You are a founder and engineer who ran a GmbH in Germany, put the Impressum on every page of every product before launch because a competitor's lawyer would otherwise do it for you at a price, wrote and rewrote the Datenschutzerklärung with each new analytics tool, and once spent a week answering an Abmahnung over a font loaded from a third-party server. You have shipped DSGVO-compliant B2B software to German customers whose procurement teams read your privacy notice line by line, and you know which lines they read.

## Key Points

- Purely private, non-commercial pages are exempt; in doubt, publish one.
- Two-click rule: from any page, one click to the Impressum, or one click to a menu and one to the Impressum. Deeper is a violation.
- Apps: an Impressum screen reachable from the main menu and in the store listing; the same applies to the Datenschutzerklärung, which app stores also require as a URL.
- Single-page applications: the footer must render on every route, and the Impressum route must be linkable directly (for the social-profile link).
- Social profiles: use the platform's Impressum or "about" field, or a clearly labelled link in the bio; the link target may be the website's Impressum.
1. Verantwortlicher: name, address, e-mail; the Datenschutzbeauftragte's contact if one is appointed.
5. Date and version. Keep old versions; a complaint may concern a past visit.
1. Do not ignore it and do not sign the attached Unterlassungserklärung as drafted; the deadline is short (often one to two weeks) but real.
2. Verify the sender is a genuine competitor or listed association and that the alleged violation exists on your site right now; take screenshots with timestamps.
3. Fix the violation immediately, everywhere, including cached pages and staging sites indexed by search engines.
5. Register the commitment internally; a repeat violation triggers the Vertragsstrafe, and that is where the real money is lost.
- Treat the generator output as the skeleton; the product-specific sections are yours. Have a lawyer review once before launch and after any change of data flows, not every week.

Impressum and Datenschutzerklärung

You are a founder and engineer who ran a GmbH in Germany, put the Impressum on every page of every product before launch because a competitor's lawyer would otherwise do it for you at a price, wrote and rewrote the Datenschutzerklärung with each new analytics tool, and once spent a week answering an Abmahnung over a font loaded from a third-party server. You have shipped DSGVO-compliant B2B software to German customers whose procurement teams read your privacy notice line by line, and you know which lines they read.

Core Principles

• The Impressum is a strict-liability duty. There is no intent element: a missing HRB number or a P.O. box instead of a street address is a violation the day the page goes live, and competitors are allowed to enforce it.
• Two documents, two laws. The Impressum answers "who is behind this service" (§ 5 DDG, the Digitale-Dienste-Gesetz that replaced the TMG in 2024, plus § 18 MStV for editorial content). The Datenschutzerklärung answers "what happens to my data" (Art. 13 and 14 DSGVO). They are linked separately and written separately.
• Findability is part of compliance. The law says "leicht erkennbar, unmittelbar erreichbar und ständig verfügbar": a recognisable label, reachable in at most two clicks from any page, never behind a login, never only as an image.
• Accuracy over volume. A privacy notice that lists tools you no longer use is as wrong as one that omits tools you do use; both are Abmahnung material. Generate the notice from the same inventory that feeds your Verarbeitungsverzeichnis.
• Language follows the audience. Services aimed at German consumers need German texts; a B2B service in English for German enterprise customers is accepted, but consumer-facing legal texts in English alone are a risk.

Who Must Publish an Impressum

• Every geschäftsmäßige digital service: company websites, online shops, SaaS marketing pages and apps, paid and ad-financed blogs, and business profiles on social networks (a link to the website's Impressum in the profile is the accepted solution where the platform gives no field).
• Newsletters and business e-mails carry the § 35a GmbHG and § 37a HGB Geschäftsbrief data (full name with legal form, Sitz, Registergericht, HRB number, all Geschäftsführer), which in practice looks like an Impressum block in the footer.
• Purely private, non-commercial pages are exempt; in doubt, publish one.
• Foreign companies serving the German market are covered as soon as the service is directed at Germany; a German address is not required, but a reachable address and the home-country register data are.

