Privacy Policy

1. Controller

The controller responsible for the processing of personal data in connection with Formhelfer is:

Brendan Kiernan
Pfalzburger Straße 73
10719 Berlin
Germany

E-Mail: kontakt@formhelfer.de

2. Overview: website and form assistant

Formhelfer is a private service that assists users in completing forms. Formhelfer is not a government authority and does not provide legal advice.

When using Formhelfer, two processing situations must be distinguished:

a) Visiting the website/landing page: Merely accessing the public website does not involve processing personal application data for a form-filling process. Only the data processing required for the technical provision of the website takes place, in particular in connection with hosting and technical communication.

b) Using the form assistant: Only when the user starts a form-filling process are the details required for the selected application processed. These include, in particular, the browser and session data described below, form entries, where applicable specially protected data, temporary PDF and preview files and, in certain cases, free-text entries for translation.

3. Data processing in the form assistant

The specific personal data processed depends on the selected form and the information provided by the user. Formhelfer therefore does not collect the same data during every use.

Depending on the form, the following categories of data may in particular be processed:

• Basic and identification data, such as name and date of birth,
• Contact and address data,
• Information about marital status, household, children and other family members,
• Information about employment, education or professional situation,
• Information about income, assets, social benefits and other financial circumstances,
• Bank account details,
• Information about housing and tenancy arrangements,
• Information about insurance and social security matters,
• official identifiers, reference numbers or other identification numbers, and
• other information and free-text entries required for the selected form.

Depending on the selected form or information voluntarily entered in free-text fields, special categories of personal data within the meaning of Article 9(1) GDPR may also be processed. This may include, for example, health data or other specially protected information.

The data is processed only to the extent necessary for the form function used by the user.

4. Purpose of form processing

The entered data is processed in order to guide the user step by step through the selected form, reuse information already provided within the current form-filling process, hide or skip questions that are not required based on previous answers, assign the information to the corresponding fields of the form, and then generate and provide a completed application.

Formhelfer does not make any automated decision with legal effect regarding the application. In particular, Formhelfer does not decide whether an application is approved or rejected. That decision is made by the competent authority.

5. Legal bases and consent to the processing of specially protected data

Where the processing of personal data is necessary to provide the form function expressly requested by the user, the processing is based on Article 6(1)(b) GDPR.

Where special categories of personal data within the meaning of Article 9(1) GDPR are processed as part of a form-filling process, such processing is based on the user’s explicit consent pursuant to Article 9(2)(a) GDPR.

Before the form-filling process begins, the user is expressly asked to provide this consent. Consent is not preselected. The form-filling process can only be started after the user has actively selected the checkbox provided for this purpose.

The consent covers the processing of special categories of personal data insofar as this is necessary to complete the form selected by the user.

Consent may be withdrawn at any time during the ongoing form-filling process with effect for the future. The user can use the “Cancel process” function for this purpose. A confirmation is requested before cancellation. If cancellation is confirmed, the ongoing form-filling process is ended and the process data stored for further form processing is deleted. The user is then returned to Formhelfer.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

6. Storage in the browser during the form-filling process

To allow a form to be completed across multiple questions, information required for the ongoing form-filling process is temporarily stored in the user’s browser.

For this purpose, Formhelfer uses the browser’s Session Storage in particular. During the form-filling process, personal information, the current processing status and information about the questions answered so far may be stored there.

This storage is used to technically enable the ongoing form-filling process and to reuse information already entered within that process.

Data stored in Session Storage is generally limited to the respective browser session. The user can also end the ongoing form-filling process using the “Cancel process” function and delete the data stored for the process. In addition, after completion of the form-filling process, Formhelfer provides the user with an option to delete the data stored for that process.

Within the current scope of functionality, Formhelfer does not permanently store personal application data in the browser as a user profile.

Technically necessary settings, such as the selected language, may be stored in the browser independently of personal application data.

7. Session cookie and server-side session

Formhelfer uses a technically necessary session for the form function. This allows individual requests from a user during the form-filling process to be assigned to the same ongoing process.

A session cookie is used for this purpose. The cookie is not used for advertising or to create a user profile.

Access to the cookie via JavaScript is technically restricted. In production operation over HTTPS, the cookie is transmitted exclusively over a secure connection.

Where storing or accessing information on the user’s terminal device is strictly necessary for the form function expressly requested by the user, this is carried out without separate consent in accordance with Section 25(2) No. 2 TDDDG.

The server-side session data is processed in a Redis session store that is accessible only internally on the same server operated in Germany. The session store is operated without permanent Redis persistence and without separate backup of the session data. The maximum lifetime of a session is 24 hours.

