Legal

Privacy Policy

Last updated: 1 May 2025

SteuerBack ("we", "us", "our"), operated by Posrednik24, is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR).

1. Data controller

The data controller responsible for your personal data is Posrednik24, operating the SteuerBack service at steuerback.com. Contact: privacy@steuerback.com

2. What data we collect

We collect the following categories of personal data:

Account data: email address, name, phone number, password (hashed).
Profile data: date of birth, nationality, address, tax ID (Steuer-ID), employer details, bank IBAN.
Documents: Lohnsteuerbescheinigung, passport / ID copy, Vollmacht (power of attorney).
Financial data: Stripe payment tokens, payment history. We do not store full card numbers — payment data is handled by Stripe.
Communication data: messages you send through our portal, email correspondence.
Usage data: page views, login timestamps, IP address (collected automatically).
Referral data: referral codes if you use or share a referral link.

3. Legal basis for processing

Contract performance (Art. 6(1)(b) GDPR): we process your data to provide the tax filing service you contracted us for.
Legal obligation (Art. 6(1)(c) GDPR): we retain certain records as required by applicable law.
Legitimate interests (Art. 6(1)(f) GDPR): fraud prevention, security, improving our service.
Consent (Art. 6(1)(a) GDPR): for optional marketing communications. You may withdraw consent at any time.

4. How we use your data

To prepare and submit your German income tax return (Einkommensteuererklärung).
To communicate with the Finanzamt on your behalf using the Vollmacht you sign.
To process payments via Stripe.
To send you status updates and notifications about your application.
To verify your identity and prevent fraud.
To comply with tax record-keeping obligations.

5. Data sharing

We share your data only where necessary:

Finanzamt (German Tax Authority): we submit your tax return data to the German tax authority as part of the service.
Stripe Inc.: payment processing. Stripe is PCI-DSS compliant. See Stripe's Privacy Policy.
Supabase: secure database and file storage infrastructure. Data is stored in EU-region servers.
Resend: transactional email delivery.

We do not sell your data or share it with advertisers.

6. Data retention

We retain your personal data for as long as your account is active plus a maximum of 7 years, in compliance with German tax record-keeping requirements (§ 147 AO). After this period, your data is securely deleted. You may request early deletion (see Your Rights below) — note that data directly tied to a filed tax return may need to be retained for the statutory period.

7. Security

We apply industry-standard security measures:

All data is encrypted in transit using TLS 1.2+.
Documents are stored with access control — only authorised staff can view them.
Passwords are hashed (never stored in plain text).
Row-Level Security (RLS) ensures users can only access their own data.

8. Your rights (GDPR)

Under GDPR, you have the following rights:

Access: request a copy of all personal data we hold about you.
Rectification: correct inaccurate data.
Erasure: request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
Portability: receive your data in a structured, machine-readable format.
Objection: object to processing based on legitimate interests.
Restriction: request that we restrict processing of your data.
Withdraw consent: withdraw marketing consent at any time via Settings > Notifications.

To exercise any right, email privacy@steuerback.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

9. Cookies

We use strictly necessary cookies for authentication (Supabase session cookies). We do not use advertising or tracking cookies. No cookie consent banner is required for strictly necessary cookies.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users by email of material changes. Continued use of the platform after changes constitutes acceptance.

11. Contact

For privacy inquiries: privacy@steuerback.com