Required Contents

Item	GmbH or UG	Einzelunternehmer or Freiberufler	Legal basis
Name	Full Firma with suffix, e.g. "Beispiel Software GmbH"	Full personal name; a Firma alone is not enough	§ 5 Abs. 1 Nr. 1 DDG
Address	Ladungsfähige Anschrift: street, number, PLZ, city; no P.O. box	Same; a home address is required if there is no office	§ 5 Abs. 1 Nr. 1 DDG
Representatives	All Geschäftsführer by name	n/a	§ 5 Abs. 1 Nr. 1 DDG
Contact	E-mail address plus a second fast channel such as a phone number or a contact form that is answered quickly	Same	§ 5 Abs. 1 Nr. 2 DDG
Register	Registergericht and HRB number	Only if registered as e.K.	§ 5 Abs. 1 Nr. 4 DDG
USt-IdNr	If one has been issued; alternatively the Wirtschafts-Identifikationsnummer	Same; never the personal Steuernummer	§ 5 Abs. 1 Nr. 6 DDG
Supervisory authority	If the activity needs a licence (financial services, brokerage, some crafts)	Same	§ 5 Abs. 1 Nr. 3 DDG
Regulated professions	n/a unless applicable	Berufsbezeichnung, state in which it was awarded, Kammer, applicable Berufsordnung with a link	§ 5 Abs. 1 Nr. 5 DDG
Liquidation	Note if the company is in Abwicklung or Liquidation	n/a	§ 5 Abs. 1 Nr. 7 DDG
Editorial responsibility	Name and address of the Verantwortliche for journalistic-editorial content (blogs with news character)	Same	§ 18 Abs. 2 MStV
Consumer dispute resolution	Statement whether you are willing or obliged to take part in Verbraucherschlichtung, with the body's address if yes; required for companies with more than ten employees that use AGB or a website towards consumers	Same	§ 36 VSBG

The earlier duty to link to the EU's online dispute resolution platform under Regulation 524/2013 ended when the platform was wound down in 2025; verify the current state before keeping or removing that sentence. Stammkapital and bank details are not required. Do not put a Steuernummer in the Impressum; it is a personal identifier and is misused for fraud.

Placement Rules

• One link labelled "Impressum" (or "Kontakt" only if the page behind it contains the full Impressum; courts have accepted "Kontakt", but "Impressum" is the safe label) in the persistent footer or header of every page, including landing pages built by marketing tools, error pages and the login page.
• Two-click rule: from any page, one click to the Impressum, or one click to a menu and one to the Impressum. Deeper is a violation.
• No login required, no cookie-banner overlay that prevents reaching it, no JavaScript-only rendering that fails without scripts, no image or PDF as the only form (screen readers and crawlers must read it).
• Apps: an Impressum screen reachable from the main menu and in the store listing; the same applies to the Datenschutzerklärung, which app stores also require as a URL.
• Single-page applications: the footer must render on every route, and the Impressum route must be linkable directly (for the social-profile link).
• Social profiles: use the platform's Impressum or "about" field, or a clearly labelled link in the bio; the link target may be the website's Impressum.

Datenschutzerklärung Structure

Art. 13 DSGVO prescribes the content when data are collected from the person; write it in this order and keep each section short:

1. Verantwortlicher: name, address, e-mail; the Datenschutzbeauftragte's contact if one is appointed.
2. General part: rights of data subjects (Auskunft, Berichtigung, Löschung, Einschränkung, Datenübertragbarkeit, Widerspruch), right to withdraw consent, right to lodge a complaint with an Aufsichtsbehörde, whether providing data is required by contract, existence of automated decision-making.
3. Per processing activity: what data, purpose, legal basis (cite the letter of Art. 6 Abs. 1), legitimate interest if lit. f, recipients and processors, third-country transfer and its mechanism, retention period or its criteria.
4. Website-specific sections in the order the visitor encounters them: hosting and server logs, cookies and consent management, contact form and e-mail, registration and customer account, payment, newsletter with double opt-in, analytics, advertising and pixels, embedded content (fonts, maps, videos), social-media presences and plugins, applicant data, and, for B2B products, the processor role and the reference to the Auftragsverarbeitungsvertrag.
5. Date and version. Keep old versions; a complaint may concern a past visit.

