Privacy Policy

GDPR / DSGVO

Privacy at a Glance

Here you can find out which data the calculator and website use, who to contact, and what choices and rights you have.

Who is responsible for data collection on this website?: The website operator is responsible for data processing. You can find their contact details below.
How do we collect your data?: Calculations run in your browser. Selected inputs and settings are stored there for the session. Shared links contain scenario values in their URL. When you visit, hosting systems also receive connection data such as your IP address, the requested URL and browser information to deliver and protect the website.
What do we use your data for?: We use data to provide the calculator and comparisons, keep your session settings, and deliver and protect the website. Any optional services and external affiliate links are described separately.
What rights do you have regarding your data?: Subject to the applicable legal conditions, you can request access, correction or deletion and object to processing. You can also complain to a data protection authority. Details and other rights are explained below.

1. Name and Address of the Controller

Oliver Ferch

Zimmererstr. 26

86153 Augsburg, Deutschland

Tel.: 0151-57475737

E-Mail: [email protected]

Website: www.nettoflow.com

2. Contact by Email or Telephone

If you contact us by email or telephone, we process your contact details, the content of your enquiry and any information you choose to provide so that we can respond. The legal basis is our legitimate interest in handling enquiries (Article 6(1)(f) GDPR); where an enquiry concerns a contract or steps requested before entering into a contract, Article 6(1)(b) GDPR applies. We keep correspondence for as long as needed to handle the enquiry and, where applicable, meet legal retention requirements or establish, exercise or defend legal claims. You can also use the controller's contact details to ask about this policy or exercise your data-protection rights.

3. Server Log Files

When you access this website, our hosting infrastructure automatically processes technical data required for delivery and security, such as IP address, date/time, requested URL, referrer, user agent, and response status. We do not use this data to identify you personally without a legal basis.

4. Cookies and Similar Storage Technologies

Our website uses cookies and similar storage technologies. Technically necessary storage (including sessionStorage under the key "aa.tax-planner.state.v2") is used to provide calculator functionality and keep selected settings during your browser session. We also use URL parameters for share links. Optional technologies, including advertising-related cookies, are only used where there is a legal basis (in particular your consent).

Choose whether to allow analytics and affiliate offers. Rejecting optional services still gives you full access. You can change or withdraw your choice at any time in cookie settings. Functional browser storage keeps calculator inputs and settings and remembers your consent choice. These functions are always active. Your choice lasts 6 months. Analytics cookies are configured for at most 13 months without renewal. We retain submitted consent receipts and daily totals for 36 months in the Netherlands. Recovery copies may remain for up to 7 additional days. Receipts contain a random reference, time, permissions, language, disclosure version and a link to the previous receipt when changed. We do not record unanswered dialogs or browsing history. Google Cloud (Cloud Run / Firestore). (Art. 6(1)(c), 7(1) GDPR; § 25(2)(2) TDDDG.) aa_consent; aa_consent_pending (localStorage): ≤ 7 days.

6. Hosting (Google Cloud)

We use Google Cloud infrastructure to host and deliver this website. Hosting processes technical connection data, including IP addresses, request times, requested URLs and browser information, for our legitimate interest in providing a reliable and secure service (Article 6(1)(f) GDPR). Interactive calculator inputs are processed in your browser; when you open a shared URL, its parameters are also transmitted to the hosting infrastructure as part of the page request. Information about Google's processing terms and international transfer safeguards is available at https://cloud.google.com/terms/data-processing-addendum.

7. Content Delivery Network (Cloudflare)

We use the Content Delivery Network (CDN) and security services of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) to deliver our website quickly and securely. Cloudflare operates as a reverse proxy, caching static assets and web pages across a global edge network to shorten loading times, and providing DDoS protection against cyberattacks. When accessing our pages, your browser establishes a connection to Cloudflare servers, which process technical connection data (including your IP address, requested URL, browser information, and access timestamp) on the basis of our legitimate interest in providing a fast, reliable, and secure service (Article 6(1)(f) GDPR). Data may be routed through or processed on servers outside the European Economic Area, including the USA. Cloudflare is certified under the EU-US Data Privacy Framework (DPF) and relies on Standard Contractual Clauses for international data transfers. Further information is available in Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.

