Privacy Policy

1. Data Controller

The controller responsible for the processing of personal data in connection with ContaTaxPay is:

SMARTPOINT DIGITAL VISION SRL – Zweigniederlassung DeutschlandRaiffeisenweg 5, 88416 Erlenmoos, GermanyEmail: info@contataxpay.comPhone: +49 155 68205116Platform: ContaTaxPay

2. Scope of this Privacy Policy

This Privacy Policy applies to the ContaTaxPay website and all functions provided through the digital platform.

These include, in particular:

• user accounts and company accounts;
• customer and supplier management;
• outgoing and incoming invoices;
• document uploading and management;
• automated document recognition using OCR;
• accounting functions;
• cash book and accounting journal;
• management of receivables and liabilities;
• fixed assets and depreciation (AfA);
• financial and accounting reports and analyses;
• employee and payroll management;
• tax-related and ELSTER functions;
• electronic invoices and exports;
• customer communication and technical support.

3. Data Processed When Visiting Our Website

When you visit our website, certain technical information may be processed automatically.

This may include:

• IP address;
• date and time of access;
• pages and files accessed;
• browser type and version;
• operating system;
• device information;
• referrer URL;
• technical, security, and system log data.

This information is used to ensure the secure and technically reliable operation of our website and platform, identify technical errors, prevent misuse, and protect our IT infrastructure.

The legal basis may be our legitimate interests pursuant to Article 6(1)(f) GDPR.

4. Registration and User Accounts

When creating and using a ContaTaxPay account, the following information may be processed, depending on the circumstances:

• first and last name;
• email address;
• telephone number;
• user role and access permissions;
• company name;
• company address, or the address (street, postal code, city) of private individuals;
• tax information;
• tax number;
• VAT identification number (USt-IdNr.);
• banking and payment information, where required;
• authentication and security information (e.g. password in encrypted form, one-time code for email confirmation);
• account settings;
• information regarding the use of the platform.

The data is processed for the creation, administration, and security of the user account and for providing the ContaTaxPay services. The mandatory fields requested during registration are necessary to conclude the contract; without them an account cannot be created.

The legal basis is, in particular, Article 6(1)(b) GDPR.

5. Accounting and Financial Data

When using ContaTaxPay functions, the following data may be processed:

• outgoing invoices;
• incoming invoices;
• invoice numbers;
• invoice dates;
• accounting/posting dates;
• net and gross amounts;
• VAT and other tax information;
• payment information;
• customer and supplier information;
• accounting entries;
• accounts and contra accounts;
• supporting documents;
• cash book information;
• receivables and liabilities;
• fixed assets;
• depreciation;
• financial and accounting reports;
• information required for tax declarations.

Processing is necessary to provide the accounting, tax, reporting, and administrative functions requested by the user.

Depending on the circumstances, the legal basis may be Article 6(1)(b) or Article 6(1)(c) GDPR.

6. Documents Uploaded to ContaTaxPay

Users may upload invoices, receipts, contracts, accounting documents, and other business documents to the platform.

These documents may contain personal data, including:

• names and addresses;
• contact information;
• banking information;
• tax information;
• customer information;
• supplier information;
• employee information;
• contractual information.

The data is processed for the purpose of providing the functions requested by the user and storing documents within the user's account.

7. OCR and Automated Document Processing

ContaTaxPay uses or may use OCR technologies and automated processes to extract information from uploaded documents.

The system may automatically identify, for example:

• supplier or customer;
• invoice number;
• invoice date;
• net amount;
• VAT;
• gross amount;
• IBAN;
• payment information;
• tax number or VAT identification number;
• other information relevant to accounting.

The purpose is to reduce manual data entry and automate the processing of accounting documents.

For text recognition and structuring, the uploaded documents or their content are transmitted to an AI/OCR service provider (OpenAI) and processed there on our behalf (see Section 14).

Automatically recognized information may subsequently be reviewed, corrected, and confirmed by the user or another authorized person. No decision based solely on automated processing within the meaning of Article 22 GDPR that produces legal effects concerning the user takes place.

