Privacy policy
Version 2026-10 · as of 21 October 2026
1. Key points at a glance
- We process your data so that you can use our parental allowance calculator, the parental allowance software and our parental allowance consultation.
- For parental allowance applications, we also need special categories of data, e.g. information on pregnancy, birth, maternity protection, employment prohibition, illness, a disability of your child and church tax (which may reveal your religious affiliation). We only process this data with your separate, voluntary and explicit consent. We ask for it before you use the parental allowance calculator (section 8).
- No tracking, no advertising cookies. Content from third parties (YouTube, Google reviews) and remembering a partner referral are only used after your consent.
- You submit your applications yourself. We do not transmit any application data to authorities.
- Your data is stored on servers of our host IONOS in Germany. We store particularly sensitive fields in encrypted form. A second factor is available for signing in.
2. Controller and data protection officer
Einfach Elterngeld GmbH, represented by the managing director Felix Böhme, Pennricher Straße 31, 01157 Dresden, Germany, phone +49 351 799 938 50, e-mail kontakt@einfach-elterngeld.de.
You can contact our data protection officer directly at datenschutz@einfach-elterngeld.de or by post at: Einfach Elterngeld GmbH, attn. data protection officer, Pennricher Straße 31, 01157 Dresden, Germany.
3. Your rights
You have the right to
- access (Art. 15 GDPR),
- rectification (Art. 16),
- erasure (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20).
You can withdraw consent at any time with effect for the future (Art. 7(3)), as easily as you gave it: in the customer area or by e-mail. Processing carried out until then remains lawful.
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.
Right to lodge a complaint (Art. 77 GDPR): The competent authority is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Maternistraße 17, 01067 Dresden (postal address: Postfach 11 01 32, 01330 Dresden), post@sdtb.sachsen.de, phone +49 351 85471-101.
Please send requests to datenschutz@einfach-elterngeld.de. To protect your data, we may ask for proof that the request comes from you.
In the customer area under “Privacy & data security”, you can at any time
- download a copy of your data under Art. 15 GDPR as a PDF,
- download a complete data export (ZIP with your data in machine-readable form, all uploaded files, applications, invoices and order documents) and
- request the erasure of your account and your data.
To protect your data, you first confirm your password and – if set up – your second factor. We log each retrieval and each request without content (type, time, channel) and inform you by e-mail. The log serves as proof that we handled your requests in time (Art. 6(1)(c) in conjunction with Art. 5(2) and Art. 12 GDPR); we delete it 3 years after the end of the year of the request. After an erasure, we only keep what we are legally obliged to keep (e.g. invoices for 8 years) and restrict this data from any other use (Art. 18 GDPR).
4. Hosting, logs, backups, security
Hosting: The website, customer area, database and e-mail mailboxes are operated for us by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data centre in Germany. We have a data processing agreement with IONOS (Art. 28 GDPR).
Server logs: For every page request, the web server stores the IP address, date and time, requested address and status code, amount of data transferred, referrer and browser identifier. The purpose is secure operation and defence against attacks (Art. 6(1)(f) GDPR). The logs are deleted after 7 days. No statistical evaluation takes place.
Application logs: technical error messages, 30 days.
Sign-in security log: customer number, event and time, without IP and e-mail address, 12 months.
Backups: We back up the database hourly and the files daily. The backups are stored on our server and additionally in encrypted form (the key stays with us) in data centres of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the EU and in the object storage of IONOS SE in Germany, each as a processor. We keep backups for 7 days; to protect against manipulation and encryption by attackers, removed backup states remain technically locked for up to 7 further days and are then permanently deleted. If a backup is restored, we repeat the deletions that became due in the meantime. We archive invoices separately and in encrypted form because of the statutory retention obligation.
Monitoring: We monitor whether our website is reachable and whether backups are running with the services Better Stack and Healthchecks.io. These services only receive technical status messages from our server, no data about you.
Protective measures: HTTPS; encrypted storage of particularly sensitive data fields (e.g. names, address, tax ID, bank details, income); two-factor sign-in (mandatory for staff with admin access); limited sign-in attempts; content security policy. Uploaded files are not publicly accessible; only authorised persons have access.
