll agreement can be found here: https://legal.linkedin.com/pages-joint-controller-addendum.

1. Hubspot 

We use HubSpot, a service provided by HubSpot Inc (USA), to analyze visits to our website. HubSpot uses cookies and similar technologies that allow us to analyze your use of our website. This involves processing personal data in the form of online identifiers (including cookie identifiers), IP addresses and device identifiers. HubSpot will use this information on our behalf to evaluate the use of our online offer by users and to compile reports for us on the activities within our website. Usage profiles can be created from the processed data.

Further information on this processing activity, the technologies used, stored data and the storage period can be found in the settings of our Consent Management Tool. The setting of cookies and the further processing of personal data described here only takes place with your consent. The legal basis for data processing is Art. 6 para. 1 letter a GDPR.

This may also involve the transfer of personal data to the USA. Please note the information in the section "Data transfer to third countries". Further information on data protection at HubSpot can be found at: https://www.hubspot.de/data-privacy/gdpr/hubspot-product-playbook.

1. Google Maps

We use Google Maps from Google Ireland Limited (Ireland, EU) on our website to search for your contact person by specifying your location. For such integration, it is technically necessary to process your IP address so that the content can be sent to your browser. Your IP address is therefore transmitted to Google and Google may set its own cookies. 

Your data is processed on the basis of our legitimate interest in the appealing design of our website. The legal basis is Art. 6 para. 1 letter f GDPR.

Further information on data protection at Google can be found in Google's privacy policy at https://www.google.com/policies/privacy.

1. Data processing within our platform / processing of user data

1. Download of the App

When you download the app, certain required information is transmitted to the app store you have selected (e.g. Google Play or Apple App Store), in particular the user name, email address, customer number of your account, the time of the download and the individual device number may be processed. This data is processed exclusively by the provider of the respective app store and is beyond our control.

1. Registration on the Platform

We process various data for registration on our platform. Since our offer is primarily aimed at B2B addressees, only the data of registered persons is personal data. Only in exceptional cases, in the case of sole traders, are all of the following data personal data:

• Name and address of the company,

• Location data of the company,

• Name and contact details of the registered persons, 

• Profile photo of the registered persons (voluntary),

• e-mail addresses of the registered persons and the preferred language,

• Account and payment data,

• tax ID.

We process the data in order to provide you with a user account on our platform and thus enable you to conclude and process contracts via the Schüttflix platform. 

The legal basis for data processing is Art. 6 para. 1 letter f GDPR for contact persons of our B2B addressees. The data processing serves the legitimate interest of entering into and fulfilling the contractual relationship with the respective company. 

If the registered person is a sole proprietorship, there is a direct contractual relationship and the legal basis for processing is Art. 6 (1) (b) GDPR.

We assign an identification number to each registered person, which we store. The legal basis for this processing is Article 6(1)(f) GDPR; we have a legitimate interest in the proper functioning of the platform, which requires the registered persons to be identifiable.

We use your data in exceptional cases to check your creditworthiness. The basis for this is our legitimate interest in a reliable business relationship with you or your company, Art. 6 para. 1 letter f GDPR.

1. Data processing when using the platform

1. Automatic processing of personal data when using the app

When you use the Schüttflix app, certain access data and device information is initially automatically transmitted to us and temporarily stored in log files. This may include:

• Your IP address,

• your device ID,

• the date and time of access

• the time zone,

• the amount of data transferred/the completeness of the data exchange/any crash of the app,

• Your operating system and the version of your operating system.

The stored data is deleted after 30 days unless there is a justified suspicion of unlawful use based on concrete evidence and further examination and processing of the information is necessary for this reason. We are not in a position to identify you as a data subject on the basis of the stored information. Art. 15 to 22 GDPR therefore do not apply in accordance with Art. 11 para. 2 GDPR, unless you provide additional information that enables your identification in order to exercise your rights set out in these articles.

