Privacy
This page summarises how faktoora GmbH collects, uses and protects personal data when the faktoora platform is used. The full privacy policy is published at faktoora.com/datenschutz.
Controller
faktoora GmbH Amselweg 1, 89231 Neu-Ulm, Germany
General enquiries: info@faktoora.com
Data Protection Officer
faktoora has appointed an external data protection officer:
PROLIANCE GmbH Leopoldstr. 21, 80802 Munich, Germany Email: datenschutzbeauftragter@datenschutzexperte.de
For questions about data protection, you can also contact privacy@faktoora.com.
Data Categories
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email address, role, permissions (passwords are held only in hashed form by our self-operated identity provider) | Authentication and access management |
| Invoice data | Company names, addresses, VAT ID numbers, contact details, line items, amounts | Creation, delivery and storage of invoices during the contract term |
| Contact data | Company information, contact persons, addresses, email, phone, VAT ID number, bank details | Customer and supplier management for invoicing |
| Usage data | Login times, activity logs, session data, API request logs | Security monitoring, audit trail, support and platform analysis |
| Payment data | Plan, billing information (card numbers are never stored by faktoora); bank transactions of a connected bank account | Subscription management, matching payments to invoices |
| Incoming invoice files | Uploaded invoice files, if automatic data extraction is enabled for your account | Automatic data extraction |
Legal Bases for Processing
| Legal basis | Processing activities |
|---|---|
| Performance of a contract (Art. 6(1)(b) GDPR) | Account management, creation and delivery of invoices, contact management, subscription management, support |
| Legal obligation (Art. 6(1)(c) GDPR) | Retention of our own billing records and books (AO § 147, HGB § 257), faktoora's tax obligations |
| Legitimate interests (Art. 6(1)(f) GDPR) | Security monitoring, error detection, platform stability, audit logging, logging of API requests, authorised support access, internal business processes and customer communication |
| Consent (Art. 6(1)(a) GDPR) | Optional marketing sign-ups, e.g. when you leave your email address in our public e-invoice validator |
Support Access to Your Account
Authorised faktoora support staff may temporarily access your account in order to provide support, investigate problems or resolve them on your behalf. This access is restricted to authorised personnel, limited in time and recorded in a tamper-evident audit log. Where faktoora acts as a processor for a business customer, support access takes place only within the scope of the data processing agreement – to handle a customer request, for error analysis or to provide the agreed service.
Invoice Data as a Processor
We process your invoices, contacts and documents on your behalf. This also applies to the transmission of e-invoices to networks such as Peppol or to tax authorities: we carry these out on your instructions so that you can meet your e-invoicing obligations.
Recipients and Data Transfers
Our own processing takes place within the EU. We use a small number of carefully selected service providers; the current list with purpose and location can be found on our Service providers and recipients page.
Where a provider processes data outside the EU or can access it from there – for example for payment processing, optional AI features or the support of our email delivery provider – the transfer is safeguarded by the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses.
Customer-Configured Integrations
Customers can connect CRM, ERP, accounting or identity systems (e.g. Xero, DATEV, Bexio, HubSpot, Microsoft Entra ID and others). The data shared with these services is controlled by the customer's configuration and is subject to the customer's own agreements with these providers. Some of these providers process data outside the EU (e.g. USA, United Kingdom, Australia); these transfers take place on your organisation's instruction on the basis of the safeguards of the respective provider, such as the EU Standard Contractual Clauses.
Personal data is neither sold nor disclosed for advertising purposes.
Retention
| Data type | Retention period | Legal basis |
|---|---|---|
| Your content in the platform (invoices, contacts, documents, bank transactions) | Contract term; after the end of the contract, at least 30 days for export, then erasure. Retention under commercial and tax law is your responsibility | Contract (AGB clause 5.2) |
| Our invoices and payment receipts for your subscription | 8 years from the end of the calendar year | AO § 147(3) |
| Our books and annual financial statements | 10 years from the end of the calendar year | AO § 147, HGB § 257 |
| User accounts | As long as the account exists; deleted accounts are deactivated | Contract |
| Session data | 24 hours (automatic expiry) | Operational necessity |
| Activity and audit logs | As long as required for security, abuse prevention and proof of proper processing; reviewed regularly | Security and audit |
| API request logs | As long as required for security and support; reviewed regularly | Security, support |
| Error reports | 90 days | Error analysis |
| Backups | Up to 12 months | Disaster recovery |
Your Rights
Under the GDPR, you have the following rights with regard to your personal data:
| Right | How to exercise it |
|---|---|
| Access (Art. 15) | Request a copy of your data; self-service export in the application |
| Rectification (Art. 16) | Change profile and account data directly in the application |
| Erasure (Art. 17) | Request erasure via privacy@faktoora.com; deleting your account in the application deactivates your account. Our own billing records are subject to statutory retention obligations |
| Restriction (Art. 18) | Request restriction of processing in certain cases |
| Data portability (Art. 20) | Export data in structured formats (CSV, XLSX, PDF, XML; JSON on request) |
| Objection (Art. 21) | Object to processing based on legitimate interests |
| Complaint (Art. 77) | Lodge a complaint with a data protection supervisory authority |
How to Exercise Your Rights
- Self-service: Export, editing and account deactivation are available directly in the faktoora application
- Email: privacy@faktoora.com
- Data protection officer: datenschutzbeauftragter@datenschutzexperte.de
We respond without undue delay and at the latest within one month. For complex requests, the period may be extended by up to two further months, of which we will inform you.
Automated Decision-Making
faktoora does not use automated decision-making or profiling that produces legal effects or similarly significantly affects data subjects.
Security Measures
To learn how we protect your data, see our Security Overview.
Changes to This Information
We review this privacy information annually and inform registered users of material changes.