Privacy notice
How we handle data when you visit our website, contact us or use our services.
Last updated: 2 November 2026
1. Scope and controller
This notice explains personal-data processing when you visit yourgermanaddress.com, contact us or use our address, mail and customer services. It covers customers, prospective customers, company representatives and people whose information appears in related correspondence.
The controller is Steven Drieß, trading as DE Office Solutions under the YourGermanAddress brand, Erfweiler Straße 12, 66994 Dahn, Germany. Contact us about privacy at info@yourgermanaddress.com or +49 155 65593428. Please do not send unsolicited identity copies or sensitive documents. If evidence of identity is needed, we will agree an appropriate route with you.
2. Website hosting and technical access data
The public website is delivered through Vercel. Requests involve technical data such as your IP address, request time and address, browser/device information and technical errors. These are processed to deliver and secure the website and diagnose faults. The basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, functioning website.
Vercel is an external provider. Choosing 'Necessary only' disables optional measurement services, not the hosting needed to deliver the page. The former Shopify shop remains relevant for existing legacy subscriptions; it does not host this public website.
3. Orders, customer accounts and billing
To arrange and perform a contract, we process contact and address details, company and representative information, selected services, contract status, invoice details and payment status. The basis is Article 6(1)(b) GDPR. For company contacts, Article 6(1)(f) GDPR may also apply to our legitimate interest in administering that company's agreement.
The Business Hub and Nextcloud run on our own hardware in Dahn. Supabase is also used for database and account functions. The Supabase project we use is configured in Frankfurt (eu-central-1). Owning the hardware does not mean that all data is processed exclusively on our premises or exclusively in Germany.
Stripe handles payments and subscriptions. Payment data needed for this is processed there; we receive payment references and status information in particular. Invoice and accounting data are processed in sevdesk. Existing Shopify/Seal subscriptions still require relevant contract, order and payment information. Payment providers may also process data to meet their own legal obligations.
4. Identity and company verification
Before approving address use, we check identity and, depending on customer type, company details and authority to act. This includes requested identity-document images, a selfie and, where relevant, register, trade or formation documents. Documents are submitted through our verification interface or the designated secure follow-up route and stored server-side. Details, assignments and review status are processed in the customer system.
Verification supports the intended contract under Article 6(1)(b) GDPR and the prevention of misuse and identity fraud under Article 6(1)(f) GDPR. We cannot approve a verification-dependent service without the required information and evidence. Address services for legal entities, partnerships or similar legal arrangements may also involve statutory due-diligence and record-keeping duties under section 2(1), number 13(c), and sections 8 and 10 onwards of the German Money Laundering Act (GwG). Where these duties apply, the basis is Article 6(1)(c) GDPR. They do not automatically apply to every private postal address or identity check.
Documents from earlier checks remain subject to their applicable purposes, agreements and retention duties. Your privacy rights also apply to those documents.
5. Letter mail, scans and forwarding requests
To provide mail services, we process recipient and sender information, mail/document contents and details of scanning, shipping and other requests. Documents may contain information about senders, employees or other third parties. Available scans and documents are accessed through the Business Hub and associated Nextcloud accounts.
Article 6(1)(b) GDPR applies to administering the customer agreement. Processing third-party data also depends on the particular instructions and the parties' data-protection roles. This notice does not replace any data processing agreement required for handling business mail on a customer's instructions.
When you request physical forwarding, postal and parcel carriers receive the recipient and shipment information needed for delivery. This is separate from digital access to a scan.
6. Contact forms, email and live chat
When you contact us, we process your contact details, message and the information needed to identify and answer your request. The contact form requires a name, email address and message; a phone number is optional. An email address is also needed for a personal reply to a chat request. Providing it does not automatically log you into a customer account.
Business email is handled through Google Workspace. Website chat uses its own session and stores messages and assignments in the customer system. Chat messages, contact details and conversation/presence information are also forwarded to our support team through Telegram. Website visitors do not need their own Telegram account. Submit identity documents or sensitive mail contents only through the designated secure route. Never share your password with support.
The basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) GDPR for our legitimate interest in accessible support. Contact details and enquiry history may be kept in contact management for identification and follow-up. Without separate marketing consent, they are not authorised for promotional emails.
7. Optional promotional emails
Consent to offers and news is voluntary and separate from handling an enquiry. If you give it, we process your email address, any supplied name and phone number, and the recorded consent status, time and wording for this purpose. The basis is Article 6(1)(a) GDPR.
You may withdraw consent at any time through the available unsubscribe option or by emailing info@yourgermanaddress.com. Necessary contract communication remains separate. Evidence of consent or withdrawal may be retained to establish or defend legal claims.
