Privacy Policy

This translation is provided for convenience. Only the German version is legally binding.

General

We attach great importance to data protection. Your personal data is collected and processed in compliance with the applicable data protection provisions, in particular the EU General Data Protection Regulation (GDPR). We collect and process your personal data in order to be able to offer you our website and the faktoora platform. In accordance with Art. 13 GDPR, this policy describes which data we use, in what way, for what purpose and to what extent, and what choices and rights you have in connection with the use of your personal data. Section 2 concerns our website, section 3 the use of the faktoora platform. Automated decisions within the meaning of Art. 22 GDPR do not take place in any area.

1. Controller

faktoora GmbH, represented by Dr. Peter Schenkel, Amselweg 1, 89231 Neu-Ulm, is responsible for compliance with data protection on our site.

For data protection enquiries, we are happy to help at privacy@faktoora.com.

Contact details of the data protection officer:

PROLIANCE GmbH
www.datenschutzexperte.de
Leopoldstr. 21
80802 Munich
datenschutzbeauftragter@datenschutzexperte.de

When contacting the data protection officer, please state the company to which your enquiry relates. Please refrain from enclosing sensitive information, such as a copy of your identity document, with your enquiry.

2. Data Collection on Our Website

a) Server log files

When you visit our website https://faktoora.com, information is automatically transmitted by your browser to the server of our website. This information is stored only briefly in server logs; these are not stored permanently but are continuously overwritten as part of automatic log rotation.

This comprises the following data:

• your IP address,
• date and time of access,
• name and URL of the file accessed,
• the website from which access is made (referrer URL),
• information about the browser and operating system you use,
• where applicable, identifiers of your internet access derived from the IP address.

This data is used for the purpose of ensuring a smooth connection and convenient use of our website, and for evaluating system security and stability.

The legal basis for the data processing is Art. 6(1)(f) GDPR; our legitimate interest follows from the purposes stated above.

The data is not used to draw conclusions about your person.

b) Communication by email

If you write to us by email, we process at least your email address and the information in your message in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to an existing or prospective contract, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries). For our enquiry forms, see point j.

We delete your data once the enquiry has been handled, unless statutory retention obligations prevent this.

c) Processing of customer and contract data

When initiating business, concluding contracts and performing contracts, we use the personal data of yours that is necessary for this purpose in accordance with Art. 6(1)(b) GDPR.

Data is transferred to third parties only if and insofar as this is necessary for the performance of the contract, e.g. if a credit institution has been engaged to process payments.

This personal data is deleted after expiry of the statutory warranty periods or after the end of statutory retention periods (Art. 6(1)(c) GDPR).

For the use of the faktoora platform with your own user account, see section 3.

Whenever you register, place an order or carry out any other binding action on our website, we store your IP address together with the date and time. This is done for your protection and, in accordance with Art. 6(1)(f) GDPR, on the basis of our legitimate interest in being able to prove that a claim has arisen and in preventing misuse or unauthorised use of our system.

d) Processing by payment service providers

For paid services, we process your personal data, in particular payment data (account, credit card and other bank data), on the basis of Art. 6(1)(b) GDPR. This is done for the purpose of performing the contract (payment processing/accounting). Where necessary, your payment data is transmitted to service providers (credit institutions, payment service providers, our tax adviser) for the payment transaction and for billing, or is processed directly by them.

Your payment data is stored for the duration of the existing contractual relationship. We retain our billing records (invoices and payment receipts) for 8 years under § 147(3) AO (German Fiscal Code) (Art. 6(1)(c) GDPR); otherwise, the payment data is deleted after the contractual relationship has been fully terminated.

e) Cookies and storage on your device

Our website uses cookies and comparable storage technologies (e.g. your browser's local storage and session storage). Cookies are small text files that are stored on your device.

We distinguish between:

• Necessary storage: This is required for the site to function and to be operated securely. It includes protecting our forms against automated misuse, storing your choice in the privacy settings and – if you expressly choose a language – a cookie that stores this language choice for up to one year and applies to all services under faktoora.com, including our application. The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); the subsequent processing is based on Art. 6(1)(f) GDPR.
• Statistics: Analysis of the use of our site (Google Analytics, see point f; session identifier of the usage measurement in the help area, see point k).
• Marketing: Measuring the success of our advertisements and campaigns (Google Ads, see point g; campaign attribution, see point i).

