Privacy policy

ControllerStill outstanding

The short version

This website loads nothing from third-party servers, embeds no Google fonts, sets no advertising or analytics cookies, and does not measure your visit.

That is why there is no cookie banner. A consent banner is required under § 25 TDDDG when information is stored on or read from your device that is not strictly necessary for the service. That does not happen here.

Server logs

When a page is requested, our hosting provider processes technically necessary connection data (IP address, timestamp, requested address, status code, user agent). A website cannot be delivered without them.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in secure, uninterrupted operation. Operation takes place in the European Union. The logs are not combined with other data and are kept only briefly.

Contact form

When you submit the form we store your name, email address, phone number if given, your message, the page you submitted from, and the time you gave consent.

Your IP address is not stored. It is used solely for abuse limiting, and only as a non-reversible hash inside a counter.

The legal basis is Art. 6(1)(a) GDPR (your consent) and, where your enquiry is aimed at a contract, Art. 6(1)(b) GDPR.

• Access is limited to people holding an operator account, protected by a password and a second factor.
• Each handling is logged — what is logged is the decision, not your message.
• We delete your enquiry once it has been dealt with and no retention obligation applies.
• You may withdraw your consent at any time; the lawfulness of processing up to that point is unaffected.

Display preference (light/dark)

If you switch the appearance, your choice is stored locally in your browser (localStorage, key "fatoura-theme"). It does not leave your device and contains no identifier.

This is strictly necessary for the service you explicitly requested within the meaning of § 25(2) TDDDG — you made the setting yourself, and the storage is the setting. You can remove it by clearing this site's data in your browser.

Signing in to the workspace

The signed-in area is part of the same application but not part of this website. When you sign in, a strictly necessary session cookie is set containing a random identifier and no information about you. Signing in is not possible without it (§ 25(2) TDDDG).

Sign-in uses Google or Microsoft. The respective provider processes your sign-in data under its own privacy policy.

The “fatoura für Mandanten” app

The app is for clients of an accounting firm that uses fatoura. The firm enables your email address; fatoura processes the app's data on the firm's behalf (Art. 28 GDPR), and the firm is the controller.

To sign you in we process your email address and send you a six-digit code valid for 15 minutes. The code is stored only as a non-reversible hash, and so is the session token your device then keeps for 30 days in the operating system's protected storage. To limit abuse, your IP address enters a counter only as a hash.

Documents you upload are placed directly in your firm's cloud storage; fatoura keeps no copy. A personnel form you send contains details about your employees, including special categories (such as tax class, health insurer, religion). It is processed only for your firm's payroll and appears there as a record the firm checks. Informing your employees under Art. 13 GDPR remains your duty as their employer. Files your firm shares with you are loaded from its cloud storage when you open them; every access is logged, without file names and without your email address.

The app contains no advertising, no analytics software and no push services. You can delete your access at any time in the app under “Einstellungen” or on the “Delete app access” page; uploaded documents and sent personnel forms belong to your firm and stay there.

No audience measurement

We run no analytics software — neither Google Analytics nor a cookieless alternative. We therefore do not know which pages are visited or how often. Should that change, it will be described here before it is switched on.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority — the one for your place of residence or for our registered office.