Privacy notice

Switzerland offering · as at 4 August 2026

This is a convenience translation. The German version is the authoritative text.

1. Controller

The controller for the processing of personal data in connection with these pages and the Swiss offering is:

David Wirfs
Sole proprietorship (Einzelunternehmen) — eBilanz Fabrik
Naumannstraße 1
50735 Köln
Germany

E-mail: hello@ebilanzfabrik.de. Further details in the imprint.

The Swiss offering is provided by the same business as the German offering at ebilanzfabrik.de. There is no separate Swiss company and no branch in Switzerland; “eBilanz Fabrik” is the brand under which the sole proprietorship operates.

2. Which data protection law applies — and what that means for you

Because the controller is established in Köln (Germany), the General Data Protection Regulation (GDPR) applies in the first place to all processing described here. Under Art. 3 (1) GDPR it attaches to the place of the controller's establishment — not to the country code of the domain and not to the customer's seat.

Because this offering is addressed to businesses in Switzerland, the revised Swiss Data Protection Act (revDSG, in force since 1 September 2023) applies alongside it. Under the effects principle (Art. 3 DSG) it also covers processing initiated abroad that has effects in Switzerland.

For you this means: both regimes apply side by side, not alternatively. We follow whichever standard is stricter — in practice that is consistently the GDPR. You can therefore assert your rights under both the GDPR and the revDSG, and you may turn to either the German or the Swiss supervisory authority (section 9). You do not need to know which of the two laws applies in a given case: an informal e-mail to hello@ebilanzfabrik.de is enough, and we will handle your request under whichever law is more favourable to you.

3. Whose data is protected at all

Both regimes protect only the data of natural persons. The revDSG expressly removed the protection of legal persons with the revision of 1 September 2023; the GDPR never covered it (Art. 4 (1) GDPR).

For our offering that means, concretely: the figures of your balance sheet and income statement are the data of your company — a legal person — and therefore in principle not personal data within the meaning of this notice. Personal data here is primarily the information about the natural person who contacts us or places the order: the name, e-mail address and role of the contact person. It is otherwise where individual information can be related to a specific natural person — for example in the case of a sole proprietorship, or information about individual shareholders; to that extent the rules of this notice apply to that information too.

That legal classification does not affect how we actually handle your financial figures: we treat them as confidential. They are not profiled, not used for advertising, not sold, and not passed to anyone not named in section 6.

4. What is actually processed on these pages today

The Swiss offering is in preparation. Through these pages you can currently place no order and upload no file — there is no form here, no ordering path and no upload. The only data actually processed today is the following:

Server log files when the page is called up: technical data arises at the hosting provider (IP address, time of access, file requested, volume transferred, browser identification). The purpose is delivery and security of the page. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation); under the revDSG the processing rests on the overriding private interest (Art. 31 DSG). Retention: a short, industry-standard period at the hosting provider.
Your e-mail to us (enquiry or early access): if you write to us, we process your sender address, your name and the content of your message. We use this to answer your enquiry and — if you asked for early access — to notify you as soon as there is something to report about the Swiss offering, at the latest on the day it becomes available. Legal bases: Art. 6 (1) (b) GDPR for answering your enquiry (pre-contractual steps taken at your own request) and Art. 6 (1) (a) GDPR (consent) for keeping your address on the early-access list until launch and writing to you within that scope. The consent covers exactly three kinds of message: the confirmation of your enquiry, a status note once there is something to report about the offering, and the message at launch. We promise no fixed reporting rhythm. You give this consent by asking us for early access, and you can withdraw it informally at any time; withdrawal does not affect the lawfulness of processing carried out until then.

Retention of your enquiry: we keep your message until your matter is settled and no further questions are to be expected; your address stays on the early-access list until you withdraw or request erasure. No automatic deletion period is currently active, and we deliberately name no period here that we cannot technically keep. An informal e-mail to hello@ebilanzfabrik.de is enough — we will then delete your information in full and confirm that to you, unless statutory retention obligations stand in the way. If a paid order comes about, sections 5 and 7 apply in addition.

No cookies, no audience measurement, no tracking services. These pages embed no third-party scripts, set no cookies and store nothing in your browser's storage (neither localStorage nor sessionStorage). No audience measurement takes place on these pages — neither by us nor by third parties — no usage profiles are formed, and no third-party content is embedded. Insofar as these pages load a script at all, it comes from our own server and serves only the functions described in this section; it transmits nothing to third parties. Should any of this change in future, this notice will be amended beforehand.

5. If you place an order with us

The following processing takes place once the Swiss offering is available and you place a paid order with us — not today.

