Privacy Policy

Version 1.3 (15/03/2021)

The secure handling of your data is particularly important. We would therefore like to inform you in detail about the use of your personal data when you visit our website. Personal data includes all data with which you can be personally identified.

1. Definitions

Our data privacy statement is based on the terms used by the European legislator for directives and regulations when the General Data Protection Regulation (GDPR) was issued. You can find more information and explanations as well as the contents of the GDPR here.

2. Responsibility

Responsible for data processing in the sense of the GDPR is:

Cloudflight GmbH (“we” or “Cloudflight”)
Kaiser-Ludwig-Platz 5
80336 Munich, Germany
CEO: Eike-Christian Frerichs, Jörn Petereit, Christian Federspiel

The data protection officer of Cloudflight GmbH can be reached at:

Data protection officer of Cloudflight GmbH
Kaiser-Ludwig-Platz 5
80336 Munich, Germany

3. Purposes of processing and legal basis

3.1. General

We collect, process and use your personal data within the scope of this website for the following purposes:

  • Initiation, conclusion and implementation of contractual relationships and the associated customer service and support
  • Registration for events and competitions
  • Publication in rankings (Hall of Fame)
  • Processing of applications
  • Participation in the e-mail newsletter
  • Advertising and marketing activities

We process your personal data only if and insofar as this processing is based on one or more of the following legal bases:

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a GDPR serves as the legal basis.

In the case of processing of personal data which is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations which are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person make it necessary to process personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or of a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Article 6 (1) lit. f GDPR serves as the legal basis for the processing. If and to the extent that this legal basis legitimises the processing, we weigh our legitimate interests against your interests, fundamental rights and/or freedoms on a case-by-case basis and explain this.

We inform you that the provision of personal data is partly required by law (e.g. tax regulations) or may also result from contractual regulations (e.g. information on the contractual partner). Sometimes it may be necessary for a contract to be concluded that a data subject provides us with personal data, which must subsequently be processed by us. For example, the data subject is obliged to provide us with personal data if our company concludes a contract with him/her. Failure to provide the personal data would mean that the contract with the data subject could not be concluded.

3.2. Collection of data when visiting our website

Every time a data subject or automated system accesses the website, data and information is collected by this website. This general data and information is stored in the log files of the server. As far as you do not register or otherwise transmit special information, the technically necessary data is collected such as:

  • browser types and versions used,
  • the Internet service provider of the accessing system
  • the operating system used by the accessing system,
  • the website from which an accessing system accesses our website
    the date and time of access,
  • the IP address used and
  • other similar data and information which serve to avert danger in the event of attacks on our information technology systems.

The collected data and information is evaluated by Cloudflight on the one hand statistically and also with the aim of increasing data protection and data security in our company, in order to ultimately ensure an optimal level of protection for the personal data processed by us. The anonymous data of the server log files are stored separately from all personal data provided by an affected person.

This information is required to display the contents of our website correctly, to optimise the advertising content for this website and to ensure its functionality. The processing is therefore carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. We reserve the right to subsequently check the server log files if there are concrete indications of illegal use. Processing with regard to optimisation by evaluation of use is also carried out in accordance with Art. 6 Para. 1 lit. f GDPR on the basis of our legitimate interest in the improvement and functionality of our website and its contents.

3.3. Use of data when registering for the e-mail newsletter using “Pardot”

On the Cloudflight website you will be given the opportunity to subscribe to the newsletter of our group of companies (Cloudflight GmbH, Cloudflight Austria GmbH, Cloudflight Germany GmbH, Cloudflight Netherlands B.V., Catalysts Romania S.R.L, Sappho zweiundzwanzigste Holding GmbH). Which personal data is transmitted to the data controller when ordering the newsletter is determined by the input mask used for this purpose. We inform our customers, business partners and potential applicants at regular intervals by means of a newsletter about offers and upcoming events of the company.

For legal reasons, a confirmation e-mail will be sent to the e-mail address you entered for the newsletter for the first time using the double opt-in procedure. This confirmation e-mail is used to check whether you, as the owner of the e-mail address, have authorized the receipt of the newsletter as the person concerned. When registering for the newsletter, Salesforce as our order processor also saves your IP address at the time of registration as well as the date and time of registration. This is necessary, because it prevents abuse and serves the legal protection.

