Last updated: 9 September 2026
This English version is a translation provided for convenience. In the event of any discrepancy, the German version of this Cookie Policy prevails.
1. Controller
The controller responsible for this website is KudTax GmbH, Mertensstr. 26, 13587 Berlin, Germany, e-mail: info@kud.tax, telephone: +49 30 25469444 ("KudTax", "we", "us").
2. Purpose of this Cookie Policy
This Cookie Policy provides information on which cookies and comparable technologies may be used on our website and platform, for which purposes this takes place, on which legal basis this occurs and how you can manage your settings.
3. What are cookies and comparable technologies?
Cookies are small text files that are stored on your device when you visit a website. They may be technically necessary in order to provide a website, to enable logins, to store language settings, to implement security functions or to document consent. In addition, cookies and similar technologies may also be used for analytics, statistics, convenience or marketing purposes, provided that valid consent is required for this and has been given.
Comparable technologies may include, in particular, local storage, session storage, pixels, tags, SDKs or server-side identifiers. Insofar as we use such technologies, we treat them functionally as cookies in this policy.
4. Principle: technically necessary cookies and optional services
Our website uses technically necessary cookies and comparable technologies insofar as these are necessary in order to provide the website, security functions, login functions, language settings, consent management, payment processes or other functions expressly requested by the user.
Optional cookies and services, in particular statistics, analytics or marketing services, are only used insofar as consent is required for this and you have given it. You may withdraw consent that has been given at any time with effect for the future.
5. Legal bases
Section 25 TDDDG applies to the storage of information on your device or access to information on your device. Technically necessary cookies may be used on the basis of Section 25(2) TDDDG. For non-necessary cookies and comparable technologies, your consent in accordance with Section 25(1) TDDDG is regularly required.
Insofar as personal data is processed, the legal bases of the GDPR additionally apply. Technically necessary processing takes place in particular on the basis of Art. 6(1)(b) GDPR, insofar as it is necessary for the provision of requested functions or the performance of a contract, or on the basis of Art. 6(1)(f) GDPR, insofar as there is a legitimate interest in security, stability and user-friendly provision. Consent-based services take place on the basis of Art. 6(1)(a) GDPR.
6. Consent management and withdrawal
We manage consent through our own cookie banner, which appears on your first visit. There you can allow all optional services ("Accept all"), none of them ("Necessary only") or, under "Settings", choose the categories Statistics and Marketing individually. Your choice is stored solely in the cookie "CookieConsent" on your device (lifetime 150 days); no external consent service is embedded and no consent decision is transmitted to third parties.
You can change or withdraw your choice at any time with effect for the future via the "Cookie settings" link in the footer of every page. If a category is deselected, the page is reloaded so that services of that category which have already been loaded do not continue to run; our own cookies set under that category (e.g. attribution) are removed in the process.
The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.
7. Browser settings
You can additionally block, delete or restrict cookies via your browser settings. Please note that the website or individual functions may not work, or only work to a limited extent, without certain cookies.
8. Categories of cookies and services used
| Category | Purpose | Consent required? | Examples |
|---|---|---|---|
| Technically necessary | Provision of the website, login, security, consent storage, payment processing, language settings | No, insofar as necessary for the requested service | Session/auth cookies, consent status, security and load-balancing cookies |
| Functional / preferences | Convenience functions and storage of voluntary settings | Yes, insofar as not technically necessary | Language, interface, voluntary settings |
| Statistics / analytics | Analysis of website usage and improvement of the user experience | Yes | Google Analytics 4 |
| Tag/service management | Technical management of optional scripts and services | Yes, insofar as optional services are controlled | Google Tag Manager |
| Marketing / conversion measurement | Measurement of advertising effectiveness (attribution of registrations and demo requests to advertising campaigns) and building of advertising audiences | Yes | Google Ads conversion tracking, LinkedIn Insight Tag, OpenAI Ads pixel, attribution |
| Payment services | Secure payment processing and fraud prevention | No, insofar as technically/contractually necessary; otherwise possibly yes | Stripe, PayPal, Apple Pay, Google Pay, Visa, Mastercard |
8.1 Cookie and service overview
The following overview lists the principal cookies and services used or potentially used. Durations of third-party cookies follow the respective provider's information; individual technical values may change.
