Website Compliance
€ 299 flat fee
excl. VAT
Scope of services
- Review and drafting of the website privacy policy
- Cookie banner / consent management
- Written audit report with remediation proposals
Optional
- Content-specific review
- Accessibility
Website Compliance
Website Compliance: the truth is in the source code.
Cookies, tracking, privacy policy, legal notice and third-country transfers, fully reviewed.
What we deliver
From obligation to advantage.
We check your website or shop for GDPR compliance, cookie banner, privacy policy, embedded third-party services and third-country transfers, draft or review your legal notice (Impressum) under § 5 DDG, and deliver a written audit report with concrete remediation proposals.
- Drafting and review of legal notice (§ 5 DDG, § 18 MStV)
- Website scan (cookies, trackers, embedded third-party services)
- Drafting and review of privacy policy (Art. 13 GDPR)
- Review of cookie banner and consent management (TDDDG)
- Assessment of third-country transfers (Art. 44 et seq. GDPR)
- Written audit report with a rating per checkpoint
How we work
Three steps to your goal.
-
Step 01
Website scan
Full technical review: cookies, trackers, third-country connections, embedded services, cookie banner, privacy policy and legal notice.
-
Step 02
Audit report
Written report with a risk rating per checkpoint. Where issues exist, such as missing mandatory legal-notice details: concrete remediation proposals.
-
Step 03
Remediation support
On request we draft or correct your legal notice (Impressum) and support fixing further issues, through to a successful re-audit and award of the Data Protection Seal.
Your Invest
One package, four building blocks.
A flat fee for reviewing and drafting the mandatory documents. Whatever is needed beyond that, you book as an add-on.
Add-on 1
Legal notice (Impressum)
Drafted or reviewed under § 5 DDG and § 18 MStV.
plus flat fee €50 plus VAT
Add-on 2
Data protection seal
Visible seal with a recurring website scan, showing the date of the last review.
plus €20 / month or €200 / year, each plus VAT
Add-on 3
AI disclosure labelling
Transparency notices under Art. 50 EU AI Act, for chatbots among others.
price on request
Add-on 4
Online shop compliance
Terms and conditions, right of withdrawal, checkout process, price indications, etc.
price on request
This service is provided by our cooperation partner: 
All prices plus statutory VAT. Optional add-ons are calculated by effort and listed separately in the quote (exception: Add-on 1 and Add-on 2, which are priced as flat rates).
Website compliance
What your website really loads.
Almost every website loads more third-party services than its operator assumes, often before consent is given. That is not just a data protection issue but a real risk of warning letters and fines.
The most common findings
- Externally loaded fonts and analytics without consent
- Cookie/consent banners that load services too early or without a real choice
- Embedded maps, videos and social-media plugins
- Missing or outdated privacy policy
- Legal notice (Impressum) defects and unreviewed third-country transfers (US services)
The legal framework
Storing and reading cookies requires consent under § 25 TDDDG; the privacy policy follows from Art. 13 GDPR, the legal notice from § 5 DDG, and third-country transfers are governed by Art. 44 et seq. GDPR.
The audit report
You receive a written audit report with a risk rating per checkpoint and concrete remediation proposals. Our free GDPR check and imprint checker allow a first self-assessment.
Partner service
Online shop compliance, reviewed by lawyers.
A shop is not only liable for its privacy policy. Its terms and conditions, the withdrawal notice, the checkout process and every price indication are just as open to challenge. The partner law firm therefore reviews the shop as a whole rather than single documents.
The mandatory texts, aligned with each other
You do not get off-the-shelf boilerplate but texts tailored to your range of goods, your shipping routes and your payment methods. Contradictions between the documents are one of the most common points of attack, for instance when the terms state a deadline that the withdrawal notice puts differently.
- General terms and conditions
- Withdrawal notice including the model withdrawal form
- Legal notice (Impressum) under § 5 DDG
- Privacy policy for shop operations
- Checkout process and order button wording
- Price indications, shipping costs and delivery times
The review protocol
The core of this service is not an opinion that disappears into a folder but a worklist. Every point stands on its own, with the place it occurs and a concrete suggested change, so you can implement it without coming back to ask.
- 01 Finding What is objected to and which provision the objection rests on.
- 02 Location Page, section or process step in which the point occurs.
- 03 Recommendation Suggested wording or change that closes the point.
- 04 Urgency Whether it has to be fixed before continuing to trade or can follow later.
Price on request, depending on your range of goods and shop system. Bookable as Add-on 4 to website compliance or on its own.
More services
What else we cover.
From the blog
Further reading on the topic.
Frequent questions
What clients ask about the website review.
What exactly do you check?
GDPR (Art. 13, Art. 25, Art. 28 and Art. 32 GDPR), BDSG, TDDDG (tracking and cookie consent), the German legal-notice requirement under § 5 DDG and § 18 MStV, CJEU case law on Google Fonts/Analytics, as well as third-country transfers under Art. 44 et seq. GDPR.
Do you also draft the legal notice, or only review it?
Both. If a legal notice is missing or incomplete, we draft one under § 5 DDG. If one already exists, we review it for completeness, e.g. authorised representatives, commercial register details or mandatory information for regulated professions. For a free initial check, use our Imprint Check.
Do I automatically get a seal after the check?
No, the check is the technical review itself. The Data Protection Seal is a separate, optional service you can additionally commission after passing the check.
How often should my website be checked?
At least once a year, and after any material change, such as newly embedded services, a website relaunch or a change of hosting provider.
What fines and penalties are possible?
Several frameworks apply side by side. GDPR (Art. 83 GDPR). Breaches of the processing principles, the legal bases, data subject rights or transfers to a third country (Art. 83(5) GDPR): up to €20 million or 4 % of worldwide annual turnover. Breaches of controller and processor obligations, such as the record of processing activities, security of processing, breach notification or appointing a data protection officer (Art. 83(4) GDPR): up to €10 million or 2 % of worldwide annual turnover. Whichever amount is higher applies. Alongside a fine, a supervisory authority may order, restrict or prohibit the processing; section 42 BDSG additionally makes certain intentional acts a criminal offence, punishable by up to three years imprisonment or a fine. German Telecommunications Digital Services Data Protection Act (TDDDG) (section 28 TDDDG). Accessing terminal equipment without the consent required by section 25, for example tracking cookies set before consent: up to €300,000. The GDPR continues to apply in parallel wherever personal data is involved.