This is an English courtesy translation. Only the German version is legally binding.
Privacy Policy
Transparent and GDPR-compliant data processing at AntragPlus
Our security standards
GDPR-compliant
Full compliance with the European General Data Protection Regulation for all of your data – including data erasure, the right of access, and purpose limitation.
Servers in Germany
All personal data is stored and processed exclusively on servers in Germany – certified and securely hosted.
Encrypted
End-to-end encryption for sensitive data – both in transit and at rest.
Privacy Policy (GDPR)
Controller responsible for data processing:
Data protection officer:
Purposes of processing
- Operation and provision of the “AntragPlus” SaaS platform
- Creation, management, and export of grant applications
- User management, billing, and support
- Communication with customers (e.g. email, notifications)
- Fulfilment of statutory retention and record-keeping obligations
Legal bases
- Art. 6(1)(b) GDPR (performance of a contract)
- Art. 6(1)(c) GDPR (legal obligation)
- Art. 6(1)(f) GDPR (legitimate interest, e.g. IT security)
- Art. 6(1)(a) GDPR (consent, e.g. cookies, newsletter)
Data collected
- Registration and contact data (name, organisation, email, payment information)
- Project data (uploaded documents, created applications, financial reports)
- System and usage data (IP address, browser, log files)
Disclosure to third parties and processors
Hosting and infrastructure:
- Netlify (servers in the EU) - website hosting
- Neon (servers in the EU) - database and backend
- AWS (servers in Frankfurt) - cloud infrastructure
Payment processing:
- PayPal (PayPal Europe S.à r.l. et Cie, S.C.A., Luxembourg)
- Stripe (Stripe Payments Europe Ltd., Ireland)
Email delivery:
- Resend (for transactional emails)
- Mailchimp (for newsletters, only with consent)
CRM (enquiries via the funding check):
- HubSpot (HubSpot Ireland Ltd., Ireland; data held in the EU data centre) - storing and handling your funding check enquiry as a contact (data processing on our behalf, see section "Funding check (Fördercheck)")
Analytics services (only with consent):
- Google Analytics 4 (anonymised IP addresses; enhanced conversions with hashed email address on form submissions)
- HubSpot (website analytics and chat)
- Leadfeeder / Dealfront (identification of company visits)
- Google Ads conversion tracking and remarketing (only with marketing consent)
International data transfers
EU/EEA processing: Your data is processed primarily within the EU/EEA (Germany, Ireland, Luxembourg).
Third countries: In individual cases, data processing takes place in third countries (USA) with the following services:
- Google (Analytics and Ads, USA) - only with consent
- HubSpot (EU data centre, partly USA) - website analytics, chat and funding check enquiries (CRM)
- Leadfeeder / Dealfront (Finland, EU)
Safeguards: Standard contractual clauses of the EU Commission, adequacy decisions, or comparable guarantees pursuant to Art. 44-49 GDPR.
Retention period
- Contract data: during the term of the contract + statutory retention period (6–10 years)
- Project data: until deleted by users or until the contract ends
- Log files: max. 14 days
Your rights as a data subject
Right of access (Art. 15 GDPR)
Right to obtain information about the personal data processed
Right to rectification (Art. 16 GDPR)
Right to have inaccurate data corrected
Right to erasure (Art. 17 GDPR)
Right to have personal data erased
Right to restriction (Art. 18 GDPR)
Right to restriction of processing
Data portability (Art. 20 GDPR)
Right to have your data transferred
Right to object (Art. 21 GDPR)
Right to object to the processing
Right to lodge a complaint (Art. 77 GDPR)
You have the right to lodge a complaint with a data protection supervisory authority:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Friedrichstr. 219, 10969 Berlin
Phone: +49 30 13889-0
Email: [email protected]
Exercising your rights
To exercise your rights, please contact: [email protected]
Automated decision-making and AI processing
AI-assisted grant analysis: Our platform uses artificial intelligence to automatically analyse and suggest funding programmes.
Processing logic: Algorithms analyse your project data and match it against available funding programmes.
Significance: Automated suggestions for suitable grants based on the information you provide.
