Legal

Privacy Policy

Contents

The following privacy policy informs you about the nature, scope, and purposes of the collection and use of personal data when using this website and our mobile app “KudTax” (iOS and Android), as well as your rights.

I. Responsible for Data Processing (hereinafter: "we")

KudTax GmbH

Mertensstr. 26

13587 Berlin, Germany

Further details and contact options can be found in our provider identification (in the so-called imprint).

II. Personal Data, Purposes of Their Processing, and Legal Bases

Personal data are all information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"). An identifiable natural person is considered to be one who can be directly or indirectly identified, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific features that express the identity of that natural person.

Personal data is processed on our website when this is necessary for the following purposes:

⦁ based on your request and given consent (Legal basis: Article 6(1)(a) of the General Data Protection Regulation – hereinafter: GDPR),

⦁ for the use of the website (Legal basis: Article 6(1)(b) GDPR),

⦁ to safeguard our interest in improving user experience, promoting our services, and/or maintaining the security of use (Legal basis: Article 6(1)(f) GDPR),

⦁ for the use of the services offered on the website as well as for pre-contractual measures, particularly for your inquiries (Legal basis: Article 6(1)(a) and/or Article 6(1)(b) GDPR),

⦁ for concluding and executing a contract (Legal basis: Article 6(1)(b) GDPR) and/or

⦁ to fulfill a legal obligation to which we are subject (e.g., tax or data protection regulations and retention obligations, Legal basis: Article 6(1)(c) GDPR).

Further details on data processing can be found below under the corresponding headings:

1. Access Data / Server Logfiles

When you visit our website, the servers of our website host automatically store the information that your browser sends, so-called server logfiles. Further information from our hoster on this can be found here: https://docs.hetzner.com/de/general/general-terms-and-conditions/data-privacy-faq/

The information includes the following: ⦁ Referrer (previously visited website) ⦁ Requested website or file ⦁ Browser type and browser version ⦁ Operating system used ⦁ Amount of data transferred ⦁ Type of device used ⦁ Time of access ⦁ IP address in anonymized form (e.g., by truncating the last digits so that no conclusions about individuals can be drawn)

The temporary processing of this data by the system is necessary to enable the delivery of the website to your device. For this, the IP address must be processed in particular. A combination of this data with other data sources does not take place. The information is used exclusively to monitor our own website traffic and to maintain the technical operation of the servers and network of our host, as well as to prevent abuse. The data will be automatically deleted after 7 days. The legal basis is Article 6 Paragraph 1 Sentence 1 Letter f GDPR.

2. Cookies

Our website uses only technically necessary cookies to provide the basic functions of the website. Other technologies such as local storage or similar storage techniques are not used unless explicitly mentioned below. Furthermore, we only use those such as functional cookies to provide you with the retrieved website along with its functions, § 25 Abs. 2 Nr. 2 TDDDG, Article 6(1)(f) GDPR.

Name

Provider Domain

Purpose

Legal basis

Duration

Info

Insofar as you give consent for optional services, non-essential cookies, the legal basis is § 25 Abs. 1 TDDDG, Article 6(1)(a) GDPR (consent). For this and for the cookies or services used, you can obtain further information at any time from our consent management tool and revoke your consent freely and without disadvantage with effect for the future. Please note, however, that our website does not always function as intended without the cookies used.

Most browsers also have an option that restricts or completely prevents the saving of cookies. However, it is pointed out that the use and particularly the user experience will be limited without cookies.

Instructions for the most common browsers:

Mozilla Firefox: https://support.mozilla.org/en/kb/Blocking%20cookies

Google Chrome: https://support.google.com/accounts/answer/61416?hl=en

Apple Safari: https://support.apple.com/de-at/HT201265

Microsoft Edge: https://support.microsoft.com/de-de/help/4468242/microsoft-edge-browsing-data-and-privacy-microsoft-privacy

3. Contact via email or other means as well as registration

If you send us inquiries via email or other means, your information, including the data you provide (such as name, email address, message content), will be processed for the purpose of handling the inquiry and, if necessary, for follow-up questions.

If you register on our website, we additionally process the data you provide, such as username, password (in encrypted form), and possibly other voluntary information (e.g., phone number, address) for the creation and management of your user account. This data is required for the provision of the service and for the execution of the contract. The legal basis is Article 6(1)(b) GDPR. Optionally provided data is processed based on your consent, Article 6(1)(a) GDPR. The legal basis is Article 6(1)(b) GDPR and/or in the case of consent Article 6(1)(a) GDPR.