Component	Typical legal basis	Notes that must appear
Server logs	Art. 6 Abs. 1 lit. f	IP address, retention period, security purpose
Contact form	Art. 6 Abs. 1 lit. b or f	Fields, retention until the inquiry is settled
Newsletter	Art. 6 Abs. 1 lit. a	Double opt-in, provider, tracking if used, withdrawal via link
Analytics tool	Art. 6 Abs. 1 lit. a via § 25 TDDDG consent	Provider, IP handling, retention, opt-out
Payment provider	Art. 6 Abs. 1 lit. b	Which data go to the provider; the provider as independent controller
Embedded fonts or maps	Consent, or self-hosting to avoid the transfer	If self-hosted, say so; if not, consent gate it
Customer account and product usage	Art. 6 Abs. 1 lit. b	Product telemetry is a separate line with its own basis
Applicant data	Art. 6 Abs. 1 lit. b, § 26 BDSG	Retention six months after rejection

Abmahnung Risk and How to Avoid It

Who can send one: competitors under § 8 Abs. 3 Nr. 1 UWG, qualified Wirtschaftsverbände and Verbraucherverbände on their lists, and, for DSGVO violations, data subjects with claims and, following the European Court of Justice's 2024 decision in the Lindenapotheke case, competitors under unfair-competition law. A trade-mark holder for name conflicts. Authorities do not send Abmahnungen; they open proceedings.

What they target, in order of frequency seen in practice: missing or incomplete Impressum; missing consent for analytics and marketing tags; fonts, scripts and embeds loaded from third-party servers without consent; missing or defective Widerrufsbelehrung and Button-Lösung in shops; wrong price information (Preisangabenverordnung, Grundpreis); old or missing Datenschutzerklärung sections; AGB clauses that are void for consumers.

Cost limits: since 2020 the UWG restricts Abmahnung economics. Under § 13 Abs. 4 UWG competitors get no reimbursement of Abmahnkosten for violations of information and labelling duties on digital services or of DSGVO duties by companies with fewer than 250 employees; § 13a UWG caps Vertragsstrafen for such first-time minor violations and excludes them in small companies; § 8c UWG sanctions abusive Abmahnungen. This lowers the price, not the duty: an injunction claim remains.

If one arrives:

1. Do not ignore it and do not sign the attached Unterlassungserklärung as drafted; the deadline is short (often one to two weeks) but real.
2. Verify the sender is a genuine competitor or listed association and that the alleged violation exists on your site right now; take screenshots with timestamps.
3. Fix the violation immediately, everywhere, including cached pages and staging sites indexed by search engines.
4. Have a Rechtsanwalt draft a modifizierte Unterlassungserklärung without acknowledgement of costs and with a Vertragsstrafe under the Hamburger Brauch (amount set by the creditor, reviewable by court), and check whether fees are even claimable under § 13 Abs. 4 UWG.
5. Register the commitment internally; a repeat violation triggers the Vertragsstrafe, and that is where the real money is lost.

Generators and Their Limits

• Widely used: the generators of eRecht24, Datenschutz-Generator.de (published by a Rechtsanwalt), the IHK model texts, and the templates provided with consent-management platforms. They produce solid text for standard components, in German, updated for legal changes if you keep the subscription.
• What they cannot do: describe your own product's processing (telemetry, AI features, multi-tenant data), your processor role in B2B, your retention logic, or a non-standard tool; nor keep the notice in sync with what your engineers deploy. Each of those needs a written paragraph and a row in the Verarbeitungsverzeichnis.
• Treat the generator output as the skeleton; the product-specific sections are yours. Have a lawyer review once before launch and after any change of data flows, not every week.
• Licence terms: many generators require a backlink or attribution in the free tier; removing it breaches their licence.

