Website/business privacy notice under Article 13 of the Datenschutz-Grundverordnung (DSGVO, the German-facing text for the EU GDPR) plus the Bundesdatenschutzgesetz (BDSG) — a Data Protection Officer (Datenschutzbeauftragter "DSB") is mandatory once at least 20 people are continuously involved in automated processing of personal data (§ 38 BDSG), and cookie/tracking consent must comply with § 25 TDDDG.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone.
Required fields not filled: 10. The PDF will have blank lines in their place to fill in by hand.
Click a field label in the text and type, or use the form. Empty fields become blank lines in the PDF.
PRIVACY NOTICE (DATENSCHUTZERKLÄRUNG)
, Effective date:
This notice explains how (the "Company", the responsible party / controller) collects, uses and protects personal data, in accordance with Article 13 of the EU General Data Protection Regulation (Datenschutz-Grundverordnung "DSGVO") and the Bundesdatenschutzgesetz "BDSG".
1. RESPONSIBLE PARTY 1.1. is responsible for the processing described in this notice (Art. 4 Nr. 7 DSGVO). 1.2. Data Protection Officer (Datenschutzbeauftragter), if appointed: 1.3. ⚠️ Under § 38 BDSG, appointing a DSB is mandatory once at least 20 people are continuously engaged in the automated processing of personal data — this is easy to reach for a small restaurant/hotel/shop once part-time staff, POS terminals and marketing tools are counted.
2. WHAT DATA WE COLLECT AND WHY 2.1.
3. PURPOSES AND LEGAL BASIS 3.1.
4. RECIPIENTS AND TRANSFERS ABROAD 4.1. 4.2. Transfers of personal data outside the EU/EEA require either an adequacy decision covering the destination country or appropriate safeguards (e.g. EU standard contractual clauses).
5. RETENTION 5.1.
6. YOUR RIGHTS 6.1. 6.2. You may also lodge a complaint with the competent state data protection authority (Landesdatenschutzbehörde) if you believe your data has been mishandled.
7. COOKIES AND TRACKING 7.1. 7.2. Under § 25 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG), storing or reading information on a visitor's device (cookies, tracking pixels, etc.) beyond what is strictly necessary for the service requested requires the visitor's prior, informed consent — a clear cookie-consent banner with a genuine "reject" option is required, not just an "accept" button.
8. CONTACT US 8.1. Questions about this notice, or requests to exercise your rights, may be sent to .
⚠️ If CCTV, guest Wi-Fi logging, or staff monitoring is used, describe it explicitly in section 2 above and register it in the internal record of processing activities (Verzeichnis von Verarbeitungstätigkeiten, Art. 30 DSGVO) — this is typically the first document a supervisory authority asks for.
This is a boilerplate template, not legal advice. German employment, consumer-protection, data-protection and workplace-safety law (BGB, Nachweisgesetz "NachwG", ArbSchG, MiLoG, SGB IV, DSGVO/BDSG, DDG, EGBGB Art. 246a) changes frequently and includes sector-specific exceptions — notably § 2a Gesetz gegen Schwarzarbeit "SchwarzArbG", which keeps the Gaststätten- und Beherbergungsgewerbe (restaurants and hotels) on paper-only Schriftform even after the BEG IV digitalisation reform. Statutory figures (Mindestlohn, Minijob-Grenze) are re-indexed periodically — have this document reviewed and adapted by a German employment/legal advisor (Rechtsanwalt/Steuerberater) and verified against the current rates before use. Where a German-language version of this document is also used, that version prevails in case of conflict.
Documents that are usually drawn up in the same process.
Mandatory website/social-media legal notice under § 5 Digitale-Dienste-Gesetz (DDG — the successor, since 2024, to the former § 5 Telemediengesetz "TMG") — must be reachable within two clicks from an…
Mandatory 14-day right-of-withdrawal notice plus the statutory model withdrawal form for distance/online sales, under § 312g BGB and Art. 246a EGBGB (Anlage 2) — an incorrect or missing notice EXTEND…
Mandatory occupational risk assessment under §§ 5–6 Arbeitsschutzgesetz (ArbSchG) — required of EVERY employer, even one with a single employee; the assessment must be documented and reviewed, and st…
2 of 11 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.