The infrastructure will be operated on servers of Amazon Web Services EMEA SARL (AWS) (Luxembourg/EU), which processes the data as a processor exclusively in accordance with instructions. When using AWS, a transfer of your personal data to the USA cannot be ruled out. Please note the information in the section "Data transfer to third countries".

To evaluate access and ensure data security, we also use the Grafana service of Raintank, Inc. dba Grafana Labs (USA), which processes the data as a processor exclusively in accordance with instructions. In the course of this, data transfer to the USA is not excluded. See the section "Data transfer to third countries".

The data processing described is carried out to technically enable the operation of the app, to make the app available to you and to ensure the security and stability of the app, i.e. to prevent and eliminate misuse and malfunctions. The legal basis for this data processing is Art. 6 para. 1 letter f GDPR. The processing is necessary to safeguard our legitimate interest in ensuring the functionality, error-free operation and security of our app.

1. Processing of contract data

We are processing information about orders requested, offered, placed, accepted and completed by you. The processing of this information is necessary for the fulfilment of contracts concluded with you or your company via the Schüttflix platform or to enable the conclusion of such contracts. The legal basis for B2B addressees is Art. 6 para. 1 letter f GDPR. The legal basis for sole proprietorships is Article 6(1)(b) GDPR. 

The provision of an overview of orders placed and processed for the registered persons in their user profile serves our legitimate interest in the appealing and clear presentation of our services. The legal basis is Article 6(1)(f) GDPR.

1. Processing of driver location data

In connection with the execution of contracts concluded via the Schüttflix platform or the delivery of bulk goods orders, we process drivers' location data. The prerequisite is that the respective driver consents to this processing by activating the GPS function on his/her end device. The customer can view the driver's location data on the Schüttflix platform in real time and thus adjust to the exact time of delivery. The data is made available to the customer as a summary at the end of the journey. This data processing only takes place during the execution of forwarding orders (journey and delivery) and during the delivery of ordered bulk goods (delivery only). The legal basis for this data processing is the consent of the driver concerned in accordance with Art. 6 para. 1 letter a GDPR. Consent can be withdrawn at any time by contacting the above mentioned address.

1. Processing of legitimation/authentication data

When loading or delivering ordered bulk goods, your signature and/or other legitimation/authentication data (e.g. ID card number or other information contained in official ID cards) may also be processed in order to confirm the loading or unloading. The legal basis for this is Article 6(1)(b) GDPR, as your signature may be required to fulfill the contract that you have concluded via the Schüttflix platform, and Article 6(1)(f) GDPR, i.e. our legitimate interest in documenting the execution of the contract or the loading and unloading of the bulk goods ordered via the Schüttflix platform. Schüttflix either collects this data itself or receives copies of documents containing this data from contracted companies.

1. Processing of creditworthiness data and similar data

In exceptional cases, we may receive data from third parties relating to the creditworthiness of your company (e.g. data from Schufa or Creditreform). In exceptional cases, we may also receive data from publicly accessible sources (e.g. commercial register, media). In particular, this includes data on payment behavior as well as annual financial statement documents or business evaluations, company balance sheet figures and other business and financial information. If personal data is processed in this context, the basis for this is our legitimate interest in a reliable business relationship with you or your company, Art. 6 para. 1 letter f GDPR.

1. Google Maps

We use Google Maps from Google Ireland Limited (Ireland, EU) in our app to display the location of orders within the Schüttflix app. We enable users to specify the coordinates of their construction projects, plants, delivery and collection locations on a map. 

Google Maps is also used to perform geocoding and reverse geocoding by converting addresses into coordinates and coordinates into addresses. Google Maps is also used to display the position of drivers on a map during the journey to the construction project.

For such integration, it is technically necessary to process your IP address so that the content can be sent to your browser. Your IP address is therefore transmitted to Google and Google may set its own cookies.

Your data is processed on the basis of our legitimate interest in the appealing design of our website. The legal basis is Art. 6 para. 1 letter f GDPR.

