Skip to content
DE
Back to home

Privacy Policy

OKRflow

Last updated: 19 October 2026

We appreciate your interest in our website, our platform, and our online presence. This Privacy Policy explains how OKRflow processes personal data when you visit our website, use our platform, contact us, or interact with us through other digital channels, including social media.

This Privacy Policy may be updated from time to time with effect for the future. The version published on our website at the time of your visit shall apply.

Unless otherwise indicated, terms such as “personal data”, “processing”, “controller”, and “processor” have the meaning assigned to them in the General Data Protection Regulation (GDPR).

I. Controller

The controller within the meaning of the GDPR and other applicable data protection laws is:

Famwa UG (haftungsbeschränkt) i.G.
Thierschstraße 51
80538 Munich
Germany

Email: info@okrflow.com

II. Data Protection Contact / Data Protection Officer

If a data protection officer has been appointed, the contact details are:

Alexa Wagner
c/o Famwa UG (haftungsbeschränkt) i.G.
Thierschstraße 51
80538 Munich
Germany

Email: info@okrflow.com

III. General Information on Data Processing

1. Scope of processing

We process personal data only where this is necessary for operating our website and platform, providing our services, fulfilling contractual obligations, complying with legal requirements, or where you have granted consent.

2. Legal bases

Depending on the circumstances, processing is based in particular on:

  • Art. 6(1)(a) GDPR – your consent
  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR – compliance with a legal obligation
  • Art. 6(1)(f) GDPR – legitimate interests, provided your interests or fundamental rights do not override them

Where special categories of personal data are processed, an additional legal basis under Art. 9 GDPR will apply if required.

3. Legitimate interests

Where processing is based on Art. 6(1)(f) GDPR, our legitimate interests may include:

  • secure and stable operation of our website and platform,
  • IT security and fraud prevention,
  • customer communication,
  • product improvement,
  • internal administration,
  • enforcement and defense of legal claims.

4. Storage period

We store personal data only for as long as necessary for the relevant purpose. Data may also be retained where required by statutory retention obligations, especially under commercial or tax law. Once the purpose no longer applies and no retention obligation exists, the data will be deleted or access will be restricted.

5. Recipients and disclosure

Personal data may be processed by:

  • OKRflow internally,
  • processors engaged by us, such as hosting, database, infrastructure, or email delivery providers,
  • public authorities or courts where disclosure is legally required.

Where processors are engaged, this is done on the basis of agreements compliant with Art. 28 GDPR.

6. Requirement to provide data

You may visit our website without actively providing personal data. However, if you wish to use our platform or enter into a contract with us, certain personal data is required. Without that data, we may be unable to provide the requested service.

7. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR unless expressly stated otherwise.

8. Security

We apply appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. These measures are regularly reviewed and updated.

IV. Processing When Using the Website and Platform

1. Server log files

Whenever our website or platform is accessed, our hosting systems automatically record technical access data. This may include:

  • date and time of access,
  • IP address,
  • browser type and browser version,
  • operating system,
  • referrer URL,
  • requested pages or files.

This processing is necessary to ensure technical delivery of the website and platform, maintain system security, detect misuse, and ensure stable operation.

Legal basis: Art. 6(1)(f) GDPR
Retention: generally up to 7 days, unless longer storage is necessary for evidence or security-related reasons.

Because this processing is technically necessary, there is no right to object in relation to the mere provision of the website/platform.

2. Cookies and similar technologies

We use only technically necessary cookies and similar technologies on our website and platform. We do not use analytics, tracking, or advertising cookies, and we do not use any web analytics or tracking tools. For this reason, no consent banner is shown.

The cookies we use serve exclusively the following purposes:

  • maintaining your session,
  • enabling secure login (authentication),
  • storing your language preference.

If technically necessary cookies are disabled, certain functions may no longer work properly.

Legal bases:

  • storage of and access to information on your device: § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as these cookies are strictly necessary to provide the service you have requested,
  • subsequent processing of personal data: Art. 6(1)(b) GDPR (login and session for using the platform) and Art. 6(1)(f) GDPR (secure operation and a user-friendly presentation of the website in your preferred language).

You can also control cookies through your browser settings and delete cookies already stored on your device.

3. Registration and use of the platform

When you create an account on our platform, we process the data required to establish and manage your account. This typically includes:

  • name,
  • email address,
  • password,
  • account-related metadata.

We use this data to create your account, authenticate logins, manage access, send technical or legal notices, and provide the contractual services.

