Privacy Policy

Last updated: 27 July 2026

1. Controller

David Wirfs (sole proprietorship — eBilanz Fabrik), Naumannstraße 1, 50735 Köln, email: hello@ebilanzfabrik.de. See the Imprint.

2. Principle — data minimization within statutory duties

eBilanz Fabrik processes as little data as possible — and as much as the engagement and the law require. The website uses no tracking cookies and relies solely on cookieless, privacy-friendly reach measurement (Pirsch, Emvi Software GmbH, Germany) — no cookies, no cross-device tracking, no personal profiles (see sections 3 and 4). Your financial data is processed solely to carry out your engagement — never profiled, never used for advertising, never sold. To perform the engagement and to meet statutory retention duties (§ 147 AO, GoBD) we store the complete engagement record (your details and confirmations) and the filing artifacts (XBRL e-Bilanz, Transferticket, invoice) — see sections 3 and 5. Your ELSTER certificate is never stored.

3. Data processed, purposes, legal bases

• Server log files (site access): technical data arising at the hosting provider (IP address, timestamp, file requested) for delivery + security of the site. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
• Contact (email): your details to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR, or (f) (legitimate interest in handling your enquiry efficiently).
• Support form (name, email, subject, message): your details are stored as a support case with its own case number, so that we can handle your request traceably and tell you where it stands. Storage is on our server at Hetzner Online GmbH (processor, located in Germany, Art. 28 GDPR agreement in place). Legal basis: Art. 6(1)(b) GDPR (initiation/performance of the contract), or (f) (legitimate interest in traceable support handling). We need your name, email address and message to handle your request and reply to you correctly and personally; providing a subject is optional. Retention: until your request is resolved, and beyond that for as long as follow-up questions on your case are to be expected. You can request deletion at any time (Art. 17 GDPR) — an informal email is enough. If the case belongs to a paid order, the statutory retention below applies.
• Contact e-mail during the preparation process (required, step 2): your e-mail address is necessary to perform the service: we deliver the transmission protocol and the invoice electronically, and must be able to reach you about your open case. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps / performance). For marketing we use the address only as set out in the “deadline reminder for our own similar services” section (§ 7(3) UWG, right to object). To support your case we may technically review it (e.g. a test run of the official ERiC validation without any transmission). The address is stored as part of the case on our server at Hetzner Online GmbH (processor, Germany, Art. 28 GDPR agreement). Retention: if the case is not completed, the address stays stored as part of the case until you ask us to delete it — no automatic deletion deadline is currently active. We deliberately do not state a period we cannot technically meet: the storage period for incomplete cases is still to be set. Once you place the order, section 3/5 (engagement record) applies. You may request deletion at any time (Art. 17 GDPR) — an informal e-mail to hello@ebilanzfabrik.de is enough, and we delete the address subject to statutory retention obligations.
• Carrying out your engagement (balance-sheet/P&L data, master data, tax number): the values you enter or confirm are converted into the XBRL format, technically validated and — after your approval — transmitted to the tax authority. The engagement record (your details, approval and confirmation records, payment references of the payment provider, transmission status) is stored to administer the engagement. Legal basis: Art. 6(1)(b) GDPR; where processing on behalf applies: a data-processing agreement under Art. 28 GDPR.
• Statutory retention: the business records belonging to your engagement — invoice, transmitted XBRL e-Bilanz, Transferticket and the complete engagement record (including company master data, tax number, the figures you confirmed and payment references) — are retained for 10 years. Legal basis: Art. 6(1)(c) GDPR in conjunction with § 147 AO, § 257 HGB (GoBD).
• Filing confirmation by email: after a successful transmission you receive a confirmation email with the Transferticket, your XBRL file and the invoice. Legal basis: Art. 6(1)(b) GDPR.
• Official ELSTER data-protection notices: transmission via the official ELSTER interface (ERiC) is additionally subject to the tax administration's data-protection notices — verbatim at ELSTER-Datenschutzhinweise (official German documents); you confirm having taken note at the start of the process.