We use the "Statistics" and "Marketing" categories exclusively with your consent. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. As long as you have not given your consent, the corresponding services are not loaded; to that extent, no connection to their servers takes place either.

You can change or withdraw your choice at any time with effect for the future. To do so, click the "Cookie settings" link at the bottom of every page. The change takes effect immediately. The withdrawal does not affect the lawfulness of the processing carried out up to that point. Irrespective of this, you can delete stored cookies at any time via your browser settings.

We store your decision itself, with a timestamp, in your browser's local storage so that we can take it into account and demonstrate it on further visits. If the services or purposes used change, we will ask you again.

f) Google Analytics

Following your consent to the "Statistics" category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Without your consent, Google Analytics is not loaded.

The purpose of the processing is the statistical analysis and continuous improvement of our offering. Pseudonymous usage profiles are created and cookies are used in the process. The following in particular is recorded:

• date and time of access,
• pages accessed and their addresses,
• the website from which access is made (referrer URL),
• information about the browser and operating system used,
• approximate location (derived from the IP address).

Google Analytics 4 does not store the IP address permanently; it is used to determine the approximate location and then discarded. Event data is deleted after 2 months, user-related data after 14 months; in the event of renewed activity, the period for user-related data starts again. The cookies (_ga, ga*) have a lifetime of up to two years. Processing in the USA by Google LLC cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR are in place. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google.

We use Google Consent Mode v2. Your choice is transmitted to Google and controls whether and to what extent data may be processed.

You can withdraw your consent at any time via the "Cookie settings". In addition, you can prevent collection by means of the browser add-on provided by Google: https://tools.google.com/dlpage/gaoptout

Further information can be found in Google's privacy policy: https://policies.google.com/privacy

g) Google Ads conversion tracking

Following your consent to the "Marketing" category, we use Google Ads conversion tracking, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

The sole purpose is to measure the success of our advertisements: we want to understand which advertisement led to an enquiry or registration. For this purpose, the click identifier of the advertisement (e.g. "gclid") and the submission of a form are transmitted to Google.

We do not carry out personalised advertising or remarketing via our website. The corresponding consent signal ("ad_personalization") remains technically disabled, even if you consent to the "Marketing" category.

In the process, Google sets a cookie for attributing conversions (e.g. "_gcl_au", lifetime of up to 90 days). Google processes the conversion data as an independent controller; the Google Ads data protection terms for controllers (Google Ads Controller-Controller Data Protection Terms) apply. We store the click identifier on our website only for the duration of the browser session.

For the transfer to the USA, the statements under point f) apply accordingly. You can withdraw your consent at any time via the "Cookie settings".

h) Cloudflare Turnstile

To protect our forms against automated entries ("bots") and spam, we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, or of Cloudflare Germany GmbH, Rosental 7, 80331 Munich.

In the process, technical information from your browser and your IP address are transmitted to Cloudflare and evaluated there in order to distinguish whether the entry comes from a human. Cloudflare Turnstile does not use cookies for recognition and does not create advertising profiles.

The legal basis is our legitimate interest in the secure, misuse-free operation of our forms in accordance with Art. 6(1)(f) GDPR; for the technically necessary access to your device, § 25(2) no. 2 TDDDG applies. Processing takes place only on pages with forms.

Insofar as data is transferred to Cloudflare, Inc. in the USA in the process, this takes place on the basis of the EU-US Data Privacy Framework, under which Cloudflare is certified, and additionally of the EU Standard Contractual Clauses.

Further information: https://www.cloudflare.com/privacypolicy/

i) Attribution of enquiries to advertising campaigns

Following your consent to the "Marketing" category, we store in your browser's session storage during your visit how you found us:

• campaign parameters from the address accessed (e.g. "utm_source", "utm_medium", "utm_campaign") and click identifiers such as "gclid", "fbclid" or "msclkid",
• the website from which you came to us,
• the first page accessed, the time of the first page view and the pages accessed during the visit.

