Privacy notice

The most important things first

• We need your details only in order to fill in the official forms from them. As soon as the PDF is ready, we delete them.
• The finished PDF stays available for 48 hours, after that we delete it. You can also delete it yourself sooner.
• There is no customer account. You do not register and do not choose a password.
• This site sets no cookies that would need consent and loads nothing from other servers. That is why you see no banner here either.
• What we do have to keep is the payment record — tax law requires that of us. It contains no details from your forms.

1. Who is responsible

The controller for the processing of your data within the meaning of the General Data Protection Regulation is:

• Antragscenter — sole trader, not entered in the commercial register
• Owner: Ercan Ayyildiz
• Am Hüttenhof 7, 50170 Kerpen
• E-mail: info@antragscenter.de
• There is no telephone line; we answer enquiries by e-mail.

2. Data protection officer

No data protection officer has been appointed. The conditions of § 38 of the Federal Data Protection Act are not met: fewer than 20 people are permanently engaged in automated processing, and there is no large-scale processing of special categories as a core activity.

3. What happens here — and what does not

Antragscenter is a form-filling service. You answer questions; from that comes a set of official forms with your details in the right place. You print the set out, sign it and hand it in yourself.

We are not an authority. We send nothing to an authority. We do not look at whether you are entitled to anything, and we make no decision about you.

4. Which data you enter

Which details are asked for is laid down by the official form — we ask for nothing beyond that. The list below is produced directly from the official forms this service fills in, and is regenerated with every change. It counts every field that can occur at all; a single application shows only part of them.

You enter details about other people — children, a partner, a legal representative — because the official form requires them. Everything that follows applies to those details in the same way.

Counted are all the fields that can occur at all in the official forms for this service (Kindergeld 12 official forms, Kinderzuschlag 9, trade notification 4). A single application only ever shows the part your case needs.

5. Special categories: health data

Some official forms ask about circumstances that count as a special category of personal data under Article 9 of the General Data Protection Regulation — essentially health data. We expressly do not claim that nothing of the kind occurs here. It does occur, in these places:

What is collected each time is only what the official form provides for as a box or a period — a yes, a no, a date. A diagnosis, a finding or a degree of disability is not asked for anywhere.

An example of where the line runs: the annex on the additional need for a costly diet (KiZ 7) has a medical part. We do not fill that part in and do not ask for it — it stays empty and is filled in by the doctor's practice after you have printed the set out. We collect only THAT you are claiming an additional need, not why. This is set down in the source code as a check and is demonstrated with every change.

The legal basis for these details is solely your explicit consent under Article 9(2)(a) GDPR. You give it before the purchase with the first tick. Without that consent we cannot produce the set. You can withdraw your consent at any time with effect for the future; the lawfulness of the processing carried out up to then is unaffected.

Details that are not a special category but are often taken for one: nationality is not information about ethnic origin within the meaning of Article 9 — it is in the official forms because entitlement depends on it. Nor are family constellations (single parent, foster child, full orphan) or membership of a statutory health insurance fund special categories. We treat them with the same care, but the stricter legal basis does not apply to them.

With the trade notification, special categories under Article 9 GDPR do not occur.

6. What we process your data for, and on what basis

Every processing operation has a purpose and a legal basis. Both stand side by side here so that you can follow them:

7. How long your data stays

The periods are short and set in the program, not merely promised here:

Deletion happens after delivery, not after payment. Only once your PDF is finished on the server do your entries disappear — otherwise you would be left with neither, if something went wrong while producing it.

8. Where your data is held

The application runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (register court Ansbach, HRB 6089). Hetzner processes the data solely on our instructions and according to our directions. The basis is a data processing agreement under Article 28 GDPR, version 1.2, concluded on 4 August 2026.

The server is in Helsinki, Finland — that is, within the European Union. Under § 3 of that agreement, processing takes place solely in a member state of the European Union or the European Economic Area. No transfer to a third country takes place.

That agreement divides up clearly who looks after what, and we write it down here so that nobody relies on the wrong thing: Hetzner provides the data centre, the network connection, the power supply, the physical security of the building and the detection of overload attacks. For the rented server itself we are responsible — encryption of the stored data, backups, firewall, security updates and monitoring. Those tasks are ours, not Hetzner's.

Hetzner is certified to ISO/IEC 27001:2022. The certificate covers all hosting services and the data centres in Nuremberg, Falkenstein and Helsinki; it is issued to Hetzner Online GmbH and Hetzner Finland Oy. The technical and organisational measures are at hetzner.com/de/AV/TOM.pdf. Hetzner's data protection officer can be reached at dataprotection@hetzner.com.

