Privacy Policy

1. Data Controller

Floxa
Owner Paul Ler
Washingtonring 14
71686 Remseck am Neckar
Germany
Email: hello@floxa.de

2. Hosting (Vercel)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. It is served from the Frankfurt region (fra1). When you access the site, Vercel processes technically necessary server log data: IP address, date and time, page accessed, browser type and operating system.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in the secure and reliable provision of the website. A data processing agreement is in place with Vercel. As Vercel is a US company, transfer of data to the USA cannot be ruled out; such transfers are safeguarded by Standard Contractual Clauses. Vercel's privacy policy

3. Contact Form

When you use our contact form, we process the data you provide: name, email address, optionally company and website, and your message.

The legal basis is Art. 6(1)(b) GDPR, as processing is necessary to answer your enquiry and to take steps prior to entering into a contract. We deliberately do not ask for consent: we need the data in order to reply to you.

Your enquiry is processed in two places: it is stored in our database (see section 4) and additionally delivered to us by email (see section 5).

Retention: if your enquiry does not lead to a working relationship, we delete the data no later than six months after the last contact. If it does, the periods in section 4 apply.

4. Database and Client Portal (Supabase)

We use Supabase (Supabase, Inc., 970 Toa Payoh North, Singapore) for our database and client portal login. The data is stored exclusively in the eu-central-1 region (Frankfurt am Main, Germany).

Processed there: contact form enquiries, contact and project data of our clients, and the tasks within a project. The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).

The client portal is passwordless: to sign in, we send a one-time link to your email address. Technically necessary cookies are set to maintain your session (see section 8).

Retention: we store client and project data for the duration of the working relationship. Afterwards we delete it, unless statutory retention periods apply (in particular commercial and tax law, up to 10 years).

5. Email Delivery (Resend)

We use Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA) to send emails — such as the notification about your enquiry or the portal sign-in link. Delivery runs through the eu-west-1 region (Ireland).

Your email address and the content of the message are processed. The legal basis is Art. 6(1)(b) GDPR. A data processing agreement is in place with Resend; transfers to the USA are safeguarded by Standard Contractual Clauses. Resend's privacy policy

6. Analytics (Vercel Analytics & Umami)

We use Vercel Analytics and Vercel Speed Insights to understand which pages are visited and how fast they load. Both work without cookies and without tracking you across websites. No individual user profile is created; the data is evaluated in aggregate.

We additionally use Umami, a self-hosted, privacy-friendly web analytics tool. Umami runs on our own server in the EU, uses no cookies at all, and does not collect personal data or device fingerprints — only anonymised metrics such as page views and referrers are recorded.

We additionally use Umami — analytics software we run on our own server in Germany. It too works without cookies and without cross-device recognition; the data is stored anonymised and in aggregate and is not passed on to third parties.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in a well-functioning website that meets users' needs. As no information is stored on or read from your device, no consent under § 25 TDDDG is required.

7. Google Ads (conversion measurement)

We run ads through Google Ads. To recognise whether an ad led to an enquiry, we can use the Google Ads tag. It stores cookies on your device and transmits, among other things, your IP address, information about your browser and the page visited to Google.

This happens only with your consent. As long as you have not agreed — and permanently if you decline — the tag is not loaded; no cookies are set and no data is sent to Google. The site is fully usable without consent.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Transfer to Google LLC in the USA cannot be excluded; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

You can withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing carried out up to that point.

8. Cookies

Without your consent, this website uses only technically necessary cookies. Advertising measurement cookies are set only if you have agreed to the conversion measurement described in section 7.

• NEXT_LOCALE — stores your language choice (German or English) so the site appears in the right language on your next visit.
• sb-… — keeps you signed in to the client portal. Only set if you sign in there.
• _gcl_au (only with consent) — set by Google Ads to attribute an enquiry to the ad you arrived through. Lifetime 90 days.

We store your decision about advertising measurement locally in your browser (localStorage, key „floxa.consent“). This entry never leaves your device.

The legal basis is § 25(2)(2) TDDDG — storage is strictly necessary for the website and the portal to function.

9. Fonts

The fonts used (Inter and Playfair Display) are served from our own server. No connection to Google's servers is established, and your IP address is not transmitted to Google.

10. Encryption

This website uses TLS encryption throughout. You can recognise this by the “https://” in the address bar and the padlock icon in your browser.

11. Your Rights

You have the right at any time to free information about your stored data, its origin and recipients, and the purpose of processing (Art. 15 GDPR). You also have the right to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interest (sections 2 and 6), you may object to that processing at any time on grounds relating to your particular situation.

For any of this, an informal message to hello@floxa.de is sufficient.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.