Privacy policy and legal notice for your app (GDPR, Germany)

Privacy notice under the GDPR

Article 13 GDPR requires information about, among other things, the controller, the purposes and legal bases of the processing, the recipients, the storage period and the rights of the people concerned, including the right to lodge a complaint with a supervisory authority.

Legal notice in the EU

Article 5 of the E-Commerce Directive (2000/31/EC) requires providers of online services to make certain general information easily, directly and permanently accessible, such as their name, geographic address and contact details including an email address. Member states implement this in their own laws.

If you operate from Germany

In Germany, § 5 of the Digital Services Act (Digitale-Dienste-Gesetz, DDG) is the legal basis for the imprint. It applies to digital services offered on a business-like basis, usually for remuneration; a free offer is not automatically exempt. It requires, among other things, name and address, details for fast electronic contact and direct communication including an email address, and, depending on the case, the commercial register and the VAT identification number. The details must be easily recognisable, directly accessible and permanently available, in practice usually through a link on every page.

Common mistakes

These mistakes follow from the text of the law:

• The legal notice is linked only on the home page or behind a login. § 5 requires it to be easily recognisable, directly accessible and permanently available.
• The email address is missing. Under point 2, the details for fast electronic contact and direct communication include the email address.
• For a company, the legal form and representatives are missing (point 1), and, if registered, the register and number (point 4) or, where it exists, the VAT identification number (point 6).
• The privacy policy is a template that does not name the services you actually use. Article 13 requires purposes, legal bases, recipients and, where applicable, transfers to third countries.
• The rights of the people concerned or the right to lodge a complaint with a supervisory authority are missing (Article 13(2)).

Example: the details at a glance

Legal notice under § 5(1) DDG, among other things:

• name and address
• for legal entities, legal form and representatives
• details for fast electronic contact and direct communication, including an email address
• register and number
• VAT identification number, where it exists
• for regulated professions, the details of the chamber, the professional title, the state that awarded it and the professional rules
• economic identification number, where it exists

Privacy policy under Article 13 GDPR

These details belong in it:

• controller with contact details
• contact details of the data protection officer, if there is one
• purposes and legal basis
• legitimate interests, if Article 6(1)(f) is the basis
• recipients
• transfers to third countries with safeguards
• storage period
• rights of access, rectification, erasure, restriction, objection and data portability
• withdrawal of consent
• right to lodge a complaint
• whether providing the data is required or necessary and the consequences of not providing it (paragraph 2(e))
• automated decision-making, where it exists (paragraph 2(f))

Typical gaps in AI-built apps

These things are often missing:

• No link to the legal notice, or it is not reachable from every page.
• A template text that does not name the services you actually use.
• Sign-in or analytics that the privacy policy does not mention.

Limits of this guide

We check that the information exists and is reachable, not whether it is legally complete. That is a job for legal advice.

This guide describes the legal position in Germany. Austria and Switzerland have their own rules.

Frequently asked questions