Privacy on this website
What happens when you visit davfla.de, what is counted and what is not, and what rights you have.
Contents
- In short
- Controller
- Hosting
- Visiting the website
- Server logs
- Anonymous page counter
- Cookies and browser storage
- Fonts, images and third-party content
- Net pay calculator and online help
- Links to the App Store, Google Play and other sites
- Web calendar (shared links)
- Resetting the WebSync password
- Contact by email
- Recipients and third countries
- Retention at a glance
- Your rights
- No obligation, no profiling
- Security
- Changes
As of: 1 November 2026. This policy applies to the website www.davfla.de and all its pages. The app has its own privacy policy.
This is a translation for convenience. The German version is authoritative.
In short
- No cookies, no analytics or advertising services, no content from third-party servers.
- The server keeps no access log. Only technical errors are written with the IP address to an error log, which is deleted after 14 days.
- Only page views are counted, as plain daily numbers without IP address and without identifier.
- The net pay calculator runs in your browser; your input never leaves it.
- If you email me, I use your details only to reply to you.
Controller
David Illmer (DavFla)
Pfarrer-Krimmer-Weg 1
85447 Reichenkirchen
Germany
Email: support@davfla.de
I develop the website and the app on my own. I am not required to appoint a data protection officer and have not appointed one. Please contact me directly with any privacy question.
Hosting
The server and the mailbox are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, in data centres in Germany. STRATO processes the data only on my behalf and on my instructions; a data processing agreement under Art. 28 GDPR is in place.
Visiting the website
When you open a page, your browser necessarily sends data to my server: your IP address, date and time, the requested address, the address of the previous page (referrer), browser and operating system (user agent) and your preferred language. The server needs this to deliver the page. It uses the data only for the duration of the request and does not store it, except when an error occurs (see Server logs).
Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is to provide the website and operate it securely. Access to this information is strictly necessary for the service you requested (Section 25(2) No. 2 TDDDG).
Server logs
The server keeps no access log (who opened which page when). If a technical error occurs during a request, the web server writes it to an error log with date, time, your IP address and the requested address. I use it only to fix errors and detect attacks. It is deleted automatically after 14 days.
To prevent mass requests, for example to the web calendar, the server briefly counts how often an address has made requests in the last few minutes. For this it creates a small counter file whose name is derived from a hash of the IP address. It contains only a start time and a count, no content.
Legal basis: Art. 6(1)(f) GDPR (secure and stable operation).
Anonymous page counter
So that I know which pages are read, a small script reports to my server when a page is opened: “this page was opened once”. It only reports after the page has been visible for at least one second. For the first page of a visit, it adds the rough origin, as one of the words “direct”, “search engine” or “link”. The address of the previous page itself never leaves your browser. Tapping a button to the App Store or Google Play is counted as well.
Only daily totals of the form “date, page, count” are stored. There are no cookies, no browser storage, no identifier, no fingerprinting, and neither the IP address nor the user agent is stored, not even shortened or hashed. Requests from search engines and other programs are recognised on arrival by technical features of the request and discarded without storing anything. The counts cannot be traced back to you.
Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is to improve the website according to visitors’ needs. If you do not want the script, you can turn off JavaScript; the pages work without it (except the net pay calculator).
Cookies and browser storage
The website sets no cookies. Only the online help remembers in your browser’s session storage whether you want to see the instructions for Android or iOS. This value stays in your browser, is not transmitted and is deleted when you close the tab. It is required for the display you chose (Section 25(2) No. 2 TDDDG).
Fonts, images and third-party content
All fonts, images and scripts come from my own server. No content is loaded from Google Fonts, CDNs, video platforms, social networks or other third-party servers. No other provider learns about your visit.
Net pay calculator and online help
The net pay calculator runs entirely in your browser. Gross pay, tax class and all other input are neither transmitted to my server or third parties nor stored. The online help is the same as in the app, and its search also runs only in your browser.
