1 Controller

The controller within the meaning of the GDPR is:

anybill GmbH
Türkenstraße 95
80799 Munich, Germany
E-mail: datenschutz@anybill.de
Website: https://anybill.de/de/legal/imprint

2 Data protection officer

You can reach our data protection officer as follows:

Kertos GmbH
DPO: Dr. Kilian Schmidt
Address: Klosterhofstraße 6, 80331 Munich, Germany
E-mail: dsb@kertos.io

You can contact our data protection officer directly at any time with questions or suggestions regarding data protection and to exercise your rights.

3 Provision of the website

3.1 General information

If you use our website for information purposes only, meaning you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (in what are known as server log files).

Each time a page is accessed, our server records a range of general data and information. This general data and information is stored in the server log files. The following may be recorded:

• browser type and browser version
• operating system used
• referrer URL
• host name of the accessing device
• time of the server request
• IP address

3.2 Hosting and content delivery networks (CDN)

Our website is hosted by an external service provider (referred to below as the host). Personal data collected via this website is stored on the host's servers. This data may include IP addresses, contact requests, metadata, communication data, contract information, contact details, names, website accesses and other data generated through use of the website.

The host is used for the purpose of fulfilling our contract with potential and existing customers (Art. 6 (1) lit. b GDPR) and in the interest of providing our online offering securely, quickly and efficiently through a professional provider (Art. 6 (1) lit. f GDPR).

Our host will only process your data to the extent necessary to fulfil its performance obligations and will follow our instructions regarding this data.

We use the following host:
Webflow, Inc.
398 11th Street, 2nd Floor
San Francisco, CA 94103, United States of America

To ensure processing in line with data protection law, we have concluded a data processing agreement with our host.

3.3 Purpose of processing

We do not draw any conclusions about you personally from this general data and information. The purposes we pursue include in particular:

• ensuring a smooth connection to the website,
• ensuring convenient use of our website,
• investigating misuse or fraud,
• analysing network problems,
• evaluating system security and stability, and
• other administrative purposes.

3.4 Legal basis

The legal basis for this processing is our legitimate interest within the meaning of Art. 6 (1) sentence 1 lit. f GDPR. We have a legitimate interest in being able to provide our offering in technically sound form.

3.5 Storage period

For security reasons (for example to investigate misuse or fraud), log files are stored for a maximum of 7 days and then deleted. Data that needs to be retained for evidentiary purposes is kept until the matter in question has been finally resolved.

4 Cookies

4.1 General information

We use cookies on our website. These are text files that your browser creates automatically and that are stored on your IT system when you visit our site. The cookie stores information relating to the specific device used.

4.2 Technically necessary cookies

We use technically necessary cookies. These are cookies that are technically required in order to make all functions of our website available.

4.2.1 Purpose of processing

We use technically necessary cookies for the following purposes:

• to offer services,
• to enable the use of our website functions,
• and to offer different languages.

4.2.2 Legal basis

The legal basis for this processing is our legitimate interest within the meaning of Art. 6 (1) sentence 1 lit. f GDPR. We have a legitimate interest in being able to provide our offering in technically sound form.

4.2.3 Storage period

We delete your personal data as soon as it is no longer required for the purpose for which it was collected. Technically necessary cookies are only stored for the respective session. When you leave our website and close your browser, the cookies are deleted.

4.3 Analytics and marketing cookies

We also use analytics and marketing cookies. These are cookies that are not technically required. We use them to understand your behaviour on our website and to improve our offering.

4.3.1 Purpose of processing

We use analytics and marketing cookies for the following purposes:

• reach measurement and tracking,
• analysis of visitor behaviour,
• optimisation of our offering,
• and targeted advertising.

4.3.2 Legal basis

The legal basis for this processing is your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR. The cookies are only set after you have given your consent via our cookie banner.

4.3.3 Storage period

We delete your personal data as soon as it is no longer required for the purpose for which it was collected. The storage period for personal data depends on the providers used. You will find information on this in the section "Use of third-party services".

5 Contact options

5.1 General information

You can contact us via our website by e-mail or using our form. When you contact us and we respond to your enquiry, we process the following personal data:

• name
• e-mail
• telephone number
• date and time of the enquiry
• IP address
• any other personal data you provide to us when contacting us.