8. SSL/TLS Encryption

We use HTTPS (TLS) to encrypt data in transit between your browser and our website. This does not prevent processing by us or our hosting providers.

9. Analysis Services (Google Analytics)

We use Google Analytics 4 from Google Ireland Limited to measure website use and improve our content. It loads only after your separate consent in Cookie settings. It may process page views, interactions, timestamps, cookie identifiers, browser and device information, and approximate location. According to Google, IP addresses from users in the EU, Switzerland and the UK are used to derive location and discarded before logging; this does not mean that all analytics data stays in those regions. Our Analytics integration disables Google signals and advertising personalization signals. Processing is based on Article 6(1)(a) GDPR; device storage and access are based on Section 25(1) TDDDG. Analytics cookies are configured for at most 13 months without renewal. (_ga, _ga_<container-id>.) Cookie lifetime differs from server-side data retention: GA4 offers configurable user/event retention, and aggregated reports are treated separately. Information: https://support.google.com/analytics/answer/7667196 and https://support.google.com/analytics/answer/12017362. You can withdraw consent through cookie settings to stop further collection by our integration.

10. Affiliate Partners

Consent: § 25(1) TDDDG and Article 6(1)(a) GDPR. Optional services can be rejected or consent withdrawn at any time. One advertising choice covers all listed partners. Every page, including the home page, follows the country selected in the header: DE/AT/CH use financeAds; all other countries use Wise / Partnerize. After advertising consent, financeAds loads banners for S Broker, SMARTBROKER+, Consors Finanz and DKB, including redirects to image hosts. Displaying a banner may transmit your IP address, device information and referring website origin. Clicking opens the advertiser via financeAds; attribution may use cookies and earn us a commission. Seen offer IDs stay in your browser for 30 days to rotate offers; they are removed when advertising consent is withdrawn. On click: IP address, browser/device information, referring website, click identifier and attributed conversion information. We do not attach calculator inputs. Cookies on partner domains must be managed in your browser or with that partner. Attribution windows after clicking: S Broker 60 days; SMARTBROKER+ 60 days; DKB 30 days. Provider privacy information: Consors Finanz is available only in Germany. After Ads consent, its banner image loads directly from financeAds. This request may send your IP address, browser/device information and the referring website origin to financeAds. financeAds may use third-party cookies to attribute leads and sales; the Consors click-attribution window is 90 days. https://www.financeads.net/Datenschutz/. Wise / Partnerize: Shows a locally hosted affiliate offer after Ads consent. Displaying it does not contact Partnerize or Wise. Clicking opens Partnerize and Wise; referral attribution can earn us a commission. On click: IP address, browser/device information, referring website, click identifier and attributed conversion information. We do not attach calculator inputs. Cookies on partner domains must be managed in your browser or with that partner. Provider privacy information: https://partnerize.com/legal/privacy-policy, https://wise.com/privacy-policy. If an ad blocker hides the banner or image, this site shows a locally hosted copy inside the same tracked link. The fallback image is served by this site; a click still goes through financeAds.

11. Recipients of Personal Data

Recipients include the hosting and security providers needed to deliver this website and authorities where disclosure is legally required. Affiliate recipients are described separately. Google services may involve processing outside the European Economic Area, including in the USA. Google describes reliance on adequacy decisions, including the EU-US Data Privacy Framework for certified recipients, and standard contractual clauses where applicable, at https://policies.google.com/privacy/frameworks. The applicable safeguards depend on the service and recipient; the Google Cloud processing terms linked in the hosting section apply specifically to hosting.

12. Legal Basis for the Processing

We process data needed to deliver and secure the website on the basis of our legitimate interests under Article 6(1)(f) GDPR. Device storage or access strictly necessary for a service you expressly request falls under Section 25(2)(2) TDDDG. Optional analytics and advertising require consent under Article 6(1)(a) GDPR and, for device storage or access, Section 25(1) TDDDG. Processing to comply with legal obligations is based on Article 6(1)(c) GDPR. The contact section explains the basis for handling enquiries.