Registration for the KudTax platform (application for use): When you register via kud.tax we process your mandatory details (name, business e-mail address, company name), voluntary details (VAT ID, website/shop URL, sales platforms used, monthly order volume), technical data (IP address, time of registration and e-mail confirmation, country of request, user agent) and consent records (accepted versions of the GTC and the DPA with timestamps, and any consent to receive product news). Legal bases are Art. 6(1)(b) GDPR (review of the application, pre-contractual steps), Art. 6(1)(f) GDPR (prevention of abuse, bots and fraud; IT security) and, where given, Art. 6(1)(a) GDPR (revocable at any time).

To prepare the decision we use supporting technical checks: Cloudflare Turnstile spam protection, e-mail domain checks (e.g. MX records, disposable addresses), reachability checks of a provided website, and validation of a provided VAT ID via the European Commission's VIES system. These checks produce an internal assessment that assists our staff; no decision is based solely on automated processing within the meaning of Art. 22 GDPR — activation is always decided by a human. Recipients in the context of registration are our hosting provider (Hetzner Online GmbH, Germany), Cloudflare, Inc. (spam protection/CDN), our e-mail delivery service (Google Ireland Limited) and — only where a VAT ID is provided — the European Commission (VIES). Unconfirmed registrations are deleted no later than 30 days after receipt; rejected applications are deleted or anonymised no later than 6 months after the decision; upon activation the details become part of your contract and account data.

Attribution at registration: To understand how prospective customers find us, we additionally record the context of your visit when you submit the registration or demo form: the campaign parameters of the address you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content, any partner code ref, and advertising-network click identifiers such as gclid, msclkid, fbclid), the page you arrived on, and the referring website. This information forms part of your application and is used solely to measure our own advertising and to process the application; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in measuring the success of our own advertising). For this attribution capture itself, no third-party services are involved, no cross-device recognition takes place, and no profile about you is created. Separately from this — and only with your consent in the cookie banner — we use Google Ads conversion tracking to attribute the completion of a registration or demo request to a Google Ads advertisement; details can be found in our Cookie Policy.

Your device is only accessed (a cookie stored) for this purpose if you consented in the cookie banner: in that case we store the context of your first visit for 90 days in a single first-party cookie (_ktx_attr, SameSite=Lax) so that a later visit can be attributed to its original source; the legal basis for that storage is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Without your consent nothing is stored on your device — only the context of the visit in which you submit the form is evaluated. If you withdraw your consent, the cookie is deleted on your next page view. The recorded information is subject to the same deletion periods as the rest of the application.

4. Integration of Services and Content from Third Parties

It may occur that within our online offering, content and services from third parties are integrated or loaded from other websites. This always requires that the providers of these contents perceive the users' IP addresses. Because without the IP address, they could not send the content to the user's browser. The IP address is therefore required for the display of this content. We strive to use only those contents whose respective providers use the IP address solely for the delivery of the content. Third-party providers may store the IP address, for example, for statistical purposes.

We partially integrate the following services and content from third parties, for which you can also view additional service providers and information at any time in our consent tool (icon/footer) and revoke consents:

Consentmanager

To manage your possible consents, we use the tool consentmanager AB, Haltegelvägen 1b, 72348 Västeras, Sweden (https://www.consentmanager.net/).

consentmanager AB is hosted on our own servers, so no data is directly transferred to the servers of consentmanager AB. The processing of the data collected by the tool (e.g., your consent decisions) is carried out exclusively on our systems. No connection is established with the servers of consentmanager AB.

Legal basis is our legitimate interest in the consent management option, Article 6(1)(f) GDPR; furthermore, in the case of your consent, Article 6(1)(a) GDPR. Furthermore, we may be legally obligated to obtain consent and ensure traceability, cf. Article 6(1)(a) GDPR as well as GDPR and/or TDDDG, cf. above.

Content Delivery Network (CDN)

We use the Content Delivery Network (CDN) from Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (https://www.cloudflare.com). A content delivery network is a network of regionally distributed servers connected via the internet, used to deliver content – particularly media files, scripts, and stylesheets. This allows us to display our content on our website faster and more reliably, optimizing the user experience. The following categories of data are processed: IP address, timestamp, time and date, user agent, visited website, amount of data transferred. Legal basis is Article 6(1)(f) GDPR (legitimate interest in optimizing website performance and security). If you give your consent, the legal basis is Article 6(1)(a) GDPR. You can revoke your consent at any time through our consent management tool with effect for the future. The data transfer to the USA is based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov). For more information, please refer to Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.