The newsletter is sent by “Pardot”, a systems of Salesforce. The e-mail addresses of our newsletter recipients are stored on the servers of Salesforce in the EU. Salesforce uses this information to send and evaluate the newsletter on our behalf.

The newsletters contain a so-called “web-beacon”, i.e. a pixel-sized file which is retrieved from the server of Salesforce when the newsletter is opened. In the context of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and time of retrieval are collected. This information is used for the technical improvement of the services based on the technical data or the target groups and their reading behaviour based on their retrieval locations (which can be determined by means of the IP address) or the access times. Statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our ambition nor that of Salesforce to observe individual users. The evaluations serve us much more to recognize the reading habits of our users and to adapt our contents to them or to send different contents according to the interests of our users.

By activating the confirmation link you give us your consent for the use of your personal data according to article 6 paragraph 1 lit. a GDPR. The data collected by us when registering for the newsletter will be used exclusively for the purpose of advertising by means of the newsletter. You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a message to the person responsible mentioned at the beginning, which also revokes your consent. After you have unsubscribed, your e-mail address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this declaration.

3.4. Contact possibility via the website

Cloudflight’s website contains a contact form that allows quick electronic contact with our group of companies (Cloudflight GmbH, Cloudflight Austria GmbH, Cloudflight Germany GmbH, Cloudflight Netherlands B.V., Catalysts Romania S.R.L, Sappho zweiundzwanzigste Holding GmbH) and direct communication with us, which also includes an e-mail address. If you contact us by e-mail or via a contact form, the personal data transmitted to us will be stored automatically. Such personal data transmitted to us on a voluntary basis is stored for the purpose of processing or contacting you. This personal data will not be passed on to unauthorized third parties.

3.5. Use of cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your end device. Some of the cookies we use are deleted again after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your terminal device and enable us to recognize your browser the next time you visit us (persistent cookies). You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general. If cookies are not accepted, the functionality of our website may be limited.

3.6. Use of Matomo

We use the web analytics service software Matomo (, a service provided by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, (“Matomo”) on our website as an on-premise solution. We consider this to be the best way to conduct analyses in compliance with data protection regulations. The legal basis for this is Art. 6 para. 1 lit. f GDPR. Based on our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes, data is collected and stored. For the same purpose, pseudonymised user profiles can be created and evaluated from this data. Cookies can be used for this purpose. Among other things, the cookies enable the recognition of the Internet browser. The data collected with Matomo technology (including your pseudonymised IP address) is processed on our servers. The information generated by the cookie in the pseudonymous user profile is not used to personally identify the visitor of this website and is not combined with personal data about the bearer of the pseudonym.

If you do not agree with the storage and evaluation of this data from your visit, you can object to its storage and use for the future at any time. In this case, a so-called opt-out cookie is stored in your browser, with the consequence that Matomo does not collect any session data. Please note that the complete deletion of your cookies means that the opt-out cookie is also deleted and may have to be reactivated by you.
Further information on data protection can be found in the privacy policy at:

3.7. Use of Salesforce

For the data you provide on the Website, we use processing systems of Germany GmbH, Erika-Mann-Str. 31, 80636 München Germany (“Salesforce”) for customer relationship management (“CRM”) purposes. Salesforce may only access the data in accordance with our instructions (order processing). Salesforce is committed to ensuring strict technical measures to protect your personal data. Salesforce will not share your Personal Information with any third party, unless the disclosure is necessary to perform the agreed services or Salesforce must do so to comply with the law or a valid and binding order from a governmental or regulatory authority. The information provided for this purpose will be kept to the minimum necessary. Salesforce Germany is a subsidiary, Salesforce has its headquarters in the USA. Therefore, it cannot be completely ruled out that the above data may be transferred to the USA. Salesforce guarantees via the EU standard contract clauses that your data is also subject to an adequate level of data protection in the USA.

3.8 Use of Google Services

We integrate services of the provider Google and its subsidiaries listed below on our website. In the course of using these services, information (including personal data, in particular your IP address and location data) may be processed by these companies. It cannot be ruled out that information may also be transmitted to a server in a third country.

