§Law in practice

Every business website — and “business” is broader than most people think: an activity intended to be ongoing is enough; an intention to make a profit is not required. Clubs and most blogs need one too.

What must go into the legal notice (Impressum) under § 5 of the German Digital Services Act (DDG):

• Name and address at which documents can be served. A PO box is not enough.
• Authorised representative for legal entities.
• Contact: email address and a second quick channel, usually phone.
• Register and number, if registered (commercial, association or partnership register).
• VAT identification number, if there is one — the one under § 27a UStG, not the tax number.
• Supervisory authority and chamber for professions requiring a licence.

The legal notice must be reachable from every page with one click and must not be hidden behind “Contact”.

What your website does with data — and specifically what it actually does. A notice describing services you do not use at all is just as wrong as one that keeps quiet about some.

The points under Art. 13 GDPR (DSGVO):

• Who the controller is (the same details as in the legal notice).
• Which data is processed for what purpose — when the page is visited, with the contact form, with the newsletter.
• On which legal basis.
• How long it is kept.
• Who else sees it — host, payment service, delivery service.
• The rights of data subjects, including the right to complain to the supervisory authority.

Aurora Hive Sites generates a version for you from your master data and what has been set up on the site. Read it all the same — only you know whether something has been added.

Towards consumers, the German Price Indication Ordinance (Preisangabenverordnung) applies, and it is strict:

• Final price including VAT and all price components.
• A note that VAT is included.
• Additional costs — travel, shipping, installation — must be stated if they arise.
• For unit prices (quantity, weight), additionally the price per unit.

Towards businesses you may state net prices, but you must label them (“plus statutory VAT”) and make clear that the offer is aimed at traders.

Under the small business scheme (Kleinunternehmerregelung), no VAT is shown; a note referring to § 19 UStG is customary.

“From” prices are allowed if the service really is available at that price.

Anything that is true and can be proven. The yardstick is not whether you believe it, but whether you can prove it if someone asks.

The main dangers are:

• Claims of being the best. “The cheapest”, “number one”, “market leader” — only with proof.
• Claims of uniqueness. “The only one in Dresden” — wrong as soon as there is a second.
• Certificates and awards that have expired or were never granted.
• Health and environmental claims. “Climate-neutral”, “sustainable”, “free of harmful substances” are regulated particularly strictly; without solid proof, better leave them out.
• Struck-through prices. The former price must actually have applied.

The practical approach: for every claim on your site, you should be able to think of how you would prove it within five seconds. If not, reword it.

Three rules, all three of which are taken seriously:

• Genuine. An invented review is a misleading commercial practice, and since the German “Act for Fair Consumer Contracts” it has been expressly prohibited.
• Complete. If you show reviews, you may not show only the good ones and filter out the bad ones without saying so.
• With consent. A person’s name, photo and quote require their agreement. An email is enough — keep it.

If you take reviews from a platform: check whether its terms allow this, and state the source.

And if you ask for reviews: that is allowed. Buying reviews or linking them to a benefit without disclosing it is not.

Only those you hold the rights to. These are:

• Your own photos. The safest — with the restrictions below if people are in them.
• Bought or royalty-free images whose licence terms you have read. “Free” does not mean “without conditions”: many require attribution, some exclude commercial use.
• Images by a photographer, if the contract states that you may use them on the internet. That is not automatically included.

What you may not use: images from an image search, images from manufacturers’ websites without permission, images from competitors, images from social networks.

For every image you buy, note where it came from and under which licence. If someone asks after three years, you will otherwise no longer know.

Only with their consent, and it should be in writing.

With employees there is an additional point: consent must be voluntary, and it can be withdrawn. When someone leaves, the photo should generally be removed; they usually have a right to that.

With customers and event photos:

• Individual recognisable people need to give consent.
• At events there are exceptions for crowds and incidental figures — but do not rely on them if someone is clearly in the picture.
• Children need the consent of both people with parental responsibility.

The practical way: a short consent form, drawn up once, signed when needed, kept on file. That takes a minute and saves an unpleasant discussion.

In order — and stay calm:

1. Note the deadlines. They are usually short and meant seriously.
2. Sign nothing. A pre-drafted cease-and-desist declaration is regularly drawn too broadly and applies without time limit, with a contractual penalty.
3. Do not delete anything without securing it. First take screenshots of the state complained about.
4. Remedy the infringement if it is obvious. That is no admission of guilt, but it limits the damage.
5. Bring in a solicitor who specialises in competition or copyright law. Not the one who drew up your purchase contract.