5. Cookies and similar technologies (Section 25 TDDDG)
We only store information on your device that is strictly necessary (Section 25(2) no. 2 TDDDG) or that you have allowed (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
| Name | Purpose | Duration | Type |
|---|---|---|---|
| laravel_session | session (sign-in, forms, payment process, entries in the free calculator) | until the browser closes or 120 minutes of inactivity | necessary |
| XSRF-TOKEN | protection against forged form requests | 2 hours | necessary |
| remember_web_… | “Stay signed in”, only at your request | 30 days | necessary at your request |
| ee_trusted_device | “Trust this device for 30 days”, only at your request | 30 days | necessary at your request |
| ee_geraet | recognises after sign-in whether you use a known device, so that we can warn you about a sign-in on a new device (section 7) | 365 days, only set when signing in | necessary (account security) |
| borlabs-cookie | stores your choice in the cookie notice | 1 year | necessary |
| ee-language | language when booking a consultation | 1 hour | necessary |
| referrer | remembers that you came via our partner Steuertipps (section 18) | 30 days | only with consent |
| __stripe_mid, __stripe_sid | fraud prevention by Stripe, only on payment pages | 1 year or 30 minutes | necessary for payment |
Cookie notice: It is self-programmed and uses no external services. It has three categories: “Essential” (always active), “External media” (YouTube, Google reviews) and “Partner referral” (cookie referrer). The last two are not preselected. Rejecting is as easy as accepting: all buttons are on the same level. Without consent, the website works normally. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page and in the customer area. When you withdraw, we delete the respective cookie. If new purposes are added, we ask you again.
6. Contact and support centre
E-mail, phone, contact form: We process your details (name, e-mail, phone if applicable, customer number, message, attachments) to handle your request (Art. 6(1)(b) GDPR where related to a contract, otherwise point (f)). To prevent misuse, we limit the number of messages per IP address; we only store the IP address briefly for this purpose.
Support centre: We file messages from the contact form, e-mails to our support addresses and requests from the customer area (“My requests”) as a request (ticket) in our own support system on our servers at IONOS. We store subject, sender, recipients and message texts in encrypted form; attachments are stored on our server and are not publicly accessible. Only our staff have access. Section 21 states how long we keep requests.
Phone: Our phone number +49 351 799 938 50 runs via the cloud telephone system Placetel of Gamma Placetel GmbH, Lothringer Straße 56, 50677 Cologne, Germany. On our behalf, Placetel processes your phone number if transmitted, time and duration of the call, the assignment to extensions and messages on our voicemail. According to the provider, the servers are located in Germany. We do not record calls.
Encrypted e-mails: We send outgoing e-mails via the encryption gateway “MXG” of comcrypto GmbH, Brückenstraße 4, 09111 Chemnitz, Germany. The gateway checks how secure the route to the recipient is and encrypts the transmission accordingly; this is indicated by the lock symbol in the subject line. comcrypto processes the content, attachments and addresses of the e-mails on our behalf (Art. 6(1)(f) in conjunction with Art. 32 GDPR).
Health data in messages: If you tell us, for example, your expected date of delivery on your own initiative, we only process this information to reply, on the basis of your explicit consent (Art. 9(2)(a) GDPR).
7. Customer account and sign-in
In the customer account, we store your name and e-mail address (encrypted), your password (only as a hash), language, booked services, invoice and payment status and your contract documents (order details, version of the GTC, withdrawal notice, your declarations and consents).
Two-factor sign-in: code by e-mail (valid for 10 minutes, only stored as a hash), authenticator app (key encrypted) or passkey (biometric data never leaves your device; we only store a public key). We only store recovery codes and trusted devices as hashes.
Active sign-ins: Under “Sign-in & security”, you can see where you are signed in and end other sign-ins. For this, we store for each sign-in the browser and operating system in rough form (encrypted), start, last activity and end – no IP address and no device models. If you sign in on a device that we do not yet know for your account, we send you an e-mail. We delete ended sign-ins after 30 days and known devices 12 months after the last sign-in.
