Datenschutz

In short

• No accounts, no tracking, no advertising, no analytics cookies. The fonts are served from this site, not from Google.
• The company password sets one functional cookie for 30 days so the Library stays open on your device. It contains no personal data.
• You give us personal data only when you send a form or an email. We store it to answer you, and for nothing else.
• A question is passed to a partner tax advisor only when you tick the box that allows it.
• The site runs on Cloudflare, a US company, under EU standard contractual clauses and the EU-US Data Privacy Framework.

Controller

Alexander Richard Hecking, Oskarstraße 54, 46149 Oberhausen, Germany, info@financial-decision.de. No data protection officer is required for a business of this size; questions about your data go to the address above.

Visiting the site

When you open a page, your browser sends the data every website needs to answer: your IP address, the address of the page, the time, and information about your browser and device. Cloudflare, which hosts the site, processes this data to deliver the page and to protect the site against attacks, and keeps it in technical logs for a few days. We do not use it to identify you. Legal basis: Art. 6(1)(f) GDPR, our interest in a working and secure website.

The site sets no cookie and loads nothing from third parties on the public pages. There is no consent banner because there is nothing to consent to.

The company password and its cookie

Employees of participating companies open the Library with a password their HR forwards. When the password is right, the site sets one cookie, fd_access, for 30 days: it holds the short name of the company, a random id for this device and a signature, nothing else. It is needed so that the Library stays open without an account or an email address; without it, every page would ask for the password again. That makes it strictly necessary under §25 (2) TDDDG, so no consent is asked. We count how many devices of a company opened the Library in a month and tell the company that number; the count cannot be traced to a person. Delete the cookie in your browser to sign out.

Wrong passwords are limited to 20 attempts per connection in ten minutes; for that, a hashed form of the IP address is kept for ten minutes, then deleted.

Forms

Every form on this site stores what you type in a database at Cloudflare (D1) and nothing more. Each form is protected against bots by a hidden field and the attempt limit described above. When Cloudflare Turnstile is switched on, it is named in the services below.

The question form

Your question, the answers to the four routing questions, the topic, your name, your email address and, optionally, your company. We use them to route your question: to the free Orientation Call, to a property conversation, or to a tax advisor from our network. Every question also goes, without your name, on the list for the next live session and the FAQ. Legal basis: Art. 6(1)(b) GDPR (steps before a possible engagement). Retention: 12 months after our last contact about it.

Forwarding to a partner tax advisor happens only when you tick the box in question 6. Then your question and your contact details go to one English-speaking tax advisor from our network, who contacts you directly and is responsible for your data from there. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time by email; the withdrawal does not affect what was forwarded before.

Webinar registration

Your name, email address, company and, optionally, one question. We use them to confirm your place, remind you the day before, and send the recording and the FAQ afterwards. Your question may be answered in the session or the FAQ without your name. Legal basis: Art. 6(1)(b) GDPR. Retention: six months after the session.

Request a place for Decision: Pension

Your name, email address, which contracts you hold, how long you expect to stay, optionally your company password and a deadline. We use them to confirm a place and to prepare the engagement. Legal basis: Art. 6(1)(b) GDPR. Retention: 12 months if no engagement follows; otherwise for the engagement plus the statutory retention of business records (six and ten years, §257 HGB, §147 AO). Your documents for the engagement are deleted after it ends unless you take the annual review.

Reform countdown emails and guide downloads

Your email address. Until the email tool is in use, the address is stored and nothing is sent; once it is, you receive one email to confirm (double opt-in), and only a confirmed address receives the countdown emails or the guide link. Legal basis: your consent, Art. 6(1)(a) GDPR; every email has an unsubscribe link. Retention: unconfirmed addresses are deleted after 30 days; confirmed ones until you unsubscribe.

Email

Email to info@financial-decision.de is received and answered through Proton Mail (Proton AG, Switzerland). We keep a conversation as long as it is open and up to 12 months afterwards, longer only where the law requires it (business correspondence: six years, §257 HGB).

Services and recipients

The services the site uses, with what they receive. This list is kept in the site's code and changes with the site; the date at the top moves with it.

Not yet in use

These tools are planned and will be added here, with their details, the day they go live:

• Transactional and list email: Not yet chosen (planned: Brevo, Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany). Confirmations, reminders, the reform countdown emails and guide links, each with double opt-in.
• Bot protection on forms: Cloudflare Turnstile (Cloudflare, Inc., see above). Telling people from bots when a form is sent, without a puzzle.
• Booking: Not yet chosen (planned: Cal.com or Calendly), linked, never embedded. Booking the Orientation Call and session dates.
• Payment: Not yet chosen (planned: Stripe payment links, or an invoice by email). Paying for a Decision package once a place is confirmed.
• Analytics: Not yet in use (planned: Plausible Analytics, Plausible Insights OÜ, Estonia). Counting page views without cookies or personal identifiers.

Transfers outside the EU

Cloudflare, Inc. is based in the USA and runs a global network; data can be processed outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework and we have concluded its data processing agreement with the EU standard contractual clauses. Proton AG is based in Switzerland, for which the European Commission has an adequacy decision. No other transfer takes place.

Your rights

You can ask us at any time which data we hold about you (Art. 15 GDPR), have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), receive it in a portable form (Art. 20), object to processing based on our legitimate interest (Art. 21), and withdraw a consent you gave (Art. 7(3)) with effect for the future. One email to info@financial-decision.de is enough. You also have the right to complain to a data protection supervisory authority, for example the one at your place of residence or the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

Changes

This page changes when the site does: a new tool, a new form, a new retention period. The date at the top is the date of the last change.