9. Payment

Payment is handled by Stripe Payments Europe, Limited (Dublin, Ireland). You are taken to a Stripe page for this and enter your payment details there.

The payment service provider is loaded only when you press the buy button — more precisely: you then leave our site and are with Stripe. On the other pages nothing from Stripe is embedded, no script and no image. The exemption from the consent requirement covers the payment process, not a site-wide integration.

We never get to see your card number, your bank details or your login data — neither in full nor in part. From Stripe we learn only whether a payment succeeded, what amount it was for and, if Stripe collected it for the receipt, your e-mail address.

For handling the payment Stripe is an independent controller within the meaning of the GDPR, not a processor for us. Which data Stripe processes for its own purposes — for example to prevent fraud and to meet its own legal obligations — and for how long is governed by Stripe's privacy notices. You will find them at stripe.com under privacy.

Stripe also processes data outside the European Union, among other places in the United States. Under Stripe's data transfer agreement, the European Commission's adequacy decision on the EU-US Data Privacy Framework applies in the first place: Stripe, LLC is itself certified under it and receives data from the European Economic Area on that basis. Where the framework does not cover a transfer, the European Commission's standard contractual clauses under Article 46(2)(c) GDPR apply as a fallback.

Stripe does not get your form data. Only what is needed for the payment goes to Stripe: the amount, a description of the service and a transaction number that says nothing.

10. Translation of what you enter

In a few places the official form asks you to describe something in your own words — an activity, a reason, an explanation. The application goes to a German body in German; a sentence in another language makes it unusable at exactly that point. If you are not using the site in German, we therefore offer to render that one text into German for you.

You decide this field by field. If you write in German, your text does not leave this computer — nothing is translated and nothing is transmitted.

PURPOSE: to produce from your text the German version that goes into the official form, and a back-translation so that you can see before signing what will be written there.

LEGAL BASIS: performance of the contract with you, Article 6(1)(b) GDPR. Translating is part of the service you are buying — the service is called help with filling in and translating. If the text also touches on health data, your explicit consent under Article 9(2)(a) GDPR applies as well, which you give before the purchase with the first tick.

RECIPIENT: Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA. Anthropic processes the text solely on our instructions and according to our directions. The basis is a data processing agreement under Article 28 GDPR; it forms part of Anthropic's Commercial Terms, which we have agreed to.

THIRD COUNTRY: The processing takes place in the United States. The transfer is based on the European Commission's standard contractual clauses under Article 46(2)(c) GDPR.

WHAT IS TRANSMITTED: the text of that one field, the language you are writing in, and the question together with the field label from the official form — the last of these so that anything ambiguous is resolved correctly. Your name, your date of birth, your address, your tax identification number, your account number and the other details of your application are not transmitted. Nor does any identifier go with it that would let the text be traced back to you later. The text of one field is transmitted on its own and is not combined with the others.

HOW LONG WITH US: We store nothing for this operation. The text passes through the translation and afterwards lies only where it lay before — in your browser. Your original text is not sent to our server on purchase either; only the German version that goes into the official form goes there.

HOW LONG WITH ANTHROPIC: up to 30 days. Anthropic keeps the request for that long in order to detect misuse; after that it is deleted. We cannot change this — a version without that retention is available only from a purchase volume that is out of the question for a business of this size. That is why it says so here rather than being left out. What lies there during those 30 days is the text of one field, without your name and without anything that points to you.

These texts can be sensitive. The official form KiZ 5c asks about the reasons why no maintenance is being paid; KG 12a about contact with a foster child. That is why the choice is yours, and why only ever one field goes out at a time.

11. No other services, no advertising, no analytics

This site loads nothing from other servers. The fonts are held by us and are delivered with the page; there is no connection to Google Fonts or any other font service. There are no maps, no videos, no social networks, no advertising networks and no embedded third-party content.

We use no analytics — not even cookie-free analytics. There is no traffic measurement, no tracking and no profiling.

We set no cookies that would need consent under § 25 of the Telecommunications Digital Services Data Protection Act (TDDDG). That is why there is no consent banner here. This is not an oversight but the reason none is needed.

The exception, and it is unavoidable: when you press the buy button you leave our site and are with Stripe. What happens there is governed by Stripe's notices.

