Financial Handbook for Germany

personal, business and public sectors

Website Privacy Policy, Use of Cookies

Website privacy policy (Datenschutzerklärung, Privacy Policy) and notice of cookie use.


Privacy Policy

Table of Contents

1. Scope and General Information

This Privacy Policy applies to the website https://finanz-handbuch.de/en/, including its subdomains that refer to this Privacy Policy. It explains which personal data is processed when you use our online services, for what purposes, on which legal grounds and what rights you have.

We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). Personal data means information relating to an identified or identifiable natural person. This includes, for example, IP addresses, email addresses, usernames and personal information contained in messages or other submissions.

Personal data is processed only where a corresponding legal basis exists. In particular, we observe the principles of purpose limitation, data minimisation, storage limitation and confidentiality. Information about the data controller and available contact methods can be found in Section 8.

2. Hosting, Access Logs and Data Security

2.1 Hosting

Our website is hosted on a server that we administer ourselves and that is provided by Alfahosting GmbH, Edmund-von-Lippmann-Straße 13–15, 06112 Halle (Saale), Germany. The server infrastructure we use is located in Germany. Alfahosting may process personal data to the extent necessary for the technical provision, maintenance and security of the infrastructure. We have concluded a data processing agreement with Alfahosting pursuant to Art. 28 GDPR. Contractually engaged subprocessors may also be involved. Further information is available in the Alfahosting Privacy Policy.

The legal basis for processing technically necessary personal data is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our online services securely, reliably and without technical disruption.

2.2 Access Logs

Whenever our website is accessed, technical access data is automatically stored in internal log files. This includes, in particular, the IP address of the accessing device, the date and time of access, the requested internet address including any URL parameters, the type of request, the response status, the amount of data transferred, the previously visited page (referrer), and information about the browser and, where available, the visitor's operating system.

This data is used to operate our website, investigate and resolve technical problems, and detect, investigate and prevent attacks, security issues and abusive access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the security and proper functioning of our online services.

IP addresses in these logs are not anonymised. Regular access logs are rotated daily and are normally deleted after approximately 14 days as part of the standard retention cycle. In the event of specific security incidents, relevant extracts from the logs may be retained separately to investigate the incident and, where necessary, to protect legal rights. Access to log data is restricted to authorised persons.

2.3 System, Security and Error Logs

Additional system, security and error logs are maintained for the technical operation and protection of our systems. Depending on the event, these logs may contain timestamps, IP addresses, technical error messages, information about the status of individual services and details of authentication attempts.

Ordinary system and communication logs are generally rotated weekly, with four previous versions retained. Longer rotation periods of approximately twelve weeks apply to certain technical error logs. Other system journals are managed according to existing storage space limits and automatic cleanup mechanisms. No uniform fixed retention period in days is defined for these journals, so the available log history may extend over a longer period.

Processing takes place exclusively for technical troubleshooting, operational security and the investigation of security incidents. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in maintaining the secure and proper operation of our systems and being able to investigate technical problems retrospectively. In the event of specific incidents, relevant information may be retained until the investigation is completed and, where necessary, for longer to protect specific legal claims.

2.4 Our Own Usage Statistics

We compile internal statistical reports to analyse the use of our online services and improve them. IP addresses are not stored in our own usage statistics. This does not affect the separate technical access logs described in Section 2.2. We do not use external web analytics services such as Google Analytics.

2.5 Data Security and Backups

Data transmitted between your browser and our website is generally encrypted using HTTPS/TLS. We implement technical and organisational measures to protect our systems, including access restrictions, appropriate authentication procedures, regular security updates and measures to detect and prevent unauthorised access. Absolute security of data transmission and processing cannot be guaranteed by technical means.

Backups are created regularly to ensure the availability and recoverability of our systems. Personal data may therefore remain temporarily in backup copies after it has been deleted from active systems. Such copies are overwritten or deleted in accordance with the applicable backup and retention cycles. When systems are restored, any continuing obligations to delete data are taken into account.

3. Data Processing When Using Our Services

When you use the functions described below, we process personal data exclusively for the stated purposes and on the specified legal grounds.

3.1 Contact Form and Email Communication

You can contact us using our contact form or by email. We process the information you provide in order to receive, review and, where appropriate, respond to your enquiry. This primarily includes your email address and the content of your message, as well as your name and any other contact details you voluntarily provide. Information required to process your enquiry is marked accordingly. Without the necessary contact details, an individual response may not be possible.