The legal basis for the processing of personal data described here is Art. 6 para. 1 lit. f GDPR. Our necessary legitimate interest lies in the advantage of not having to provide large amounts of data on our servers ourselves. We can thus use these more efficiently elsewhere for the benefit of performance and thus ensure greater stability for you. In addition, you give your consent accordingly via the consent management tool, Art. 6 para. 1 lit. a GDPR.  You can send or inform us of your right to object at any time, see section 4 of this privacy policy.

You are also not obliged to provide personal data. However, failure to provide such data may result in you not being able to use the corresponding services on our website or not being able to use them to their full extent. You can find more detailed information in Google’s privacy policy, which you can access here:, opt-out option:, settings for the display of advertisements:

3.8.1 Google Maps

We integrate maps from the provider Google. The service provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Maps is integrated on our website as an “Iframe”. Our purpose in integrating Google Maps is to provide you with maps and route information (directions to our offices) on our website.

3.9.2 YouTube

We integrate YouTube plug-ins on this website to enable the display of videos. YouTube is a service provided by YouTube LLC (“YouTube”), 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube LLC is a subsidiary of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube is integrated on our website by means of “iframe”. Our purpose in integrating YouTube is to make various videos available to you on our website so that you can view them directly by clicking on them.

3.9. Microsoft Bookings

Our website uses the Microsoft Bookings service (part of the Microsoft Office 365 software suite) of the provider Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521 (“Microsoft”) for online appointment booking. The software enables the booking of a customer appointment (e.g. for a consultation before or after the conclusion of a contract). The connection to the service is only established when you call up the online booking function via a link or button on our website, in an e-mail or in the newsletter. To make an appointment, your entries in the appointment form are transferred to Microsoft. You can find further information on the handling of your data in Microsoft’s privacy policy. The legal basis for the processing of your data in relation to the service “Microsoft Bookings” is Art. 6 para. 1 lit. f) GDPR (Legitimate Interest).

3.10. Applications and application procedures

We collect and process the personal data transmitted by you for the purpose of processing the application procedure. You can object to the storage of your data in applications and in the application process at any time. For this purpose, the provisions of section 4 of this data privacy statement apply. If we conclude an employment contract with you, the data transmitted will be stored for the purpose of processing the employment relationship in compliance with the statutory provisions. If no contract of employment is concluded with you, the application documents will be deleted 12 months after notification of the rejection decision, unless storage for future applications has been expressly agreed and no other legitimate interests oppose deletion. Another legitimate interest is, for example, our duty of proof in proceedings under the General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, AGG). Within the deletion period, there may also be country-specific deviations on the basis of special storage obligations, which we weigh up in accordance with the above-mentioned legitimate interest.

4. Right of revocation and objection / opt-out possibility

You can revoke all consents to the use of your personal data that you have given us (including any declarations of consent that you may not have given), either in total or for individual processing operations, free of charge. The legality of the processing carried out on the basis of the consent up to the revocation is not affected by the revocation.
Since your personal data are required for the creation of a user profile for the sending of personalised newsletters, a revocation of your consent may result in either no personalised newsletters being sent to you or, in the event of an objection, no newsletters being sent to you at all for all processing operations. Depending on the scope of the revocation, notifications of participation in events and competitions as well as the Hall-of-Fame may also be omitted.

You also have the right to object, in accordance with Art. 21 GDPR, to the processing of your personal data that is carried out on the basis of a legitimate interest on our part or on the part of a third party, provided that there are reasons for doing so that arise from your particular situation or that the objection is directed against general or customised direct advertising. In the latter case, you have a general right of objection, which will be implemented by us without indicating a special situation.

If you do not wish cookies to be stored in your browser, you can also do so by selecting the appropriate browser setting under Tools/Internet Options. If you want to allow the writing of cookies only for certain websites, please proceed according to the settings for each browser:

Please note, however, that in this case you have to expect a limited presentation of the online offers and a limited user guidance. You can also delete cookies at any time. In this case, the information stored in them will be removed from your end device.