Legal basis: Art. 6(1)(b) and (f), Art. 32 GDPR.
Access by staff: Staff with admin access only access data for support and order processing, always with a second factor. Every “login as customer” is logged. Only specifically authorised persons create copies of data and data exports in response to requests by e-mail or post; each operation is logged, and you receive a notification. In the customer view, staff cannot trigger a copy of data, an export or an erasure request for you.
8. Consent to the processing of special categories of data (Art. 9 GDPR)
Before you use the parental allowance calculator or the parental allowance software or upload documents for the consultation, we ask for your consent (Art. 9(2)(a) GDPR). The consent is:
- separate from the GTC, the order and other declarations, with its own checkbox that is not preselected;
- voluntary: we do not tie it to other purposes. Without this information, however, we cannot calculate or prepare applications, or only to a limited extent; the functions concerned are then not available;
- explicit and logged: we store the version and a checksum of the wording, language, time and channel;
- revocable at any time, in the customer area (profile) or by e-mail to datenschutz@einfach-elterngeld.de.
After a withdrawal, we immediately block the information concerned and delete your calculator and master data as well as generated application PDFs after 14 days; invoices and order documents remain because of the statutory retention obligation. If you consent again before then, the deletion is cancelled. In the free calculator without a customer account, we delete your entries immediately when you withdraw.
If we receive your consent in another way (e.g. by e-mail), our consultation team records this with name and time in your customer account.
If we change the wording of the consent, it receives a new version and we ask you again the next time you use the service.
Wording of the consent (version 2026-10-v3):
I consent to Einfach Elterngeld GmbH processing my information on pregnancy, birth, maternity protection, employment prohibition, illness, a disability of my child and church tax liability as well as information that may allow conclusions to be drawn about my family constellation (e.g. the chosen designation of the parents) in order to calculate my parental allowance, prepare applications and advise me. I declare that I have parental responsibility for my child and that I also release the information about my child (e.g. on a disability) for processing on the child's behalf. Where I provide information about the other parent (e.g. on maternity protection, illness or church tax liability), I confirm that the other parent has been informed and has consented to the processing of their special categories of personal data, or that I am entitled to provide this information. The only recipients are the host IONOS and, for a consultation, the consultants, each on behalf of Einfach Elterngeld GmbH; the information is stored until the chosen retention period expires. I can withdraw this consent at any time with effect for the future; the information is then blocked and deleted. Without this information, a calculation or the preparation of applications is not possible or only to a limited extent.
8a. Data of the other parent and of your child
The parental allowance application often also requires information on the other parent and on your child, e.g. name, date of birth, income and parental leave of the other parent, possibly also special categories such as maternity benefit, illness or church tax status of the other parent, and for the child the information in section 10. We only collect the information required by the respective application form. Please inform the other parent about this processing and this privacy policy.
The legal basis for the information about the other parent and your child (name, date of birth, income, parental leave, etc.) is performance of the contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in preparing your application completely and correctly (Art. 6(1)(f) GDPR). You act for your family; we use the information only for your application.
The legal basis for special categories (Art. 9 GDPR) of the other parent and of your child (e.g. maternity pay, illness, disability, church tax) is your consent (Art. 9(2)(a) GDPR; section 8). In the wording of the consent you declare that you have parental responsibility for your child and release the information about your child also on the child's behalf, and you confirm that the other parent has been informed of the processing and has consented to the processing of their special categories of personal data, or that you are entitled to provide this information. Without this consent we do not accept such information; the calculator, the software and the upload of documents cannot then be used. You can withdraw the consent at any time with effect for the future (section 8).
9. Parental allowance calculator
The calculator calculates the expected parental allowance from your entries, e.g. income and tax class; date of birth or expected date of delivery, premature birth, multiple births; periods with maternity benefits; an illness caused by pregnancy and its period; for older siblings their date of birth, a premature birth and months of parental allowance.
Legal basis: Art. 6(1)(b) GDPR; for health information your consent (section 8).
