v1.0 · 08.08.2026
Status: 08.08.2026 Scope: GDPR Art. 13, 14 Controller: flowgeist
Controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG):
flowgeist Owner: Ralf Carsjens Eidamshauser Straße 13 40822 Mettmann Germany
Email: info@flowgeist.de Web: https://flowgeist.de
Data Protection Officer: Pursuant to Art. 37 GDPR and § 38 BDSG, no Data Protection Officer has been appointed at this time, as the prerequisites of § 38(1) BDSG (as a rule, more than 20 persons permanently engaged in the automated processing of personal data) are not met. The following data protection contact person is available to you: datenschutz@flowgeist.de (interim).
This Privacy Policy informs you about the nature, scope, and purposes of the collection, processing, and use of personal data by the flowgeist ZERO platform as well as about your rights as a data subject pursuant to the GDPR and BDSG.
flowgeist ZERO is an AI compliance platform for managing AI systems in accordance with the EU AI Act. The processing of personal data is carried out exclusively on the basis of the GDPR and the BDSG, observing the principles of data minimisation, purpose limitation, and data avoidance.
In the context of the provision and use of the flowgeist ZERO platform, the following categories of personal data are processed:
| Category | Description | Examples |
|---|---|---|
| Contact data | Data for communication and account management | Name, email address, telephone number (optional), company name |
| AI system data | Data on managed AI systems | Designation, classification, risk category, documentation fields |
| Training data | Data within the scope of the training module | Name, email, training progress, exam results, certificate status |
| Audit data | Logging data in accordance with ISO 27001 A.12.4 | Timestamp, User-ID, Tenant-ID, Action, Resource, IP address, User-Agent |
| Payment data | Billing-relevant data | Stripe customer ID, SEPA direct debit mandate, IBAN (stored in encrypted form) |
Personal data is processed for the following purposes:
Personal data is processed on the following legal bases:
Where Consent is obtained for processing (e.g., for analytics via Umami or the Partner Program), this is done on the basis of Art. 6(1)(a) GDPR.
Personal data is disclosed to the following recipients or categories of recipients:
| Recipient | Seat / Country | Third country reference | Legal basis / Safeguards |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Ireland (IE) / USA (US) | EU-US Data Privacy Framework (DPF) + Standard Contractual Clauses (SCC) | Processing on behalf of the Controller pursuant to Art. 28 GDPR; payment processing |
| Postmark / ActiveCampaign | USA (US) | EU-US Data Privacy Framework (DPF) + Standard Contractual Clauses (SCC) | Processing on behalf of the Controller pursuant to Art. 28 GDPR; email delivery |
| Hetzner Online GmbH | Germany (DE) | No third country transfer | Processing on behalf of the Controller pursuant to Art. 28 GDPR; hosting |
| Lexware GmbH | Germany (DE) | No third country transfer | Processing on behalf of the Controller pursuant to Art. 28 GDPR; accounting |
| Mistral AI | France (FR) | No third country transfer | Processing on behalf of the Controller pursuant to Art. 28 GDPR; AI text generation |
| Partner in High-Risk Referral | Germany (DE) / EU | No third country transfer | Consent pursuant to Art. 6(1)(a) GDPR; lead transmission upon active selection |
The primary processing of personal data takes place in Germany. The hosting infrastructure is operated by Hetzner Online GmbH at the Falkenstein data centre (Germany). A transfer to third countries (countries outside the European Economic Area) takes place in the following cases:
For all other recipients (Hetzner, Lexware, Mistral AI), processing takes place exclusively within the European Union or the European Economic Area, so no third country transfer occurs.
