Privacy Policy

Last updated: 20 October 2026

1. Controller

David Wirfs (sole proprietorship — eBilanz Fabrik), Naumannstraße 1, 50735 Köln, email: hello@ebilanzfabrik.de. See the Imprint.

2. Principle — data minimization within statutory duties

eBilanz Fabrik processes as little data as possible — and as much as the engagement and the law require. The website uses no tracking cookies and relies solely on cookieless, privacy-friendly reach measurement (Pirsch, Emvi Software GmbH, Germany) — no cookies, no cross-device tracking, no personal profiles (see sections 3 and 4). Your financial data is processed solely to carry out your engagement — never profiled, never used for advertising, never sold. To perform the engagement and to meet statutory retention duties (§ 147 AO, GoBD) we store the complete engagement record (your details and confirmations) and the filing artifacts (XBRL e-Bilanz, Transferticket, invoice) — see sections 3 and 5. Your ELSTER certificate is never stored.

3. Data processed, purposes, legal bases

• Server log files (site access): technical data arising at the hosting provider (IP address, timestamp, file requested) for delivery + security of the site. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
• Contact (email): your details to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR, or (f) (legitimate interest in handling your enquiry efficiently).
• Support form (name, email, subject, message): your details are stored as a support case with its own case number, so that we can handle your request traceably and tell you where it stands. Storage is on our server at Hetzner Online GmbH (processor, located in Germany, Art. 28 GDPR agreement in place). Legal basis: Art. 6(1)(b) GDPR (initiation/performance of the contract), or (f) (legitimate interest in traceable support handling). We need your name, email address and message to handle your request and reply to you correctly and personally; providing a subject is optional. Retention: until your request is resolved, and beyond that for as long as follow-up questions on your case are to be expected. You can request deletion at any time (Art. 17 GDPR) — an informal email is enough. If the case belongs to a paid order, the statutory retention below applies.
• Contact e-mail during the preparation process (required, the “Company” step): your e-mail address is necessary to perform the service: we deliver the transmission protocol and the invoice electronically, and must be able to reach you about your open case. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps / performance). For marketing we use the address only as set out in the “Deadline reminders for our own similar services” item (§ 7(3) UWG, right to object) and — only if you tick the optional “News by email” checkbox and confirm your address via the link in our confirmation email — as set out in the “Newsletter and news by email” item. To support your case we may technically review it (e.g. a test run of the official ERiC validation without any transmission). The address is stored as part of the case on our server at Hetzner Online GmbH (processor, Germany, Art. 28 GDPR agreement). Retention: if the case is not completed, the address stays stored as part of the case until you ask us to delete it — no automatic deletion deadline is currently active. We deliberately do not state a period we cannot technically meet: the storage period for incomplete cases is still to be set. Once you place the order, section 3/5 (engagement record) applies. You may request deletion at any time (Art. 17 GDPR) — an informal e-mail to hello@ebilanzfabrik.de is enough, and we delete the address subject to statutory retention obligations.
• Carrying out your engagement (balance-sheet/P&L data, master data, tax number): the values you enter or confirm are converted into the XBRL format, technically validated and — after your approval — transmitted to the tax authority. The engagement record (your details, approval and confirmation records, payment references of the payment provider, transmission status) is stored to administer the engagement. Legal basis: Art. 6(1)(b) GDPR; where processing on behalf applies: a data-processing agreement under Art. 28 GDPR.
• Comparison with your prior-year e-Bilanz: if you file a further financial year via the link on the completion page, we compare, before payment, the equity you enter for the start of the year — and, where both balance sheets show the annual result separately, also the profit carried forward and revenue reserves — with the prior-year e-Bilanz you transmitted through us. If it differs, we ask you for the reason; every answer leads on to the order. With your order we store only the result of the comparison, the reference to your prior-year order and your answer, no amounts; that we asked is noted without amounts in our technical log (retention 365 days). If you state that a figure in your prior-year e-Bilanz is wrong, our support is informed. Without this link, no comparison takes place. Legal basis: Art. 6(1)(b) GDPR.