Messages submitted through the contact form are initially stored in a database on our server. They are then retrieved directly by our own application onto a device used by us and processed there. We do not use an external email service for this internal transfer. In ordinary email communication, the mail servers and technical service providers of the sender or recipient may be involved in transmitting messages.

Messages from the contact form are generally deleted from the server database after 30 days. Ordinary correspondence stored on our own device is generally deleted no later than one year after its processing has been completed. Statutory retention obligations and necessary storage to protect specific legal claims remain unaffected. Further information can be found in Section 6.

The legal basis for processing ordinary enquiries is Art. 6(1)(f) GDPR. Our legitimate interest lies in handling incoming enquiries, comments and error reports. Where communication serves to take pre-contractual steps or fulfil a contract, processing is based on Art. 6(1)(b) GDPR. Separate consent to this Privacy Policy is not required for the ordinary processing of an enquiry.

3.2 Interactive Tools, Calculators and Converters

Our website provides interactive tools for processing, converting and calculating texts, selected values and other input data. The information required for each function is transmitted to our server via an encrypted connection using HTTP POST, processed there, and the result is then returned to your browser.

The input data submitted is used exclusively to perform the requested operation. It is not stored in a database or in separate application logs. Processing takes place only temporarily while the request is being handled. General technical logs contain the access information listed in Section 2.2 but not the content of the HTTP POST request body.

The legal basis is Art. 6(1)(b) GDPR where the function is provided as part of a corresponding user relationship, or Art. 6(1)(f) GDPR for publicly accessible functions. Our legitimate interest lies in providing functional interactive tools. Please do not submit passwords, confidential documents or particularly sensitive personal data unless this is necessary for the requested processing.

Cookies are pieces of information that may be stored on your device and read during subsequent visits. We also use other browser-based storage mechanisms, including Local Storage, Session Storage and technical caches. These technologies are used to provide website functions, save settings and, in the case of third-party advertising services, for the purposes described below.

Under § 25(1) TDDDG, consent is generally required to store information on your device or access information already stored there. An exemption is provided, in particular, under § 25(2) No. 2 TDDDG where such storage or access is strictly necessary to provide a digital service expressly requested by the user. Where personal data is also processed, the relevant legal bases under the GDPR apply in addition.

Technically necessary cookies and storage mechanisms are used, in particular, to provide settings expressly selected by the user and ensure the proper functioning of our online services. You can view, restrict and delete cookies and other stored website data through your browser settings. Disabling necessary storage mechanisms may restrict the operation of the corresponding website functions.

4.1 Google AdSense and Advertising Consent Management

We use Google AdSense to display advertisements on our website. For users in the European Economic Area, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is involved in providing the corresponding services. Google and other participating advertising partners may process personal data in connection with displaying advertisements, including IP addresses, technical device and browser information, cookie identifiers, and information about website use and interactions with advertisements.

Google AdSense uses cookies and similar technologies, in particular, to deliver advertisements, limit their frequency, measure performance, prevent fraud and, where permitted, personalise advertising. The specific processing activities depend on the service settings, your region and your privacy choices.

To manage your privacy choices, we use the Google Consent Management Platform (CMP) within the Transparency and Consent Framework (TCF) of IAB Europe. It provides information about the purposes of processing and the participating service providers. You can give consent, adjust individual settings, refuse consent, and subsequently change or withdraw your decision. Individual providers may rely on legitimate interests for certain processing activities where permitted by law.

Section 25(1) TDDDG applies to the storage of information on your device and access to such information where consent is required. Where personal data is processed on the basis of your consent, Art. 6(1)(a) GDPR applies. Other processing activities may rely only on legal bases permitted by law, information about which is provided through the consent management platform.

Technical cookies or similar mechanisms may be used to save your decision, for example a cookie named FCCDCF. Other cookies, such as __eoi, may also be used in connection with advertising. Their actual use, purposes and retention periods may change as the services are updated.

You can reopen your privacy settings at any time, change them or withdraw previously given consent with effect for the future. To do so, use the privacy and cookie settings link provided on our website or the following function:

Cookie Permission Settings

Further information is available in the Google Privacy Policy and under Google Advertising and Privacy.