Without a customer account: Your entries are only stored in encrypted form in your session and are deleted when it ends, at the latest 120 minutes after your last entry. We do not create a hidden guest account for this and do not use the entries for analysis or advertising. We only transfer them to a customer account if you actively choose to do so when making a purchase; section 10 then applies.
We determine the federal state from the postal code using our own table (data source GeoNames), without third-party services.
10. Parental allowance software (application assistant)
Which data: what the official forms require.
- About you and, where applicable, the other parent (section 8a): names, dates of birth, address, contact details; marital status, nationality, residence title; sex as registered (only for the “sex” fields and the form of address in applications and cover letters); tax ID, health insurance; bank details for payment; employer, income, working hours, parental leave, other benefits.
- About your child: name, dates of birth, sex, tax ID, child benefit number, household.
- Special categories: pregnancy, expected date of delivery, premature birth, multiple births; maternity protection, maternity benefit, employment prohibition; illness caused by pregnancy, sickness benefit; disability of a child; church tax status.
Purpose: calculation and planning (including the most favourable assessment and example distributions); preparation of the application forms (parental allowance, child benefit, parental leave notification) and cover letters; storage so that you can continue working. When an application is created, we store the underlying calculation values as proof of calculation in your customer account.
Saving drafts: While you fill in a step of the parental allowance calculator, we automatically (and at the push of a button) save your entries that are not yet completed in encrypted form in your customer account, so that you can continue later. They are only applied when you complete the step with “Next”. We delete the drafts together with your other calculator data (section 21); after an application has been created, we no longer save new drafts. Staff cannot see your drafts.
Designation of the parents: You can choose how we refer to you and the other parent in the software (mother, father or neutral “parent”). The neutral designation is preset. This information is only used for display, is voluntary and is stored in encrypted form. It may allow conclusions to be drawn about your family constellation and thus about sexual orientation (special category under Art. 9 GDPR) and is therefore expressly part of your consent under section 8. It is not transmitted to AI services.
Legal basis: Art. 6(1)(b) GDPR; for special categories section 8 or 8a.
Recipients: We do not transmit any application data to authorities. Our host (processor) and authorised staff have access.
Protection: We store personal, tax, bank, income and health insurance data as well as periods of maternity benefit in encrypted form. The PDFs are not publicly accessible.
10a. Submitting the application (assistant and electronic signature)
This section only concerns you if you use the "Submit application" assistant in your customer account.
Which data: postcode and town (to determine the responsible office), where necessary district and – in Bavaria – your child's date of birth; the parental allowance office determined, the route you chose and your note "sent on". For the route with a qualified electronic signature additionally: the PDF/A file of your application created for signing, the signed file you upload and the result of our preliminary check (names of the signatories, time, issuer and type of certificate, whether the file was changed afterwards). The application files contain the data from section 10, including special categories.
Purpose: determining the responsible parental allowance office, showing the possible routes with instructions, providing the file for signing, checking the signature in advance and recording the dispatch for you.
Signature and dispatch: You sign electronically yourself with a trust service provider of your choice (e.g. sign-me by D-Trust GmbH). You send the application to the parental allowance office yourself, e.g. by e-mail to the address named by the office or via "Mein Justizpostfach". The privacy notices of the respective provider or authority apply. We do not transmit any data to signature providers or authorities. The preliminary check of the signature takes place on our server, without an external verification service.
Legal basis: Art. 6(1)(b) GDPR; for special categories section 8 or 8a.
Recipients and protection: Access is limited to our hosting provider (processor) and authorised staff; in a consultation, your adviser sees the office, route, status and result of the preliminary check. We store postcode, town, file details and the check result encrypted; the files are not publicly accessible. They are deleted together with the application data (section 21).
10b. Child supplement check and application
This section only concerns you if you use the child supplement (Kinderzuschlag) check in your customer account.