• Protection against a duplicate first filing: before payment we ask whether an e-Bilanz for the company and the financial year has already been transmitted to the tax office, and store your answer with your order. In addition, we compare the tax number and the balance sheet date with the e-Bilanzen already transmitted through us, so that no second e-Bilanz goes to the tax office as a first filing for the same company and financial year. We show no one any details of another filing. Legal basis: Art. 6(1)(b) and (f) GDPR (legitimate interest in correct filings).
• Corrected e-Bilanz: if you transmit, through us, a correction of an e-Bilanz previously transmitted through us, we enter your details from the earlier order into the form, compare the figures of the correction with the earlier e-Bilanz so that the transmission is marked correctly for the tax office (for example as “corrected”), and show you what changes before you release it. Legal basis: Art. 6(1)(b) GDPR.
• Statutory retention: the business records belonging to your engagement — invoice, transmitted XBRL e-Bilanz, Transferticket and the complete engagement record (including company master data, tax number, the figures you confirmed and payment references) — are retained for 10 years. Legal basis: Art. 6(1)(c) GDPR in conjunction with § 147 AO, § 257 HGB (GoBD).
• Filing confirmation by email: after a successful transmission you receive a confirmation email with the Transferticket, your XBRL file and the invoice. Legal basis: Art. 6(1)(b) GDPR.
• Reviews after an order is completed: After an order has been completed successfully (e-Bilanz transmitted or disclosure file provided), we ask you on the completion page, in a rating panel, for a voluntary rating from 1 to 5 stars and, if you wish, a comment. We ask only there, never by email; whether and how you rate changes nothing about your order. Clicking a star saves the rating; afterwards you can change or delete it on the completion page. We store the number of stars (after a change, also earlier values), your comment, the product, the language, the times, your order's identifier and technical notes, for example whether the rating comes from a test case. We do not add your email address or your IP address to the rating. Through the identifier the rating is linked internally to your order, and so to you; this way only someone who has completed an order through eBilanz Fabrik can rate, and each order has at most one rating. So that we do not ask you twice, we also note times on your order, for example when the rating panel was shown and when it was closed; this note contains neither stars nor a comment and stays stored with your engagement record (section 5). Storage on our server at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR); without your consent we do not pass your rating on to third parties. A rating given in the rating panel stays on this server: for our internal analysis, only aggregated figures leave it (for example the number, distribution and average of the star ratings) and, for 1 or 2 stars, an internal notice without your order's identifier and without the exact number of stars. We do not contact you because of a rating. Our reach measurement (Pirsch, section 4) learns about the rating only whether the rating panel was shown or closed or a rating was given, and for which product, never the number of stars, the comment or your order's identifier. The purpose is to improve our service and an average rating that we may publish; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in feedback on our service and in presenting it). You may object to this processing at any time under Art. 21(1) GDPR, informally to hello@ebilanzfabrik.de, or delete your rating yourself. Internal unless you consent: we publish an individual review, stars or comment, only with your express consent. Without it, only your number of stars may count, without your name, towards an average rating that we may publish. “Without your name” means: the average rating names neither you nor your company, contains no comment and does not reveal who rated. It includes every star rating given in the rating panel, regardless of the number of stars, except deleted ones and those from our own companies or from test cases. Publication only with your consent (Art. 6(1)(a) GDPR): if you have written a comment, you can consent, with a checkbox that is not pre-ticked, to our publishing your review (stars and comment) on ebilanzfabrik.de in the form you choose, together with the product and the month it was given. With “Without a name”, only a description derived from your company's legal form appears instead of a name, e.g. “Managing director of a GmbH”; with “First name and initial” or “Name and company”, the display name you enter. With the consent we store its time, the version of the consent text, the chosen form, that description and, where applicable, your display name. Before publishing, we remove tax identifiers and details about other people; otherwise we do not change your text. Consent is voluntary and can be withdrawn at any time with effect for the future (Art. 7(3) GDPR), on the completion page or by email