• Deadline reminders for our own similar services (right to object): once you have placed a paid e-Bilanz order with us, we use the email address collected in that order — unless you object — to remind you of the deadline for your next e-Bilanz and to inform you about our own similar services. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in direct marketing to existing customers, Recital 47) in conjunction with § 7(3) UWG. You can object at any time — informally to hello@ebilanzfabrik.de or via the unsubscribe link in every such email; no costs arise other than transmission costs at base rates. We point out this right to object already when the address is collected during checkout. No consent is required or obtained for this (there is no opt-in checkbox).
• Necessity of provision: providing the engagement data (master data, tax number, balance-sheet/P&L figures, your ELSTER certificate for one-time use) is required to perform the contract — without it the e-Bilanz cannot be created or transmitted. There is no statutory obligation to provide it to us.
• Import of your figures (PDF, Excel, CSV or HTML — local): When you import your finished balance sheet / P&L, the file is read exclusively locally in your browser (e.g. via pdf.js) and never leaves your device. There is no AI extraction and no transfer to an AI service or any third party. The imported values land as an editable pre-fill in the form — you review and confirm every position yourself; alternatively you enter every value manually. The values you review and confirm are then transmitted to our server and stored as part of the engagement record (sections 3/5) — legal basis for that: Art. 6(1)(b) GDPR (performance of contract) — the source file itself never leaves your browser. One exception, and only this one: if the import fails or the balance sheet does not add up, we ask you at exactly that moment, in exactly these words: “So we can fix this error, we transmit your file — deletable at any time, automatically after 30 days.” It is transmitted only after your explicit click; without your consent nothing happens and you can continue normally. The sole purpose is repairing the parser that failed on your file. It is stored separately from the engagement record, readable only with a separate access token, never shared with third parties, and automatically deleted after 30 days at the latest — sooner if you ask (hello@ebilanzfabrik.de). Legal basis for this alone: Art. 6(1)(a) GDPR (consent), revocable at any time — without your consent this transfer does not happen.
• Payment: handled via Stripe on a data path separate from the financial data; eBilanz Fabrik receives no full payment-instrument data. Legal basis: Art. 6(1)(b) GDPR.
• Error and stall reports (technical log): If a technical error occurs in the form, a check will not let you proceed, or you get stuck on a step, your browser reports this to our server — that is the only way we can identify and fix the cause. Only the event type, a fixed, predefined notice code (a technical identifier from a closed list, never free text), the step number and — if one exists — the reference number of your in-progress engagement are transmitted, so that we can attribute a fault to your case. No entered values, no amounts, no tax number, no name and no e-mail address are transmitted. Stored on our server at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR); no transfer to third parties, no advertising or profiling purposes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning, error-free service). Retention: 365 days, then automatic deletion.
• Reach measurement (web analytics): cookie-free, aggregated usage statistics (page views, source/campaign via UTM, approximate region) to improve our service. This also covers individual interaction events in the form — in each case only the event type, a fixed, predefined notice code (a technical identifier from a closed list, never free text) and the step number: for example that help was opened, that a check raised a notice, or that a step was left without clicking onward. These events contain no entered values, no amounts, no tax number, no name and no e-mail address. No cookies are set and no cross-device profiles are created. Your IP address is not stored: it is combined with your browser identifier (user agent), the site identifier, a secret key held by the provider and a rotating value to compute a session identifier, and is discarded thereafter. The rotating value is renewed at the start of each calendar month; the session identifier therefore stays the same within a calendar month — a repeat visit from the same IP address and the same browser is mapped to the same identifier during that period, after which a new one is formed. This is pseudonymisation (Art. 4(5) GDPR), not anonymisation: the secret key remains permanently with the provider, so the mapping could in principle be recomputed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising, cookie-free reach measurement). You may object to this processing at any time under Art. 21(1) GDPR (section 6); for retention see section 5.