5. Transfer of data to third parties

Your data will only be passed on to service providers and partner companies that have been carefully selected and contractually bound. In doing so, we will only transfer your data to processors and service providers to the extent that this is necessary for the performance of the contract (Art. 6 para. 1 lit. b GDPR); data processing is required in particular to ensure the completeness and accuracy of the data and to be able to perform the contract, or to the extent that this is necessary to fulfil a legal obligation (Art. 6 para. 1 lit. c GDPR; the data processing is required in particular to guarantee the completeness and accuracy of tax data in accordance with the German Tax Code),insofar as this is covered by your voluntarily given consent (Art. 6 para. 1 lit. a GDPR), or if this is necessary to safeguard the legitimate interests of the person responsible or of a third party (Art. 6 para. 1 lit. f GDPR; a legitimate interest is in particular our customer loyalty interest).

This includes in particular service providers for IT services, for the delivery of products or for marketing such as lettershops or newsletter dispatch and/or service partners such as online payment providers, to whom we only pass on the data (e.g. name, address) necessary for the fulfilment of the task.

This also includes the forwarding of data to companies affiliated with us, which are required for the fulfilment of internal administrative purposes and the uniform control of company-wide objectives. The processing is therefore carried out on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR.

All personal data will, of course, be treated in strict confidence. The recipients are contractually bound by us in accordance with the strict provisions of the GDPR and may not use the data for any other purposes. With the exception of any recipients named in this data protection declaration, your data will not be transferred to third countries (countries outside the European Economic Area, EEA). In the event of a data transfer, this always takes place on the basis of so-called standard contractual clauses of the European Union.

6. General duration of data storage

Your personal data will only be stored for the period of time required to fulfil the purpose of storage, unless we are obliged to store the data for a longer period of time due to legal, statutory or contractual retention periods. Your personal data will be deleted or blocked once the purpose is no longer applicable or fulfilled. In the case of blocking, the data will be deleted as soon as legal, statutory or contractual retention periods are no longer opposed. Only in exceptional cases can we refrain from deleting the data, which would cause a disproportionately high effort due to the special type of storage.

If you do not conclude a contract with us, your personal data will be deleted basically 12 months after the last contact between you and us. Deviations from this to shorter or longer periods are possible insofar as permitted by data protection law.

Your personal data relevant to a contract, in particular data relevant to tax law, will be deleted after expiry of the statutory retention periods, at the latest 10 years after termination of the contract. Where applicable, different deletion periods for individual categories of data are indicated within this data protection information at the end of the respective category.

7. Rights of the data subject

You are entitled to the following rights with regard to your data processed by us:

  • The right to obtain information about your personal data stored by us in accordance with Art. 15 GDPR; in particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the origin of your data if it has not been collected directly from you,
  • The right to correct incorrect data or to complete correct data in accordance with Art. 16 GDPR,
  • The right to delete your data stored with us in accordance with Art. 17 GDPR, insofar as no legal or contractual retention periods or other legal obligations or rights for further storage must be observed,
  • The right to restrict the processing of your data in accordance with Art. 18 GDPR, if you dispute the accuracy of the data, if the processing is unlawful but you refuse to have it deleted; if the person responsible no longer needs the data but you need it to assert, exercise or defend legal claims or if you have lodged an objection to the processing in accordance with Art. 21 GDPR,
  • The right to data transferability in accordance with Art. 20 GDPR, i.e. the right to have selected data stored by us about you transferred in a common, machine-readable format, or to request transfer to another responsible party,
  • The right to appeal to a supervisory authority. As a rule, you can contact the supervisory authority at your usual place of residence or workplace or at our company headquarters. The competent authority is then:

    Landesamt für Datenschutzaufsicht
    Promenade 18
    91522 Ansbach
    Postfach 1349
    91504 Ansbach
    Tel.: 0981/180093-0
    Fax: 0981/180093-800

If you have any further questions regarding the processing of your personal data or the exercise of any of the rights available to you, please send us an e-mail to: .

8. Data security

The protection of your data and compliance with legal regulations in all data processing procedures (e.g. collection, processing and transmission) is our highest priority.

On this website, all personal data is encrypted appropriately and in accordance with the generally recognised state of the art before it leaves your terminal device (e.g. PC, laptop) for transmission on the Internet. Your details are therefore not visible to outsiders.

9. Changes

Changes in the law or changes in our internal processes, technologies used and/or selection of partners may make it necessary to amend this privacy policy. In the event of such a change, we advise you to visit this section regularly and keep yourself informed of the latest changes. Please note that the current version of the data protection declaration is the valid one.