Your rights: You have the right to human review, to express your point of view, and to contest the decision pursuant to Art. 22 GDPR.
Website features and data processing
Contact form
Data processed: Name, email address, organisation, message content
Purpose: Handling your enquiry and communication
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
Retention period: 3 years after the communication has concluded
Funding check (Fördercheck)
Data processed: name of the organisation, website (optional), fields of activity, name and role of the contact person, email address, phone number (optional, also after submitting), challenges (optional), your project description from the funding compass where applicable, the language of the page and the origin of the enquiry (campaign parameters such as utm_source or gclid, landing page)
Purpose: Getting in touch: our team calls you and discusses which funding programmes fit your project. Without a phone number we get back to you by email.
Recipients: Your details are stored in our database (Neon) and handed over to our CRM HubSpot, where our team handles the enquiry. We never pass an IP address to HubSpot. The HubSpot visitor cookie (hubspotutk) is only included if you have consented to the Statistics category.
Draft in your browser: While you fill in the funding check, the page saves your entries as a draft in your browser's local storage (localStorage), so you can continue later at the same step. The draft stays on your device until you submit. It is deleted after submitting; a draft older than 24 hours is deleted the next time you open the page.
Legal basis: Art. 6(1)(b) GDPR (your enquiry, pre-contractual measures); for the draft in your browser Section 25(2) no. 2 TDDDG (a function you requested)
Retention period: 3 years after the communication has ended
Campaign attribution of enquiries
Data processed: Campaign parameters from the address through which you reached our website (UTM parameters such as source, medium and campaign, the Google Ads click identifier "gclid"), the landing page, and whether you came via an ad on Google or in ChatGPT. For ChatGPT ads we only store this information, not the click identifier.
Purpose: Attributing your enquiry (e.g. funding check, contact form, callback) to the campaign it came from, in order to evaluate the success of our advertising
Process: Only if you have consented to the Statistics or Marketing category do we store the parameters in your browser's session storage (sessionStorage) for the duration of the browser session and transmit them to us together with an enquiry. Until you decide in the cookie banner, they are only kept in the memory of the open page. Without consent they are neither stored nor transmitted; withdrawing consent deletes them.
Legal basis: Your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG), which you can withdraw at any time via "Cookie settings" in the footer
Retention period: together with the enquiry (3 years after the communication has concluded)
Job applications (careers page)
Data processed: Name, email address, phone number (optional), LinkedIn/portfolio link (optional), message/motivation, and the position you are applying for
Purpose: Conducting the application procedure and communicating with you
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) in conjunction with Section 26(1) BDSG (initiation of an employment relationship)
Retention period: Erasure no later than 6 months after the application procedure has concluded, unless you have consented to longer storage (e.g. talent pool)
Newsletter sign-up
Data processed: Email address, name (optional)
Purpose: Sending information about grants and product updates
Legal basis: Art. 6(1)(a) GDPR (consent)
Double opt-in: Confirmation via a separate link required
Unsubscribing: At any time via the link in every email or by emailing us
User accounts and platform use
Data processed: Registration data, project information, usage behaviour
Purpose: Provision of the SaaS features, project management, support
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
Retention period: During the term of the contract + statutory retention periods
Cookies & tracking technologies
Essential cookies (no consent required)
- Session cookies for login and user navigation
- Security cookies for CSRF protection
- Functional cookies for language settings
Analytics cookies (only with consent)
- Google Analytics 4: Website analytics, anonymised IP addresses
- Enhanced conversions (Google Analytics 4): When you submit a form, your email address is transmitted to Google Analytics in hashed form (SHA-256) to attribute enquiries more accurately (see section "Enhanced conversions")
- Funding check flow (Google Analytics 4): events about the flow of the funding check: form started, step shown and completed, click on "Back", error message with the affected field (without its content), seconds per step, exit popup shown, continued or left with the chosen reason, and the request for a phone number. The events contain none of your entries, so no name, email address or phone number, and they are not conversions. The page records them only if you have consented to the Statistics category.
