Datenschutzerklärung · Privacy notice

What we do with your documents

Last updated: 13 August 2026

Draft — not for publication This notice must be reviewed and completed by the German lawyer alongside the StBerG opinion (GTX-003) before the site goes live. German privacy notices have mandatory content, and the joint-controller arrangement with the partner firm has to exist in writing first. Every bracketed item below is unresolved.

1. Who is responsible for your data

The controller is [legal entity name, legal form, registered address], contactable at [email]. Full identification is on the Impressum.

Once you agree to your file being passed on, we and the partner tax firm [Steuerberater name and address] act as joint controllers under Article 26 GDPR. The essential terms of that arrangement are available to you on request.

2. What we collect

Identity: Passport details, tax identification number, social insurance number, residence permit details.
Contact: Phone number, WhatsApp profile, email address, postal address.
Employment and income: Wage tax certificates, payslips, employment and deputation contracts, benefit statements.
Residence history: Registration and deregistration certificates, arrival and departure dates, rent contracts.
Family details you choose to give us: Where you claim support sent to relatives: their names, dates of birth, addresses and income evidence. This is other people's personal data, so only send it if you are able to.
Financial: Bank details for the refund, and records of the fee you paid us.
Conversation: Your WhatsApp messages with us, and the answers you gave in the eligibility check.

3. Why we hold it, and on what basis

To perform our contract with you (Art. 6(1)(b) GDPR) — collecting, organising and passing on your documents.
With your consent (Art. 6(1)(a)) — passing your file to the named partner firm, and sending you anything beyond service messages. You can withdraw consent at any time by messaging us.
Our legitimate interests (Art. 6(1)(f)) — fraud prevention and improving the service.
Legal obligation — retention periods German law imposes on records of this kind.

We do not sell your data, and we do not use your documents for anything other than your own case.

4. Who else sees it

The named partner Steuerberater, for review and filing.
The Finanzamt and, for pension claims, the Deutsche Rentenversicherung, as part of your application.
Our processors: [WhatsApp Business API provider], [cloud storage], [CRM], [payment provider], each under a data processing agreement.

WhatsApp is operated by Meta, which processes message metadata under its own terms that we do not control. If you would rather not send documents through WhatsApp, ask us and we will send you a direct upload link instead.

5. Data leaving the EU

Your data moves between India, the EU and our providers' infrastructure. Transfers are covered by [standard contractual clauses / adequacy decision — to be specified]. Processing in India is carried out in line with the Digital Personal Data Protection Act 2023.

6. How long we keep it

Case files: for the engagement plus [retention period — to be set with the lawyer; the partner firm's own obligations for a filed return are longer].
Our own copies of your documents: deleted [12 months] after your case closes.
Enquiries that never became cases: deleted after [6 months].

7. Your rights

You can ask for a copy of your data, correction, deletion, restriction of processing, portability, or object to processing. Write to [email] and we will respond within 30 days. You can also complain to a supervisory authority — in Germany the relevant state data protection authority, in India the Data Protection Board.

8. Security

Documents are stored in a folder used only for your case, accessible to named staff only. Your refund is paid by the authorities directly to you and never passes through our accounts, so we never hold your money.

9. Cookies and tracking

[To be completed once analytics and the Meta advertising pixel are configured. No non-essential cookie may be set before consent. If the site ships without a pixel, say so here plainly — it is a real advantage worth stating.]