In addition, we may store the IP address as well as the date and time of registration in order to prevent abuse, detect unauthorized activity, and document account creation where necessary.

Legal basis:

  • Art. 6(1)(b) GDPR for account creation and service provision
  • Art. 6(1)(f) GDPR for abuse prevention and platform security

Data will generally be deleted once the contractual relationship ends and statutory retention periods have expired, unless further storage is legally permitted or required.

If you request deletion of your account, we will delete or restrict the associated personal data unless retention is required by law.

4. Use of the platform by employees of customer organizations

If you use the platform as an employee, contractor, or other authorized user of one of our business customers, your employer or contracting organization may determine which personal data is collected and processed through the platform, for example in connection with feedback, goals, surveys, or employee development workflows.

In such cases, the respective customer is generally the controller, and OKRflow acts as a processor on behalf of that customer in accordance with Art. 28 GDPR.

For details on such processing, please contact your employer or the organization that granted you access.

5. Single Sign-On (SSO)

Where offered, you may sign in through a Single Sign-On service instead of registering separately.

If you choose this option, we receive the information necessary to create or link your account, typically:

  • name,
  • email address,
  • account identifier supplied by the SSO provider.

This processing is necessary to provide platform access and user authentication.

Legal basis: Art. 6(1)(b) GDPR

a) Google Sign-In

Where Google Sign-In is used, the provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data transfers outside the EEA may occur. Such transfers may be based on an adequacy decision or other appropriate safeguards, including the European Commission’s Standard Contractual Clauses, where applicable.

Further information is available in Google’s privacy information.

b) Microsoft Sign-In

Where Microsoft-based SSO is used, the provider is generally Microsoft Ireland Operations Limited or the relevant Microsoft entity. International transfers may take place subject to applicable transfer mechanisms, including adequacy decisions or Standard Contractual Clauses where required.

Further information is available in Microsoft’s privacy information.

6. Integrations activated by customers

Our business customers may connect third-party systems to the platform. If such integrations are activated by the customer, data may be exchanged with the relevant external service to enable the requested functionality.

The customer is responsible for deciding whether such integrations are used and for assessing whether their use is permissible in the relevant employment and data protection context.

Where OKRflow merely enables the technical connection, the third-party provider’s own privacy terms also apply.

V. Contact by Email or Other Communication Channels

If you contact us by email or through another direct communication channel, we process the data you provide in order to handle your request. This may include:

  • your name,
  • email address,
  • company details,
  • the content of your message,
  • follow-up communication.

Legal basis:

  • Art. 6(1)(b) GDPR if your inquiry relates to a contract or pre-contractual steps
  • Art. 6(1)(f) GDPR for other legitimate communication and request handling

Your inquiry and related data will be deleted when the matter has been fully resolved, unless legal retention obligations apply.

VI. Payment Processing

If paid services are booked, payments may be processed through an external payment provider.

In that case, payment-related personal data may be processed, including:

  • billing data,
  • contact details,
  • transaction details,
  • information required for fraud prevention or payment verification.

Payment data is processed exclusively for transaction handling and, where necessary, the prevention of fraud.

Legal basis:

  • Art. 6(1)(b) GDPR where payment is necessary for contract performance
  • Art. 6(1)(f) GDPR where external payment services are used to ensure secure and efficient payment handling

Please also refer to the privacy information of the relevant payment provider.

VII. Third-Party Services

To operate our website and services, we use selected external service providers. Personal data may be processed in this context. We choose such providers carefully and, where required, conclude data processing agreements in accordance with Art. 28 GDPR.

1. Render (hosting)

Our website and platform are hosted by Render Services, Inc., USA (“Render”). The servers we use are located in Render’s Frankfurt, Germany region.

In this context, personal data may be processed, especially:

  • technical connection data,
  • server log data (see section IV.1),
  • data transmitted when using the website and platform.

The use of Render serves the secure, stable, and performant operation of our website and platform.

Legal basis: Art. 6(1)(f) GDPR and, where applicable, Art. 6(1)(b) GDPR

Render acts as our processor on the basis of an agreement pursuant to Art. 28 GDPR. As Render is a US company, access to data from the USA cannot be ruled out. Any such transfer is based on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

2. Supabase (database, authentication, and authentication emails)

We use services of Supabase, Inc., USA (“Supabase”) for our database, for user authentication (login, registration, session management), and for sending authentication-related emails. The data is stored in Supabase’s Frankfurt, Germany region.