4.2 Appearance Settings

Our website allows you to choose between a light and a dark appearance. Your selected setting is stored in a cookie named dmode so that it remains active on subsequent visits. The storage period is up to one year. Where the conditions of § 25(2) No. 2 TDDDG are met, separate consent is not required for this expressly requested function. Where personal data is processed, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in conveniently providing the appearance settings selected by the user.

4.3 Local Caching and Offline Functions

To improve the loading speed and availability of our website, we use technical mechanisms that store previously loaded resources locally on your device. These may include images, style files, scripts and other technical website files. As a result, some previously loaded content may remain available even if the network connection is temporarily interrupted.

Local caching is intended to support the operation and technical optimisation of the website. Where the conditions of § 25(2) No. 2 TDDDG are met, separate consent is not required. Where personal data is processed, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the stable, fast and resource-efficient operation of our online services. You can delete locally stored website data through your browser settings.

5. Data Recipients and International Data Transfers

Personal data is transferred to or processed by other organisations only to the extent necessary to provide our services, handle enquiries, use expressly activated external content or comply with legal obligations. Potential recipients include, in particular, our hosting provider and its contractually engaged subprocessors, as well as the providers of the external services described above.

Our hosting provider processes data under a data processing agreement. Google and participating advertising partners may process data as part of the advertising services described in Section 4.1. Recipients involved when external media content is activated are identified in the descriptions of the respective functions. We do not independently transfer information stored in contact messages or user accounts to advertising companies for commercial exploitation of that information.

Our own server infrastructure is located in Germany. However, when Google services are used, personal data may be processed or transferred outside the European Economic Area, particularly to the United States. Such transfers are subject to the requirements of Art. 44 et seq. GDPR. For US organisations with the relevant certification, the European Commission's adequacy decision under the EU-US Data Privacy Framework pursuant to Art. 45 GDPR may apply. Other transfers may require appropriate safeguards, in particular standard contractual clauses pursuant to Art. 46 GDPR. Further information about the legal grounds used by Google for data transfers is available at Google: Legal Frameworks for Data Transfers.

Personal data is disclosed to public authorities or other authorised bodies only where there is a corresponding legal obligation or another permissible legal basis.

6. Data Retention and Deletion

We retain personal data only for as long as necessary for the respective processing purpose or for a mandatory period prescribed by law. Specific retention periods or the criteria for determining them depend on the type of data and the relevant processing activity.

Statutory retention periods apply to certain business, tax and accounting documents. Depending on the type of document, these periods may be six, eight or ten years, for example under § 147 of the German Fiscal Code (AO). Such periods apply only to the categories of documents specified by law and do not automatically apply to ordinary messages or enquiries from website visitors.

Data required for the establishment, exercise or defence of specific legal claims may be retained separately for the period necessary for that purpose. Once the processing purpose no longer applies or the applicable retention period has expired, the relevant data is deleted unless another permissible legal basis exists.

When data is deleted from active systems, it may remain temporarily in regularly created backup copies. These copies are overwritten or deleted according to the applicable retention cycles. They are used to restore the availability and integrity of our systems.

7. Your Data Protection Rights

Where we process your personal data, you have the following rights, subject to the conditions provided by law:

To exercise your rights, you can contact us using the contact information in Section 8. Requests may generally be submitted without any particular formality. If there are reasonable doubts about your identity, we may request additional information necessary to confirm it. We handle requests within the time limits established by law.

You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You can manage your consent to advertising technologies using the function described in Section 4.1.

Reading publicly accessible content generally does not require you to provide personal information under a contract. However, certain information is necessary for some functions, in particular registration, contacting us and using restricted services. Without such information, the corresponding functions may be unavailable or only partially available.

As part of our own website functions, we do not make decisions based solely on automated processing that produce legal effects or similarly significant effects within the meaning of Art. 22 GDPR. External advertising services may use automated selection or personalisation methods. Information about these methods is provided by the respective service providers and the consent management platform.

8. Data Controller and Contact Information

The controller responsible for processing personal data within the meaning of the GDPR is:

Internetservice Seljunin
Anton Seljunin
Waldstr. 71
22846 Norderstedt
Germany

Show electronic contact details

Contact Form

9. Changes to This Privacy Policy

We may amend this Privacy Policy if legal requirements, technical processes, the services used or the functions of our online services change. The current version is published on this website. If changes require separate notification or renewed consent, we comply with the relevant legal requirements.