Which data: For the check we take over details from your parental allowance calculation (section 10: family, children, income, periods of parental allowance and maternity protection). In addition, the details you add or change in the check: housing costs (rent including heating), income from work and income of the other parent, maintenance or maintenance advance per child, other children in the household (age), other income, housing benefit and whether there are substantial assets (yes/no). We also store the result: whether child supplement is likely to be possible, the recommended month of application with the expected amount, and the date of the check. As soon as we offer filling in the child supplement application, the details required by the official application form will be added (e.g. housing situation, other persons in the household, income and expenses, child benefit number, bank details).
Purpose: initial assessment of whether and from which month child supplement is possible; showing the result in your overview; pre-filling when you check again; in future, filling in the application. You can delete the details at any time with "Discard details".
Reminder at your request: If the check results in a recommended month of application in the future, you can choose in your overview that we remind you once by e-mail on the 1st of that month to apply. Without your choice we do not send a reminder. We store your choice with the date and time; for sending we only store the date, no text and no amounts. You can unsubscribe at any time in your overview or via the link in the e-mail; the e-mail contains no advertising.
Legal basis: Art. 6(1)(b) GDPR (use of the software).
Recipients: We do not pass on the details, not even to the Familienkasse; you submit the application yourself. Access is limited to our hosting provider (processor) and authorised staff. In a parental allowance consultation, your adviser can technically see the details in the customer view but does not edit them; the child supplement check is not part of the consultation.
Protection and storage period: We store the details encrypted in your customer account and delete them together with your calculator data (section 21). Scheduled reminders are deleted 30 days after they were sent or no longer apply.
11. Parental allowance consultation
Booking: name, contact details, phone number, expected date of birth, package, payment data (section 13).
Upload in the customer area: for example payslips, tax assessments, employer certificates, birth certificate, copy of ID, maternity benefit or health insurance certificates, medical certificates and letters from the parental allowance office. We check the type and size of each file and store it so that it is not publicly accessible.
Reading your documents: Payslips, profit statements and income tax assessments that you upload for the consultation are read automatically (text recognition) on our own server in Germany, so that we can suggest figures for your parental allowance calculation to our advisers, such as monthly gross pay, tax class or profit. The data do not leave our server; we do not use external AI or cloud services and do not use your data for training. We store the extracted figures in encrypted form together with their location in the document and delete them together with the document. No figure is used without review: your adviser checks every figure against the document before it is used in the calculation. To improve recognition we only count anonymously how often a figure was recognised – without amounts, names or any link to you.
Session: by phone or Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We use a business Microsoft 365 subscription; Microsoft's data protection addendum (Art. 28 GDPR) therefore applies. Microsoft processes connection and metadata; transfers to the USA are possible (section 20). Sessions are not recorded.
Notes and applications: We prepare a summary of the session and, for Top/Premium, your applications. We store both in your customer area.
Activation of the software (Basic package): If you activate the parental allowance software after the session, we transfer your calculation from the consultation; section 10 applies to further use.
Who has access: our consultants. Some of them work freelance; we have contractually bound these persons as processors (Art. 28 GDPR).
Legal basis: Art. 6(1)(b) GDPR; for special categories section 8 or 8a.
12. Appointment portal (termin.einfach-elterngeld.de)
Sign-in: with the e-mail address of the customer account. The portal only reads the customer number, e-mail address and consultation status.
Processed: answers in the questionnaire, e.g. income range, types of income, pregnancy and expected date of delivery (with consent under section 8); appointment, language; e-mails to reserve and confirm appointments. The answers are also sent to our mailbox for review.
Storage of notes at pCloud: We store session notes (PDF) with pCloud International AG, Zugerstrasse 74, 6340 Baar, Switzerland, in the Europe data region. This is based on a data processing agreement (Art. 28 GDPR). An adequacy decision of the EU Commission exists for Switzerland. We keep the notes for at least 3 years after the consultation has been completed and delete them after that following a review.
Storage period in the portal: personal data 92 days after the appointment; sign-in attempts and IP address in the log 30 days; expired sessions 7 days.
13. Payment processing
Depending on the payment method, we pass on name, e-mail, amount and order number to the payment service. You enter card and account details directly there. The services are controllers in their own right and may carry out their own fraud and credit checks.
