Privacy Policy
1. Data protection at a glance
General information
The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in this Privacy Policy.
Data collection on our website
The data controller for this website is the website operator. The controller’s contact details are provided below.
We collect data that you provide to us, for example when you contact us by email or telephone, make an enquiry, place an order or otherwise communicate with us. Other data is collected automatically by our IT systems when you visit the website. This mainly includes technical data such as your browser, operating system, IP address and time of access.
Some data is processed to ensure the technically correct and secure operation of the website. Other data is processed where necessary to handle enquiries, orders and contractual relationships.
Your rights
Subject to the applicable legal requirements, you have the right to obtain information about your stored personal data, to request rectification or erasure, to restrict processing, to object to processing and to receive certain data in a portable format. You also have the right to lodge a complaint with a competent supervisory authority.
2. General information and mandatory information
Data protection
We take the protection of your personal data seriously. We treat your personal data confidentially and in accordance with the applicable data protection legislation and this Privacy Policy.
Please note that data transmission over the Internet, for example communication by email, may be subject to security vulnerabilities. Complete protection of data against access by third parties cannot be guaranteed.
Controller
The controller responsible for data processing on this website is:
Multiflower GmbH
Daimlerstr. 17
74909 Meckesheim
Germany
Telephone: +49 (0) 6226 92798-0
Fax: +49 (0) 6226 92798-10
Email:
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
Withdrawal of consent
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. An informal notification by email is sufficient unless another method is expressly provided. The lawfulness of processing carried out before the withdrawal remains unaffected.
Right to lodge a complaint
If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for our company is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany.
Data portability
You have the right, under the statutory conditions, to receive data that we process automatically on the basis of your consent or in performance of a contract in a commonly used, machine-readable format, and to have such data transmitted to another controller where technically feasible.
SSL/TLS encryption
This website uses SSL/TLS encryption to protect confidential content transmitted to us. You can recognise an encrypted connection by the use of “https://” in the address bar of your browser.
Access, rectification, erasure and restriction
Within the framework of the applicable statutory provisions, you have the right to obtain information about your stored personal data, its origin and recipients and the purpose of processing. You may also have the right to rectification, erasure or restriction of processing. You may contact us at any time using the contact details provided above.
Objection to promotional emails
The use of contact details published as part of our legal notice obligations for sending unsolicited advertising and information materials is hereby objected to. We reserve the right to take legal action in the event of unsolicited promotional information, such as spam emails.
3. Data collection on our website
Cookies and similar technologies
Our website may use cookies that are technically necessary for the operation and functionality of the website, for example for session or shopping-cart functions. Technically necessary cookies may be used where required to provide the website and its functions. Where consent is legally required for other cookies or comparable technologies, these will only be used after the corresponding consent has been given.
Hosting by STRATO
We host our website with STRATO. The provider is STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When our website is accessed, STRATO processes technical connection data and IP addresses in server log files. According to STRATO, IP addresses used for detecting and defending against attacks are stored for a maximum of seven days. Processing is carried out to provide our website securely and reliably on the basis of Art. 6(1)(f) GDPR. Where required, we have concluded a data processing agreement with STRATO pursuant to Art. 28 GDPR.
Server log files
The hosting provider automatically collects and stores information in server log files transmitted by your browser. This may include:
· browser type and browser version
· operating system used
· referrer URL
· host name of the accessing device
· time of the server request
· IP address
The processing is based on our legitimate interest in the secure, stable and technically error-free provision of our website pursuant to Art. 6(1)(f) GDPR.
Joomla / VirtueMart online shop
We use the Joomla content management system together with the VirtueMart shop component to provide our online shop. When you use the shop and, in particular, when you place an order, we process the data required to handle the order, delivery, communication and invoicing. This may include your name, company, postal address, delivery address, email address, telephone number and order and contract data.
Processing is carried out for the performance of a contract or to take steps at your request prior to entering into a contract pursuant to Art. 6(1)(b) GDPR. Where commercial or tax retention obligations apply, further storage is based on Art. 6(1)(c) GDPR.
We currently do not use external online payment service providers on our website.
Customer, enquiry and contract data
We process personal data where necessary to handle enquiries, establish and manage customer relationships, prepare quotations, process orders and fulfil contracts. The legal basis is Art. 6(1)(b) GDPR where processing is necessary for pre-contractual measures or contract performance. Where applicable, processing may also be based on legal obligations pursuant to Art. 6(1)(c) GDPR or on our legitimate interests pursuant to Art. 6(1)(f) GDPR.