If the user selects the “Cancel process” function during the ongoing process and confirms the cancellation, or uses the deletion function provided after completion of the process, the application and process data stored in the relevant session for further form processing is deleted immediately.

If no manual deletion takes place, this server-side data is deleted no later than upon expiry of the session retention period of no more than 24 hours.

8. Creation and provision of the completed application

After the questions have been completed, Formhelfer generates a completed PDF document from the information entered.

The generated PDF and the files required for the protected preview are temporarily stored on the Formhelfer server. They are not located in a publicly accessible directory. Access to the generated document and its preview is tied to the associated session.

After a successful download, the generated PDF and the associated preview files are deleted.

If the document is not downloaded, the temporary files are deleted automatically. Once a storage period of 24 hours has been reached, the generated PDF and the associated preview files are automatically deleted as part of the next scheduled cleanup process.

The temporary storage is used exclusively to create, display and provide the completed application requested by the user.

9. Translation of certain free-text entries using OpenAI

Formhelfer may use AI-assisted translation in certain form fields.

This processing takes place only for designated free-text fields when the form guidance is used in a language other than German and the relevant answer must be translated into German for the German-language form.

When the form guidance is used in German, free-text entries are not transmitted to OpenAI for translation purposes.

The entire application is not automatically transmitted to the AI service. Only completed free-text entries designated for translation, together with a technical field identifier, are transmitted. Multiple free-text entries designated for translation may be processed together.

Because users can enter information themselves in a free-text field, the transmitted texts may contain personal data and, in individual cases, special categories of personal data. Free-text entries transmitted for translation are not generally anonymised before transmission.

The OpenAI API is used for translation.

For users in the European Economic Area, processing is carried out under the applicable contractual data protection arrangements with OpenAI. OpenAI processes customer data provided via the API as a processor in accordance with the applicable agreements.

According to OpenAI, data transmitted via the API is not used to train models by default unless the API customer has expressly opted in to such use.

With the API used, content may generally be retained by OpenAI for up to 30 days as part of safety and abuse monitoring. Longer retention may occur in exceptional cases where required for legal or security reasons.

Where data is processed outside the European Economic Area in the course of providing the service, the transfer is governed by the data protection safeguards provided by OpenAI for this purpose, in particular, where applicable, adequacy decisions or Standard Contractual Clauses.

10. Hosting by netcup

Formhelfer is operated on a virtual server provided by netcup GmbH, Emmy-Noether-Str. 10, 76131 Karlsruhe, Germany. The data centre location used for Formhelfer is in Nuremberg, Germany.

The data required for technical operation is processed on the server. When the form assistant is used, this may in particular include session data required for the ongoing form-filling process as well as temporarily generated PDF and preview files.

A data processing agreement pursuant to Article 28 GDPR has been concluded with netcup. The agreement covers the processing of personal data on behalf of Formhelfer. Based on the agreed configuration and selected server location, the Formhelfer server itself is hosted in Germany.

netcup may use the subprocessors listed in the data processing agreement to provide its services. The subprocessors listed in the reviewed agreement are located in Germany or Austria and therefore within the European Union.

11. Technical server and security logs

For production operation, Formhelfer follows the principle of data minimisation with regard to technical logs.

No permanent access logs are enabled for the upstream web server or reverse proxy (Caddy). Formhelfer therefore does not maintain a routine visitor history of access to the website or form assistant.

Where technical error or system logs are generated as required for operation, troubleshooting or security, these may contain technical information such as the time, affected system component, error or status information and, depending on the technical process, personal connection data. Formhelfer is designed not to intentionally output form answers, request bodies, session contents or cookies in such logs.

Formhelfer’s own technical error and system logs are stored for no more than 7 days and are then automatically deleted. Access is restricted to system administration. Long-term backup of these logs is not intended.

Independently of this, netcup may process technical security data as part of operating and securing its own infrastructure. Such processing is subject to the hosting provider’s data protection and retention rules.

12. Recipients of personal data

Personal data is transferred to recipients only where this is necessary to provide Formhelfer or where there is a legal obligation to do so.

Within the scope of functionality described, recipients or processors include in particular:

• netcup GmbH for hosting and technical infrastructure,
• OpenAI for translating the free-text entries designated for this purpose.

Technical libraries and programs executed locally on the Formhelfer server or in the browser are not separate recipients of personal data insofar as no data is transmitted to their manufacturers or other external parties.

Formhelfer does not independently transmit the completed application to a government authority. The user receives the completed application and decides how it is subsequently used or submitted.

13. Retention periods and deletion

Formhelfer follows the principle of storing personal application data only for as long as technically necessary for the respective form-filling process.

