Data protection notice for the use of the Federal Government's Central Invoice Submission Portal (CISP)

Last updated: 5 June 2020

I.

Handling personal data responsibly is a top priority for the federal administration. We want to ensure that users know when and which data is collected and used while they are using the Central Invoice Submission Portal (CISP).

II. Name and address of the controller

The Federal Ministry of Finance (BMF) and the Federal Ministry of the Interior and Community (BMI) are responsible for processing personal data.

Federal Ministry of Finance

Wilhelmstraße 97
10117 Berlin
Postal address: 11016 Berlin, Germany

Tel.: +49 (0)30 18682-0
Fax: +49 (0)30 18682-3260
E-mail: poststelle@bmf.bund.de

Federal Ministry of the Interior and Community

Alt-Moabit 140
10557 Berlin, Germany

Tel.: +49 (0)30 18681-0
Fax: +49 (0)30 18681-12926
E-mail: poststelle@bmi.bund.de

III. Obligations of the controller as defined in Article 26 of the GDPR

The Federal Ministry of Finance is responsible for the care and maintenance of the CISP and undertakes to fulfil all data protection requirements for the portal.

The Federal Ministry of the Interior and Community is responsible for the website itself, and for the registration and authentication of the Federation's service account. It undertakes to fulfil all data privacy requirements for the website and the service account, in particular:

IV. Name and address of the data protection officers

Data Protection Officer for the Federal Ministry of Finance

Wilhelmstr. 97
10117 Berlin

Tel.: +49 (0)30 18682-3208
E-mail: datenschutz@bmf.bund.de

Data Protection Officer for the Federal Ministry of the Interior and Community

Bundesallee 216-218
10719 Berlin

Tel.: +49 (0)30 18681-0
E-mail: bds@bmi.bund.de

V. Which personal data is collected while using the CISP?

Visiting the CISP website

Each time the CISP website is accessed, personal data and other data from the user's computer is used automatically.

The following data is recorded in this context:

The Federal Ministry of Finance analyses this data, which is first rendered anonymous, for purely statistical purposes in order to continuously improve the CISP.

The stored data is not linked to the user's other personal data.

1. Legal basis and purpose of data processing

Article 6(1) (e) of the GDPR provides the legal basis for the storage of this personal data for the purposes of tracing and analysing possible errors in the system so that these errors can be swiftly rectified in the public interest, thus safeguarding the operation of the CISP.

2. Period of storage

Data which is stored temporarily for the purpose of providing the website to the user is deleted when the user's session ends.

3. Right to object and to removal

The temporary collection and storage of data is essential for providing and operating the CISP website.

VI. Use of cookies

The CISP website uses cookies. Cookies are text files which are stored in the internet browser or which the internet browser stores on a user's computer system. When a user accesses the CISP website, a cookie may be stored on the userʼs computer system. This cookie contains a distinctive sequence of characters which allows the browser to be clearly identified the next time the user accesses the website. The CISP website only uses session cookies. These become invalid as soon as the user leaves the website, and can be deleted locally by the user by changing the browser settings accordingly.

Article 6(1) (e) of the GDPR, in conjunction with section 3 (2) of the Ordinance on Electronic Invoicing in Federal Public Procurement (E-Invoicing Ordinance), provides the legal basis for the use of cookies in view of the CISP's task of forwarding invoices to recipients and the associated need for registration pursuant to the Online Access Act (Onlinezugangsgesetz, OZG).

Some of the functions of the CISP website cannot be used without cookies. In order to provide these functions, it is essential that the user's browser can still be recognized after the user navigates to a different page on the site.

The user data collected using cookies which are necessary for technical reasons are not used to compile user profiles.

Cookies are stored on the userʼs computer and then transmitted to the CISP website. By changing the settings in their internet browser, users can deactivate or restrict the transmission of cookies. Previously stored cookies can be deleted at any time by the user. This can also be done automatically. If cookies are not used, however, it may no longer be possible to use all the functions of the CISP website.

VII. Registration

The CISP website gives users the option of registering with the portal by setting up a user account. Users also have the option to create company accounts. Personal data and company-related user data is collected and stored during the registration process and when creating such accounts.

The following data is stored during the registration process when setting up a user account:

The following data is stored when company accounts are created:

Administrator rights enable the user to administer the company account that they have set up.

During the registration process the user must consent to the terms of use, and a record of their consent is stored.