This information is held exclusively in your browser and is deleted automatically as soon as you close the browser tab or withdraw your consent. Only when you submit a form is it transmitted to us together with your enquiry and stored in our own system (see point j). No transfer to third parties takes place in the process.

The purpose is to measure the success of our own marketing activities. The legal basis for storage on your device is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR; we base the evaluation of the information transmitted with your enquiry on Art. 6(1)(f) GDPR. Without your consent, no storage takes place.

j) Contact, consultation and trial requests

If you use our enquiry form, we process the data you provide (depending on the form: name, email address, company, telephone number, subject and your message) as well as the attribution data mentioned under point i), your IP address, the browser identifier and the time of submission.

The purpose is to handle your enquiry and – in the case of a trial registration – to set up your access. The legal basis is Art. 6(1)(b) GDPR (taking steps prior to entering into a contract) and Art. 6(1)(f) GDPR with regard to the storage of the IP address and time for evidence and misuse-prevention purposes.

Your enquiry is stored in our own customer management system and retained there for the duration of its handling and of any subsequent business relationship. If no business relationship comes about, we delete the enquiry as soon as it has been finally handled and no statutory retention periods prevent this.

A password that you set during a trial registration is used exclusively to set up your access and is not stored in our customer management system.

k) Usage measurement in the help area

To improve our help area, we record on the help pages which articles are accessed, which search terms are entered and whether contact is made with us from there. Before storage, search terms are cleansed of email addresses, telephone numbers, IBANs and longer sequences of digits. The events are transmitted exclusively to our own system and stored in server logs that are continuously overwritten as part of automatic log rotation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in improving our help offering. You can object to this processing under Art. 21 GDPR.

Following your consent to the "Statistics" category, we additionally store a random session identifier in your browser's session storage in order to combine the events of a visit; it is deleted when the tab is closed (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR). Without consent, we record the events without an identifier. If you create a support ticket from the help area (name, email address, subject and message), we transmit the session identifier and the help articles previously accessed with the ticket in order to be able to handle your request more quickly (Art. 6(1)(b) GDPR).

l) Hosting

Our website is hosted by Hetzner Online GmbH in Germany as a processor.

m) E-invoice validator

Our public e-invoice validator checks uploaded e-invoices for format conformity. If you voluntarily provide your email address there in order to receive information about faktoora, we store it in our self-operated customer communication system. The legal basis is your consent (Art. 6(1)(a) GDPR). We store the address until you unsubscribe or request its erasure; you can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every email or at privacy@faktoora.com.

3. Use of the faktoora Platform

This section applies if you create a user account with faktoora and use the platform.

a) Roles

faktoora GmbH is the controller for the data of your user account and of your contractual relationship with us. Data about third parties that you, as a business customer, process in the platform (e.g. invoice recipients, suppliers, contacts) is processed by us as a processor on your instructions on the basis of our data processing agreement; in this respect, your company is the controller.

b) Data processed and purposes

• Account data (name, email address, role, permissions) for account management, login and access control. Login takes place via an identity provider operated by us; passwords are stored there exclusively in hashed form. Alternatively, login can take place via single sign-on through your organisation's identity provider (e.g. Microsoft Entra ID).
• Invoice and contact data for the creation, delivery, management and storage of invoices during the contract term.
• Usage data (login times, activity logs, session data) for security monitoring and for a tamper-evident audit trail. We process activity and audit logs relating to your account as a processor under the data processing agreement.
• API logs (requests to and responses from our application programming interface, including IP address) for security, for support and for the traceability of use. Insofar as they contain data of your company, we process them as a processor under the data processing agreement.
• Payment data for subscription management (we do not store card numbers) and – if you connect a bank account – bank transactions for matching payments to invoices and – if you initiate transfers from faktoora – the transfer data.
• Incoming invoice files, if automatic data extraction is enabled for your account.
• Product communication: We transmit registration and subscription events (email address, registration date, plan) to our self-operated customer management and customer communication systems in order to inform you about your account and our offering. You can object at any time to the use of your email address for information about our offering, without incurring any costs other than the transmission costs at the basic rates – via the unsubscribe link in every email or at privacy@faktoora.com.