Further information on data protection at Google can be found in Google's privacy policy at https://www.google.com/policies/privacy.

1. Communication and surveys

1. Contact form

If you cannot find an answer to your question in the FAQ section, you have the option of sending us a message/question via the text field. A user ID is used to identify you personally so that we can trace which user sent us the message. The processing of your request and the associated processing of your personal data serves our legitimate interest in responding to your request. The legal basis is Art. 6 para. 1 letter f GDPR. If you contact us as an individual entrepreneur and the request is directly related to the conclusion of a contract, we process the data for the purpose of fulfilling the contract or pre-contractual measures. The legal basis is then Art. 6 para. 1 letter b GDPR.

1. Transactional emails

There are situations in which we contact you by email in order to maintain and enable the use of our app. In the course of this, personal data such as name, email address and telephone number are processed. These are not promotional emails, but transactional emails that we send, for example, to send you order confirmations or to send you a new password if you have forgotten yours. This data processing serves our legitimate interest in the flawless provision of our app. The legal basis for this data processing is Art. 6 para. 1 letter f GDPR.

1. Product updates / Notifications

We regularly send you emails about the functions and new features of our app. In the course of this, personal data such as name and e-mail address are processed. We send e-mails based on our legitimate interest in providing information about existing and new services.The legal basis is Art. 6 para. 1 letter f GDPR. You can revoke  receiving these emails by contacting us at the above address.

1. Satisfaction surveys

In order to improve the user experience and conduct satisfaction surveys within the app, we use the UserFlow service from UserFlow Inc. (USA), which processes the data as a processor exclusively in accordance with instructions. This concerns information about your end device, a user ID and the entries made in the survey. This data processing serves our legitimate interest in the appealing design of our app. The legal basis for this data processing is Art. 6 para. 1 letter f GDPR. In the course of this, data transfer to the USA is not excluded. See the section "Data transfer to third countries".

1. Advertisement 

We use your data, in particular the contact details you provided to us when registering, for the purpose of direct advertising for our company and our offers - in particular by email, if we have received your email address in connection with the sale of products or services. The legal basis for this processing is Article 6(1)(f) GDPR. i. We have a legitimate interest in sending you direct advertising. You are entitled to revoke  the use of your data for direct marketing purposes at any time by contacting us using the contact details above. In this case, we will no longer send you any advertising messages.

1. Data processing in our career portal

Information on data protection in our career portal can be found here: https://schuettflix.com/de/de/legal/privacy-policy-job-application/.

1. Data processing on our social media pages

We are represented on several social media platforms with a company page. In this way, we would like to offer further opportunities for information about our company and for communication with us. Our company has company pages on the following social media platforms:

• Instagram of Meta Platforms Ireland Limited, (Ireland, EU), hereinafter referred to as "Meta";

• Facebook of Meta Platforms Ireland Limited, (Ireland, EU), hereinafter referred to as "Meta";

• LinkedIn of LinkedIn Ireland Unlimited Company, (Ireland, EU), hereinafter referred to as "LinkedIn".

When you visit or interact with a profile on a social media platform, personal data about you may be processed. The information associated with a social media profile used also regularly constitutes personal data. This also includes messages and statements made using the profile. In addition, certain information is often automatically collected during your visit to a social media profile, which may also constitute personal data.

1. Social Media 

When you access our social media page, which we use to present our company or individual products from our range, certain personal data is processed. The operators of the social media platforms are solely responsible for this processing of personal data. Further information on the processing of personal data can be found in their privacy policies, which we link to below:

• Meta (https://www.facebook.com/privacy/explanation). Meta offers the option of objecting to certain data processing; information and opt-out options can be found at https://www.facebook.com/settings?tab=ads;

• LinkedIn (https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy)

The operators of the social media platforms collect and process event data and profile data and provide us with statistics and insights for our pages in anonymized form, through whichwe gain knowledge about the types of actions that people take on our site (so-called "page insights"). These page insights are generated on the basis of certain information about people who have visited our site. This processing of personal data is carried out by the social media operators and us as joint controllers. The processing serves our legitimate interest in evaluating the types of actions taken on our site and improving our site based on these findings. The legal basis for this processing is Article 6(1)(f) GDPR.