The retention periods are based on legal requirements, contractual necessities, and the principle of data minimisation. The following periods apply to the respective data category:
| Data category | Storage period | Justification |
|---|---|---|
| Contact data | 30 days after termination | Data minimisation after end of contract |
| AI system data | 30 days after termination | Data minimisation after end of contract |
| Training data | 30 days after termination | Data minimisation after end of contract |
| Audit logs | 3 years | ISO 27001 A.12.4; security and compliance requirements |
| Stripe webhook logs (with PII) | 30 days, thereafter pseudonymisation | Data minimisation; PII is pseudonymised after 30 days |
| Stripe webhook logs (without PII) | 10 years | Accounting and record-keeping obligations |
| Invoices | 10 years | § 147 AO (retention period for commercial and business letters) |
Upon expiry of the respective storage period, the data is erased or – where required by law – pseudonymised, provided that further storage is no longer necessary.
As a data subject, you have the following rights under the GDPR:
You have the right to obtain from the Controller confirmation as to whether personal data concerning you is being processed; if this is the case, you have a right of access to such personal data and to the information set out in detail in Art. 15(1) GDPR.
You have the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed – including by means of a supplementary statement.
You have the right to obtain from the Controller the erasure of personal data concerning you without undue delay where one of the grounds referred to in Art. 17(2) GDPR applies and the processing is not necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defence of legal claims.
You have the right to obtain from the Controller the restriction of processing where one of the conditions set out in Art. 18(1) GDPR is met.
You have the right to receive the personal data concerning you, which you have provided to the Controller, in a structured, commonly used, and machine-readable format, and you have the right to transmit such data to another Controller.
You have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. The Controller shall no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defence of legal claims.
You have the right to lodge a complaint with a supervisory authority, typically in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
To exercise your above-mentioned rights, you may contact the Controller at any time:
Your request will be processed and answered in accordance with Art. 12(3) GDPR within one month of receipt. This period may be extended by a further two months for more complex requests, provided you are informed of this within the first month.
To verify your identity, we may request additional information where necessary to ensure that the information is not provided to unauthorised persons.
Automated decision-making within the meaning of Art. 22 GDPR does not take place. The flowgeist ZERO platform uses AI technology (Mistral AI) for text generation in compliance fields; however, no automated decision is made that produces legal effects concerning you or similarly significantly affects you. All AI-generated outputs must be reviewed by a competent natural person prior to use (human oversight in accordance with Art. 14 EU AI Act).
The flowgeist ZERO platform uses technically necessary cookies to maintain the session and authentication. These cookies are required for the operation of the platform and are based on Art. 6(1)(b) GDPR (contractual performance). Consent is not required.
For web analytics, flowgeist uses the cookie-free analytics tool Umami. Umami operates without cookies and does not employ fingerprinting. The use of analytics is based on explicit Consent (opt-in) pursuant to Art. 6(1)(a) GDPR. You may withdraw your Consent at any time without affecting the lawfulness of the processing carried out prior to the withdrawal.
To protect your personal data against unauthorised access, loss, or manipulation, flowgeist employs the following technical and organizational measures (TOMs) pursuant to Art. 32 GDPR:
A detailed description of the TOMs can be found in the separate TOMs document.
flowgeist reserves the right to adapt this Privacy Policy so that it always reflects current legal requirements or responds to changes in services and data processing. The current version is available on the website at https://flowgeist.de/rechtliches.
In the event of material changes affecting the processing of your personal data, we will inform you in a timely manner prior to their entry into force.
If you have questions regarding data protection, the processing of your personal data, or the exercise of your rights as a data subject, you may contact us at any time:
flowgeist Owner: Ralf Carsjens Eidamshauser Straße 13 40822 Mettmann Germany
Email: info@flowgeist.de Data protection contact person: datenschutz@flowgeist.de
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR. The competent supervisory authority is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Postfach 20 04 44 40102 Düsseldorf Web: https://www.ldi.nrw
| Version | Date | Material Changes |
|---|---|---|
| 1.0 | 02.05.2026 | Initial version |
| 1.1 | 23.06.2026 | Finalisation |
| 1.2 | 08.08.2026 | Product-specific adaptation for flowgeist ZERO |
© 2026 flowgeist – Ralf Carsjens · All rights reserved