to hello@ebilanzfabrik.de; the lawfulness of processing carried out until withdrawal remains unaffected. After a withdrawal we do not publish your review; a comment already published is removed without delay and deleted, and a comment not yet published remains an internal comment. Nothing is given in return for a review. Retention: your rating stays stored until you delete it or object to the processing. If you consented to publication, we keep the proof (times of consent, withdrawal and deletion, version of the consent text, checksum of a published text, your order's identifier) after a deletion or withdrawal as well, for as long as we need it to demonstrate whether, and on what basis, a review was published (Art. 17(3)(e) GDPR). No fixed deletion period is currently set up. This rule is prepared but not yet active: 24 months after the rating was first given, an unpublished comment is deleted and the number of stars is detached from your order, so that all that remains of the rating is an anonymous entry of stars, product and month; the proof of consent is deleted three years after the withdrawal or the deletion of the rating, whichever is later. A published comment stays as long as your consent stands. The “How was your experience?” card: star ratings given on this card, which says “it stays private, just for us”, remain internal: we use them only to improve our service (legal basis as above), do not publish them and never include them in a published average rating. They are stored with your order; you can ask for their deletion at any time, informally to hello@ebilanzfabrik.de, and if your rating is shown on the completion page you can also delete it there yourself. The same retention applies as above.
• Official ELSTER data-protection notices: transmission via the official ELSTER interface (ERiC) is additionally subject to the tax administration's data-protection notices — verbatim at ELSTER-Datenschutzhinweise (official German documents); you confirm having taken note at the start of the process.
• Deadline reminders for our own similar services (right to object): once you have placed a paid e-Bilanz order with us, we use the email address collected in that order — unless you object — to remind you of the deadline for your next e-Bilanz and to inform you about our own similar services. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in direct marketing to existing customers, Recital 47) in conjunction with § 7(3) UWG. You can object at any time — informally to hello@ebilanzfabrik.de or via the unsubscribe link in every such email; no costs arise other than transmission costs at base rates. We point out this right to object already when the address is collected during checkout. No consent is required or obtained for this. The optional “News by email” checkbox in the order process concerns only the newsletter (next item); whether or not you tick it does not change this reminder or your right to object.
• Newsletter and news by email (only with your consent, double opt-in): Beyond the deadline reminder above, we send advertising emails only with your express consent. You can give it (1) via the newsletter field on our homepage. Content: news and reminders about annual accounts and the e-Bilanz (e.g. deadlines, disclosure, taxonomy changes) as well as information about new features and offers from eBilanz Fabrik. Or (2) via the optional, unticked “News by email” checkbox in the order process (the “Company” step). Content: news about eBilanz Fabrik's products, in particular new features and new offers. Consent is voluntary; without it nothing changes about an order. Legal basis: Art. 6(1)(a) GDPR; the consent is also the express consent required under § 7(2) no. 2 UWG. Double opt-in: we only write to you after you have confirmed your address via the link in our confirmation email. For the checkbox in the order process, we first note your consent on your case and send the confirmation email only once your order is complete; if you do not complete the order, we send none. If you do not confirm within 72 hours, we delete the sign-up automatically. We store your email address, your language, where the sign-up came from (the page you signed up on), the wording of the consent shown to you, the times of consent, confirmation email, confirmation and any unsubscription, and which newsletter issues we sent you and when. We do not store an IP address. Storage and sending take place via our server and our mailbox at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR); there is no disclosure to third parties. You can withdraw at any time with future effect via the unsubscribe link in every email or informally to hello@ebilanzfabrik.de; the lawfulness of processing carried out until withdrawal remains unaffected. After a withdrawal we send you no further newsletters. We keep the proof of consent and withdrawal (email address, wording, times) after a withdrawal for as long as we need it to demonstrate that the sending was lawful (Art. 17(3)(e) GDPR); no fixed deletion period has been set up for it yet. We also treat an unsubscription from the newsletter as an objection to the deadline reminder (previous item).