Worked Example: Impressum for a GmbH

Impressum

Angaben gemäß § 5 DDG
Beispiel Software GmbH
Musterstraße 1
10115 Berlin

Vertreten durch die Geschäftsführerin Anna Beispiel

Kontakt
Telefon: +49 30 1234560
E-Mail: kontakt@beispiel-software.example

Registereintrag
Eintragung im Handelsregister
Registergericht: Amtsgericht Charlottenburg (Berlin)
Registernummer: HRB 123456

Umsatzsteuer-Identifikationsnummer gemäß § 27a UStG: DE123456789

Verantwortlich für den Inhalt nach § 18 Abs. 2 MStV
Anna Beispiel, Anschrift wie oben

Verbraucherstreitbeilegung
Wir sind nicht bereit und nicht verpflichtet, an Streitbeilegungsverfahren vor einer
Verbraucherschlichtungsstelle teilzunehmen.

Footer markup that satisfies the placement rule on every route of a single-page app:

<footer class="site-footer">
  <nav aria-label="Rechtliches">
    <a href="/impressum">Impressum</a>
    <a href="/datenschutz">Datenschutzerklärung</a>
    <a href="/agb">AGB</a>
    <button type="button" data-consent-open>Cookie-Einstellungen</button>
  </nav>
</footer>

Server-render the footer or include it in the app shell so that it exists before any JavaScript runs, and add both legal routes to the sitemap and the store listings.

Procedure Before Launch

1. Inventory every third-party request the site makes (open the browser's network panel on a cold load, before consent): fonts, scripts, tag managers, images, iframes. Each external host is either self-hosted, consent-gated, or documented as necessary.
2. Inventory every form and every backend integration that receives personal data; map each to a Verarbeitungsverzeichnis row.
3. Write the Impressum from the Handelsregisterauszug and the USt-IdNr notice; check spelling of the Firma against the register.
4. Generate the Datenschutzerklärung skeleton; write product-specific sections; add the consent tool's purposes verbatim.
5. Place both links in the persistent footer; test on the 404 page, the login page, the marketing tool's landing pages, the mobile layout and with scripts disabled.
6. Have a lawyer review once; set a calendar reminder to re-run steps 1 and 2 at each release that adds a vendor.

Checklist

• Impressum shows Firma with suffix, street address, all Geschäftsführer, e-mail plus phone, Registergericht and HRB, USt-IdNr, § 18 MStV person if editorial content exists, VSBG statement.
• Reachable in two clicks from every page and route, without login or consent, as text.
• Datenschutzerklärung sections match the live vendor inventory; each has purpose, basis, recipients, transfer, retention.
• Third-party fonts and scripts self-hosted or consent-gated; the network panel before consent shows only your own hosts and necessary ones.
• Newsletter uses double opt-in and the consent log stores the opt-in evidence.
• Versions of both documents archived with dates.
• Social profiles and app-store listings link to both documents.

Common Mistakes

• A P.O. box, a co-working "virtual office" that does not accept service, or only a city as the address.
• "Geschäftsführung" without names, or the wrong Registergericht after a move of the Sitz.
• Impressum only in the German version of a bilingual site, or only reachable after the cookie banner is dismissed.
• A Datenschutzerklärung copied from another company, including their DSB, their tools and their address.
• Loading a consent tool that reports consent but never actually blocks the tags.
• Removing the Impressum from marketing landing pages because "the template had no footer".
• Signing the competitor's Unterlassungserklärung unchanged, with a fixed high Vertragsstrafe, and forgetting the staging site that still shows the violation.

Limits

This skill explains the Impressum and privacy-notice duties as applied in Germany from a founder's perspective; it is not legal advice. The DDG, the MStV, the VSBG, the UWG, the DSGVO and the TDDDG are amended, and court practice on banners, embeds and Abmahnung costs moves; verify the current text and case law before relying on any figure or formulation here. For regulated professions, shops with consumers, an actual Abmahnung, or a product with non-standard data flows, consult a Rechtsanwalt for IT- und Medienrecht or Datenschutzrecht.