• Storage in your browser (§ 25 TDDDG) — engagement handle and campaign source: we set no cookies, but we store two technically necessary values in your browser's storage: (1) an engagement handle (ebf_session_id, localStorage, stored for 30 days, deleted automatically thereafter) — the identifier of your ongoing e-Bilanz engagement. It lets you resume after a page reload and — if you open our support form — is attached automatically there, so we can link a support request to your engagement and reproduce your problem without a screenshot. This creates a link between your support request and your engagement record; legal basis: Art. 6(1)(b) GDPR (performance of the contract / pre-contractual steps). (2) the campaign source (ebf_utm, sessionStorage) — the UTM parameters you arrived with; they are attached to the payment reference at checkout and are deleted when you close the browser tab. Both are strictly necessary to provide the service you explicitly requested (§ 25(2) no. 2 TDDDG) and therefore require no consent; they contain no personal content (no names, no figures, no tax number) and are not transmitted to third parties. You can delete both at any time via your browser settings.
• Product improvement and error analysis (what you type into the form, including if you abandon it): So that we can improve our form and find where it fails, we store the entries you type into the form — including when you abandon the process and do not become a customer. This covers the values you enter: company, contact person, address, e-mail address, tax number, federal state, fiscal year, business activity, the balance-sheet and P&L figures and shareholder details, plus the step at which you left. Each record additionally carries a random technical process identifier — the same one the error reports under this section carry — so that we can match a reported malfunction to the entries it belongs to and fix the cause; this identifier is generated from random values in your browser and contains no personal content. Your ELSTER PIN and ELSTER certificate are never recorded — at no point, not even in part. The data is held on our server at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR), is internal only and readable solely with a separate access token, is never passed to third parties, never sold and never used for advertising or profiling; no automated decision-making within the meaning of Art. 22 GDPR takes place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-driven improvement of our own service; for abandoned processes performance of a contract under (b) does not apply). Retention: indefinite — we do not delete these entries after a fixed period, because comparison across several filing years is the actual purpose; they are deleted as soon as you object or request erasure (section 5). Your right to object: you may object at any time and without giving reasons under Art. 21(1) GDPR — informally to hello@ebilanzfabrik.de. We then delete your entries in full and confirm it. On request you will likewise receive access under Art. 15 GDPR to which of your entries are stored (section 6).
• e-Bilanz-Ampel: the e-Bilanz-Ampel lets you technically pre-check your balance sheet and P&L for free. Your file is read locally in your browser only and does not leave your device. Only the figures extracted from it are transmitted to us for the technical check (arithmetic correctness, equity roll-forward, structure); these figures are processed only for the duration of the check and are then discarded and not stored. There is no content and no tax review. Permanently stored are only anonymous technical metrics of the run — the check result ("passed"/"open"/"query"/"outside the schema"), which technical points were affected, where applicable the reason for non-coverage (legal form/size class/financial year), the file type (PDF/Excel/CSV) and the placement of the run. No amounts, no file, no tax number, no names, no IP address, no session or sign-in data are stored; there is no personal reference. Processing and storage on our server at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR), not shared with third parties, no profiling, no automated decision-making (Art. 22 GDPR). Legal bases: for the transient technical check of your transmitted figures Art. 6(1)(b) GDPR (performing the check you requested); for the anonymous metrics — insofar as any personal reference exists at all — Art. 6(1)(f) GDPR (legitimate interest in improving our own service); objection under Art. 21 GDPR to hello@ebilanzfabrik.de. Retention of the anonymous metrics: 180 days. The Ampel itself sets no cookies. If you click "Create e-Bilanz" to move on to the paid creation process, the values recognised so far are stored locally in your browser for this function you explicitly requested (localStorage, on your device only, auto-deleted after 30 days, deletable by you at any time) — § 25(2)(2) TDDDG (strictly necessary for the service you explicitly requested).