- Stripe (credit card, SEPA direct debit, Klarna): Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. We only load the Stripe script on payment pages.
- Klarna (via Stripe): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
- Invoice (consultation only): we process invoice data and receipt of payment ourselves or via our bank.
Legal bases: Art. 6(1)(b) GDPR; retention under Art. 6(1)(c) GDPR in conjunction with Section 147 AO (German Fiscal Code) and Section 257 HGB (German Commercial Code). We transmit invoice data to our tax accountants for bookkeeping.
14. System e-mails
We send order confirmations with contract documents and invoices; sign-in codes, password links and security notifications (e.g. sign-in on a new device); appointment confirmations; acknowledgements of receipt for withdrawals; information on the retention of your application data (notice 30 days before deletion); at your request, the reminder of the child supplement application month (section 10b, can be unsubscribed). The legal basis is Art. 6(1)(b) or (f) GDPR. E-mails are sent via our mail server at IONOS. We do not send advertising e-mails.
15. Parental allowance course (Udemy)
Our course is only available on Udemy. If you follow the link or buy there, Udemy processes your data under its own responsibility in accordance with its privacy policy. As a course provider, according to Udemy we see the names and profile information of participants, not their e-mail addresses, as well as statistics, e.g. on countries and languages. We show software customers a Udemy voucher link in the customer area; we do not transmit any data to Udemy in doing so.
16. External media – only with your consent
We only load this content once you allow “External media” in the cookie notice or agree at the preview image (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw at any time via “Cookie settings”.
- YouTube videos (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) via youtube-nocookie.com. After the start, Google receives your IP address, among other things, and may set cookies.
- Google reviews: official Google Maps element with our reviews. Google receives the IP address and device data.
Transfers to the USA are possible (section 20). Our own explanatory videos are stored on our server and do not load third-party content.
17. Reviews on our website
ProvenExpert: our own seal image with a link. No data is transmitted to ProvenExpert when a page is loaded. Our server retrieves the overall rating without your data.
Individual customer reviews: We only show individual review texts if the reviewer has expressly agreed to their use. They are then shown with first name and initial of the surname, the source and the date. The legal basis is the consent (Art. 6(1)(a) GDPR). We do not copy review texts from Google without such authorisation.
18. Partner Steuertipps
If you come via a link from our partner Steuertipps and have allowed “Partner referral” in the cookie notice, we remember this referral for 30 days in the cookie referrer. This serves to display the partner logo (co-branding) and to attribute any commission. If you buy during this period, we record the referral in your customer account. Without consent, we do not set the cookie; the website works normally. We do not pass on personal data to the partner. Legal basis: consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
19. Social media
We operate profiles on Instagram and YouTube. Our website does not embed these services; the icons at the bottom of the page are simple links.
Instagram: For the statistics on visits to our profile (Page Insights), we are joint controllers with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Art. 26 GDPR). Meta has undertaken to fulfil the information obligations and to handle data subject rights (https://www.facebook.com/legal/terms/page_controller_addendum). You can also exercise your rights against us. Meta is solely responsible for all other processing (https://privacycenter.instagram.com/policy).
YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for processing on youtube.com (https://policies.google.com/privacy). We only receive aggregated statistics on the use of our channel from YouTube, without reference to individuals.
Transfers to the USA are possible for both services (section 20).
19a. Partner offers (partner.einfach-elterngeld.de)
On partner.einfach-elterngeld.de, cooperation partners present their offers. These are advertisements; we sometimes receive a commission for referrals. There are no cookies and no analysis tools for visitors there. We only count clicks on “To the offer” per partner and day, without IP address. Details are set out in the privacy notice of the partner portal.