8. Necessary browser storage
Alongside technically necessary cookies, we use local and session storage. Consent choices are stored under yga_consent_v1 until you change them or remove the relevant browser data. After starting a chat, yga_chat_session_v1 may store the associated session and contact information so that you can continue the conversation.
Storage strictly necessary for a service you request is covered by section 25(2) TDDDG. Personal-data processing also requires the relevant GDPR basis. Removing browser data may remove saved preferences or access to a chat conversation.
9. Optional statistics and selection measurement
Only with statistics consent do we load Vercel Web Analytics and Speed Insights and record our own events about plan selection and checkout. These include page visits, selected plans, optional Express choices and technical performance data. Our own event measurement uses a random session identifier; it is not intended to transmit message or identity-document contents.
The session identifier and one-time event markers use session storage. When a selection test is enabled, a test assignment may also be kept locally with this consent. Preparing this functionality does not mean that an A/B test is always running. The basis is Article 6(1)(a) GDPR and, where required, section 25(1) TDDDG.
10. Google Ads, maps and reviews
With advertising consent, Google Ads tags may load and advertising click identifiers such as gclid, gbraid or wbraid and allowlisted campaign details may be stored. They help attribute a booking to an advertisement. Local attribution is treated as expired after 90 days and removed when advertising consent is withdrawn. Google also receives technical access information when its services load.
Interactive Google maps load only after you allow external media. Technical connection data is then transmitted to Google. Advertising and external-media consent are separate from each other and from statistics and are not required to book. The basis is Article 6(1)(a) GDPR and, where required, section 25(1) TDDDG.
Public reviews and location information may also be retrieved server-side for display on our website. This differs from loading an interactive map. If you follow an external Google link, Google's notices apply to your visit there.
11. Recipients and other sources
Data is accessible to authorised people and the technical providers used for the relevant purpose. These include the hosting, database, communication, payment and accounting services described above and contracted carriers. Authorities or advisers may receive data when necessary and legally permitted. Article 6(1)(c) GDPR applies where processing meets a legal obligation.
Information may also come from incoming mail, public registers, an authorised company representative or status reports from payment, shipping and subscription providers. We process it in connection with the relevant instructions, assignment or required review.
12. Processing outside the EU and EEA
Some external providers may process data outside the EU and EEA. Hosting our own systems in Germany does not exclude these additional data flows. The data involved depends on the service and its configuration. The core Supabase project is in Frankfurt. According to the provider, account and billing information or necessary support access may nevertheless involve processing outside that region. The project region therefore does not guarantee that all data stays in Germany.
Transfers to countries outside the EU and EEA are subject to Articles 44 onwards GDPR. Depending on the recipient, the basis may be an applicable adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses. You can request information about the data flows and safeguards relevant to a particular service at info@yourgermanaddress.com.
13. Retention and deletion
Retention depends on the purpose, customer relationship, statutory duties and evidence needed for legal claims. Relevant contract and consent records may remain necessary beyond an individual contact. Continued retention requires a continuing reason.
Records subject to money-laundering retention duties generally have to be kept for five years under section 8(4) of the German Money Laundering Act (§ 8 GwG). For a business relationship, the period starts at the end of the calendar year in which the relationship ends, rather than when the booking is made. In the other cases covered by that provision, it starts at the end of the calendar year in which the relevant information was established. Other statutory duties may require longer retention; section 8(4) sets a ten-year maximum for the records it covers.
Withdrawal from a contract does not automatically remove statutory retention duties that have already arisen. The records still needed depend in particular on whether a check or transaction subject to retention requirements took place. Data no longer needed must be deleted; required evidence must not be discarded solely because of withdrawal.
Invoice and accounting records follow applicable commercial and tax retention requirements. Agreed rules also apply to originals and digital customer content. Request originals in good time and save documents before the agreement ends. For information about the retention of particular records or to request deletion of your data, contact info@yourgermanaddress.com. We consider the relevant purpose and any retention duties that prevent deletion.
14. Your rights and complaints
Subject to the applicable legal conditions, you have rights of access, correction, erasure, restriction and data portability. You may withdraw consent for future processing; withdrawal does not affect the lawfulness of earlier processing. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time.
Contact info@yourgermanaddress.com to exercise these rights. You may also complain to a supervisory authority, particularly in the country of your residence, workplace or the alleged infringement. For our location, the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate is a relevant contact.
15. Required information and decisions
You do not need an address agreement to visit the website. Enquiries, bookings and verification require the information identified as mandatory for each process. We may be unable to handle the requested service without it. Optional marketing, statistics and external-media consent remain separate.
The processes described here do not involve a solely automated decision producing legal or similarly significant effects within Article 22 GDPR.