Privacy Policy
Version: 01.11.2026
Part A: Website
1. Controller. Laura Scheidt, Valifex, Kronprinzenstraße 22, 53773 Hennef, Germany, telephone: +49 2242 9359284, e-mail: info@valifex.de
2. General. This website is an information site. We do not use cookies, tracking tools, third party analytics services or third party content (e.g. external fonts, maps or videos). Fonts are delivered locally from our server. For visitor statistics we only use the aggregated evaluation of the server log files by our host (see no. 3).
3. Hosting and server log files. This website is hosted by ALL-INKL.COM, Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When the website is accessed, the host automatically stores information transmitted by your browser in server log files. This includes in particular: IP address, date and time of access, page or file accessed, amount of data transferred, referrer URL, browser type and version, and operating system. Processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically correct presentation and the security of the website. The log files are only stored for as long as necessary for these purposes and then deleted automatically; data whose further retention is required for evidence purposes (e.g. to investigate an attack) is excluded from deletion until the incident has been finally resolved. A data processing agreement under Art. 28 GDPR has been concluded with ALL-INKL.COM (signed on 28.10.2026). The connection to this website is encrypted using TLS (SSL). Visitor statistics. Our host shortens IP addresses before they are stored: the last two parts are removed (11.22.33.44 becomes 11.22.0.0). The log files are deleted automatically after 7 days. From the shortened log files, the host's statistics tool (Webalizer) creates an aggregated overview, e.g. number of requests and pages accessed; it contains no full IP addresses and no profiles. No cookies are set and no data is transferred to third parties. The statistics are password protected and accessible only to us. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is understanding how the website is used and improving it.
4. Contact form, e-mail and telephone. If you contact us via the contact form, by e-mail or by telephone, we process your details (name, company if provided, e-mail address or telephone number, content of the message and date and time of the enquiry) solely to handle and answer your enquiry. Data is not passed on to third parties. Data entered in the contact form is transmitted to us by e-mail; processing takes place on the servers of our host ALL-INKL.COM under the data processing agreement mentioned above. The contact form does not set cookies. The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to a contract or pre-contractual measures (e.g. a trial), otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). The data is deleted as soon as it is no longer required for handling, usually after your enquiry has been dealt with, unless statutory retention obligations (e.g. under commercial or tax law) apply.
Part B: The Valifex service (web app and API)
5. Trial registration. We process the e-mail address, company name and USt-IdNr. (VAT ID) or tax number to set up the trial and prevent misuse (Art. 6 (1) (b) and (f) GDPR). The VAT ID is checked via the MIAS/VIES system of the European Commission. Only check values (hashes) of the VAT ID or tax number and e-mail domain are stored permanently to prevent repeated trials; they are deleted 3 years after the last trial. In case of manual approval, we store the e-mail address until the decision, after which it is deleted. Confirmation links expire after 48 hours.
6. Consent at registration. We store the time at which you confirmed that your details are correct and that you are acting for the company named, as well as the time of acceptance of the terms and acknowledgement of this privacy notice together with the respective version of the terms (evidence, Art. 6 (1) (b) and (f) GDPR).
7. Customer account and billing. For paid plans we process company, contact person, billing address, e-mail, plan and usage for performing the contract and billing (Art. 6 (1) (b) and (c) GDPR). Invoices are retained in accordance with statutory periods (§ 147 AO, § 257 HGB).
8. Checks and data sources. Data of your business partners entered by you (e.g. company name, address/postcode, VAT ID, register number, IBAN) is used to carry out the check and, where necessary, transmitted to the following bodies: VIES (European Commission) or the Federal Central Tax Office, BZSt (VAT ID), a licensed provider of register data, GLEIF (LEI) and, where applicable, the joint register portal of the German federal states (handelsregister.de). Sanctions lists (EU, UN, USA, United Kingdom and Switzerland) and the bank code file of the Deutsche Bundesbank are matched locally on our server; no data is transmitted to third parties in this process. Depending on the plan, we display register data, including names and roles of managing directors and representatives, register announcements, insolvency and liquidation notices and financial figures from the Bundesanzeiger (Federal Gazette). Source of the data (Art. 14 (2) (f) GDPR): data on checked business partners, in particular names of managing directors and other authorised representatives, register data, announcements and financial figures, is not collected from the data subjects themselves. It originates from the following sources: commercial register data and register announcements via a licensed data provider; VIES (European Commission); qualified confirmation from the Federal Central Tax Office (BZSt); sanctions lists of the EU, the UN, the USA (OFAC), the United Kingdom (FCDO) and Switzerland (SECO); GLEIF (LEI); Bundesanzeiger; insolvenzbekanntmachungen.de. The entry in the commercial register is authoritative. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest of our customers and of us lies in checking business partners to avoid fraud, payment defaults, VAT risks and sanctions breaches. We provide the documented balancing of interests on request.
