The controller for the processing described on this website is:
David Wirfs (sole trader), Naumannstraße 1, 50735 Köln, Germany, email:
hello@meinekiakte.de. Further details in the
Imprint.
The same controller operates
eBilanz Fabrik. The data of the two offerings are processed separately.
Data protection officer: No data protection officer has been appointed; there is no obligation to appoint one. Fewer than 20 persons are permanently engaged in the automated processing of personal data (§ 38(1) BDSG), there is no large-scale regular and systematic monitoring, and no special categories of personal data are processed (Art. 37(1) GDPR). For any data protection matter you can reach the controller directly at the address above.
This is a purely static website. It is currently delivered by Porkbun, LLC, 11575 SW Pacific Hwy PMB 40649, Tigard, OR 97223, USA; the same provider also operates the domain's name resolution (DNS). In this respect Porkbun is not our processor but an independent recipient of the connection data that arise; no Art. 28 GDPR data processing agreement exists with Porkbun.
When you open a page of this website, your browser establishes a connection to a server in the United States. The technically necessary connection data arise in the process, in particular:
This processing is technically indispensable for delivering the website; without it the page cannot be shown to you. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technically sound and secure provision of this website.
This involves a transfer of personal data to a third country. We inform you of the following: there is no adequacy decision of the European Commission covering this recipient, and we cannot provide you with appropriate safeguards within the meaning of Art. 46 GDPR — the provider offers neither a data processing agreement nor standard contractual clauses for its hosting services, so we cannot make a copy of such safeguards available to you either. We are therefore moving the hosting of this website to a provider with servers in the European Union. Until that move is complete, we expressly draw your attention to the transfer here.
Storage period: the current hosting provider has not disclosed to us what storage period it applies to these connection data. We therefore state no period here that we cannot substantiate. With the move to a provider in the European Union the storage period will be contractually fixed and stated at this point.
The free pre-check runs entirely in your browser. It consists of several steps that build on one another. So that your entries are not lost as you move between those steps, the page holds them in your browser's local storage; without that storage the pre-check could not work. This also lets you interrupt the check and resume it later.
What is stored: your entries — system names, vendors, purposes, your company name and the responsible role you nominate — and your language choice (German or English), so that the page reappears in the language you picked. No recognition identifiers are set and we use no cookies. What you type in is not transmitted to us: the page sends no form data and creates no account. The audience measurement described below records which steps were reached and which preset categories were chosen — never what you typed in yourself. What you type in never reaches us; we can neither see nor evaluate it.
The legal basis for the storage on your device is § 25(2) no. 2 TDDDG: the storage is strictly necessary to provide the service you expressly requested — the pre-check. No consent is required.
Storage period: the entries stay in your browser until you delete them. The “Angaben löschen” (clear entries) button at the end of the pre-check removes your entries completely at any time; the stored language choice is retained. Clearing your browser's site data removes both.
We measure the reach of this website with Pirsch Analytics of Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany. An Art. 28 GDPR data processing agreement is in place with Emvi Software GmbH. That agreement names a single sub-processor, Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, with Nuremberg and Falkenstein as the places of processing; under the agreement and those named places of processing, no transfer to a third country takes place in this chain.
Pirsch works without cookies and without cross-device recognition: a daily-rotating, irreversible hash is formed from IP address, user agent and date. According to the provider, your IP address is stored neither in full nor in part, and recognition beyond 24 hours is not possible. We have additionally switched off the reading of screen and device resolution and the transmission of search parameters.
What is collected: the page called up, the referrer, the coarse origin at country level, and named events — for example the start of the pre-check, reaching a step, or reaching the result. For an event we transmit only preset categories and grouped values, such as the purpose and contact category chosen for a system, a rule branch confirmed or rejected, your number of systems in bands (1–3 / 4–9 / 10+), or a yes/no — for example on a risk class, or on whether an Art. 5 practice was declared. Your entries themselves — system names, vendors, and the responsible role (we do not ask for a name) — are never transmitted.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a data-minimising measurement of reach. § 25 TDDDG does not apply, because no information on your device is accessed for recognition purposes. You may object to this processing at any time under Art. 21 GDPR; an informal message to the address above is sufficient.
Switch the measurement off in this browser: open meinekiakte.de/analytics-opt-out-en.html and press “Exclude this browser”; the page shows you the current state. Your browser remembers it permanently, and from that browser neither a page view nor an event is transmitted again — on every page of this website. The same page switches it back on. The setting is stored only locally in your browser; nothing reaches us in the process, and we do not learn that you have objected.
Storage period: only the aggregated evaluations, which no longer relate to an identifiable person, are stored permanently.
The only contact route on this website is email. If you write to us, we process your sender address, your name in so far as you give it, the content of your message and the technical headers of the email in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR in so far as your enquiry serves the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR with our legitimate interest in answering enquiries.
The mailbox is operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany; the servers are located in Germany. An Art. 28 GDPR data processing agreement is in place with Hetzner Online GmbH.
Storage period: we delete your message once your matter has been conclusively settled and no statutory retention obligations stand in the way. Where the message is a commercial or business letter within the meaning of the statutory retention rules, the periods of § 257 HGB and § 147 AO apply; in that case processing is restricted until the period expires.
We currently accept no customer data. There is no sign-up form, no account, no waiting list and no payment process on this website; the pre-check never transmits what you type in.
As soon as the service is offered against payment, we will describe the processing that then actually takes place at this point, before the first data flow, and will conclude the required Art. 28 GDPR data processing agreements beforehand. The intention is to process the AI-system and compliance data entered by customers on a tenant-separated basis and exclusively for the production of the respective evidence file, and not to use them for other purposes, in particular not for training or for enriching our own knowledge bases.
Beyond the recipients below we do not pass your data on. No sale of data takes place.
Disclosure to authorities or courts takes place only in so far as we are legally obliged to make it.
None of the processing described on this website is based on your consent. A withdrawal under Art. 7(3) GDPR is therefore not applicable; in its place stands your right to object under Art. 21 GDPR against the processing based on Art. 6(1)(f) GDPR.
You are not obliged to provide us with personal data. Using this website requires no data from you, and you can complete the pre-check in full without anything you type in reaching us. No disadvantages arise for you from this.
Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place. The pre-check assigns the AI systems you enter to the risk classes of the AI Act — it does not assess persons. It runs entirely in your browser, its result does not reach us, and it produces no legal effect and no similarly significant impact on you.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21).
An informal message to hello@meinekiakte.de is enough to exercise your rights. We reply without undue delay and at the latest within one month.
Independently of the above you may lodge a complaint with a data protection supervisory authority. The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany, www.ldi.nrw.de. Competence follows the controller's establishment in Köln; if that moves, so does competence.
We adapt this privacy notice as soon as the actual processing changes — in particular with the move of the hosting to the European Union and before the start of paid operation. The version published here is always the governing one. As of 25 September 2026.