In this context, personal data may be processed, especially:

  • account data (e.g., name, email address, password in hashed form),
  • content and platform data stored in the database,
  • authentication and session data, including IP address and time of login,
  • email address and technical delivery data for authentication emails.

Authentication emails may include, for example:

  • account confirmations,
  • password reset messages,
  • login links or login notifications.

Legal basis:

  • Art. 6(1)(b) GDPR where processing is necessary for providing the platform and for contract performance
  • Art. 6(1)(f) GDPR for secure authentication and reliable delivery of essential service messages

Supabase acts as our processor on the basis of an agreement pursuant to Art. 28 GDPR. As Supabase is a US company, access to data from the USA cannot be ruled out. Any such transfer is based on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

3. IONOS (domains and DNS)

We use IONOS as the registrar for our domains and for DNS (domain name system) services. IONOS does not host our website or platform.

When you access our website, your browser or the DNS resolver you use sends a DNS query to resolve our domain name. In this context, technical connection data (in particular IP addresses of the requesting systems) may be processed by IONOS.

Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in making our website and platform reliably reachable under our domains.

Where IONOS acts as our processor, processing is carried out on the basis of an agreement pursuant to Art. 28 GDPR.

VIII. Social Media Presences

We maintain online presences on social media platforms in order to communicate with interested users and provide information about OKRflow.

When you visit one of our profiles, the respective platform provider may process personal data independently. This may include usage data, device information, IP address, and interactions with content. Social media providers may also use cookies and similar technologies to analyze usage and display personalized advertising.

If you are logged into your account on the relevant network while visiting our profile, the visit may be associated with your user account there.

Legal basis:

  • Art. 6(1)(f) GDPR for our legitimate interest in external communication and public visibility
  • where the platform provider processes data based on consent, Art. 6(1)(a) GDPR may additionally apply in the relationship between you and the provider

We currently maintain presences on the following networks:

1. Facebook
Provider: Meta Platforms Ireland Limited, Dublin, Ireland
Further information is available in Facebook’s privacy policy.

2. X
Provider: the operator of the platform X (formerly Twitter)
Further information is available in X’s privacy policy.

3. LinkedIn
Provider: LinkedIn Ireland Unlimited Company, Dublin, Ireland
Further information is available in LinkedIn’s privacy policy.

4. XING
Provider: New Work SE / XING, Hamburg, Germany
Further information is available in XING’s privacy policy.

IX. International Data Transfers

Where personal data is transferred to recipients outside the European Economic Area (EEA), this is done only where permitted under applicable law.

Depending on the provider and destination country, transfers may be based on:

  • an adequacy decision of the European Commission, including, for certified US recipients, the EU-US Data Privacy Framework, or
  • appropriate safeguards such as the Standard Contractual Clauses (SCCs) adopted by the European Commission.

Where required, we also assess whether supplementary protective measures are necessary.

X. Rights of Data Subjects

If we process your personal data, you have the following rights under the GDPR, subject to the statutory requirements:

1. Right of access – Art. 15 GDPR

You may request confirmation as to whether we process personal data concerning you. If so, you may request access to that data and to additional information about the processing.

2. Right to rectification – Art. 16 GDPR

You may request correction of inaccurate personal data and completion of incomplete data.

3. Right to erasure – Art. 17 GDPR

You may request deletion of your personal data where the statutory requirements are met.

4. Right to restriction of processing – Art. 18 GDPR

You may request that processing be restricted under the conditions laid down by law.

5. Right to notification

If you have exercised a right to rectification, erasure, or restriction, you may request information about recipients to whom the data was disclosed, unless this is impossible or disproportionate.

6. Right to data portability – Art. 20 GDPR

Where processing is based on consent or contract and carried out by automated means, you may request the personal data you provided in a structured, commonly used, machine-readable format and, where technically feasible, transmission to another controller.

7. Right to object – Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR. If personal data is processed for direct marketing purposes, you may object at any time to such processing.

8. Right to withdraw consent – Art. 7(3) GDPR

Where processing is based on consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

9. Right to lodge a complaint – Art. 77 GDPR

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you believe that the processing of your personal data violates data protection law.

XI. Contact for Privacy Requests

To exercise your rights or ask questions about this Privacy Policy, please contact:

Famwa UG (haftungsbeschränkt) i.G.
Thierschstraße 51
80538 Munich
Email: info@okrflow.com