Datenschutz

1. Controller

The controller is Johannes J Voigt, a sole proprietor trading as Johannes Voigt Kollektiv and offering the Prufit service, Bismarckstraße 3–5, 04249 Leipzig, Germany. Email: kontakt@prufit.de; telephone: +49 177 5699967.

2. General information and legal bases

Personal data is processed only where necessary to provide this website, communicate, perform contracts or protect legitimate interests. The legal bases are in particular Art. 6(1)(a), (b), (c) and (f) GDPR. Where we rely on legitimate interests, these are secure and reliable operation, answering enquiries and conducting our business.

3. Replit hosting and log data

This website is hosted on Replit infrastructure. On access, Replit and technical providers used for operation process connection data, including IP address, date and time, requested page, data volume, referrer URL, and browser and operating-system information. Processing serves provision, security, troubleshooting and stability. The legal basis is Art. 6(1)(f) GDPR. Logs are retained only as long as required for these purposes and legal duties.

4. Encrypted transmission

The website is provided over HTTPS. Transmission between browser and website is encrypted in transit. This does not promise independent certification or absolute security.

5. Email, telephone and business contacts

When you contact us by email or telephone, we process the contact details and content you provide to handle your enquiry and communicate about business matters. The legal basis is Art. 6(1)(b) or (f) GDPR. Business contact details may be processed to initiate, perform and document a business relationship.

6. Contact form

When you use the contact form, we process your information to handle and respond to your business enquiry. Required fields are name, company, business email, approximate invoice volume and number of legal entities. Other details are voluntary. The legal basis is Art. 6(1)(b) or (f) GDPR.

Transmission takes place server-side through the Resend email service. Form data is not used for analytics and is not written to application logs. Do not send invoices or confidential financial documents through this marketing form.

7. Customer and business data

In a business relationship we may process contact, contract, billing, communications, supplier, invoice and review data. Processing serves contract initiation and performance, agreed services, communications, invoicing and legal duties.

8. Accounting and statutory retention

Data is deleted when its purpose ends unless statutory retention applies. Business and accounting records are retained under German tax and commercial rules, in particular Sections 147 AO and 257 HGB, and deleted thereafter unless another legal basis or dispute requires longer retention.

9. Service delivery and DPA roles

To provide financial-risk, compliance and control services, we may process data supplied by customers. Where this is personal data processed on behalf of a customer, the customer is controller and Prufit is processor. Details are governed by an Art. 28 GDPR data-processing agreement (DPA). Prufit processes only on documented instructions and within the agreed scope.

10. Confidentiality and technical and organisational measures

We treat customer and business information confidentially. We apply appropriate technical and organisational measures, including access restrictions, secure authentication, confidentiality duties, data minimisation, safeguards and regular review of protections. Absolute protection against every risk cannot be guaranteed.

11. Processors

For hosting, IT operations, communications, storage or other services, carefully selected processors may be used. These include Replit for hosting and technical operation and Resend for server-side transmission of contact enquiries. They process data only to the extent required and under the applicable data-protection agreements.

12. International transfers

Where providers outside the European Economic Area are used or third-country access is possible, transfers occur only under GDPR Arts. 44 et seq., in particular an adequacy decision or safeguards such as Standard Contractual Clauses and supplementary measures.

13. Cookies, consent and local storage

The website stores your optional analytics choice in your browser's local storage. Necessary website functions remain available when analytics is rejected. Google Analytics loads only when technically enabled and after you expressly consent. You can change your decision at any time through the cookie settings in the footer. Withdrawal deletes accessible analytics cookies. If analytics has already loaded, the page reloads to stop its further execution.

14. Google Analytics 4

After your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to evaluate page views and selected interactions such as CTA, package, email, telephone and form-status events. Form fields, message text, invoice data and other confidential content are not sent to analytics.

The legal basis is Art. 6(1)(a) GDPR. Consent is voluntary and can be changed or withdrawn at any time for the future. Google may also process data in third countries; the requirements described in section 12 apply.

15. Locally hosted fonts

The fonts used are served through our own website. Loading fonts does not establish a connection to Google Fonts or other external font providers. The hosting information in section 3 applies.

16. External links and social links

The website may contain links to external websites. When clicked, you leave our website; the operator of the destination is responsible for its processing. Embedded social networks and social-media plugins are not currently present.

17. No automated decisions

We do not make decisions concerning you that produce legal effects or similarly significantly affect you and are based solely on automated processing. Automated assistance does not replace human review or decisions.

18. Retention

We retain personal data only while the relevant purpose exists, consent applies, a contract is being performed, or statutory retention and evidence duties apply. Afterwards data is deleted or anonymised unless a legal basis requires continued retention.

19. Required provision

Providing personal data is generally voluntary. Certain information may be necessary for a contract or enquiry. Without it, the requested service or communication may not be possible.

20. Data-subject rights

Subject to statutory requirements, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21 GDPR). Consent may be withdrawn at any time for the future. To exercise rights, email kontakt@prufit.de.

21. Right to complain

You may complain to a data-protection supervisory authority. The authority principally responsible for our registered location is the Saxon Data Protection and Transparency Commissioner (SDTB), Devrientstraße 5, 01067 Dresden, Germany, https://www.datenschutz.sachsen.de.

22. Updates

We update this privacy policy when processing, services used or legal requirements change. The version published on this page applies. Last updated: September 2026.