JavaScript Libraries

We use the following JavaScript libraries to enhance the functionality and user-friendliness of our website:

Framer Motion

The legal basis is Article 6(1)(f) GDPR (legitimate interest in providing a functional and user-friendly website).

Statistics and Evaluation

We use the following tools to analyze and evaluate user behavior in order to optimize our website:

We use Google Analytics (version: Google Analytics 4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to analyze user behavior and optimize our website. The following data is processed:

IP address (anonymized by truncation before storage), visited pages, duration of stay, click paths, device information (e.g., browser type, operating system), approximate location (at city level)

The data is stored for a maximum of 14 months and then automatically deleted. IP anonymization is activated, so your IP address is shortened within the EU/EEA before it is further processed. A transfer to the USA only takes place based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov).

Legal basis: Your consent in accordance with Article 6(1)(a) GDPR and § 25(1) TDDG. You can revoke your consent at any time through our consent management tool or prevent data collection by Google Analytics by installing the browser add-on to disable Google Analytics (https://tools.google.com/dlpage/gaoptout).

For more information, please refer to Google's Privacy Policy: https://policies.google.com/privacy.

Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to manage tracking and analysis tools (e.g., Google Analytics) as well as other services on our website. The Google Tag Manager loads the corresponding scripts, which are only activated after your consent. Your IP address is transmitted to Google to deliver the scripts. A transfer to the USA only takes place based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov).

Legal basis: Your consent in accordance with Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You can withdraw your consent at any time through our consent management tool.

For more information, please refer to Google's Privacy Policy: https://policies.google.com/privacy.

Google Ads conversion tracking

We use Google Ads conversion tracking, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to measure whether a registration or demo request originated from a Google Ads advertisement placed by us. The tracking is loaded via the same Google tag as Google Analytics and only becomes active after your consent; without consent, no Google service is loaded and no conversion is transmitted. In doing so, information about the ad click (e.g. a click identifier), device and browser information as well as the fact of completion (registration or demo request) may be processed, in particular. A transfer to the USA only takes place based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov).

Legal basis: Your consent in accordance with Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You can withdraw your consent at any time through our consent management tool.

For more information, please refer to Google's Privacy Policy: https://policies.google.com/privacy.

5. Payment Service Provider

For processing payments, we use the service Stripe, provided by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). Stripe processes the following data that you provide during the payment: name, email address, billing address, payment data (e.g., credit card or bank account information), order number, transaction amount, date and time of the transaction.

Stripe acts as an independent controller for payment processing, and we have concluded a data processing agreement (DPA) with Stripe for processing related to our platform. Data transfer to the USA (Stripe Inc.) is carried out based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov).

Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6 paragraph 1 subparagraph letter c GDPR (legal obligations).

For more information, please refer to Stripe's privacy policy: https://stripe.com/de/privacy

The following payment options can be enabled through the service provider Stripe:

⦁ PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (https://www.paypal.com/de/webapps/mpp/ua/privacy-full),

⦁ Giropay, paydirekt GmbH, Stephanstraße 14-16, 60313 Frankfurt am Main (https://www.giropay.de/agb/);

⦁ Apple Pay, Apple Inc., Infinite Loop, Cupertino, CA 95014, USA, (https://www.apple.com/de/legal/privacy/data/de/apple-pay/ / https://www.apple.com/legal/privacy/de-ww/)

⦁Google Pay by Google. Google refers to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, and its affiliated companies. (https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de / https://policies.google.com/privacy)

⦁ VISA from Visa Inc.; for the EU/EEA area, Visa Europe Services Inc., 1 Sheldon Square, London W2 6TT, GB, is responsible (https://www.visa.de/legal/privacy-policy.html / https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zu-zustandigkeitsfragen-fur-den-ewr.html)

⦁ Mastercard, Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo (https://www.mastercard.de/de-de/datenschutz.html) In this regard, we refer to the privacy notices and the terms and conditions provided there. The chosen payment service receives the information you provide during the payment process. This generally includes your name, your payment details (e.g., credit card or account information), the order number, and the transaction amount, as well as any additional information such as transaction IDs or device data, depending on the provider. For data processing in the context of payment processing, the payment service provider is the responsible entity.