We cannot assign the information obtained via Page Insights to individual user profiles that interact with our pages. We have entered into agreements with the operators of the social media platforms on processing as joint controllers, in which the distribution of data protection obligations between us and the operators is defined. Details on the processing of personal data for the creation of Page Insights and the agreement concluded between us and the operators can be found under the following links:

• Meta (Information about Page Insights Data)

• LinkedIn (LinkedIn Pages Joint Controller Addendum)

You also have the option of asserting your rights against the operators. You can find further information on this under the following links:

• Meta (Meta Privacy Policy - How Meta collects and uses user data); 

• LinkedIn (https://www.linkedin.com/help/linkedin/ask/PPQ?lang=de);

We have agreed with Meta and LinkedIn that the Irish Data Protection Commission is the lead supervisory authority overseeing processing for Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other supervisory authority.

1. Communication via social media pages

We also process information that you have made available to us via our company page on the respective social media platform. Such information may include the username used, contact details or a message to us. This processing is carried out by us as the sole controller. We process this data on the basis of our legitimate interest in contacting people who make inquiries. The legal basis for data processing is Article 6(1)(f) GDPR. Further data processing may take place if you have given your consent (Art. 6 para. 1 letter a GDPR) or if this is necessary to fulfill a legal obligation (Art. 6 para. 1 letter c GDPR).

1. Additional data processing

1. Job Applications

If you apply to our company, we process your application data exclusively for purposes related to your interest in current or future employment with us and the processing of your application. Your application will only be processed and acknowledged by the relevant contact persons at our company. All employees entrusted with data processing are obliged to maintain the confidentiality of your data. If we are unable to offer you employment, we will retain the data you have provided for up to 6 months after any rejection for the purpose of to answer questions in connection with your application and rejection. This does not apply if legal provisions prevent deletion, if further storage is necessary for the purpose of providing evidence or if you have expressly consented to longer storage. The legal basis for data processing is r Art. 6 para. 1 letter b GDPR. If we store your applicant data for longer than 6 months and you have expressly consented to this, we would like to point out that this consent can be freely revoked at any time in accordance with Art. 7 para. 3 GDPR. Such a revocation does not affect the legality of the processing that was carried out on the basis of the consent until the revocation.

1. Contacting SFLX by e-mail

If you send us a message via the contact email provided, we will process the data transmitted for the purpose of responding to your inquiry. We process this data on the basis of our legitimate interest in contacting inquiring persons. The legal basis for data processing is Art. 6 para. 1 letter f GDPR.

1. Customer and prospect data

When you contact our company as a customer or prospective customer, we process your data to the extent necessary to establish or execute the contractual relationship. This regularly includes processing the personal master data, contract data and payment data provided to us, as well as the contact and communication data of our contact persons for commercial customers and business partners. The legal basis for this processing is Article 6(1)(f) GDPR.

We also process customer and interested party data for evaluation and marketing purposes. This processing is carried out on the legal basis of Art. 6 para. 1 letter f GDPR and serves our interest in further developing our offer and informing you specifically about our offers. 

Further data processing may take place if you have given your consent (Art. 6 para. 1 letter a GDPR) or if this is necessary to fulfill a legal obligation (Art. 6 para. 1 letter c GDPR).

1. Usage of the e-mail address for marketing purposes

We may use the email address you provide when registering to inform you about our own similar products and services. 

The legal basis is Art. 6 para. 1 letter f GDPR. You can revoke this at any time without incurring any costs other than the transmission costs according to the basic rates. To do so, you can send an email to the contact details mentioned above.

Version: 2.0, April 2024