The translation of what you enter (section 10) does not contradict this: it happens on our server, not in your browser. Nothing is loaded in, nothing is embedded and nothing is set — your browser talks only to us. A third party is nonetheless involved; who, what for and on what basis is in section 10.

12. What is stored on your device

§ 25 of the Telecommunications Digital Services Data Protection Act (TDDDG) is not only about cookies. It covers any storing of information on your device and any access to it — so Local Storage, Session Storage, IndexedDB and the browser cache as well.

No consent is needed for this if the entry is strictly necessary for the service you expressly asked for to be provided (§ 25(2)(2) TDDDG). We still have to inform you — the duty to inform applies even where no consent is needed. So here is everything that is stored:

All the entries listed are strictly necessary under § 25 paragraph 2 number 2 TDDDG; consent is not needed for them. This site sets no cookies.

That is all there is. There is no identifier by which we could recognise you, and nothing that says anything about your device or your behaviour.

13. What is expressly NOT stored on your device

Your answers from the form are not stored on your device. They are held only in the browser's working memory while the page is open, and are lost when it is reloaded. That has a price — reloading by accident means starting again — but it also means that nothing is left behind on a shared device.

We do not store your transaction number on your device either. It is in the address of the collection page you are taken to after payment. Keep that address for as long as you still need the PDF.

There is no traffic measurement — not even a cookie-free one. Whether such a measurement falls under § 25 TDDDG is judged differently by different people; without any measurement the question does not arise.

14. When you call up this site

When a page is called up, connection data arises for technical reasons: the IP address of your connection, the date and time, the address called up, the volume of data transferred and the message stating whether the call succeeded.

We need this data in order to deliver the page at all and to be able to detect faults and attacks. The legal basis is our legitimate interest in secure operation (Article 6(1)(f) GDPR).

We delete these logs automatically after seven days. We do not keep them longer — that period is enough for troubleshooting and for fending off attacks.

Your answers from the form are not in these logs. They are not transmitted in the address bar.

15. When you use the contact form

In the legal notice, next to the e-mail address, there is a contact form. It is there because § 5 of the Digital Services Act requires a second means of direct communication alongside the e-mail address.

What you enter there is processed: your name, your e-mail address and your message. The purpose is solely to answer your enquiry. The legal basis is our legitimate interest in being reachable and yours in reaching us (Article 6(1)(f) GDPR); if it concerns a contract with us, it is Article 6(1)(b) GDPR.

The message is forwarded to our mailbox and is not stored in the process — no record, no file, no database. What remains of it is the e-mail in our mailbox; it is deleted as soon as your enquiry has been dealt with and no statutory retention duty stands in the way, at the latest after six months.

You do not need an account for this, and no account is created in the process.

16. Your rights

You have these rights in relation to us:

• Access to which data we process about you (Article 15 GDPR).
• Rectification of incorrect data (Article 16 GDPR).
• Erasure (Article 17 GDPR). For your PDF you do not need a request: there is a “Delete now” button on the collection page.
• Restriction of processing (Article 18 GDPR).
• Data portability (Article 20 GDPR).
• Objection to processing based on a legitimate interest (Article 21 GDPR).
• Withdrawal of a consent given, at any time and with effect for the future (Article 7(3) GDPR).

A note on what remains of these in practice: because we delete your details immediately after producing the PDF, and the PDF after 48 hours, after two days there is as a rule nothing left that we could give information about or correct — apart from the payment record.

17. Right to complain

You can complain to a data protection supervisory authority at any time, in particular in the member state of your residence, your place of work or the place of the alleged infringement (Article 77 GDPR).

The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf (street address: Kavalleriestr. 2–4, 40213 Düsseldorf), telephone 0211 38424-0, e-mail poststelle@ldi.nrw.de, ldi.nrw.de.

18. Do you have to give this data?

You are under no statutory or contractual obligation to give us anything. Without the details the official form in question requires, however, we cannot fill in the set — that is the whole service.

Which details are mandatory you can see in the form from a red asterisk. Voluntary details carry none. The details on the additional need for Kinderzuschlag, for example, are voluntary throughout.

19. No automated decision

No automated decision-making, including profiling, under Article 22 GDPR takes place. The program decides only which official forms your case needs and what goes in which field. It does not assess you and makes no decision about your entitlements.

Your application is decided solely by the responsible body, after you have submitted it yourself.

20. Changes to this notice

If what data this service collects changes, this notice changes with it: the lists in sections 4 and 5 are produced directly from the official forms. The version published here is the one that applies.