• Necessity of provision: providing the engagement data (master data, tax number, balance-sheet/P&L figures, your ELSTER certificate for one-time use) is required to perform the contract — without it the e-Bilanz cannot be created or transmitted. There is no statutory obligation to provide it to us.
• Import of your figures (PDF, Excel, CSV or HTML — local): When you import your finished balance sheet / P&L, the file is read exclusively locally in your browser (e.g. via pdf.js) and never leaves your device. There is no AI extraction and no transfer to an AI service or any third party. The imported values land as an editable pre-fill in the form — you review and confirm every position yourself; alternatively you enter every value manually. The values you review and confirm are then transmitted to our server and stored as part of the engagement record (sections 3/5) — legal basis for that: Art. 6(1)(b) GDPR (performance of contract) — the source file itself never leaves your browser. One exception, and only this one: if the import fails or the balance sheet does not add up, we ask you at exactly that moment, in exactly these words: “So we can fix this error, we transmit your file — deletable at any time, automatically after 30 days.” It is transmitted only after your explicit click; without your consent nothing happens and you can continue normally. The sole purpose is repairing the parser that failed on your file. It is stored separately from the engagement record, readable only with a separate access token, never shared with third parties, and automatically deleted after 30 days at the latest — sooner if you ask (hello@ebilanzfabrik.de). Legal basis for this alone: Art. 6(1)(a) GDPR (consent), revocable at any time — without your consent this transfer does not happen. Structural details of the import: So that we can improve the import, your browser additionally transmits, when you import, details of how your file is structured and how our import read it. These include: the file type and whether you selected the file, dragged it in or pasted figures; for PDF files the number of pages in bands, for Excel files the number of worksheets; which software created the file, where the file states this in its technical file properties or in a program note in its header or footer — only an entry from a fixed list is transmitted (such as “DATEV”), never the property itself; whether and why reading failed (such as “PDF without readable text”); layout features, such as whether positions are printed side by side or how negative amounts are written; the number of amount columns and what kind of headings they carry (such as “names the chosen financial year” or “names the prior year”); counts from the reading, such as how many lines were read, matched, not matched or discarded, and how long reading took; which form positions the import filled and which of those values were later changed or cleared; whether the balance sheet and P&L added up after the import, any difference only as an approximate order of magnitude relative to the balance-sheet total or the P&L figures; and whether we asked you which column holds your financial year, whether and which column you chose, and whether you switched columns. These structural details contain no amounts, no labels, no names and no other text from your file — not in full, not shortened, not encoded — no file name and no checksum of the file; the file itself is not transmitted for this. We store them together with the records under “Product improvement and error analysis”, and the same applies: stored on our server at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR), internal only and readable solely with a separate access token, never passed to third parties, never used for advertising or profiling. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in our import taking your figures completely and from the right column). Retention: indefinite, like the other records under that item. You may object to this processing at any time under Art. 21(1) GDPR, informally to hello@ebilanzfabrik.de; we then delete these details together with your other records. The values taken from your file into the form are treated like your other form entries (see “Product improvement and error analysis”).
• Payment: handled via Stripe on a data path separate from the financial data; eBilanz Fabrik receives no full payment-instrument data. Legal basis: Art. 6(1)(b) GDPR.
• Error and stall reports (technical log): If a technical error occurs in the form, a check will not let you proceed, or you get stuck on a step, your browser reports this to our server — that is the only way we can identify and fix the cause. Only the event type, a fixed, predefined notice code (a technical identifier from a closed list, never free text), the step number and — if one exists — the reference number of your in-progress engagement are transmitted, so that we can attribute a fault to your case. No entered values, no amounts, no tax number, no name and no e-mail address are transmitted. Stored on our server at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR); no transfer to third parties, no advertising or profiling purposes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning, error-free service). Retention: 365 days, then automatic deletion.