4. Recipients / processors

• Domain & DNS: Porkbun LLC, USA — domain registration and operation of the authoritative nameservers (DNS) for ebilanzfabrik.de. The website and all email have run exclusively on servers in Germany since 16 July 2026 (Hetzner, see below); website server logs (incl. visitor IP) no longer accrue at Porkbun. In authoritative name resolution Porkbun technically receives only the query of the requesting DNS resolver (typically the user's internet provider or a public resolver), not the IP address of website visitors; this does not normally establish a personal reference to our visitors. With respect to domain and DNS, Porkbun acts as an independent recipient (not a processor); the legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating a reachable domain).
• Website & application hosting: Hetzner Online GmbH, Germany — operation of the website ebilanzfabrik.de (static hosting, incl. resulting server logs such as visitor IP) and the engagement application (app.ebilanzfabrik.de), plus productive storage of engagement data on servers in Germany; Art. 28 GDPR agreement, no third-country transfer.
• Email (receipt & delivery): Hetzner Online GmbH, Germany — operation of the hello@ebilanzfabrik.de mailbox and delivery of the filing confirmation (incl. the XBRL file and invoice as attachments) via servers in Germany; Art. 28 GDPR agreement, no third-country transfer.
• Payment: Stripe Payments Europe, Ltd. (Ireland) — as payment service provider for payment processing; technical processing also by Stripe, Inc./Stripe, LLC (USA). Payment runs on a data path separate from your financial-statement data; eBilanz Fabrik receives no full payment-instrument data (you pay directly with Stripe). For payment processing Stripe acts as an independent (separate) controller — not as a processor, because it determines the processing for its own purposes (including fraud prevention and its anti-money-laundering and regulatory duties as a payment institution); Stripe's own privacy notice applies in addition. Where personal data is transferred to the USA, Stripe (Stripe, LLC) is certified under the EU-US Data Privacy Framework (EU Commission adequacy decision); Standard Contractual Clauses (SCCs) apply in addition.
• Web analytics (DE): Pirsch (Emvi Software GmbH, Germany) — cookieless reach measurement; hosted exclusively in Germany, no third-country transfer. Art. 28 GDPR agreement.

For internal record-keeping and backup, the controller additionally keeps an access-protected archive copy of engagement data on its own systems. You can request a copy of the Standard Contractual Clauses (SCCs) for the relevant third-country recipient (Stripe as independent controller) via hello@ebilanzfabrik.de.

5. Retention period

Filing artifacts and invoice data plus the complete engagement record (invoice, XBRL e-Bilanz, Transferticket, your details and confirmations incl. payment references): 10 years (§ 147 AO, § 257 HGB / GoBD). Contact data: until handled, then per statutory periods. Reach measurement (section 3): the pseudonymous analytics data is deleted after 6 months (the analytics provider's retention period on the plan in use); the IP address itself is never stored at any point. Form entries for product improvement (section 3): stored indefinitely — there is no fixed deletion deadline for these, because the year-on-year comparison is the purpose; deletion follows your objection (Art. 21 GDPR) or your erasure request (Art. 17 GDPR), informally to hello@ebilanzfabrik.de. This does not affect records we are required to retain under § 147 AO / § 257 HGB — those we cannot delete even on request (Art. 17(3)(b) GDPR). Server logs: a short, operationally usual period. Your ELSTER certificate: never stored (used exclusively in memory for the one transmission).

6. Your rights

You have the right to access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21), plus a right to lodge a complaint with a supervisory authority (Art. 77). The right to erasure does not apply where processing is required to meet statutory retention duties (Art. 17(3)(b) GDPR); such data is restricted instead of erased for the duration of the retention period. Competent supervisory authority: the Data Protection Commissioner of North Rhine-Westphalia (LDI NRW), Düsseldorf. Contact: hello@ebilanzfabrik.de.