The following principles apply in particular to the form function:

• Personal information is processed in the browser and in the associated server-side session during the ongoing form-filling process.
• During an ongoing form-filling process, the user can use the “Cancel process” function. If cancellation is confirmed, the ongoing process is ended and the process data stored for further form processing is deleted.
• After completion of the form-filling process, an option is also available to delete the personal session data stored for further form processing.
• Without manual deletion, the server-side application and processing data is deleted no later than after the session retention period of no more than 24 hours.
• Generated PDF documents and preview files are deleted after a successful download. If no download takes place, they are automatically deleted after reaching a storage period of 24 hours as part of the next scheduled cleanup process.
• Formhelfer’s own technical error and system logs are retained for no more than 7 days.
• For data transmitted to OpenAI as part of free-text translation, the retention rules applicable to the API service used also apply. According to OpenAI, content may generally be stored for up to 30 days as part of safety and abuse monitoring for the API used.

14. No permanent storage of applications or user profiles

Within the scope of functionality described, Formhelfer does not offer permanent storage of completed applications or a permanent user profile.

Personal application data is therefore not stored for the purpose of automatically making it available to the user during a later, separate use of Formhelfer.

This does not affect the reuse of information already provided within an ongoing form-filling process.

15. Cookies, browser storage and optional services

Within the scope of functionality described, Formhelfer uses only storage mechanisms required to provide the form function requested by the user or for technically necessary settings. These include in particular the technically necessary session cookie, Session Storage during the form-filling process and, where applicable, local storage of technically necessary settings such as the selected language.

These technically necessary storage mechanisms are not used for advertising or cross-user tracking. Where Section 25(2) No. 2 TDDDG applies, no separate consent is required for this purpose.

Google Analytics or comparable optional analytics or marketing services are not enabled within the scope of functionality described. Before any later activation of such services, their data processing and consent requirements will be reviewed separately and the necessary privacy information or consent solution will be implemented before activation.

Any payment services or other external services added later will also be reviewed for data protection compliance before activation and added to this Privacy Policy where required.

16. Security

Formhelfer uses technical and organisational measures to protect personal data against loss, unauthorised access, unlawful alteration and unauthorised disclosure.

These measures include, in particular, limiting storage to the period required for the form function, separating publicly accessible web content from protected generated documents, session-bound access to generated documents and previews, automatic deletion of temporary documents, restricting client-side access to session cookies, and avoiding unnecessary personal content in application logs.

Formhelfer is provided over an HTTPS-secured connection and a reverse proxy. The application server and session store are not directly accessible from the public internet.

The production environment is configured in accordance with the technical and organisational measures described in this Privacy Policy.

17. Rights of data subjects

Where the legal requirements are met, data subjects have, in particular, the following rights under the GDPR:

• to request access to personal data concerning them,
• to request rectification of inaccurate personal data,
• to request deletion of personal data,
• to request restriction of processing,
• to receive data in a structured, commonly used and machine-readable format where the requirements for the right to data portability are met,
• to object to processing where the legal requirements for doing so are met, and
• to withdraw consent at any time with effect for the future.

Where consent to the processing of special categories of personal data relates to the ongoing form-filling process, it can be withdrawn during that process using the “Cancel process” function. If cancellation is confirmed, the ongoing process is ended and the process data stored for further form processing is deleted.

Independently of this, requests to exercise data subject rights may be sent to the contact address provided below.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Requests to exercise these rights may be sent to the following address:

kontakt@formhelfer.de

Because Formhelfer generally processes application data only for a short period and without a permanent user account, data may no longer be attributable to a specific person or use after deletion. Data that has already been deleted cannot subsequently be restored or provided.

18. Right to lodge a complaint with a data protection supervisory authority

Under Article 77 GDPR, data subjects have the right to lodge a complaint with a data protection supervisory authority if they consider that the processing of their personal data infringes the GDPR.

The right to lodge a complaint may be exercised in particular with a supervisory authority in the Member State of the data subject’s habitual residence, place of work or the place of the alleged infringement.

19. Future services and changes to this Privacy Policy

This Privacy Policy will be updated if the functions offered by Formhelfer, the service providers used, or the technical or legal design of data processing changes.

In particular, services that have not yet been activated will only be described as ongoing processing once their specific technical implementation has been determined. This applies in particular to planned email use and a possible contact form, as well as later analytics and payment services.

Before Google Analytics or comparable tracking services are activated, it will be assessed in particular whether and in what form consent is required. Before Stripe, PayPal or other payment services are activated, their specific data flows and data protection requirements will be reviewed separately.

This Privacy Policy describes the server, cookie, logging and service-provider configuration in use at the time of its publication.

Last updated: October 2026