• Reach measurement (web analytics): cookie-free, aggregated usage statistics (page views, source/campaign via UTM, approximate region) to improve our service. This also covers individual interaction events in the form and on the transmission and completion page — in each case only technical details such as the event type, a fixed, predefined notice code (a technical identifier from a closed list, never free text), the step number, the page language and the chosen product: for example that help was opened, that a check raised a notice, or that a step was left without clicking onward. These events contain no entered values, no amounts, no tax number, no name and no e-mail address. The completion of an order — that your e-Bilanz has been transmitted — is reported to the reach measurement not by your browser but by our server itself, and so also when your browser blocks the measurement. This report contains only the event type, the chosen product and the language of the order, and neither your IP address nor your browser identifier nor an identifier of your order; it therefore cannot be linked to any visit or session. No cookies are set and no cross-device profiles are created. Your IP address is not stored: it is combined with your browser identifier (user agent), the current date and a value the provider keeps for each website separately to compute a visitor identifier, and is discarded thereafter. Because the date is part of the computation, a new identifier is formed every day: a repeat visit from the same IP address and the same browser is recognised only on the same day, for at most 24 hours. This is pseudonymisation (Art. 4(5) GDPR), not anonymisation: with this value, which the provider holds, the mapping could in principle be recomputed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising, cookie-free reach measurement). You may object to this processing at any time under Art. 21(1) GDPR (section 6); for retention see section 5.
• Storage in your browser (§ 25 TDDDG) — identifiers and the source of your visit: we set no cookies, but we store the following values in your browser's storage: (1) an engagement handle (ebf_session_id, localStorage) — the identifier of your e-Bilanz engagement. The form stores it as soon as your entries have reached us for the technical check. If you open our support form within 30 days, it attaches the handle automatically, where it finds one, so we can link your request to your engagement and reproduce your problem without a screenshot. This creates a link between your support request and your engagement record; legal basis for this: Art. 6(1)(b) GDPR (performance of the contract / pre-contractual steps). After 30 days we no longer use the handle; it is deleted when you next open the support form, and otherwise stays stored until a new engagement replaces it or you delete it. (2) the source of your visit (sessionStorage), where there is one, stored as soon as you open our home page or the form: the campaign details (UTM parameters) of the link that brought you to us (ebf_utm) and the address of the page you came from, if your browser provides it (ebf_ref, at most 400 characters, addresses of our own pages excluded). Our server receives both with your entries for the technical check; as part of your engagement we store the campaign details and, of the address, only the name of the website (e.g. google.com). We also pass the campaign details to Stripe at checkout as part of the payment reference (section 4). The purpose is to see which routes lead to orders; legal basis for this: Art. 6(1)(f) GDPR (legitimate interest in the effectiveness of our advertising). You may object to this processing at any time under Art. 21(1) GDPR, informally to hello@ebilanzfabrik.de. (3) on the transmission and completion page (app.ebilanzfabrik.de), the same engagement handle in the open tab's page state (history.state), not in the address bar, so the page can continue after a reload. Only this handle is stored, with the time it reached the page — never your ELSTER certificate, ELSTER PIN or entries. It is bound to this tab (a browser restoring the tab, e.g. after a restart, may restore it too) and used for at most 30 days. (4) a technical identifier (ebf_cid, sessionStorage) — the random technical process identifier described under "Product improvement and error analysis". The form generates it from the time and random values the first time it opens in a tab and keeps it for that tab, so that error reports, records of your form entries and your engagement can be matched even across a reload; it is transmitted to our server with them. Legal basis for this: Art. 6(1)(f) GDPR (as stated there). (5) a marker for our reach measurement (disable_pirsch, localStorage, content only "1"): while it is set, the measurement sends nothing from this browser. We set it when your browser reports that it is being controlled by automation (for example test or crawler software), or when counting is switched off for a browser on a page intended for that purpose; it stays until it is deleted. The storage under (3) is strictly necessary to provide the service you explicitly requested (§ 25(2) no. 2 TDDDG) and therefore requires no consent. (1), (3), (4) and (5) contain no personal content (no names, no figures, no tax number) and are not transmitted to third parties. (2) and (4) are bound to the open tab — a browser restoring the tab may restore them too. You can delete (1), (2), (4) and (5) at any time via your browser settings (site data of ebilanzfabrik.de). The form keeps your form entries separately (next item).