| Name / Service | Provider | Domain | Category | Purpose | Legal basis | Duration |
|---|---|---|---|---|---|---|
| Consent status (CookieConsent) | KudTax GmbH | kud.tax | Technically necessary | Storage of your choice in the cookie banner (Statistics / Marketing allowed or declined) | Section 25(2) TDDDG; Art. 6(1)(c)/(f) GDPR | 150 days |
| Session/auth cookie | KudTax GmbH | kud.tax | Technically necessary | Login, session management, security and platform use | Section 25(2) TDDDG; Art. 6(1)(b)/(f) GDPR | Session |
| Language setting / preference | KudTax GmbH | kud.tax | Functional / possibly necessary | Storage of the language setting and user preferences | Section 25(2) TDDDG or consent; Art. 6(1)(b)/(f)/(a) GDPR | up to 12 months |
| Cloudflare (e.g. __cf_bm, cf_clearance) | Cloudflare, Inc. | cloudflare.com / kud.tax | Technically necessary / security | Performance, delivery, DDoS protection, security and network functions | Section 25(2) TDDDG; Art. 6(1)(f) GDPR | __cf_bm approx. 30 minutes; cf_clearance up to 12 months |
| Framer Motion | Framer / library | kud.tax | Technical/functional | Display, animations and user guidance | Art. 6(1)(f) GDPR; possibly Section 25(2) TDDDG | No cookie |
| Attribution (_ktx_attr) | KudTax GmbH | kud.tax | Marketing / conversion measurement | Stores the source of the first visit (campaign parameters, referring site) so that a later registration can be attributed to the original advertising source | Consent: § 25(1) TDDDG; Art. 6(1)(a) GDPR | 90 days |
| Google Analytics 4 (_ga, ga*) | Google Ireland Limited | google.com / google-analytics.com | Statistics / analytics | Web analytics, reach measurement, improvement of the website | Consent: Section 25(1) TDDDG; Art. 6(1)(a) GDPR | _ga up to 24 months (data retention max. 14 months) |
| Google Tag Manager | Google Ireland Limited | googletagmanager.com | Tag/service management | Management and triggering of scripts following consent | Consent: Section 25(1) TDDDG; Art. 6(1)(a) GDPR | No cookie of its own |
| Google Ads conversion tracking (_gcl_au, possibly _gcl_aw, gac*) | Google Ireland Limited | google.com / googleadservices.com / doubleclick.net | Marketing / conversion measurement | Measurement of whether a registration or demo request originated from a Google Ads advertisement | Consent: Section 25(1) TDDDG; Art. 6(1)(a) GDPR | _gcl_au 90 days |
| LinkedIn Insight Tag (li_sugr, bcookie, bscookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_gc, ln_or) | LinkedIn Ireland Unlimited Company | linkedin.com / licdn.com / ads.linkedin.com; ln_or on kud.tax | Marketing / conversion measurement | Measurement of whether a registration originated from a LinkedIn advertisement, and building of audiences (retargeting) on LinkedIn | Consent: Section 25(1) TDDDG; Art. 6(1)(a) GDPR | per LinkedIn's cookie table: bcookie/bscookie up to 12 months, li_sugr 90 days, UserMatchHistory/AnalyticsSyncHistory 30 days, li_gc 6 months, lidc 24 hours, ln_or 1 day |
| OpenAI Ads pixel (__oppref, __obref, __oaiq_consent) | OpenAI Ireland Limited | cookie on kud.tax (first-party cookie written by the OpenAI script); script from bzrcdn.openai.com, measurements to bzr.openai.com | Marketing / conversion measurement | Storage of the click identifier ("oppref") of an advertisement shown in ChatGPT, so that a later registration or demo request can be attributed to that advertisement; "__obref" holds a browser identifier generated by the script, "__oaiq_consent" the record of your consent | Consent: Section 25(1) TDDDG; Art. 6(1)(a) GDPR | __oppref 30 days; __obref 12 months; __oaiq_consent 30 days (measured in the browser on 9 September 2026; OpenAI does not publish the lifetimes) |
| Stripe (__stripe_mid, __stripe_sid) | Stripe Payments Europe Ltd. | stripe.com / checkout.stripe.com | Payment services | Payment processing, fraud prevention, transaction security | Section 25(2) TDDDG; Art. 6(1)(b)/(c) GDPR | __stripe_mid up to 12 months; __stripe_sid approx. 30 minutes |