- HubSpot: Website analytics and recognition for the chat function
- Retention period: 14 months (Google Analytics), up to 13 months (HubSpot)
Marketing cookies (only with consent)
- Google Ads conversion tracking: Measures whether a visit via a Google ad led to an enquiry (e.g. funding check, callback, contact form)
- Google Ads remarketing: Allows us to show you relevant ads on Google after a visit to our website
- Enhanced conversions (Google Ads): When you submit a form, your email address is transmitted to Google Ads in hashed form (SHA-256) to improve conversion measurement (see section "Enhanced conversions")
- Retention period: up to 90 days (Google Ads cookies)
Managing cookie settings
You can adjust your cookie settings at any time via the "Cookie settings" link in the footer of every page or in your browser settings. You can withdraw consent you have given there with effect for the future (Art. 7(3) GDPR); withdrawing is as easy as giving consent.
Note: Disabling certain cookies may limit the functionality of the website.
Google Tag Manager and Google Ads
We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to manage measurement and marketing services on this website. The Tag Manager itself does not set cookies; the services it manages are only activated after your consent via the cookie banner (Google Consent Mode v2).
For the funding check, the page also hands flow events (foerdercheck_*, see "Analytics cookies") to the Tag Manager, which forwards them to Google Analytics 4, but only with your consent to the Statistics category. They contain none of your entries and count as a conversion neither in Google Analytics nor in Google Ads.
With your consent to the Marketing category we use Google Ads for conversion tracking and remarketing: Google then records whether a click on one of our ads led to an enquiry, and may show you relevant ads based on your visit. When you submit a form, we transmit your email address to Google in hashed form to improve measurement (enhanced conversions, see next section). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework, supplemented by standard contractual clauses.
Legal basis: Your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). Without marketing consent there is no conversion tracking and no remarketing. You can withdraw your consent at any time via "Cookie settings" in the footer with effect for the future.
Enhanced conversions (Google Analytics 4 and Google Ads)
We have enabled enhanced conversions (in Google Analytics: "user-provided data collection") for Google Analytics 4 and Google Ads. This feature improves the accuracy of conversion measurement: when you submit an enquiry via a form in which you provide your email address (e.g. funding check, contact form), the email address you enter is hashed in your browser using SHA-256, i.e. converted into a pseudonymous string, before it is transmitted to Google. Google can match this hashed address against the equally hashed data of signed-in Google accounts and thereby attribute an enquiry to an ad click or session that could otherwise not be measured (e.g. after switching devices or with restricted cookies). Google does not receive your email address in plain text. In multi-step forms such as the funding check, this already happens once you complete the step containing your email address and click "Next", i.e. before the entire form is submitted.
Transmission to Google Analytics 4 only takes place if you have consented to the Statistics category. For Google Ads (conversion measurement, campaign optimisation and audiences) the hashed data is only used if you have additionally consented to the Marketing category (Google Consent Mode v2). Without the respective consent, we do not transmit any hashed form data to Google. According to Google, the hashed data is used solely for matching; the attributed conversion data is subject to the retention periods stated above (14 months in Google Analytics, up to 90 days for Google Ads cookies).
Legal basis: Your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to the USA (EU-US Data Privacy Framework, supplemented by standard contractual clauses). You can withdraw your consent at any time via "Cookie settings" in the footer with effect for the future.
Embedded YouTube videos
Some pages embed videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We use the privacy-enhanced mode (youtube-nocookie.com) and load a video only after you click "Play". Until then, only a preview image from our own server is shown and no connection to YouTube is made.
When you click "Play", your browser connects to YouTube's servers. Your IP address, browser and device details and the video you play are transmitted to Google, which may set cookies or similar technologies. If you are signed in to YouTube, Google may link the request to your account. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework and standard contractual clauses apply in addition.
Legal basis: your consent given by clicking "Play" (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without that click, no data is sent to YouTube. See Google's privacy policy for details.
Data security and technical measures
Encryption: All data transmissions take place via SSL/TLS encryption (HTTPS).
Access control: Strict authentication and authorisation for all system access.
Data protection by design: Minimising data collection to what is necessary.
Regular updates: Continuous security updates and penetration tests.
Data protection impact assessment: Regular assessment of data protection risks.
As of: October 2026