• Saving your form entries in your browser: So that you can resume an interrupted engagement — after a reload, after a cancelled checkout or on a later day — the form continuously saves what you enter in your browser (ebf_form_v1, localStorage): company, salutation, contact person, address, e-mail address, tax number, commercial register number, federal state, business activity, fiscal year, the balance-sheet and P&L figures, shareholder details and your other entries and selections. Checkboxes and confirmations are not saved — you always set them afresh — and neither are passwords or files. Saving starts with your first entry, also covers values you take over from the e-Bilanz-Ampel, and does not end when you pay. This saving does not send your entries off your device. When you open the form again, it names the saved company, where one was entered, and offers to restore the entries; "Discard" deletes them. At the latest 30 days after the last save we stop offering them; if you open the form after that, it deletes them. Until then they stay stored in your browser. Please note: anyone who uses the same browser after you sees the saved company name when opening the form and can restore your entries. On a shared device we therefore recommend deleting them once you are done — by opening the form again and choosing "Discard", or via your browser settings (site data of ebilanzfabrik.de). Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to the order). Separately, we store form entries on our server as described under "Product improvement and error analysis".
• Product improvement and error analysis (what you type into the form, including if you abandon it): So that we can improve our form and find where it fails, we store the entries you type into the form — including when you abandon the process and do not become a customer. This covers the values you enter: company, contact person, address, e-mail address, tax number, federal state, fiscal year, business activity, the balance-sheet and P&L figures and shareholder details, plus the step at which you left. If you imported a file, the structural details of the import are added (see “Import of your figures”). Each record additionally carries a random technical process identifier — the same one the error reports under this section carry — so that we can match a reported malfunction to the entries it belongs to and fix the cause; this identifier is generated from the time and random values in your browser and contains no personal content. Your ELSTER PIN and ELSTER certificate are never recorded — at no point, not even in part. The data is held on our server at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR), is internal only and readable solely with a separate access token, is never passed to third parties, never sold and never used for advertising or profiling; no automated decision-making within the meaning of Art. 22 GDPR takes place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-driven improvement of our own service; for abandoned processes performance of a contract under (b) does not apply). Retention: indefinite — we do not delete these entries after a fixed period, because comparison across several filing years is the actual purpose; they are deleted as soon as you object or request erasure (section 5). Your right to object: you may object at any time and without giving reasons under Art. 21(1) GDPR — informally to hello@ebilanzfabrik.de. We then delete your entries in full and confirm it. On request you will likewise receive access under Art. 15 GDPR to which of your entries are stored (section 6).
• Interaction notes on the transmission and completion page: After you order, we note which steps you take on the transmission and completion page — for example opening the page, the authorisation, choosing a certificate file, starting the transmission and whether it succeeded or an error occurred — each with the time, the page language and the time elapsed since the page was opened, linked to the identifier of your order. This lets us see where a transmission fails and help you if you contact us. We do not note what you enter, your ELSTER certificate or its file name, your PIN, error texts or the Transferticket number, nor anything from the rating panel. Stored on our server at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR) and in our access-protected archive copy (section 4); not passed on to third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working, error-free service). Retention: no fixed deletion period (section 5). You may object to this processing at any time under Art. 21(1) GDPR, informally to hello@ebilanzfabrik.de.