c) Legal bases

• Art. 6(1)(b) GDPR for account management, invoicing functions, subscription and support.
• Art. 6(1)(c) GDPR for the retention of our own accounting and billing records under commercial and tax law (§ 147 AO; § 257 HGB, German Commercial Code). We carry out transmissions to tax authorities in e-invoicing (e.g. VeriFactu in Spain, KSeF in Poland) as a processor on behalf of the respective customer.
• Art. 6(1)(f) GDPR for security monitoring, error detection, platform stability and product communication; our legitimate interest lies in the secure and reliable operation of the platform and in informing our customers.

d) Support access to your account

Authorised faktoora support staff can temporarily access your account in order to provide support or to investigate or resolve problems on your behalf. This access is restricted to authorised personnel, time-limited and recorded in a tamper-evident audit log. Insofar as data of your company is affected in the process, the processing takes place as processing on behalf of the controller under clause 11 of the data processing agreement.

e) AI-assisted features

AI-assisted features are optional. For automatic data extraction from incoming invoices, the uploaded file is transmitted to a specialised service provider. For AI-assisted document search, only the search query entered is transmitted to an external AI service; documents and other data remain with us. The search query contains personal data only if you enter such data. Automated decisions within the meaning of Art. 22 GDPR do not take place.

f) Storage period

4. Recipients and Transfers to Third Countries

We transfer your personal data to third parties only insofar as you have consented (Art. 6(1)(a) GDPR), this is necessary for the performance of a contract (point (b)), we are legally obliged to do so (point (c)), or this is necessary to safeguard our legitimate interests and your interests do not override them (point (f)).

To operate the platform, we use carefully selected service providers as processors:

Further recipients:

The current overview can also be found in our Trust Center at trust.faktoora.com. If you yourself connect accounting, ERP or CRM systems (e.g. DATEV, Xero, Bexio, HubSpot), we transmit data to them on your instructions.

Our own processing takes place in the EU. Where a service provider processes data outside the EU or can access data from there – see the information in the table – this takes place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR) or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We do not sell personal data. We do not pass on data from the platform for advertising purposes; on the website, we transmit data for measuring the success of advertisements only with your consent (section 2 g).

5. Obligation to Provide Data

The provision of your data is not required by law or by contract. However, the information marked as mandatory fields is necessary for concluding and performing a usage contract and for handling enquiries; without it, we cannot conclude the contract or handle the enquiry. The connection data mentioned under point 2 a) is processed for technical reasons.

6. Your Rights

You have the following rights against us with regard to the personal data concerning you:

• Access (Art. 15 GDPR) to the data processed by us, the purposes, recipients, storage period and source.
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data.
• Erasure (Art. 17 GDPR), unless statutory retention obligations or other exceptions under Art. 17(3) GDPR prevent this.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) – in the platform also via self-service export (CSV and PDF, partly XLSX; JSON on request).
• Withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future, for example via the "Cookie settings" at the bottom of every page.
• Complaint to a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA).

Right to object under Art. 21 GDPR: Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. If we process your data for direct marketing, you can object to this at any time without giving reasons.

To exercise your rights, an email to privacy@faktoora.com or to our data protection officer is sufficient. You can also exercise some rights directly in the platform (export, editing, deleting the account). We respond to requests without undue delay, at the latest within one month; for complex requests, the period may be extended by two further months, of which we will inform you.

7. Data Security

This site and the faktoora platform use TLS encryption to protect transmission. You can recognise an encrypted connection by the fact that the browser's address bar begins with "https://" and shows a padlock symbol.

In addition, we have taken technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction or unauthorised access – including full disk encryption of the production servers, role-based access control, multi-factor authentication for infrastructure access and a tamper-evident audit trail. Further information can be found in our Trust Center.

8. Status and Changes to This Privacy Policy

This privacy policy is current as of 29.10.2026.

We adapt this privacy policy when legal requirements or our services change. We inform registered users of material changes by email or in the platform.

Our privacy policy is available at any time for viewing and printing at https://faktoora.com/datenschutz.