There are also unjustified and abusive formal warnings. Whether yours is one of them can only be judged by someone who has read it — hence point 5.

Four things:

• Only ask for what is needed. A mandatory “date of birth” field in a request for a quote serves no purpose and is therefore not permitted.
• A note on data processing at the form, with a reference to the privacy notice.
• Encrypted transmission. You have this; without it the form would not be permitted.
• Limit retention. Enquiries that came to nothing should be deleted after a reasonable period.

A tick box “I have read the privacy notice” is not required and usually legally worthless — the information is enough. If you add one, it must not be pre-ticked.

For the Newsletter, stricter rules apply than for an enquiry: genuine consent and the confirmation procedure are needed there.

Provable consent from every recipient. That is the toughest requirement in this whole chapter, and it is the one most often breached.

Specifically:

• Double confirmation. After signing up, an email goes out in which the recipient confirms. Only then are they subscribed.
• Log. When, from which address, with which text consent was given — you must be able to show this in a dispute.
• Unsubscribe option in every mail, easy to find and without signing in.
• Legal notice in every mail.

What is not allowed: addresses from business cards, from a prize draw without a clear notice, from a bought list — or “simply adding” customers.

There is an exception for existing customers with your own similar goods (§ 7 (3) of the German Act against Unfair Competition, UWG). It is narrow and tied to conditions; do not rely on it without having checked it.

Clubs are not exempt from the obligations — the most common misconception in this area.

What applies:

• Legal notice obligation as for businesses, with the register of associations, registration number and the authorised board.
• Data protection in full. Members’ data is personal data.
• Photos of events need the same consents as everywhere.
• Newsletters to members: internal club information is not advertising — but as soon as something is being promoted, the same rules apply.

What is different:

• With Donations, tax requirements for donation receipts come on top.
• A data protection officer is not required for most clubs, but active clubs reach the threshold faster than you might think.

Only if you conclude contracts via the website — that is, if something can be sold, booked or ordered.

A pure information site with a contact form needs no terms and conditions (AGB) and no cancellation policy. A form for requesting a non-binding quote is not the conclusion of a contract.

But as soon as you:

• sell goods,
• make appointments bookable on a binding basis,
• let people conclude paid services online,

considerable obligations come on top: right of withdrawal for consumers, model withdrawal form, information before the contract is concluded, an order button with the correct label. That is a subject area of its own, and a solicitor’s review is worthwhile there — mistakes in it are expensive.

Aurora Hive Sites is not a shop. What is handled online here are donations and memberships; separate rules apply to those too.

As soon as something is stored or read that is not technically necessary. The rule is set out in the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG) and applies regardless of whether personal data is involved.

Technically necessary are, for example: the session ID in the members’ area, remembering a language choice.

Not necessary are: audience measurement, recognising returning visitors, embedded content that sets its own identifiers.

An ordinary Aurora Hive Sites website without a counting tool and without embedded third-party content manages without a banner. That is the normal case, and you should not depart from it without a reason.

If you need a banner: it must make declining as easy as accepting. A banner with a big “Accept” and a hidden “Decline” is invalid.

Not from the outset — but from the moment you know. If you learn that a linked page has unlawful content, you must remove the link.

What that means in practice:

• Check the target before linking. Opening it once is enough.
• The blanket “disclaimer for links” found on many sites does not help. It has no effect and looks unprofessional.
• Check old links occasionally. A domain that belonged to an association years ago may show something quite different today.

Paid links — that is, links for which you receive something in return — are advertising and must be labelled. That also applies to affiliate programmes.

On four occasions, and there it pays off instead of improvising:

1. If you sell online or let people book on a binding basis. Terms and conditions, withdrawal and contract conclusion are not a do-it-yourself area.
2. If you process special categories of data — health, ethnic origin, religion, trade union membership. Typical for practices, care, counselling, some clubs.
3. If a formal warning arrives.
4. For regulated professions — healthcare professions, legal advice, tax advice, financial brokerage. They have their own advertising restrictions.

For everything else — legal notice, privacy notice, image rights, normal advertising claims — care is enough. This help does not replace legal advice, but it shows the places where things typically go wrong.

Half an hour, once a year, and you have covered most of it:

• Legal notice: are address, representation, register and VAT ID correct? Has the legal form changed?
• Privacy notice: has anything been added — a video, a map, a counting tool?
• Prices: are final prices shown? Are they still correct?
• Employee photos: are all the people pictured still there?
• Reviews and awards: still valid? Still provable?
• External links: do they still lead where they should?

Note the date of the check. If someone asks, the answer “last checked in March” is considerably better than “it has always been like that”.