• e-Bilanz-Ampel: the e-Bilanz-Ampel lets you technically pre-check your balance sheet and P&L for free. Your file is read locally in your browser only and does not leave your device. Only the figures extracted from it are transmitted to us for the technical check (arithmetic correctness, equity roll-forward, structure); these figures are processed only for the duration of the check and are then discarded and not stored. There is no content and no tax review. Permanently stored are only anonymous technical metrics of the run — the check result ("passed"/"open"/"query"/"outside the schema"), which technical points were affected, where applicable the reason for non-coverage (legal form/size class/financial year), the file type (PDF/Excel/CSV) and the placement of the run. No amounts, no file, no tax number, no names, no IP address, no session or sign-in data are stored; there is no personal reference. Processing and storage on our server at Hetzner Online GmbH (Germany, processor under Art. 28 GDPR), not shared with third parties, no profiling, no automated decision-making (Art. 22 GDPR). Legal bases: for the transient technical check of your transmitted figures Art. 6(1)(b) GDPR (performing the check you requested); for the anonymous metrics — insofar as any personal reference exists at all — Art. 6(1)(f) GDPR (legitimate interest in improving our own service); objection under Art. 21 GDPR to hello@ebilanzfabrik.de. Retention of the anonymous metrics: 180 days. Requests to the AI-assistant interface at app.ebilanzfabrik.de/mcp are not included in these metrics. Checks that the downloadable MCP server sends to the Ampel from your computer are recorded like calls from the page. The Ampel itself sets no cookies. If you move on from the Ampel's result to the paid creation process, your browser carries the values recognised and entered so far into the form's saved entries (ebf_form_v1, localStorage, in your browser only); for how long they are kept, how to delete them and the note on shared devices, see "Saving your form entries in your browser".
• AI-assistant interface (MCP): At https://app.ebilanzfabrik.de/mcp we answer requests from AI assistants and other programs that use the Model Context Protocol (MCP), for example after you have added eBilanz Fabrik to your assistant as a connector. Depending on the assistant, the request is made either by its provider from the provider's servers (then the provider's server address reaches us, not yours) or by the program on your device (then your IP address reaches us). The interface asks only for your company's legal form, size class, financial year and balance-sheet date and accepts nothing else, in particular no figures from the balance sheet or P&L; it does not ask for names or tax numbers. Purpose: to say which products we offer, what they cost and whether we can serve a company with these details. Unlike the server log files (above), we do not log these requests individually and do not store them, not even as an anonymous e-Bilanz-Ampel metric; if a technical error occurs, we note only the error, without the sender's address. We only count how often the interface is used: one number per type of request and tool, with no content and no addresses. We hold the IP address a request comes from in working memory only, to limit the number of requests per sender, and discard it there after two minutes at most; it is neither stored permanently nor logged. Legal basis, insofar as personal data are processed: Art. 6(1)(f) GDPR (legitimate interest in answering questions about our offer and in protecting the interface against overload and misuse). Recipients: none, apart from our hosting provider (processing on our behalf, section 4). The assistant provider's own privacy policy governs its processing.

4. Recipients / processors

• Domain & DNS: Porkbun LLC, USA — domain registration and operation of the authoritative nameservers (DNS) for ebilanzfabrik.de. The website and all email have run exclusively on servers in Germany since 16 July 2026 (Hetzner, see below); website server logs (incl. visitor IP) no longer accrue at Porkbun. In authoritative name resolution Porkbun technically receives only the query of the requesting DNS resolver (typically the user's internet provider or a public resolver), not the IP address of website visitors; this does not normally establish a personal reference to our visitors. With respect to domain and DNS, Porkbun acts as an independent recipient (not a processor); the legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating a reachable domain).