9. Check results and cache. Check results and the check history are stored locally in your browser or on your device in the web app. Raw responses from the sources remain on the server. To reduce load on the sources and for consistent answers, the server keeps a cache: register data 24 hours; commercial register retrievals 10 days (active companies) or 30 days (deleted companies) (Art. 6 (1) (f) GDPR). For the imprint comparison, the business partner's website is retrieved once (robots.txt is respected); only the result of the comparison is stored.
10. Partner monitoring (from the Komfort plan). For monitored companies we store, per customer licence, the company name, identifier (e.g. register number, VAT ID), the most recently determined status of the check items, the change history and the notification e-mail address. The companies are checked again regularly; in case of changes you receive an e-mail sent via the e-mail server of ALL-INKL.COM. Legal basis: Art. 6 (1) (b) and (f) GDPR. Storage period: until the company is removed or until 3 months after the end of the contract.
11. Check numbers and authenticity check of PDF reports. When you create a PDF report, the server assigns a sequential check number and stores: time, name of the checked company, client (company and VAT ID or tax number from your registration or licence), optionally the examiner name entered in the app, an internal licence identifier and the SHA-256 hash of the finished PDF file. We do not store the content of the PDF. The purpose is to prove authenticity to third parties (e.g. auditors, tax office) and to protect against forged reports (Art. 6 (1) (b) and (f) GDPR). Storage period: storage serves solely as long term proof of authenticity; it is not based on a statutory retention obligation (in particular not on § 147 AO), but its duration is guided by the periods in which such evidence is typically requested. Entries are stored actively for 2 years; they are then archived in restricted form (examiner name and client identifier are removed, use only for the authenticity check) and deleted no later than 10 years after issue. At valifex.de/verifizieren anyone who knows the check number can check whether a report is genuine and unchanged. Only the date, the checked company and the client are shown, never the examiner name, licence or results. The PDF is hashed in the browser and not uploaded. The query is rate limited; for this purpose IP addresses are only processed as hashes in memory. If the client's access is suspended, the check shows only the neutral notice „Access of the client suspended. Please verify the report with the client“, without reason and without further data (Art. 6 (1) (f) GDPR).
12. Usage counters. For quotas and limits we store per licence the number of checks per day and month (without content) on the server; they are deleted after billing, at the latest after 90 days.
13. Server logs and hosting. We log time, method, path (without parameters), status, duration and access type; no IP addresses, names or VAT IDs. For misuse detection, IP addresses are only processed as hashes and only in memory or on a daily basis. Hosting of the web app and API: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, data centre Nuremberg (Germany), as processor (Art. 28 GDPR; agreement signed on 28.10.2026). No transfer to third countries takes place.
14. Orders, billing and bank data. When you order a plan or additional checks, we process company, billing address, VAT ID (if provided), e-mail address for invoices, the name of the person ordering, time and content of the order and the chosen payment method. For SEPA business direct debit, account holder, IBAN, BIC (if provided) and the mandate reference are added. The purpose is the performance of the contract, i.e. activation, invoicing and collection; the legal basis is Art. 6 (1) (b) GDPR, for retention Art. 6 (1) (c) GDPR. We store the IBAN encrypted on our server in Germany; in the app, in e-mails and in order confirmations it only appears shortened. Data is not passed on to payment service providers or credit card companies; we submit direct debits exclusively via our house bank. Storage period: we retain order and billing data in accordance with statutory retention periods (§ 147 AO, § 257 HGB) for up to 10 years, after which it is deleted. We delete bank data for direct debit when the mandate ends and no payments are outstanding, unless it must be retained as part of accounting records.
14a. Check at order time. When you order a plan, we automatically check the details of the ordering company: the VAT ID via the European Commission's VIES system, the commercial register and insolvency notices via a licensed data provider, and a match against sanctions lists (EU, UN, USA, United Kingdom, Switzerland). We process company name, address, VAT ID, register details and the name of the person ordering. The purpose is to decide which payment methods and terms we offer (invoice, prepayment, monthly plan) and to protect against payment default and misuse. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual steps) and Art. 6 (1) (f) GDPR (legitimate interest in avoiding payment default and fraud). The check does not count towards any quota. We store the result and time with the order and keep them as long as the order data (no. 14).
Automated decision (Art. 22 GDPR). The result of the check only determines which payment method and term we offer you; a contract remains possible, e.g. as a monthly plan with prepayment. In case of doubt, a person reviews the order before we decide. You can contact us at any time at info@valifex.de, state your point of view and request that a person reviews the decision.
Part C: Your rights
15. Your rights. You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6 (1) (f) GDPR on grounds relating to your particular situation (Art. 21). Please contact info@valifex.de. These rights also apply to persons whose data (e.g. as managing director) is displayed in a check.
16. Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2 bis 4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
17. No cookies, no tracking. The website and web app do not use tracking services or third party analytics services. The only visitor statistics are the aggregated evaluation of the website server log files by our host (no. 3). The web app stores settings and check history locally in the browser (technically necessary, § 25 (2) TDDDG).