Privacy Policy

Effective date: February 10, 2026

This Privacy Policy applies to the website www.floorzilla.de.

1. Introduction and Overview

The protection of your personal data is very important to us. We process personal data confidentially and strictly in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and this Privacy Policy.

The following information explains which personal data we collect, for what purposes and on which legal bases such data is processed, and which rights you have as a data subject when you visit our website, use our services, contact us, or apply for a position with us.

2. Controller

The controller responsible for data processing on this website is:

ecoCOAT GmbH
Kesselbodenstraße 4A
85391 Allershausen
Germany

Represented by: Managing Director Enrico Flade
Email: info@floorzilla.de
Phone: +49 8166 673870

3. Legal Bases for Processing

We process personal data exclusively on the basis of the GDPR and other applicable data protection laws. Depending on the purpose of processing, the following legal bases apply in particular:

·         Art. 6(1)(a) GDPR – Consent

·         Art. 6(1)(b) GDPR – Performance of a contract or pre-contractual measures

·         Art. 6(1)(f) GDPR – Legitimate interests

·         Section 26 BDSG – Processing of data in the context of employment and application procedures

Our legitimate interests lie in particular in the secure provision of our website, prevention of misuse and spam, optimization of our online offering, and efficient communication with interested parties, customers, and applicants.

4. Data Retention and Deletion

Unless a more specific retention period is stated in this Privacy Policy, we process personal data only for as long as necessary to achieve the respective purpose or as required by statutory retention obligations. After the purpose ceases to apply or statutory retention periods expire, the data is routinely deleted.

5. Hosting and Server Log Files (Domainfactory)

Our website is hosted by domainfactory GmbH, Oskar-Messter-Straße 33, 85737 Ismaning, Germany.

When you visit our website, domainfactory automatically collects and stores information in so-called server log files. This information includes in particular:

·         IP address

·         Date and time of access

·         Accessed pages / files

·         Referrer URL

·         Browser type and operating system

Processing is carried out on the basis of Art. 6(1)(f) GDPR.
Our legitimate interest lies in the secure, stable, and error-free provision of our website.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with domainfactory.

6. Cookies and Consent Management

Our website uses cookies.

·         Technically necessary cookies are required for the operation of the website and are processed on the basis of Art. 6(1)(f) GDPR.

·         Analytics and marketing cookies are set only after you have given your prior consent in accordance with Art. 6(1)(a) GDPR.

You may withdraw or adjust your consent at any time via our consent management tool.

7. Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Dublin, Ireland).
Google Tag Manager itself does not process personal data but is used solely to manage and trigger other services that may process personal data.

Legal basis: Art. 6(1)(f) GDPR.

8. CRM and Customer Management – Salesforce

For processing customer inquiries, managing prospective customers, and maintaining customer relationships, we use the CRM system Salesforce (provider: salesforce.com Germany GmbH or Salesforce.com Inc., USA).

Purpose of processing:
Customer and prospect management, sales and communication processes.

Legal basis:
Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

Transfer to third countries:
Personal data may be transferred to the United States. Salesforce is certified under the EU-U.S. Data Privacy Framework and additionally uses Binding Corporate Rules (BCR) and EU Standard Contractual Clauses.

9. Applicant Data and Recruiting (including JOIN)

Processing of applicant data

We process personal data of applicants that is provided to us in the course of applications, unsolicited applications, or recruitment processes. This includes in particular:

·         Name and contact details

·         Application documents (e.g. CV, cover letter, certificates)

·         Qualification and professional information

·         Communication data within the application process

Purpose of processing:
Conducting the application process and deciding on the establishment of an employment relationship.

Legal basis:
Section 26 BDSG and Art. 6(1)(b) GDPR.

Use of JOIN

For publishing job advertisements and managing applications, we use the platform JOIN (provider: Join Solutions GmbH, Schönhauser Allee 36, 10435 Berlin, Germany).

JOIN processes applicant data either on our behalf or as an independent controller. The privacy policy of JOIN applies in addition.

Retention period:
If no employment relationship is established, applicant data will be deleted no later than six (6) months after completion of the application process, unless statutory retention obligations exist or explicit consent for longer storage (e.g. applicant pool) has been given.

10. Analytics and Marketing Tools

Google Analytics 4

We use Google Analytics 4 (Google Ireland Limited) to analyze the use of our website. IP addresses are anonymized by default.

Legal basis:
Art. 6(1)(a) GDPR (consent).

Meta Pixel (Facebook & Instagram)

We use the Meta Pixel provided by Meta Platforms Ireland Ltd. to measure and optimize advertising performance.

There is joint controllership pursuant to Art. 26 GDPR between us and Meta.

Legal basis:
Art. 6(1)(a) GDPR (consent).

LinkedIn Insight Tag

We use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company to analyze website visits and campaign performance.

Legal basis:
Art. 6(1)(a) GDPR (consent).

11. Security and Spam Protection – Google reCAPTCHA

To protect our online forms, we use Google reCAPTCHA (Google Ireland Limited).

Purpose:
Protection against spam, misuse, and automated attacks.

Processed data:
IP address, date and time of access, referrer URL, browser and device information, mouse movements, and keystrokes.

Legal basis:
Art. 6(1)(f) GDPR.

Data processing on behalf:
Google processes this data exclusively as a data processor on the basis of the Google Cloud Data Processing Addendum pursuant to Art. 28 GDPR.

12. Google Maps

We use Google Maps to display our locations. Personal data (in particular IP addresses) may be transmitted to Google in the process.

Legal basis:
Art. 6(1)(f) GDPR.

13. YouTube (Enhanced Privacy Mode)

We embed videos from the YouTube platform using the enhanced privacy mode. Data is transmitted to Google only after you actively play the video.

Legal basis:
Art. 6(1)(f) GDPR.

14. Social Media Presence

We maintain online profiles on Facebook, Instagram, and LinkedIn to communicate with customers, interested parties, and applicants.

Data processing is based on our legitimate interests in modern and effective communication (Art. 6(1)(f) GDPR) and, where applicable, on your consent given to the respective platform provider.

15. Transfers to Third Countries

Where personal data is transferred to third countries (e.g. the United States), this is done exclusively in compliance with Arts. 44 et seq. GDPR, in particular through adequacy decisions, EU Standard Contractual Clauses, or other appropriate safeguards.

16. Rights of Data Subjects

You have the right to:

·         Access (Art. 15 GDPR)

·         Rectification (Art. 16 GDPR)

·         Erasure (Art. 17 GDPR)

·         Restriction of processing (Art. 18 GDPR)

·         Data portability (Art. 20 GDPR)

·         Objection to processing (Art. 21 GDPR)

Withdrawal of consent

You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to lodge a complaint

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).