1. Data Controller
The data controller responsible for your personal data is German Company Formation, Graf-Adolf-Strasse 41, 40215 Düsseldorf, Germany. Email: legal@germancompanyformation.com. You may contact our Data Protection Officer at: dpo@germancompanyformation.com.
2. Data We Collect
We collect the following categories of personal data:
- Identity data: name, job title, company name
- Contact data: email address, telephone number, postal address
- Technical data: IP address, browser type and version, time zone, browser plug-in types, operating system
- Usage data: information about how you use our website, products, and services
- Marketing and communications data: your preferences in receiving marketing from us
3. How We Use Your Data
We use your personal data for the following purposes:
- To provide legal and corporate services you have requested
- To manage our relationship with you (billing, notifications, service changes)
- To respond to enquiries submitted via our contact form
- To send you marketing communications where you have consented or we have a legitimate interest
- To improve our website through analytics (aggregated, anonymised data)
- To comply with our legal obligations under German and EU law
4. Legal Basis for Processing
We process your personal data on the following legal bases under Article 6 GDPR:
- Contract performance (Art. 6(1)(b)): Processing necessary to provide the services you have engaged us for
- Legitimate interests (Art. 6(1)(f)): Analytics, fraud prevention, and marketing communications to existing clients
- Consent (Art. 6(1)(a)): Marketing emails to prospective clients; cookie consent
- Legal obligation (Art. 6(1)(c)): Retention of financial records under §147 AO (German Fiscal Code)
5. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Client legal files are retained for 10 years under German professional regulations. Financial records are retained for 10 years under §147 AO. Marketing contact data is deleted upon opt-out or after 3 years of inactivity.
6. Data Sharing
We do not sell your personal data. We share data with:
- Our professional advisors (notaries, tax authorities) where required to provide services
- Cloud service providers (e.g. Vercel for hosting, Mailchimp for email) acting as data processors under GDPR-compliant DPAs
- German authorities where required by law (e.g. Geldwäschegesetz AML obligations)
7. Your Rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15): Request a copy of your personal data
- Right to rectification (Art. 16): Request correction of inaccurate data
- Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
- Right to restriction (Art. 18): Request restriction of processing in certain circumstances
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
- Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent: Withdraw consent at any time without affecting lawfulness of prior processing
8. Cookies
We use cookies and similar tracking technologies. For details, please see our Cookie Policy. You may withdraw cookie consent at any time via our cookie preference centre.
9. International Transfers
Where we transfer your data outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission. Our cloud infrastructure primarily operates within the EU.
10. Supervisory Authority
You have the right to lodge a complaint with the competent supervisory authority. In Germany, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Friedrichstr. 219, 10969 Berlin. You may also contact the supervisory authority in your country of residence.
11. Contact
For any questions about this Privacy Policy or to exercise your rights, please contact: legal@germancompanyformation.com or by post to: German Company Formation, Attention: Data Protection, Graf-Adolf-Strasse 41, 40215 Düsseldorf, Germany.