Privacy

Short version: privacy-friendly. The Quick Check works without registration. We do not store real names in the Quick Check. Some inputs and the result are stored as a pseudonymized check, separated from an optional email address (double opt-in).

1. Controller

The controller for this website is named in the imprint.

2. What this is about

SteuKompass is a Quick Check for a rough estimate of a possible tax refund or additional payment. It is not tax advice.

3. What data we process

A) Quick Check inputs (for the estimate)

When you use the Quick Check, we process the values you enter to calculate a range.

B) Storage as a "check" (pseudonymized, without real names)

We also store a check in our database to improve the quality of the tool (for example plausibility checks, common input combinations and optimization of the calculation logic).

A check may include in particular:

  • Tax year and filing type (single or joint filing)
  • Inputs from the Quick Check (for example gross employment income, wage tax, solidarity surcharge/church tax, commute km/days, childcare, §35a labour costs)
  • Estimated result (min/mid/max)

Important: A check contains no real names and no full address.

C) Email (optional, double opt-in, stored separately)

You can optionally provide an email address to receive the result and/or a reminder. For this we use a double opt-in process (6-digit confirmation code).

The email address is stored in a separate database table and is technically separated from the checks. In addition, we store the necessary log data to prove consent (for example timestamps of sign-up and confirmation).

We use Brevo as an email delivery service (processor).

D) Server logs (web server)

When you access the website, server log data is processed for technical reasons (for example IP address, date/time, requested URL, status code, user agent, referrer if sent). These logs are processed to ensure operation, analyze errors and prevent abuse (for example attacks).

We store server logs only as long as necessary and delete or rotate them regularly. Currently, Apache logs are retained for a maximum of 14 days.

4. Purposes of processing

  • Calculating and displaying the estimate
  • Improving the tool by evaluating pseudonymized checks
  • Sending emails only on request and after confirmation
  • Secure operation, error analysis and abuse prevention (server logs)

5. Recipients and service providers

We use service providers (processors) where required for operation and communication:

  • Hosting/server operation (VPS) at Contabo
  • Email delivery via Brevo

We do not share data with third parties otherwise unless we are legally required to do so.

Note on transfers: Processing generally takes place within the EU/EEA. If in individual cases processing in third countries is necessary, this will only take place on the basis of appropriate safeguards (for example EU Standard Contractual Clauses) where legally applicable.

6. Cookies and tracking

We do not use third-party tracking cookies that follow you across other websites.

Strictly necessary cookies may be used in individual cases (for example to store language settings). If we use analytics tools in the future, we will document this transparently here.

7. Security measures

We use common technical and organizational measures to protect data (for example TLS/SSL encryption in transit and access restrictions).

8. Legal bases

  • Quick Check (calculation): Art. 6(1)(b) GDPR
  • Checks (product improvement): Art. 6(1)(f) GDPR
  • Email delivery (double opt-in): Art. 6(1)(a) GDPR (consent)
  • Logging of double opt-in: Art. 6(1)(f) GDPR (proof and abuse prevention)
  • Server logs: Art. 6(1)(f) GDPR (secure operation and IT security)

9. Retention periods

  • We store checks only as long as necessary for analysis and product improvement.
  • We store email data until you unsubscribe or withdraw your consent, or the purpose no longer applies.
  • Server logs are rotated regularly and currently retained for a maximum of 14 days.

10. Your rights

Depending on the case, you have the right to access, rectification, erasure, restriction of processing, data portability and objection.

Objection: If we process data based on Art. 6(1)(f) GDPR (legitimate interest, for example pseudonymized checks or server logs), you can object at any time on grounds relating to your particular situation.

You can withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority (for example in Bavaria with the Bavarian State Office for Data Protection Supervision, BayLDA).

11. No automated decision-making

We do not use automated decision-making or profiling with legal or similarly significant effects.

12. Contact

For privacy-related requests, please use the contact options in the imprint.