Privacy Policy

The core of our service is the software-assisted preparation of your application documents. For this we process the information you provide in the wizard — basic personal data, residence and family circumstances, language skills, economic circumstances and, where applicable, information on criminal convictions —, the documents you upload and your account data (e-mail address, orders, subscriptions). The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO).

Individual details may reveal special categories of personal data (Art. 9 DSGVO, for example inferences about origin). We process these only with your explicit consent (Art. 9 Abs. 2 lit. a DSGVO), which you can withdraw at any time with effect for the future. We process information on criminal convictions (Art. 10 DSGVO) exclusively insofar as the official application form asks for it — encrypted and only for your application.

Providing this data is necessary for the contract: without your information we cannot prepare your application documents. There is no statutory obligation to provide it.

The official application form also asks for data of family members (spouse, children, where applicable parents — e.g. name, dates of birth, nationality). We do not collect this data from the data subjects themselves; it comes from the information you provide in the wizard (Art. 14 DSGVO). We process it exclusively to prepare your application documents (Art. 6 Abs. 1 lit. b DSGVO) and do not pass it on to any recipients other than those named in this statement. All data subject rights described below also apply to your family members. Please inform adult family members whose data you provide about this statement.

When you upload identity documents (e.g. passport or electronic residence permit), the image data is transmitted to Anthropic PBC (USA) for automatic text recognition and read there by the AI model Claude — this way we transfer your document data directly into the application without you having to type everything out. The same applies to official letters that you upload for translation in the application tracker — their contents are likewise transmitted to Anthropic PBC for text recognition and translation. The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). On the safeguards for the transfer to the USA, see the section “Transfer to third countries”.

Payments are processed by Stripe; our contractual partner is Stripe Payments Europe Ltd (Ireland). Stripe receives the data required for the payment; your card details are captured directly by Stripe and do not reach our servers. The legal bases are the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO) and legal obligations (lit. c), in particular the retention of invoice data for tax purposes (§ 147 AO). Within the Stripe group, data may be transferred to the USA; Stripe is certified under the EU-US Data Privacy Framework.

We send login links, order, result and confirmation e-mails via Postmark, a service of AC PM LLC (USA, ActiveCampaign group of companies). For this, Postmark receives your e-mail address and the mail contents. The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). AC PM LLC is certified under the EU-US Data Privacy Framework.

When you write to us via the contact form, we process your name, your e-mail address, where applicable your telephone number and your message in order to answer the enquiry. The legal basis is the performance or initiation of the contract (Art. 6 Abs. 1 lit. b DSGVO), otherwise our legitimate interest in answering your enquiry (lit. f). We store the enquiry for as long as its processing requires and then delete it.

For waiting lists and product notifications, we process your e-mail address only with your consent (Art. 6 Abs. 1 lit. a DSGVO) — using the double opt-in procedure: you receive a confirmation e-mail, and only your click on the confirmation link activates the registration. To document consent (Art. 7 Abs. 1 DSGVO), we log the time, IP address, browser identifier and the wording of the consent.

You can withdraw your consent at any time with effect for the future — via the unsubscribe link in every e-mail or informally to kontakt@einbuergerungsservice.de. The lawfulness of the processing carried out up to the withdrawal remains unaffected. Providing this information is voluntary; after withdrawal we delete your waiting-list data, unless another legal basis permits further storage.

Our systems run on servers of Hetzner Online GmbH in Nuremberg (Germany); there we also operate the object storage for uploaded documents. When the website is accessed, we process technical connection data (IP address, time, page accessed, browser identifier) in server logs. We record application errors with Sentry, a service of Functional Software, Inc. (USA); personal content is automatically removed as far as possible before transmission (PII scrubbing). The legal basis is our legitimate interest in secure, stable operation and in defending against attacks (Art. 6 Abs. 1 lit. f DSGVO).

For reach measurement we use Plausible Analytics, a service of Plausible Insights OÜ (Tallinn, Estonia — processing in the EU), without cookies. Aggregated usage data (pages accessed, country of origin, device type) is recorded; individual visitors are not identified. The legal basis is our legitimate interest in the aggregated analysis of website usage (Art. 6 Abs. 1 lit. f DSGVO). You can object to this processing at any time via the privacy settings on the website (Art. 21 DSGVO).