8. Employee and Payroll Data

If a customer uses the employee and payroll modules, ContaTaxPay may process data such as:

• employee's first and last name;
• address;
• date of birth;
• contact information;
• employment start and termination dates;
• type of employment;
• working hours;
• employment contracts;
• salary and remuneration information;
• tax information;
• social security information;
• health insurance information;
• banking information;
• payslips and other employment-related documents.

The employer remains responsible for ensuring that there is a lawful basis for entering and processing its employees' personal data.

Where ContaTaxPay processes such information solely on behalf of a customer, the processing is carried out in accordance with the applicable GDPR requirements governing processing on behalf of a controller.

9. Tax Data and ELSTER

Where users make use of the tax-related functions of ContaTaxPay, information required for preparing, reviewing, generating, or transmitting tax declarations may be processed.

Depending on the available functions, this may include:

• VAT advance returns (UStVA);
• annual VAT returns;
• EÜR;
• data for other tax forms and declarations;
• company tax information;
• figures generated from accounting records.

Data is transmitted to authorities only where this is necessary for the selected function and in accordance with the applicable process.

10. Electronic Invoices

ContaTaxPay may provide functions for creating, importing, processing, storing, and exporting electronic invoices.

Supported formats may include:

• XRechnung;
• ZUGFeRD;
• other electronic formats supported by the platform.

For these purposes, information necessary for invoicing is processed, including company, customer, service, product, tax, and payment information.

11. Payments and Subscriptions

External payment service providers may be used for paid services and subscriptions.

Information required to process a payment is transmitted to the respective payment provider only to the extent necessary to carry out the transaction and manage the subscription.

For payments (e.g. payment links and subscriptions) we use Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). The data required to process the payment is transmitted, in particular name, email address, amount and payment details. The legal basis is Article 6(1)(b) GDPR.

12. Contact and Support

If you contact us by email, telephone, contact form, or through a support function provided within the platform, we may process:

• your name;
• email address;
• telephone number;
• company information;
• account information;
• the content of your request;
• documents or screenshots submitted by you.

The data is used to process your request and provide the necessary support.

The legal basis may be Article 6(1)(b) or Article 6(1)(f) GDPR.

13. Cookies and Similar Technologies

ContaTaxPay uses cookies and similar technologies (for example the local storage of your browser). Non-essential technologies are only activated after you have given your consent (Section 25(1) TDDDG, Article 6(1)(a) GDPR).

Strictly Necessary Cookies and Storage Access

These are necessary for the proper operation of the website and platform. They are permitted without consent (Section 25(2) No. 2 TDDDG). They are used for:

• authentication and login;
• maintaining user sessions;
• security;
• language selection (storing the language you chose);
• storing your cookie choice (entry “ctp.consent.v1” in local storage, valid for 12 months);
• technical operation of the platform (e.g. recovery after software updates).

Statistics and Marketing Technologies

If we use analytics, statistics, or marketing technologies that require consent, they will only be activated after you have provided the required consent. Currently this concerns audience measurement with Vercel Web Analytics in parts of the platform (category “Statistics”). We currently do not use marketing technologies.

Error Monitoring

To detect and fix technical errors we use an error-monitoring service. Technical error information is transmitted; identifiers and accounting data are masked before transmission. The legal basis is our legitimate interest in stable and secure operation (Article 6(1)(f) GDPR).

Your Choices

You can accept or reject non-essential categories and change your choice at any time with effect for the future – via the “Cookie Settings” link in the footer of every page or here: Cookie Settings.

14. Hosting and Technical Service Providers

For the operation of the ContaTaxPay platform, we may use specialized service providers for:

• hosting and cloud infrastructure;
• data storage;
• security;
• email services;
• document processing;
• OCR;
• communication services;
• payment processing;
• technical maintenance.

Where these service providers process personal data on our behalf, they are engaged in accordance with the applicable GDPR requirements for processors.

We currently use, in particular, the following service providers:

• Server hosting: operation of the application and database on servers operated by us at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany;
• Amazon Web Services (AWS): storage of uploaded documents (Amazon S3) and sending of system emails, e.g. verification codes and invoice delivery (Amazon SES);
• OpenAI: AI-assisted text recognition and structuring of receipts and documents;
• Stripe: payment processing;
• Sentry (Functional Software, Inc.): error monitoring (see Section 13);
• Vercel Web Analytics (Vercel Inc.): audience measurement, only with your consent (see Section 13).