• Website & application hosting: Hetzner Online GmbH, Germany — operation of the website ebilanzfabrik.de (static hosting, incl. resulting server logs such as visitor IP) and the engagement application (app.ebilanzfabrik.de), plus productive storage of engagement data on servers in Germany; Art. 28 GDPR agreement, no third-country transfer.
• Email (receipt & delivery): Hetzner Online GmbH, Germany — operation of the hello@ebilanzfabrik.de mailbox and delivery of the filing confirmation (incl. the XBRL file and invoice as attachments) via servers in Germany; Art. 28 GDPR agreement, no third-country transfer.
• Payment: Stripe Payments Europe, Ltd. (Ireland) — as payment service provider for payment processing; technical processing also by Stripe, Inc./Stripe, LLC (USA). Payment runs on a data path separate from your financial-statement data; eBilanz Fabrik receives no full payment-instrument data (you pay directly with Stripe). For payment processing Stripe acts as an independent (separate) controller — not as a processor, because it determines the processing for its own purposes (including fraud prevention and its anti-money-laundering and regulatory duties as a payment institution); Stripe's own privacy notice applies in addition. Where personal data is transferred to the USA, Stripe (Stripe, LLC) is certified under the EU-US Data Privacy Framework (EU Commission adequacy decision); Standard Contractual Clauses (SCCs) apply in addition.
• Web analytics (DE): Pirsch (Emvi Software GmbH, Germany) — cookieless reach measurement; hosted exclusively in Germany, no third-country transfer. Art. 28 GDPR agreement.

For internal record-keeping and backup, the controller additionally keeps an access-protected archive copy of engagement data on its own systems. You can request a copy of the Standard Contractual Clauses (SCCs) for the relevant third-country recipient (Stripe as independent controller) via hello@ebilanzfabrik.de.

5. Retention period

Filing artifacts and invoice data plus the complete engagement record (invoice, XBRL e-Bilanz, Transferticket, your details and confirmations incl. payment references): 10 years (§ 147 AO, § 257 HGB / GoBD). Contact data: until handled, then per statutory periods. Reach measurement (section 3): the pseudonymous analytics data is deleted after 6 months (the analytics provider's retention period on the plan in use); the IP address itself is never stored at any point. Interaction notes on the transmission and completion page (section 3): no fixed deletion period; deleted on your objection (Art. 21 GDPR) or erasure request (Art. 17 GDPR). Form entries for product improvement, including the structural details of the import (section 3): stored indefinitely — there is no fixed deletion deadline for these, because the year-on-year comparison is the purpose; deletion follows your objection (Art. 21 GDPR) or your erasure request (Art. 17 GDPR), informally to hello@ebilanzfabrik.de. This does not affect records we are required to retain under § 147 AO / § 257 HGB — those we cannot delete even on request (Art. 17(3)(b) GDPR). Newsletter (section 3): unconfirmed sign-ups 72 hours; confirmed sign-ups until you withdraw; after that, proof of consent and withdrawal for as long as it is needed to demonstrate that the sending was lawful (no fixed deletion period has been set up for it yet). Reviews (section 3): until you delete them or object to the processing; if you consented to publication, the proof of that consent also after a deletion or withdrawal, for as long as it is needed to demonstrate whether, and on what basis, a review was published (no fixed deletion period has been set up for either yet). Server logs: a short, operationally usual period. Your ELSTER certificate: never stored (used exclusively in memory for the one transmission).

6. Your rights

You have the right to access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21), plus a right to lodge a complaint with a supervisory authority (Art. 77). The right to erasure does not apply where processing is required to meet statutory retention duties (Art. 17(3)(b) GDPR); such data is restricted instead of erased for the duration of the retention period. Competent supervisory authority: the Data Protection Commissioner of North Rhine-Westphalia (LDI NRW), Düsseldorf. Contact: hello@ebilanzfabrik.de.