| PayPal / Apple Pay / Google Pay / card providers | respective payment service | respective provider | Payment services | Provision of the selected payment method | Art. 6(1)(b)/(c) GDPR; possibly consent | provider-dependent |
9. Explanations of individual services
9.1 Consent management (cookie banner)
We manage your consent decisions with our own cookie banner hosted on our website; no external consent service is embedded. The banner stores your selection in the cookie "CookieConsent", activates optional services solely in accordance with that selection and does not load any of the services listed under Statistics or Marketing before a decision has been made. The cookie is used on the basis of Section 25(2) TDDDG as well as Art. 6(1)(c) and (f) GDPR (demonstration and management of consent). Insofar as consent is concerned, the processing takes place on the basis of Art. 6(1)(a) GDPR.
9.2 Hosting, server log files and security
When the website is accessed, technically necessary access data is processed in order to deliver the website, to ensure technical operation, to prevent misuse and to be able to trace security incidents. This may include, in particular, the IP address, the time of access, the page accessed, browser and device information as well as referrer information. The legal basis is Art. 6(1)(f) GDPR; insofar as the processing is necessary for the provision of requested functions, also Art. 6(1)(b) GDPR.
9.3 Cloudflare / content delivery network
We may use a content delivery network and security services from Cloudflare in order to deliver content more quickly and reliably, to protect the website against attacks and to improve performance. In doing so, technical access data such as the IP address, time stamp, user agent, page visited and volume of data transferred may be processed. Insofar as Cloudflare is technically necessary for security and provision, it is used on the basis of Section 25(2) TDDDG as well as Art. 6(1)(f) GDPR. Insofar as optional analytics functions are used, this takes place only following consent.
9.4 JavaScript libraries / Framer Motion
We may use JavaScript libraries such as Framer Motion in order to provide animations, displays and user guidance. Insofar as no optional tracking or analytics purposes are pursued in this regard, the use takes place on the basis of our legitimate interest in a functional and user-friendly website, Art. 6(1)(f) GDPR.
9.5 Google Analytics 4
We may use Google Analytics 4 to analyse the use of our website, provided that you have consented to this. In doing so, page views, time spent, click paths, device information, approximate location and truncated IP addresses may be processed, in particular. The legal basis is your consent in accordance with Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time via "Cookie settings" in the footer.
9.6 Google Tag Manager
We may use Google Tag Manager to manage tags and scripts on the website. Tracking or analytics tags are only activated in accordance with your consent. Google Tag Manager itself serves the technical management of integrated services; insofar as personal data is processed in this regard, this takes place in accordance with the respectively applicable legal basis, in particular your consent for optional services.
9.7 Google Ads conversion tracking
We may use Google Ads conversion tracking to measure whether a registration or demo request originated from a Google Ads advertisement placed by us, provided that you have consented to this. The tracking is loaded technically via the same Google tag as Google Analytics and only becomes active following your consent; without consent, no Google service is loaded and no conversion is transmitted. In doing so, information about the ad click (e.g. a click identifier), device and browser information as well as the fact of completion (registration or demo request) may be processed, in particular. The legal basis is your consent in accordance with Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time via "Cookie settings" in the footer.