Legal basis is Article 6(1)(b) GDPR (pre-contractual measures, contract fulfillment) as well as 6 paragraph 1 subparagraph 1 letter f and c GDPR (legitimate interest and legal proof obligations). We fulfill a contract with you and have a legitimate interest in the payment functionalities, to be able to offer you effective, widespread, and secure payment options and a modern online shop functionality, Article 6(1)(f) GDPR.

We only receive the minimum necessary data for confirmation and processing (e.g., last four digits of card numbers).

6. Use of our mobile app "KudTax" (iOS and Android)

This section applies to our mobile app KudTax (package identifier com.kudtax.app), available from the Apple App Store and Google Play. It supplements the preceding sections; unless stated otherwise, those sections apply accordingly.

The app is an entry point to the same user account you use in your browser. It processes no business data other than the web application does — it additionally offers features that require your device's camera, photo library and microphone. Those forms of access are explained individually below.

a) Camera

The app requests access to the camera so that you can photograph invoices and receipts or scan them with the built-in document scanner (VisionKit on iOS, ML Kit on Android). Access occurs only when you invoke the corresponding feature yourself; the camera is never activated in the background. The capture is processed on your device and then transmitted to our servers in the same way as a receipt you upload yourself (see letter f).

Legal basis: Article 6(1)(1)(b) GDPR (use of the service you have requested).

b) Photo library

If you wish to upload a receipt you already have, the app opens your operating system's picker. We receive only the file you select there, together with its file name. We do not access, browse or index your entire library. On Android the app does not request permission to read the media library for this purpose.

Legal basis: Article 6(1)(1)(b) GDPR.

c) Microphone and speech recognition

In the AI assistant you may dictate your question instead of typing it. The microphone is activated only while you have started dictation yourself, and recording ends automatically after a pause in speech.

To convert speech into text the app uses your operating system's speech recognition service (Apple or Google). Whether that recognition takes place on your device or on the respective provider's servers is decided by the operating system depending on device, system version and selected language; in the default configuration transmission to the provider is possible. The respective provider is the controller for that processing and its privacy notices apply.

We ourselves store no audio recordings. Only the recognised text reaches our servers, and only once you send the question. Please do not dictate content you would not want to disclose to a speech recognition provider; you may type instead at any time.

Legal basis: Article 6(1)(1)(a) GDPR (your consent by granting the permission and starting dictation); you may withdraw the permission at any time in your system settings (see letter j).

d) Data stored on your device

After sign-in the app stores your session credentials (access and refresh tokens together with their expiry) in your operating system's protected key store — the Keychain on iOS, the Android Keystore on Android. These credentials leave your device only as proof of identity towards our servers and are deleted when you sign out. The app additionally stores local preferences such as your chosen language and the client you last selected.

This storage is strictly necessary for the operation of the app you have expressly requested; without it you would have to sign in again on every launch.

Legal basis: Article 6(1)(1)(b) GDPR; Section 25(2) no. 2 TDDDG.

e) Sign-in

Sign-in takes place either through a form in the app or through the standard OAuth 2.0 procedure with PKCE, which runs in your device's system browser (not in an embedded window). Your email address and password are processed for the purpose of authentication. A password is not stored persistently on the device.

Legal basis: Article 6(1)(1)(b) GDPR.

f) Processing of uploaded receipts

Before uploading, the app reduces the capture on your device (longest edge 2,500 pixels) and combines multi-page scans into a single PDF file there. Receipts you photograph or select are then stored on our servers and then pass through an automated processing chain: format conversion, text extraction, thumbnail generation, optical character recognition (OCR) and automatic detection of invoice fields (such as amount, date, invoice number and counterparty). The text recognition runs on a service we operate ourselves; the image of your receipt is not transmitted to a third-party OCR service for this purpose.

For the automatic detection of invoice fields we transmit the content of the receipt, or the text obtained from it, to a language model provider (see letter g). If you do not want this, please enter the receipt manually.

Legal basis: Article 6(1)(1)(b) GDPR.

g) AI assistant and transmission to language model providers

The AI assistant answers questions about your accounting data. For this purpose your input, the history of the respective conversation and those of your client's data that are necessary to answer are transmitted to a language model provider and processed there. The same applies to the automatic invoice recognition described under letter f.