4. Newsletter
Newsletter distribution with SuperMailer
We send newsletters and information by email only to recipients who have given the corresponding consent or where sending such communications is permitted in an individual case under an applicable statutory exception.
We use the SuperMailer desktop software to create and send newsletters. In our current use of the desktop software, recipient data is processed locally within our own IT environment and is not transferred to an external SuperMailer cloud service solely through the use of the desktop application.
Where the newsletter is sent on the basis of consent, the legal basis is Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future, in particular by using the unsubscribe option provided in the newsletter.
New contacts are not added to the newsletter distribution list merely because they have submitted an enquiry to us or have been entered in our enterprise resource planning system. A separate and verifiable consent is documented for newsletter subscriptions. For electronic newsletter registrations, a double opt-in procedure should be used.
Following an unsubscribe request or withdrawal of consent, the relevant data is generally removed from the active newsletter distribution list. Where necessary, the email address may be stored on a suppression list to ensure that no further newsletters are sent to that address.
5. Applications and recruitment
We process applicants’ personal data for the purpose of conducting the recruitment process. Processing may also take place electronically, in particular when application documents are sent to us by email.
The legal basis is Section 26 of the German Federal Data Protection Act (BDSG) in conjunction with Art. 6(1)(b) GDPR. If an employment relationship is established, the data required for the employment relationship will be processed further in accordance with the applicable legal provisions. If no employment relationship is established, application data will be deleted after expiry of the period required to defend against possible legal claims, unless consent has been given for longer storage or another legal basis requires further retention.
6. Use of artificial intelligence (AI)
As part of our business activities, we use applications based on artificial intelligence (AI) as supporting tools, in particular for drafting and revising texts and for translations.
Personal data is processed in this context only where this is necessary for the respective purpose and legally permissible under data protection law. Personal data that is not required is removed or anonymised, where possible, before an AI application is used.
AI applications are used solely as supporting work tools. We do not make decisions producing legal or similarly significant effects on individuals solely by automated means using AI.
7. Facebook and Instagram
Social media profiles
We maintain publicly accessible company profiles on Facebook and Instagram. The provider of these services is:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
When you visit our Facebook or Instagram profiles, Meta may process personal data. This may also occur if you are not logged in to Facebook or Instagram or do not have an account. We have only limited influence over the nature and scope of Meta’s processing. Further information is available in Meta’s privacy information.
Our website may contain simple links to our Facebook and Instagram profiles. Merely visiting our website does not establish a connection to Meta through such a simple link. Only when you follow the link do you leave our website and the privacy provisions of the respective platform apply.
Processing by Multiflower
If you contact us through Facebook or Instagram, for example by message, comment or another interaction, we process the personal data you provide in order to handle your request and communicate with you.
This may include your name or username, profile information visible to us, the content and time of your message or comment and any other information you voluntarily provide.
Depending on the content of your request, processing is based on Art. 6(1)(b) GDPR where communication relates to a contract or pre-contractual measures. In other cases, processing is based on our legitimate interest in communicating with interested parties, customers and business partners and in conducting public relations pursuant to Art. 6(1)(f) GDPR.
Facebook and Instagram Insights
When operating our Facebook and Instagram profiles, Meta may provide us with statistical information about the use of our profiles (“Insights”). We use this information to better understand the use of our social media offerings and to develop our content.
For certain processing activities in connection with the operation of our Facebook page, Multiflower GmbH and Meta may be joint controllers. Details of the processing and joint controllership are set out in Meta’s privacy information and applicable agreements.
International data transfers
When Facebook and Instagram are used, personal data may also be processed outside the European Union or the European Economic Area. Information on the mechanisms and safeguards used by Meta for international data transfers can be found in Meta’s privacy information.
Data subject rights
You are generally entitled to the data protection rights described in this Privacy Policy. Where processing is carried out exclusively by Meta, you may exercise your rights directly against Meta.
For questions regarding the processing of personal data by Multiflower GmbH, please contact:
Multiflower GmbH
Daimlerstr. 17
74909 Meckesheim
Germany
Telephone: +49 (0) 6226 92798-0
Email:
Last updated: 29 September 2026