5.2 Purpose of processing

We process your data in order to respond to your enquiry and to handle any matters arising from it.

5.3 Legal basis

If your enquiry relates to pre-contractual measures or to an existing contract with us, the legal basis is the performance of a contract and the implementation of pre-contractual measures pursuant to Art. 6 (1) sentence 1 lit. b GDPR.

If your enquiry is unrelated to contractual or pre-contractual measures and is not sent via our contact form, our legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR are the legal basis. The legitimate interest corresponds to the purposes stated above.

5.4 Storage period

We delete your personal data as soon as it is no longer required for the purpose for which it was collected. In the case of contact enquiries, this is generally when the circumstances indicate that the matter in question has been conclusively dealt with.

6 Use of third-party services

We use the following third-party services on our website:

6.1 Marketing

Service: Google Analytics 4
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Creating analyses and reports on users' website activity, remarketing
Legal basis: Your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR
Storage period: Users' personal data is deleted or anonymised after 14 months, unless legal retention obligations apply.

Service: Google Ads
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Optimising our advertising on Google
Legal basis: Your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR
Storage period: We delete your personal data as soon as it is no longer required for the purpose for which it was collected.

Service: Google Tag Manager
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Managing and embedding tags on our website
Legal basis: Your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR
Storage period: We delete your personal data as soon as it is no longer required for the purpose for which it was collected.

Service: LinkedIn Insight Tag
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Purpose: Recording and analysing LinkedIn members on our website
Legal basis: Your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR
Storage period: We delete your personal data as soon as it is no longer required for the purpose for which it was collected.

Service: YouTube video
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Embedding a YouTube video on our website
Legal basis: Your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR
Storage period: We delete your personal data as soon as it is no longer required for the purpose for which it was collected.

6.2 Website presentation and fonts

Service: Google Fonts
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Providing various fonts for our online offering
Legal basis: Legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR. The legitimate interest corresponds to our purpose of processing.
Storage period: We delete your personal data as soon as it is no longer required for the purpose for which it was collected.

6.3 Cloud services and e-mail delivery

Service: Microsoft Azure
Provider: Microsoft Ireland Operations Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland
Purpose: Providing the technical infrastructure for hosting the website
Legal basis: Legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR. The legitimate interest corresponds to our purpose of processing.
Storage period: We delete your personal data as soon as it is no longer required for the purpose for which it was collected.

Service: Mailjet
Provider: Mailjet GmbH, Alt-Moabit 2, 10557 Berlin, Germany; Mailgun Technologies Inc., 112 E Pecan St #1135, San Antonio, TX 78205, USA
Purpose: Sending e-mails
Legal basis: Your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR
Storage period: We delete your personal data as soon as it is no longer required for the purpose for which it was collected.

6.4 Transfer of personal data to third countries

Where we transfer personal data to a third country for processing, we ensure compliance with Art. 44 et seq. GDPR. This means that before any disclosure of personal data to third parties in a country outside the European Union (EU) or the European Economic Area (EEA), we check whether an adequate level of protection is ensured.

An adequate level of protection can be ensured, among other things, by an adequacy decision of the EU Commission, by our having concluded standard data protection clauses with the recipient together with further supplementary measures, or where the third-country transfer is permitted under other safeguards set out in Art. 46 et seq. GDPR.

Where the data transfer takes place on the basis of Art. 46, 47 or 49 (1) GDPR, you may obtain from us a copy of the safeguards demonstrating an adequate level of data protection for the transfer, or a reference to where a copy of those safeguards is available. Copies of these safeguards can be requested from us. A transfer of data to third countries is possible with the following providers:

Service: Google
Third country: USA
Appropriate safeguard pursuant to Art. 44 et seq. GDPR: Standard data protection clauses, standard data protection clauses Google Ads. For Google Analytics 4, IP address anonymisation is enabled by default.

Service: LinkedIn
Third country: USA
Appropriate safeguard pursuant to Art. 44 et seq. GDPR: Standard data protection clauses

Service: Mailjet
Third country: USA
Appropriate safeguard pursuant to Art. 44 et seq. GDPR: Standard data protection clauses

Service: Microsoft
Third country: USA
Appropriate safeguard pursuant to Art. 44 et seq. GDPR: Standard data protection clauses

Service: Webflow
Third country: USA
Appropriate safeguard pursuant to Art. 44 et seq. GDPR: Standard data protection clauses

7 Social networks

7.1 General information

We maintain profiles on social networks in order to communicate with you and to provide information about our services.