The transmission may involve processing outside the European Union. We will inform you of the providers used, the legal basis for the respective transfer and any standard contractual clauses on request at [email protected]; Section III applies in addition.

Legal basis: Article 6(1)(1)(b) GDPR.

h) What the app does not collect

When you use the app's document scanner (Android only), Google's "ML Kit" library transmits usage and performance metrics to Google. This happens only when the scanner is invoked – not when the app starts and not during normal use. According to Google and to our own analysis of the library, the following are transmitted: the app's package name and version, the version of the library used, the device's language settings, an identifier assigned per installation, and the type, result and duration of the scanning operation. The contents of your receipts are not transmitted in this process. Transmission happens in the background, delayed and in batches. The library provides no opt-out; you can avoid the transmission by not using the document scanner and uploading receipts as a file instead. The recipient is Google Ireland Limited or Google LLC (USA); the legal basis is Article 6(1)(b) GDPR. The iOS version of the app does not use this library.

For the avoidance of doubt: beyond this, the app contains no analytics or usage measurement software of our own and no crash reporting software. It does not read an advertising identifier (IDFA or Advertising ID), processes no location data, does not access contacts or calendars, sends no push notifications and contains no advertising. We do not sell or share personal data for advertising purposes.

i) Deleting your account

You may request deletion of your account at any time. The page provided for this is reachable without the app installed:

https://app.kud.tax/account-deletion

It describes in detail which data is deleted and which data we must retain due to statutory retention obligations — in particular accounting records under Section 147 of the German Fiscal Code (Abgabenordnung) and Section 257 of the German Commercial Code (Handelsgesetzbuch), as well as Section 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung). Section IV applies in addition.

j) Withdrawing permissions

You may withdraw permissions granted for camera, photos, microphone and speech recognition at any time with effect for the future in your operating system's settings (iOS: Settings → KudTax; Android: Settings → Apps → KudTax → Permissions). The respective feature will then no longer be available; the remaining use of the app is unaffected.

k) Technical information sent with each request

With every call to our servers the app transmits its version number and an identifier containing the device model and operating system version. We store this information as an attribute of the respective session so that you can see in your account which device a session originates from and end it specifically. The app's traffic is also routed through our service provider Cloudflare (see section 4).

Legal basis: Article 6(1)(1)(f) GDPR (security of use, session management).

l) Connecting portals, and logos

When you connect a sales portal (such as Amazon, Shopify or TikTok Shop), the app opens that provider's authorisation page in your system browser. The processing that takes place there is the responsibility of that provider. Portal credentials cannot be entered in the app, and our server does not return credentials already stored to the device.

The app loads portal logos from https://kud.tax/cdn/portal-logos; your IP address and technical details of your device are transmitted in the process (see section 1).

m) No sign-up, no cookies, no tracking in the app

A user account cannot be created in the app; registration takes place exclusively via our website. The app sets no cookies — the consent banner used on the website does not apply there. No cross-device tracking takes place, which is why no App Tracking Transparency prompt appears on iOS.

III. Recipients of Personal Data and Transfers to Third Countries

Personal data is shared with the following categories of recipients: Our employees and our processors to the necessary extent, in particular the website and hosting provider of our website, Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, (https://docs.hetzner.com/de), and, if applicable, its respective sub-processors, depending on the service you use, as well as, if applicable, individual named service providers when using the website, see above under II. 4 and 5. Furthermore, your personal data will not be disclosed to third parties without your explicit consent, unless we are legally obligated to do so or the data transfer is absolutely necessary for the performance of a contractual relationship.

A transfer to third countries is not intended.

A transfer to a third country may be considered when using the following services: Google (Google Analytics, Google Tag Manager, Google Ads conversion tracking, ML Kit – see section 6 h above), providers of language models for the AI features and invoice recognition (see section 6 g above), Stripe, Cloudflare (CDN, Browser Insights), Apple (Apple Pay), PayPal, Visa, Mastercard, see above under II.4 and 5 or as indicated. The data transfer is based on the EU-US Data Privacy Framework or Standard Contractual Clauses, as described for the respective services and below:

We process personal data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) when it is necessary to fulfill our (pre)contractual obligations, based on your consent, due to a legal obligation, or based on our legitimate interests. The same applies to processing by third parties on our behalf, the disclosure of personal data to third parties, as well as their transfer to third parties. Service providers who process personal data on our behalf in a third country will only be engaged if there is an "adequacy decision" by the European Commission for that third country (Article 45 GDPR), "appropriate safeguards" (Article 46 GDPR), "standard contractual clauses" (Article 46 paragraph 2 letter c GDPR) are agreed upon and/or "binding corporate rules" (Article 47 GDPR) are in place at the recipient. General information on adequacy decisions can be found at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en, regarding US tools: www.dataprivacyframework.gov, on suitable guarantees as internal regulations at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/binding-corporate-rules-bcr_en, and on standard contractual clauses at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_de.

For further information, you can contact us.

IV. Duration of Storage

We delete personal data after the purpose has been achieved and the legal basis has ceased to exist, as well as in the absence of a retention obligation. Stored server log files and IP addresses are automatically deleted by our host after 7 days.

Session cookies are also automatically deleted after the session ends. In addition, cookies with an expiration date are stored on your device, and you also have control over the use and deletion of cookies, as mentioned above. We process personal data from your inquiries via email or other means until your inquiry is fully processed and completed. Afterwards, the information will be deleted if there is no legal retention obligation, for example, also data protection documentation and retention obligations under Article 5 Paragraph 2 GDPR or Article 6(1)(c) GDPR. Please note that due to a legal transaction with you, certain data may be subject to commercial and tax retention obligations of at least six (§ 257 HGB) or ten (§ 147 AO) years, which can also apply to the content of contact inquiries and emails. For example, personal data collected by us is generally stored after the termination of a contractual relationship until the expiration of the statutory three-year regular limitation period (§ 195 BGB) (protection of legitimate interests: defense and enforcement of claims, Article 6(1)(f) GDPR).

In the case of registration data, we store your data as long as your user account is active. After the deletion of your account, the data will be deleted within 30 days, provided there are no legal retention obligations. A permanent deletion of customer data is possible. The users can send an e-mail to [email protected] herefor.

Furthermore – also with regard to all tools used and the aforementioned – an annual review will be conducted to determine whether data deletion is possible. This is the case when the purpose of processing and the conditions of the legal basis for processing have ceased to exist, and there is no longer a legal obligation to retain the data, there is no legitimate interest in defending and enforcing claims, Article 6(1)(f) GDPR applies, and you have not consented to any further storage under Article 6(1)(a) GDPR.

V. Provision of Personal Data and Rights of the Data Subjects

You are not legally obligated to provide personal data. However, providing the information may be necessary for concluding a contract or for the functions of the website. In the event of non-provision, a contract or a function on the website may therefore not be offered.

No automated decision-making or profiling takes place on our website.

The rights of affected persons arise in particular from Articles 15 to 23 and Article 77 GDPR as well as from Sections 32 to 37 of the Federal Data Protection Act (new).

You have the right, with regard to your personal data, to

∙ Access, Article 15 GDPR,

∙ Rectification, Article 16 GDPR,

∙ Erasure, Article 17 GDPR,

∙ Restriction of processing, Article 18 GDPR,

∙ Data portability, Article 20 GDPR, provided the legal requirements are met. If you have given consent for the processing of personal data, you have the right to withdraw it, Article 7 GDPR, with effect for the future. The legality of the processing carried out based on the consent until the withdrawal remains unaffected.

You also have the right to object to the processing of personal data

∙ Objection, Article 21 GDPR

see further information separately below under VI.

Please direct all inquiries, requests, and communications to us, see above under I.

If you believe that the processing of your personal data violates data protection law, you always have the

∙ right to lodge a complaint

with the competent supervisory authority, cf. Article 77 GDPR. Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state of your residence, your workplace, or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

The contact details of the data protection officers in the federal states, the supervisory authorities for the non-public sector, broadcasting, churches, in Europe and the rest of the world, as well as the Virtual Data Protection Office can be found here:

https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html

VI. Information on the Right to Object under Article 21 GDPR

  1. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(f) (data processing based on a balancing of interests). If you file an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

  2. If personal data is processed for the purpose of direct advertising, you have the right to object at any time to the processing of your data for such advertising purposes. If you object to the processing for the purposes of direct advertising, we will no longer process your personal data for these purposes.

The objection can be made without formal requirements and should preferably be addressed to us (see section I).

Version: 1.2 Status: 15.08.2026