After signing into the user account, the following data is stored in relation to the user's activities:

1. Legal basis and purpose of data processing

Article 6 (1) (e) of the GDPR, in conjunction with section 3 (2) of the Ordinance on Electronic Invoicing in Federal Public Procurement, provides the legal basis for the processing of the data. The data is processed for the purpose of forwarding invoices to recipients, and due to the associated need for registration pursuant to the Online Access Act.

2. Period of storage

The data is deleted as soon as it is no longer needed for processing purposes. This is the case if the user account and the user's company accounts are deleted. In the event of an amendment to the details in the user or company account, the revised information is stored and the original information is deleted. Please note that an account is only permanently deleted after a 30-day retention period. The user account is also deleted if the user has not used it for more than 360 days.

Please note that if a user account is deleted, the company accounts linked to the user account will also be deleted automatically.

Users can delete their user account and the associated company accounts, or amend their stored personal data, at any time.

VIII. Submission of invoices

Users can submit electronic invoices via their user account using various input channels (transmission methods). These are:

As well as the content of the electronic invoice, the following data is also processed when electronic invoices are submitted using one of the above-mentioned transmission methods:

1. Legal basis and purpose of the data processing

Article 6 (1) (e) of the GDPR, in conjunction with section 3 (2) of the Ordinance on Electronic Invoicing in Federal Public Procurement, provides the legal basis for the storage of the data.

The processing of the data serves the purpose of a) validating a submitted electronic invoice in accordance with the XRechnung standard in its current version, b) logging the status of a submitted electronic invoice, c) enabling a connection to be made between the electronic invoice and the user submitting the invoice, and d) forwarding the invoice to the competent federal authority which is the addressee of the invoice.

Invoice data is further processed by the invoice recipient solely with the purpose of processing the invoice in accordance with current budget and economic management regulations and to document adherence to these regulations (see section 90 Federal Budget Code; Bundeshaushaltsordnung, BHO).

2. Period of storage

Invoices will be deleted by the operator 30 days after submission in the CISP, regardless of their status.

Data connected to the processing of an invoice (invoice and invoice data) will generally be stored for five years by the invoice recipient in accordance with section 4.7 of the "administrative regulation for payments, accounting and invoicing" of the Federal Budget Code (Verwaltungsvorschrift für Zahlungen, Buchführung und Rechnungslegung - Bundeshaushaltsordnung, VV-ZBR BHO). To allow for individual agreements in special cases, the duration of storage for electronic invoices may be extended in these cases by the authority.

IX. Sharing your data with third parties

In individual cases, the Federal Ministry of Finance and the Federal Ministry of the Interior and Community may be legally obliged to allow access to your data for law enforcement authorities (cf. section 23 (1) nos 3 and 4 of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG)) or the Federal Office for Information Security (BSI) (cf. section 5 (1), sentence 4, of the Act on the Federal Office for Information Security (Gesetz über das Bundesamt für Sicherheit in der Informationstechnik, BSIG)), if this is required in connection with the prosecution of criminal acts or to defend against attacks on the Federal Government's IT infrastructure.

In order to ensure remittance of the invoice total, the payee's name and account information as well as the reference line will be submitted to the Federal Cash Office and the Bundesbank. Apart from this, no data is shared with third parties.

X. Contact

The CISP's controllers (see sections II and IV above) may be contacted in the event of questions relating to data protection.

In case of technical or specialist questions, the user can contact the CISP support hotline. This service can be contacted on working days from Monday to Friday, 8:00-16:00 (CET), on +49 (0)30 2598-4436, or any time via e-mail: sendersupport-xrechnung@bdr.de.

XI. Your data protection rights

Every person whose data is collected has the right to access personal data concerning him or her (Article 15 GDPR), the right to rectification (Article 16 GDPR), the right to erasure (Article 17 GDPR), the right to restriction of processing (Article 18 GDPR) and the right to object to the processing of personal data on grounds relating to his or her particular situation (Article 21 GDPR).

The right to lodge a complaint with a supervisory authority

If you think that the processing of your personal data infringes on your rights, you can lodge a complaint with the competent data protection supervisory authority (Article 77 GDPR):

Federal Commissioner for Data Protection and Freedom of Information (BfDI)
Husarenstrasse 30
53117 Bonn
E-mail: poststelle@bfdi.bund.de