When you visit one of the pages we maintain there, we may be a joint controller within the meaning of Art. 26 GDPR, together with the provider of the respective platform, for the processing operations involving personal data that this triggers.

The processing operations involve, among other things, the following data:

• master data (for example first and last name, address, age, gender)
• content data (for example texts, photographs, videos)
• usage data (for example visits to websites, interests)
• metadata (for example device information, IP address)

On social and professional networks, this usage data is often processed by the providers for advertising purposes or to analyse user behaviour, without our being able to influence this.

Providers also frequently create usage profiles, on the basis of which user-based advertising can then be shown inside and outside the network. Cookies are often used for this, or usage behaviour is assigned directly to your own member profile on the network (if you are logged in there).

We also use user data to communicate with you via the respective network and to provide you with information. If you interact with our company profile on the respective network (for example by visiting our company profile, commenting on something or liking it), your user profile including your personal data may be made public as a result.

Information on the processing of your data on social and professional networks and on how to exercise your right to object or withdraw consent (opt-out) is set out below.

7.2 Purpose of processing

We process your personal data for the following purposes:

• public relations and marketing purposes, meaning that we provide information about our services and offerings and communicate with you
• recruitment

7.3 Legal basis

The legal basis for processing personal data is our overriding legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR. The overriding legitimate interest corresponds to the purposes stated above.

7.4 Storage period

As a rule, your data is stored by the respective network provider and not directly by us. We store the activities and personal data you publish via our profile until the purpose of processing no longer applies or your consent has been withdrawn, unless retention obligations require otherwise.

7.5 Recipients of personal data

Social network: LinkedIn
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Third country: USA
Appropriate safeguards: Standard data protection clauses
Further information: Privacy policy, opt-out and advertising settings, joint controllership agreement

Social network: Facebook
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland | USA
Third country: USA
Appropriate safeguards: Standard data protection clauses
Further information: Privacy policy, objection settings, joint controllership agreement

Social network: Instagram
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland | USA
Third country: USA
Appropriate safeguards: Standard data protection clauses
Further information: Privacy policy, objection settings, joint controllership agreement

Social network: YouTube
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Third country: USA
Appropriate safeguards: Standard data protection clauses
Further information: Privacy policy, objection settings

8 Your rights

8.1 Right to confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

8.2 Access (Art. 15 GDPR)

You have the right to obtain from us, free of charge and at any time, information about the personal data stored about you, as well as a copy of this data, in accordance with statutory provisions.

8.3 Rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data concerning you. You also have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.

8.4 Erasure (Art. 17 GDPR)

You have the right to request that we erase personal data concerning you without undue delay, where one of the grounds provided for by law applies and where the processing or storage is not necessary.

8.5 Restriction of processing (Art. 18 GDPR)

You have the right to request that we restrict processing where one of the statutory conditions is met.

8.6 Data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, where the processing is based on consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR or Art. 9 (2) lit. a GDPR, or on a contract pursuant to Art. 6 (1) sentence 1 lit. b GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

In addition, when exercising your right to data portability pursuant to Art. 20 (1) GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

8.7 Objection (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of processing in the public interest pursuant to Art. 6 (1) sentence 1 lit. e GDPR or on the basis of our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR.

This also applies to profiling based on these provisions within the meaning of Art. 4 (4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

In individual cases we process personal data for direct marketing purposes. You may object at any time to the processing of personal data for the purposes of such advertising. This also applies to profiling insofar as it is connected with such direct marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for those purposes.

You also have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you that we carry out for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

8.8 Withdrawal of consent under data protection law

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

8.9 Complaint to a supervisory authority

You have the right to lodge a complaint about our processing of personal data with a supervisory authority responsible for data protection.

9 Validity and changes to this privacy policy

This privacy policy is currently valid and dated 14 August 2026.

As we develop our website and our offerings further, or as legal or regulatory requirements change, it may become necessary to amend this privacy policy. You can access the current version of the privacy policy here at any time.