Where these providers process personal data on our behalf, data processing agreements are in place.

15. Disclosure of Data to Third Parties

ContaTaxPay does not sell users' personal data.

Personal data may only be disclosed where there is an appropriate legal basis, for example:

• where necessary to perform a contract;
• to authorized technical service providers;
• to payment service providers;
• to an accountant or adviser authorized by the customer;
• to tax authorities or other public institutions where necessary;
• to comply with a legal obligation;
• for the establishment, exercise, or defense of legal claims.

16. Data Transfers Outside the EU/EEA

Some technical service providers may be located or maintain infrastructure outside Germany or the European Economic Area.

Where personal data is transferred internationally, such transfer will only take place in accordance with GDPR requirements and applicable legal safeguards, such as an adequacy decision or the European Commission's Standard Contractual Clauses, where required.

A transfer to the USA may take place in particular with OpenAI, Stripe, Sentry, Vercel and Amazon Web Services.

17. Data Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected or for as long as statutory retention obligations apply.

Accounting and tax documents are retained in accordance with the applicable statutory retention periods.

After the applicable retention periods have expired, the data is deleted or anonymized unless another legal basis permits or requires its continued retention.

Deletion of a ContaTaxPay account therefore does not necessarily result in the immediate deletion of all accounting or tax documents where statutory retention obligations apply.

18. Data Security

ContaTaxPay implements appropriate technical and organizational measures to protect personal data against:

• unauthorized access;
• loss;
• alteration;
• destruction;
• unauthorized disclosure;
• misuse.

Such measures may include:

• encrypted data transmission;
• access controls;
• role-based permissions;
• authentication mechanisms;
• security logging;
• backups;
• data recovery procedures;
• measures designed to protect server and cloud infrastructure.

19. Rights of Data Subjects

Under the GDPR, data subjects have, subject to the applicable legal requirements, the following rights:

Right of Access – Article 15 GDPRYou may request information about the personal data we process concerning you.

Right to Rectification – Article 16 GDPRYou may request the correction of inaccurate data or the completion of incomplete data.

Right to Erasure – Article 17 GDPRYou may request the deletion of personal data where the statutory requirements are met.

Right to Restriction of Processing – Article 18 GDPRYou may request restriction of processing in the circumstances provided by law.

Right to Data Portability – Article 20 GDPRWhere the legal requirements are met, you may request to receive your data in a structured, commonly used, and machine-readable format.

Right to Object – Article 21 GDPRWhere processing is based on legitimate interests, you have the right to object, on grounds relating to your particular situation, to such processing.

Withdrawal of Consent – Article 7(3) GDPRWhere processing is based on consent, consent may be withdrawn at any time with effect for the future, e.g. via Cookie Settings. This does not affect the lawfulness of processing carried out before withdrawal.

20. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

The competent authority is, in particular, the one at your place of residence, your place of work or the place of the alleged infringement. For our branch in Erlenmoos this is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

21. Responsibilities of ContaTaxPay Customers

ContaTaxPay may be used by companies, self-employed persons, accountants, and other authorized users to manage commercial, accounting, and tax information.

Where a customer enters personal data concerning employees, customers, suppliers, or other individuals into ContaTaxPay, the customer is responsible for ensuring that an appropriate legal basis exists for processing such data.

Where ContaTaxPay processes personal data exclusively in accordance with the customer's instructions, the GDPR provisions governing processing on behalf of a controller apply where applicable.

22. Changes to this Privacy Policy

This Privacy Policy may be updated where there are changes to applicable legislation, technical infrastructure, service providers, or ContaTaxPay functionality.

The current version will be published on our website.

23. Data Protection Contact

For questions concerning data protection or to exercise your data protection rights, you can contact us at:

• SMARTPOINT DIGITAL VISION SRL – Zweigniederlassung Deutschland
• Raiffeisenweg 5, 88416 Erlenmoos, Germany
• Email: info@contataxpay.com
• Phone: +49 155 68205116