Privacy policy

The controller responsible for processing personal data on this website is FNLY IT UG (haftungsbeschränkt), Am Kraftwerk 23, 34582 Borken, represented by its managing director Alina Schmid.

Phone: +49 5682 7369200, email: info@fnly-it.com. You can reach us at this address with any questions about data protection and to exercise your rights.

Under Art. 37 of the General Data Protection Regulation (GDPR, German: DSGVO) and § 38 of the Federal Data Protection Act (BDSG), we are not obliged to appoint a data protection officer. Your data protection enquiries are handled directly by the management.

This website runs on servers that we operate ourselves. The servers are located in the data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, at the Falkenstein site in Germany. Hetzner provides the data centre, power and network connection. We have a data processing agreement with Hetzner under Art. 28 GDPR.

The connection to this website is encrypted with TLS. You can recognise this by the padlock symbol and "https" in the address bar.

Each time you open this website, your browser transmits data to our server for technical reasons, including:

• IP address of the requesting device
• date and time of access
• page or file requested
• website from which you came to us (referrer)
• browser and operating system used
• amount of data transferred and status code of the response

Our server processes this data only to deliver the requested page to you. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technical provision of the website. We do not store access logs containing this information.

If you open fnly-it.com without a language in the address, we forward you to the matching language version. To do this we derive the country you are in from your IP address and take your browser's language setting into account. The country lookup uses a database on our own server (IP geolocation by DB-IP, db-ip.com, licence CC BY 4.0). Your IP address is not passed to third parties for this and is not stored. The legal basis is our legitimate interest in showing you the site in your language and with the contracting company responsible for your country (Art. 6(1)(f) GDPR).

If you choose a language version yourself in the language selector, we store this choice in a cookie ("fnly_it_locale", valid for one year) so we do not redirect you again on your next visit. The cookie is required for this function you have explicitly requested (Section 25(2) no. 2 TDDDG) and only contains the code of the chosen language version.

We do not set cookies for advertising. We store your choice in the consent banner in your browser's local storage (localStorage, entry "fnly-consent") so that the banner does not appear again on every page view. This storage is strictly necessary for the service you have requested and is permitted under § 25 (2) No. 2 of the Telecommunications Digital Services Data Protection Act (TDDDG).

We only load services that are not strictly necessary with your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You can change or withdraw your consent at any time via the "Cookie settings" link in the footer of every page. The withdrawal applies to the future.

If you consent to the "Analytics" category, we use the open source software Matomo to measure how our website is used. Matomo runs at statistik.fnly-group.com on servers of the FNLY Group in Germany, which operates the analytics for all websites of the group. The data is not passed on to third parties outside the FNLY Group.

In doing so, we process your IP address, which is shortened by the last two bytes before storage, the pages viewed and the time spent on them, the website you came from, information on your device, browser and screen size, and actions such as submitting a form. For this purpose, Matomo sets the cookies "_pk_id" (storage period 13 months) and "_pk_ses" (30 minutes).

We use the analysis to improve our content and to understand which pages lead to enquiries. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. The raw data is deleted after 395 days.

If you consent to the "Marketing" category, we use services of the advertising platforms on which we run ads: Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland), the Meta Pixel for Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and the TikTok Pixel (TikTok Technology Limited, Dublin, Ireland). Without your consent, these services are not loaded.

These services set cookies or similar identifiers and transmit data such as your IP address, information on your device and browser, the pages viewed and whether you have sent an enquiry or booked an appointment. This lets us measure which ads lead to enquiries and show ads again to visitors of our website on these platforms. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. For data collection via the Meta Pixel, we are joint controllers with Meta under Art. 26 GDPR.

The providers may transfer data to the USA. Google LLC, Meta Platforms, Inc. and LinkedIn Corporation are certified under the EU-US Data Privacy Framework, for which an adequacy decision under Art. 45 GDPR exists. You can withdraw your consent at any time via "Cookie settings" in the footer.

If you come to us via an ad and send an enquiry, we transmit the campaign details from the page address, such as utm_campaign or gclid, together with your enquiry. This shows us which campaign led to which enquiry. The legal basis is our legitimate interest in measuring the performance of our advertising under Art. 6 (1) (f) GDPR.

If you write to us via the contact form or the funding check, we process the information you provide there: name, email address, company, phone number, the selected topic, the approximate number of users, your message and, for the funding check, your answers to the questions.

We use this data to answer your enquiry and, where applicable, to prepare a quote. The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at a contract, and otherwise our legitimate interest in answering enquiries under Art. 6 (1) (f) GDPR.

Our server transmits your information via the Microsoft Graph interface as an email to our Microsoft 365 mailbox. We do not operate a database for form submissions. To protect against misuse, the server briefly processes your IP address in memory to limit too many requests in a short time. It is not stored permanently and is discarded after one hour at the latest.

We delete your enquiry as soon as it has been dealt with, unless statutory retention obligations prevent this. If your enquiry leads to a contract, the retention periods under commercial and tax law of up to ten years apply.

If you contact us by email or phone, we process your information to deal with your request. The same legal basis and storage period apply as for the contact form. We record support requests from customers as tickets so that every request remains traceable.

For email, calendar and appointment booking, we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We have a data processing agreement with Microsoft under Art. 28 GDPR.

Microsoft generally processes data for customers in the EU within the EU. A transfer to the USA cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission under Art. 45 GDPR exists.

We use Microsoft Bookings for online appointment booking. Your browser does not connect to Microsoft: the appointment picker on this page queries available times via our server, and only your booking is transmitted by our server to Microsoft Bookings. No cookies are set in the process.

When you book an appointment, we process your name, email address, company, phone number, your optional message and the selected time in order to hold the call and send you a confirmation. The legal basis is Art. 6 (1) (b) GDPR. To protect against misuse, the server briefly processes your IP address in memory, as with the contact form. We delete the data when it is no longer needed for the call and any possible cooperation.

The NIS2 check and the price calculator run entirely in your browser. Your answers and entries are neither stored nor transmitted to us.

Without your consent we do not load fonts, scripts or images from third-party servers; ad tags load only after you consent to the “Marketing” category. The content of this website is delivered from our own servers.

This website contains links to services of other providers, for example to download TeamViewer QuickSupport (TeamViewer Germany GmbH, Göppingen) and to the LinkedIn profiles of our founders. Data is only transmitted when you click such a link. The respective provider is responsible for processing on the linked pages.

Your data is only received by those who need it for the purposes stated: our employees who handle your enquiry and the processors Hetzner and Microsoft named above. Your data is not passed on for advertising purposes.

You have the following rights with regard to your personal data:

• access under Art. 15 GDPR
• rectification under Art. 16 GDPR
• erasure under Art. 17 GDPR
• restriction of processing under Art. 18 GDPR
• data portability under Art. 20 GDPR
• withdrawal of consent under Art. 7 (3) GDPR with effect for the future

Where we process data on the basis of a legitimate interest under Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, www.datenschutz.hessen.de.

You are not obliged to provide us with data. However, without the mandatory information in the contact form, we cannot process your enquiry. There is no automated decision-making, including profiling, under Art. 22 GDPR.

We update this privacy policy when the website or the legal situation changes. The version published here at any given time applies.