v1.0 · 08.08.2026
Status: 27.09.2026 Scope: GDPR Art. 13, 14 Controller: flowgeist
The controller for data processing on the flowgeist DMS platform (flowgeist-dms.de) is:
flowgeist Owner: Ralf Carsjens Eidamshauser Straße 13 40822 Mettmann Germany
Email: info@flowgeist.de Data protection: datenschutz@flowgeist.de
This Privacy Policy informs about the processing of personal data by the flowgeist DMS platform (European Dealer Management System for car dealerships and dealer groups). The platform is aimed at businesses (B2B) and is operated by flowgeist.
Where flowgeist processes personal data of the dealership’s end customers and employees on behalf of the customer, this is done on the basis of a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR; for this data, the respective customer (dealership/dealer group) is the controller.
Depending on the booked scope of services, the platform processes the following categories of personal data:
| Category | Description | Examples |
|---|---|---|
| Master data | Identification and contact data | Name, first name, email address, company name, address, phone number |
| Customer data of the dealership | Data of the customer’s end customers (data processing on behalf) | Name, contact details, vehicle assignment, purchase/service history |
| Vehicle and business data | Data on vehicles and transactions | VIN, vehicle data, offers, contracts, service orders |
| Staff data | Data of the customer’s employees | Name, role, working times, commission data |
| Access data | Authentication data | Keycloak/OIDC, password hash (scrypt), TOTP secret, session token, user roles |
| Documents | Uploaded or archived files | Contracts, evidence, certificates (Mayan EDMS) |
| Audit data | Logging of system accesses | Login times, executed actions, IP addresses, user identifiers |
| Communication data | Notifications via the embedded notification system | Email/push notifications (Novu, self-hosted) |
Personal data is processed for the following purposes:
Processing takes place on the following legal bases:
| Legal basis | Scope |
|---|---|
| Art. 6(1)(b) GDPR | Contract performance — provision of the SaaS platform for the customer |
| Art. 6(1)(f) GDPR | Legitimate interest — operational security, audit logging, abuse detection |
| Art. 28 GDPR | Data processing on behalf — processing of the customer’s end-customer and employee data |
| Recipient | Registered office | Purpose | Third-country transfer |
|---|---|---|---|
| Hetzner Online GmbH | Germany (Falkenstein) | Platform hosting (single-server Docker) | None (EU) |
The other platform components (PostgreSQL, Keycloak, MinIO, OpenSearch, ClickHouse, Kafka, Valkey, Temporal, Novu, Mayan EDMS, ERPNext, Kimai, APISIX, Infisical, SigNoz) are operated as embedded open-source components on flowgeist’s own Hetzner infrastructure and do not constitute external recipients.
Optional integrations (customer-configured): Via the Integration Hub, interfaces to third-party systems can be activated at the customer’s initiative — in particular OEM connectors (BMW, Mercedes-Benz, VAG, Stellantis, among others), STAR, DAT/Schwacke, DATEV, PEPPOL, banks and charging network operators. Only upon activation by the customer may personal data be transmitted to the respective third-party system; the respective operator is itself the data controller.
The primary processing of personal data takes place in Germany (Hetzner Online GmbH, Falkenstein). No transfer to third countries takes place in standard operation.
AI processing takes place exclusively on EU-resident models (Azure OpenAI EU regions or self-hosted models); no transmission to public AI services outside the EU takes place.
For customer-configured integrations (e.g., OEM portals, DATEV, PEPPOL), the transfer route depends on the respective customer configuration; any third-country references are coordinated with the customer before activation.
Personal data is stored for the duration of the contractual relationship. After the end of the contract, the data is deleted after a grace period of 30 days, unless statutory retention obligations apply (in particular commercial and tax law retention periods, e.g., § 147 AO, § 257 HGB, and GoBD requirements for the document archive).
You have the rights under Art. 15–21 GDPR (access, rectification, erasure, restriction of processing, data portability, objection). Where processing is based on consent, you may revoke it at any time with effect for the future.
If you are an end customer or employee of a dealership using flowgeist DMS, please contact the respective dealership (the controller) to exercise your rights; flowgeist supports the controller within the framework of the DPA.
To exercise your rights, contact: datenschutz@flowgeist.de
No automated decision-making within the meaning of Art. 22 GDPR takes place. The AI layer produces suggestions and insights subject to human-in-the-loop approval; binding decisions are not made automatically.
The platform uses only technically necessary cookies/session mechanisms (authentication via Keycloak/OIDC). No analytics cookies, marketing cookies or tracking tools are used. Operational monitoring is performed via self-hosted SigNoz on flowgeist’s own infrastructure.
Customers will be informed in good time of material changes.
flowgeist — Email: datenschutz@flowgeist.de
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf.
| Version | Date | Material Changes |
|---|---|---|
| 1.0 | 27.09.2026 | Initial version for flowgeist DMS (code-verified against flowgeist-dms / EuroDMS) |
© 2026 flowgeist – Ralf Carsjens · All rights reserved