Only with your consent (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG) do we use Microsoft Clarity, a service of Microsoft Corporation (USA), which creates session recordings and heatmaps so that we can improve the usability of the website. Without consent, Clarity is not loaded. In this process, data may be transferred to the USA (see “Transfer to third countries”). You can withdraw your consent at any time with effect for the future via the cookie settings (Art. 7 Abs. 3 DSGVO).

Technically necessary are a signed session cookie (login and assignment of your application) as well as the local temporary storage of your wizard draft in the browser — no consent is required for this (§ 25 Abs. 2 Nr. 2 TDDDG). All non-necessary access to your device takes place only with your consent (§ 25 Abs. 1 TDDDG). Details on all cookies used and your setting options: https://einbuergerungsservice.de/recht/cookies

Your data goes exclusively to the recipients named in this statement: Hetzner Online GmbH (hosting), Stripe (payments), AC PM LLC/Postmark (e-mail delivery), Plausible Insights OÜ (reach measurement), Anthropic PBC (document recognition), Functional Software, Inc. (Sentry, error diagnosis) and — only with your consent — Microsoft Corporation (Clarity). Service providers that process data on our behalf are bound by contracts pursuant to Art. 28 DSGVO. We do not transfer your data to authorities — you submit your application yourself to the competent authority.

Some recipients are located in the USA: Stripe (payments), AC PM LLC/ActiveCampaign (e-mail delivery), Anthropic PBC (document recognition), Functional Software, Inc. (Sentry, error diagnosis) and Microsoft Corporation (Clarity, only with consent). Insofar as the recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the EU Commission (Art. 45 Abs. 3 DSGVO, Decision (EU) 2023/1795); Stripe, AC PM LLC/ActiveCampaign and Microsoft Corporation are certified there (viewable at https://www.dataprivacyframework.gov). Otherwise, we safeguard transfers by means of EU standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO, Implementing Decision (EU) 2021/914). You can obtain a copy of the respective safeguards via kontakt@einbuergerungsservice.de.

Sensitive application data is additionally encrypted at the application level with AES-256-GCM before storage. Transmission takes place exclusively TLS-encrypted (HTTPS) with HSTS. More on our security measures: https://einbuergerungsservice.de/recht/sicherheit

You have the right to access (Art. 15 DSGVO), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consents given at any time with effect for the future (Art. 7 Abs. 3 DSGVO), without the lawfulness of the previous processing being affected.

Send access and export requests to kontakt@einbuergerungsservice.de; after identity verification we provide your data within one month (Art. 12 Abs. 3 DSGVO) in a structured, machine-readable format (JSON). Account deletion is additionally available as self-service in your account. Excluded from deletion is only data that we are legally required to retain (Art. 17 Abs. 3 lit. b DSGVO, e.g. invoice data).

You have the right, on grounds relating to your particular situation, to object at any time to processing based on Art. 6 Abs. 1 lit. f DSGVO (Art. 21 Abs. 1 DSGVO) — this concerns in particular the reach measurement, which you can object to directly via the privacy settings of the website. We will then no longer process the data concerned, unless there are compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

If data is processed for direct marketing, you can object to this processing at any time without giving reasons (Art. 21 Abs. 2 DSGVO). Send your objection to kontakt@einbuergerungsservice.de.

From your information, the wizard generates a software-assisted assessment of whether your information meets the statutory requirements. This assessment is an informational and form-filling aid — an automated decision with legal effect within the meaning of Art. 22 DSGVO does not take place. Your application is decided exclusively by the competent authority. civitas. is a private service provider — not a public authority, not a law firm.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 DSGVO). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, https://www.ldi.nrw.de. You can also contact the supervisory authority of your habitual residence or place of work.

We adjust this statement when our processing changes; the version published here at any given time, with the status indicated above, is authoritative. Should we wish to further process your data for a purpose other than the one for which it was originally collected, we will inform you in advance (Art. 13 Abs. 3 DSGVO).