20. Recipients and transfers to third countries
| Service | Purpose | Role | Location / third country |
|---|---|---|---|
| IONOS SE | hosting, database, e-mail, encrypted backup copy | processor | Germany |
| Hetzner Online GmbH | encrypted backup copy | processor | EU |
| comcrypto GmbH, Chemnitz | encryption of outgoing e-mails | processor | Germany |
| Gamma Placetel GmbH, Cologne | telephone system, voicemail | processor | Germany |
| freelance consultants | parental allowance consultation | processor | Germany |
| Microsoft Ireland Operations Ltd. | video consultation (Teams) | processor (Microsoft DPA) | Ireland / USA possible |
| pCloud International AG | storage of consultation notes | processor | Switzerland, Europe data region |
| Stripe, Klarna, PayPal | payment | controllers in their own right | Ireland, Sweden, Luxembourg / USA possible |
| Google Ireland Ltd. | YouTube, Google reviews (after consent) | controller in its own right | Ireland / USA possible |
| Meta Platforms Ireland Ltd. | Instagram Page Insights | joint controller | Ireland / USA possible |
| Udemy, Inc. | course | controller in its own right | USA |
| ProvenExpert | review profile (link and server retrieval only) | controller in its own right | Germany |
| tax accountants, bank | bookkeeping, receipt of payment | controllers in their own right | Germany |
Third countries: We store your data in the EU. Microsoft, Google, Stripe, PayPal and Meta may transfer data to the USA. This is based on the adequacy decision on the EU-US Data Privacy Framework (10 July 2023) for certified companies, otherwise on standard contractual clauses (Art. 46 GDPR). An adequacy decision exists for Switzerland. You only reach Udemy if you go to udemy.com yourself; we do not transmit any data to Udemy.
21. Storage period
We only store data for as long as necessary for the respective purpose. We delete health and application data earlier than contract and invoice data. For possible legal claims, we do not keep any application content, only the specific evidence required, separately and with restricted access.
| Data | Deletion |
|---|---|
| Entries in the free calculator without a customer account | only in your session (encrypted); deleted when the session ends, at the latest 120 minutes after the last entry, or immediately when consent is withdrawn |
| Software: application data, drafts, proof of calculation, generated applications, submission data (section 10a), completed support requests | according to your choice in the customer account: immediately or 6, 12 (default), 24 or 36 months after the applications have been created, changeable at any time. We announce the deletion by e-mail 30 days in advance; the period is not extended without action on your part. For applications created before 10 October 2026, the period starts on that date. As proof of the licence used, a note without application content remains (type, date). |
| Software: paid licence not yet used | no deletion as long as the licence has not been used (unlimited right of use, GTC § 5.3); at your request we delete the account earlier |
| Consultation: uploads, notes, draft applications, submission data (section 10a), support requests | at least 3 years after the consultation has been completed, then after a review (open requests only after they have been closed) |
| Requests without a contract (e-mail, contact form, support centre without customer account) | 12 months after the request has been closed |
| Contract and evidence data without application content and uploads (order details, contract documents, your declarations, withdrawal records without IP address, records of consent after the consent has ended) | 3 years from the end of the year in which the contract or the consent ended (regular limitation period), with restricted access; insofar as they are commercial or business letters, 6 years (Section 257 HGB) |
| Invoices and accounting records | 8 years from the end of the year (Section 147 AO, Section 257 HGB) |
| Log of your data protection requests (without content) | 3 years from the end of the year; open erasure requests until they are completed |
| Active sign-ins / known devices | 30 days after the end of the sign-in / 12 months after the last sign-in |
| Appointment portal | 92 days after the appointment |
| Server logs | 7 days |
| Application logs | 30 days |
| Sign-in security log | 12 months |
| Backups | 7 days, technically locked protective copies for no more than 7 further days; repeated deletion run after every restoration |
After you withdraw your consent under section 8, we immediately block the information and delete your calculator and master data as well as the application PDFs after 14 days, unless there is a retention obligation. At your request, we delete your account earlier.
22. Obligation to provide data, no automated decisions
Without the information required for a contract, we cannot provide the service. We do not make automated decisions within the meaning of Art. 22 GDPR. The software only calculates; the authority decides on your application. Figures extracted from your documents are also always checked by a person before they are used.
23. Changes
We adapt this privacy policy when the processing or the legal situation changes. The version published here applies; earlier versions: einfach-elterngeld.de/en/legal-archive
In case of doubt, the German version of this privacy policy applies.