13. Legitimate Interests

Our legitimate interests include providing reliable calculator functionality, preserving user-entered settings during a session, protecting and securing the service, and troubleshooting technical issues.

14. Period for Which Personal Data Will Be Stored

Calculator settings in sessionStorage normally remain for the browser tab's session; restoring a browser session may also restore these settings. Shared URLs contain the scenario values themselves, and deleting your URL or browser history does not delete copies held by recipients or recorded in technical logs. Technical logs are retained only as needed for service operation, investigating faults or security incidents, and applicable legal obligations. Contact correspondence is retained as needed to handle the enquiry and, where applicable, meet legal retention requirements or establish, exercise or defend legal claims.

15. Routine Erasure and Blocking of Personal Data

We process and store personal data only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator. If the storage purpose is not applicable, or if a storage period expires, the personal data are routinely blocked or erased.

16. Statutory or Contractual Requirements

You do not have to provide your name or other identifying details to use the calculator. Entering scenario values and creating share links is voluntary, and you may use hypothetical values. If you contact us, we need sufficient contact and enquiry information to respond. Technical connection data is processed when the website is delivered.

17. Existence of Automated Decision-making

We do not use calculator inputs for solely automated decisions that produce legal effects concerning you or similarly significantly affect you. Where personalized advertising is offered and you consent, advertising providers may evaluate information to select ads based on interests. The advertising section describes this separately.

18. Rights of the Data Subject

a) Right of confirmation: Each data subject has the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed.
b) Right of access: Each data subject has the right to obtain free information about personal data stored at any time and a copy of this information, including the purposes of the processing, categories of data concerned, recipients, storage period, and existence of rights to rectification or erasure.
c) Right to rectification: Each data subject has the right to obtain without undue delay the rectification of inaccurate personal data and to have incomplete personal data completed.
d) Right to erasure (Right to be forgotten): Each data subject has the right to obtain from the controller the erasure of personal data without undue delay where one of specific grounds applies, such as the data no longer being necessary for its original purpose.

e) Right of restriction of processing

Each data subject has the right to obtain restriction of processing where the accuracy of data is contested, the processing is unlawful, or the data subject has objected to processing.

The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data happened/is happening unlawfully, you can request the restriction of data processing instead of deletion.
If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request restriction of the processing of your personal data instead of deletion.
If you have lodged an objection pursuant to Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may – apart from its storage – only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

f) Right to data portability: You have the right to receive personal data you have provided to us in a structured, commonly used, machine-readable format and transmit it to another controller, where processing is automated and based on your consent or a contract.
g) Right to object: You have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR, including related profiling. You may object to processing for direct marketing at any time.
h) Automated individual decision-making: Subject to the exceptions in Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.
i) Right to withdraw consent: You can withdraw consent at any time through cookie settings. Withdrawal does not affect the lawfulness of processing before withdrawal. It stops future consent-based processing by our integrations, but does not automatically delete previously stored data. Your statutory rights to request erasure remain unaffected. You can continue using the calculator without consenting to optional services.
j) Right to lodge a complaint: Each data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if they consider that the processing of personal data relating to them infringes the GDPR.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ASSERTION, EXERCISE OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).

19. Objection to Advertising Emails

The use of contact data published as part of the imprint obligation for sending unsolicited advertising and information materials is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, such as spam emails.

20. Definitions

This data protection declaration is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our data protection declaration should be legible and understandable for the general public, as well as our customers and business partners.

a) Personal data: Personal data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
b) Data subject: Data subject is any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing.
c) Processing: Processing is any operation or set of operations which is performed on personal data, such as collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure or destruction.
d) Restriction of processing: Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.
e) Profiling: Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
f) Pseudonymisation: Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately.
g) Controller: Controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
h) Processor: Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
i) Recipient: Recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.
j) Third party: Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who are authorised to process personal data.
k) Consent: Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she signifies agreement to the processing of personal data.