Performing your order: we process your company's master data — including your commercial-register number — the details of your contact person, and the values you have confirmed from the balance sheet and income statement. Those values are mechanically converted into the eCH-0276 format and checked technically; you receive the generated file back. Legal basis: Art. 6 (1) (b) GDPR (performance of the contract). Where we exceptionally act as a processor, this is done on the basis of a contract under Art. 28 GDPR (and, where the revDSG applies, under Art. 9 DSG).
You do the filing yourself. We transmit nothing to any cantonal tax authority, file nothing in your name, and hold no access credentials of yours. Sign-in to the cantonal declaration solution uses AGOV, the Swiss authorities' login. The portal registration number and the matching access code — the details the cantonal tax office allocated to you in its letter, which where a registered general power of attorney exists go to your Treuhänder — stay with you or with them and are at no time collected by us. This is to be distinguished from the commercial-register number mentioned above, which is master data of your annual accounts and is needed to produce the file. No data is transmitted by us to any tax authority.
Statutory retention — please note this point: as a German business we are subject to statutory retention obligations. The invoice and the other accounting vouchers — including the order record (your details, the confirmed values and the payment references) insofar as it evidences the billing — are kept for eight years. Legal basis: Art. 6 (1) (c) GDPR in conjunction with § 147 (3) AO and § 257 (4) HGB; the Fourth Bureaucracy Relief Act shortened that period from ten to eight years with effect from 1 January 2025, and we state here the period that applies today, not the former one. The generated eCH-0276 file is held for the same period so that the billing remains traceable. We therefore expressly do not promise complete erasure of your order data after processing — we could not keep such a promise.
Payment: payment is handled by Stripe on a data path separate from the order data; eBilanz Fabrik receives no complete payment-instrument data, because you pay Stripe directly. Legal basis: Art. 6 (1) (b) GDPR. On Stripe's role see section 6.

6. Recipients

Hosting of these pages: Hetzner Online GmbH, Germany — delivery of these pages from a server location in Nuremberg, Germany. The server log files named in section 4 arise in the process; to that extent Hetzner acts as our processor. Data processing agreement under Art. 28 GDPR, no third-country transfer. We say this explicitly because the pages are reachable under a Swiss domain: delivery is from Germany, not from Switzerland.
Domain and name servers for ebilanzfabrik.ch: Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona, Switzerland — registration of the domain and operation of the authoritative name servers. These pages are not delivered by Hostpoint; the server log files named in section 4, containing your IP address, therefore do not arise at Hostpoint. In authoritative name resolution Hostpoint technically receives only the query of the requesting DNS resolver (usually the internet provider's or a public resolver), not the IP address of visitors; as a rule no personal reference to our visitors arises. As regards the domain and name resolution, Hostpoint acts as an independent recipient and not as a processor; the legal basis is Art. 6 (1) (f) GDPR (legitimate interest in operating a reachable domain).
E-mail (receipt and dispatch): Hetzner Online GmbH, Germany — operation of the mailbox hello@ebilanzfabrik.de on servers in Germany. Data processing agreement under Art. 28 GDPR, no third-country transfer.
Payment (once the offering is available): Stripe Payments Europe, Ltd. (Ireland) as payment service provider; the technical processing is also carried out by Stripe, Inc. / Stripe, LLC (USA). In payment processing Stripe acts as an independent (separate) controller — not as a processor, because Stripe determines the processing for its own purposes, among others for fraud prevention and to meet anti-money-laundering and regulatory duties as a payment institution. To that extent Stripe's own privacy notices apply in addition. Where personal data is transferred to the USA in the process, Stripe (Stripe, LLC) is certified under both the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework; Switzerland recognised the USA as adequate to that extent with the revision of Annex 1 DSV effective 15 September 2024. Standard contractual clauses (SCC) exist in addition. You can request a copy of the standard contractual clauses via hello@ebilanzfabrik.de.

There are no other recipients. In particular we use no analytics, advertising or tracking service providers on these pages (section 4). For internal order administration and data backup the controller additionally keeps an access-protected archive copy of the order data on its own systems.

7. Retention periods at a glance

Server log files: a short, industry-standard period at the hosting provider. Enquiries and early-access list: until settled, or until your withdrawal or erasure request; no automatic deletion period is currently active (section 4). Invoice, other accounting vouchers, order record and generated eCH-0276 file: eight years under § 147 (3) AO and § 257 (4) HGB (section 5). The right to erasure does not apply where processing is necessary to comply with these statutory retention obligations (Art. 17 (3) (b) GDPR) — that data is blocked rather than deleted for the duration of the period.

8. Representative in Switzerland

We have not designated a representative in Switzerland under Art. 14 DSG. The conditions there must be met cumulatively — the processing must relate to an offering to persons in Switzerland and be extensive and be regular and involve a high risk to the personality of the data subjects. Processing at its current scope does not meet them.

You can therefore reach us directly at hello@ebilanzfabrik.de and at the address given in section 1. Should the conditions of Art. 14 DSG be met in future, we will designate a representative and name them and their address here.

9. Your rights and the competent supervisory authorities

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent at any time (Art. 7 (3)). Under the revDSG you have in particular the right of access (Art. 25 DSG), the right to release or transfer of data (Art. 28 DSG), and claims for rectification, erasure or destruction and for prohibition of processing (Art. 32 DSG).

An informal e-mail to hello@ebilanzfabrik.de is enough to exercise them. You incur no costs other than transmission costs at base rates.

Supervisory authority under the GDPR (competent for the controller established in Köln): Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf — www.ldi.nrw.de. You have a right to lodge a complaint under Art. 77 GDPR.

Swiss point of contact under the revDSG: Federal Data Protection and Information Commissioner (EDÖB), Feldeggweg 1, 3003 Bern — www.edoeb.admin.ch. You may report a breach of data protection provisions to the EDÖB; it opens an investigation of its own motion or on such a report (Art. 49 DSG).