9.8 LinkedIn Insight Tag
We use the LinkedIn Insight Tag, a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"), provided that you have consented to the Marketing category. The Insight Tag serves to measure whether a registration originated from an advertisement we placed on LinkedIn, and to address visitors of our website on LinkedIn as an audience for our advertisements (retargeting). Without your consent the Insight Tag is not loaded and no connection to LinkedIn is established. Once loaded, the page accessed, the referring page, your IP address (truncated or hashed according to LinkedIn), device and browser information, a timestamp and – for LinkedIn members – the LinkedIn cookies may be processed, in particular. We receive only aggregated reports from LinkedIn with no reference to individual persons. A transfer to LinkedIn Corporation in the USA takes place on the basis of the EU-US Data Privacy Framework. The legal basis is your consent in accordance with Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time via "Cookie settings" in the footer; LinkedIn members can additionally disable advertising based on website visits in their LinkedIn settings (https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out). Further information: https://www.linkedin.com/legal/privacy-policy and https://www.linkedin.com/legal/l/cookie-table.
9.9 OpenAI Ads pixel (advertising in ChatGPT)
We use OpenAI's measurement pixel ("OpenAI Ads pixel"), a service of OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland ("OpenAI"), provided that you have consented to the Marketing category. It serves solely to measure whether a registration or a demo request originated from an advertisement we placed in ChatGPT. Without your consent the script is not loaded and no connection to OpenAI is established.
After your consent the script is loaded from bzrcdn.openai.com. It reads a click identifier ("oppref") from the address through which you reached our site and stores it in the first-party cookie __oppref on kud.tax. Only the events we trigger are transmitted — a completed registration or a demo request — together with that click identifier, the timestamp and the origin of the page, as well as the data technically associated with the request (in particular IP address, device and browser information).
We report no page views to OpenAI — the pixel sends nothing while you read our pages.
OpenAI's automatic advanced matching is, however, active. The script reads information you enter into forms on this website — in particular e-mail address, telephone number, first and last name, region and postal code — normalises it and derives a SHA-256 hash from it in your browser. Only that hash is transmitted to OpenAI together with the event; the plain-text values do not leave your browser. OpenAI can match the hash against its own user data in order to improve attribution to an advertisement. A hash remains personal data; the transmission therefore takes place solely on the basis of your consent to the Marketing category, and does not take place without it. We receive only aggregated reports from OpenAI.
The legal basis is your consent in accordance with Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time via "Cookie settings" in the footer; the __oppref cookie is deleted in the process. Processing in the USA takes place on the basis of OpenAI's Ad Tools Data Processing Addendum (standard contractual clauses). Further information: https://openai.com/policies/eu-privacy-policy/ and https://openai.com/policies/ad-tools-dpa/.
9.10 Payment services / Stripe and further payment methods
If you book chargeable services or initiate payments, payment services such as Stripe as well as payment methods supported by Stripe may be used. In doing so, payment, invoicing, transaction and identification data may be processed. Payment-related cookies or comparable technologies may be technically necessary in order to enable secure payment processing. The legal bases are Section 25(2) TDDDG as well as Art. 6(1)(b) and (c) GDPR. For optional payment methods, the data protection and terms of use of the respective payment service may additionally apply.
10. Transfers to third countries
For individual services (in particular Google, LinkedIn, OpenAI, Cloudflare, Stripe), processing outside the European Union or the European Economic Area cannot be ruled out. Insofar as a transfer to a third country takes place, it takes place in accordance with the GDPR, in particular on the basis of an adequacy decision, the EU-US Data Privacy Framework, standard contractual clauses or other appropriate safeguards.
11. Storage period
Cookies are only stored for as long as is necessary for the respective purpose or as indicated in the cookie table or in the respective service information. Session cookies are regularly deleted after the end of the browser session. Persistent cookies remain stored for the indicated duration, unless you delete them beforehand or withdraw your consent.
12. Amendment of this Cookie Policy
We may adapt this Cookie Policy if the services used, legal bases, technical processes or statutory requirements change. The authoritative version is the version published on our website at the relevant time.
13. Contact
If you have any questions about this Cookie Policy or about data protection, you can reach us at:
KudTax GmbH, Mertensstr. 26, 13587 Berlin, Germany, e-mail: info@kud.tax, telephone: +49 30 25469444