Links to the App Store, Google Play and other sites
The App Store and Google Play buttons and the link to Schicht-Wissen are plain links. Only when you tap them does your browser open the other site, and only then does its provider receive data from you. Their privacy policy applies there: Apple Distribution International Ltd. (App Store), Google Ireland Limited (Google Play) or the operators of Schicht-Wissen.
Web calendar (shared links)
Users of the app can share their calendar through a personal link. If you open such a link, the server shows the user’s calendar read-only. For that link it records only the first and last access and the number of accesses, so that the user can see in the app whether and how often the link was used. I do not store who opened the link. Once the user has revoked the link, it shows nothing.
Legal basis: Art. 6(1)(f) GDPR. The legitimate interest of the user and mine is to be able to control shared links and detect misuse.
Resetting the WebSync password
If you have forgotten your WebSync password, my server sends you an email with a link that can be used only once. On the page behind the link you set a new password. For this I process your email address and the random code of the link. The code is deleted as soon as you have set the new password and replaced if you request a reset again. The new password is stored only as a hash. Details are in the app privacy policy.
Legal basis: Art. 6(1)(b) GDPR (providing your WebSync account).
Contact by email
If you write to support@davfla.de or supportios@davfla.de, I process your email address, your name if you give it, the content of your message and attachments in order to answer your request. The mailbox is hosted by STRATO (see Hosting).
AI-assisted reply drafts: To answer faster, a program on my own computer has a reply draft written for newly received emails. For this, sender name and address, date, subject and text of the email are sent to the AI service Claude by Anthropic. Attachments are not sent. Anthropic processes the data as a processor and, under its contract terms, does not use it to train its models. Processing may take place in the USA (see Recipients and third countries). The draft is delivered only to me. I check it and send every reply myself; there are no automatic replies. If you do not want this, let me know: I will put your address on an exclusion list, and your future emails will no longer be sent to the service.
Legal basis: Art. 6(1)(b) GDPR if your request concerns your purchase or your WebSync account, otherwise Art. 6(1)(f) GDPR (answering your request; faster handling through drafts).
Retention: I delete emails once your request has been dealt with and no further need is apparent. Statutory retention obligations (for example for records relating to purchases) remain unaffected.
Recipients and third countries
| Recipient | Purpose | Location |
|---|---|---|
| STRATO GmbH, Berlin | Server, mailbox, sending emails (processor) | Germany |
| Anthropic (Claude) | Reply drafts for support emails (processor) | USA possible |
Transfers to Anthropic in the USA are covered by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which are part of Anthropic’s contract terms. Beyond that, I pass on your data only if I am legally obliged to. I do not sell data.
Retention at a glance
| Data | Period |
|---|---|
| Connection data during a request | only during the request |
| Web server error log (with IP address) | 14 days |
| Page counter (daily totals, not personal) | indefinitely, as anonymous |
| Web calendar counters (first/last access, count) | until the link is revoked or the account is deleted |
| Support emails | until the request has been dealt with, unless retention is required by law |
Your rights
You have the following rights regarding your personal data:
- Access (Art. 15 GDPR): which data I hold about you.
- Rectification (Art. 16 GDPR) of incorrect data.
- Erasure (Art. 17 GDPR), unless a retention obligation applies.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR): your data in a common, machine-readable format.
- Withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future. Processing up to that point remains lawful.
Right to object (Art. 21 GDPR): Where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. I will then stop processing the data unless I can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
A short email to support@davfla.de is enough. So that I do not hand out data to the wrong person, I may ask for something like your WebSync ID.
Complaints: You can lodge a complaint with any data protection supervisory authority. The authority responsible for me is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
No obligation, no profiling
You are under no legal or contractual obligation to provide data. Without the respective details, only the feature concerned is unavailable. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.
Security
All connections to my server are encrypted via HTTPS (TLS). Access to the server and the admin area is password-protected, and WebSync account passwords are stored only as hashes. No system is perfectly secure, but I keep the server up to date and check it regularly.
Changes
If the website or the legal situation changes, I will update this policy. The version published here applies; the date is at the top.