Komfortkasse Hilfe-Seiten

Diesen Artikel auf Deutsch lesen

Support for Your Documentation · As of August 10, 2026 · Version [x.y]

You use Komfortkasse to reconcile your postings. You are the data controller for this processing under data protection law; Komfortkasse is your data processor. You, not us, are therefore subject to two documentation requirements: the balancing of your legitimate interests under Article 6(1)(f) of the GDPR and—depending on the specific circumstances—a data protection impact assessment under Article 35 of the GDPR.

This document provides you with the sections you cannot write yourself because they provide the description of our procedures. It is not a completed impact assessment. The assessments are suggestions; the decision and signature remain with you, and you must fill in the fields marked with [ … ].

Order: Part 0 tells you what you need. You will almost certainly need Part A. Parts B through F are only required if Part 0 results in a data protection impact assessment.

The text module for your privacy notice is in a separate article: Privacy Notice for Payment Reconciliation. Without it, the assessment in Part A is not valid.

Part 0 — Preliminary Review: What Do You Need?

Please fill this out and keep it on file. If the assessment shows that no impact assessment is required, this completed form serves as your documented determination—it is just as important as the impact assessment itself.

1. Data Controller

Company: [ … ] · Registered office: [ … ] · Competent supervisory authority: [ … ] · Data protection officer appointed: yes / no; if yes: [ … ]

2. Which services do you use?

☐ Payment reconciliation (always)
☐ Payment information, payment reminders, pre-collection letters, refunds
☐ Clarification of unallocable payments — Instruction granted on [ … ]
☐ Statistical analysis — instruction granted on [ … ]

3. Scope

Orders paid in prepayment, by invoice, or Cash on delivery per year: [ … ]

4. Product range

Do you carry items from which information pursuant to Art. 9(1) of the GDPR can be derived—pharmacy-only medications (including over-the-counter ones), medical devices, medical supplies, religious items, political party merchandise, labor union merchandise, or adult products?

☐ No
☐ Yes, specifically [ … ]

Result

If you did not check either of the last two boxes in Section 2, you process data as part of the payment reconciliation based on Article 6(1)(b) of the GDPR (performance of the sales contract), and additionally under (f) for reminders and pre-collection letters. A data protection impact assessment is not required in this case, and Part A of this document is not subject to your circumstances. Please retain this sheet nonetheless.

If you have granted one or both instructions, you must in any case perform the balancing of interests as described in Part A. This is not a matter of scale: without a documented balancing of interests, the processing lacks a legal basis.

Whether an additional data protection impact assessment is required depends on your place of business, because the list under Article 35(4) of the GDPR is that of your supervisory authority:

Registered office in Austria. The DSFA-V (Federal Law Gazette II 278/2018) lists the use of new technologies, including artificial intelligence, as a standalone trigger. Artificial intelligence is used to resolve unassignable payments. An impact assessment is likely to be required.

Registered office in Germany. The mandatory list of the Data Protection Conference does not clearly apply to this case: its entries regarding the merging of data from various sources additionally require algorithms that are not transparent to the data subjects, combined with decisions having legal effect or with big data pattern recognition. Neither of these conditions applies here—no profile is created, no score is assigned, and no decision with legal effect is made . Therefore, the general assessment under Article 35(1) is decisive. According to the criteria of the Article 29 Working Party (WP248 rev.01), the following are met: Matching and merging of data sets, collection from third parties without the data subject’s knowledge, use of innovative technology, and—depending on your answer to Question 3—extensive processing. If two or more criteria are met, the Working Party recommends a data protection impact assessment. We also recommend that you process one. Processing a data protection impact assessment does no harm; failing to do so without just cause is subject to a fine under Article 83(4)(a).

Headquarters in another country. Please validate the list provided by your supervisory authority. The criteria of WP248 rev.01 apply regardless.

⚠️ If you checked “yes” under 4, please stop here and contact us at: datenschutz@Komfortkasse.eu. According to the case law of the European Court of Justice (judgment of October 4, 2024, C-21/23, Lindenapotheke), order data for prescription-only medications constitute health data, even in the case of non-prescription products. For a product range of this nature, Article 6(1)(f) alone does not apply; Article 9 requires a separate exception. This situation requires a separate assessment, which this document does not provide.

Result of the preliminary review: Balancing of interests required: yes / no · Impact assessment required: yes / no
City, date, signature: [ … ]

Part A — Balancing of Interests Pursuant to Article 6(1)(f) of the GDPR

This part is required regardless of the impact assessment as soon as either of the two directives has been granted.

The assessment proceeds in three steps (ECJ, Judgment of Oct. 4, 2024, C-621/22, para. 37): legitimate interest, necessity, balancing.

A.1 Legitimate Interest

Clarification of unallocated payments. Your interest is the correct and timely assignment of incoming payments to orders. If a payment remains unassigned, three consequences arise, all of which also affect the data subject: The order is not shipped, even though payment has been made. Payment reminders and pre-collection letters are sent to a person who has already paid. And the payment must be returned to the sender’s account, which means the process starts over for everyone involved. In addition, there is your interest in fulfilling the sales contract with the end customer.

Statistical analysis. Your interest lies in measuring and ensuring the quality of the service provided to you—matching rate, reminder and collection histories, refunds—as well as quantifying the benefits that the matching procedure yields compared to a simpler one.

Important, and the most common error at this point: The legitimate interest must be communicated to the data subjects at the time of collection. Otherwise, the processing cannot be based on Article 6(1)(f)—the European Court of Justice has expressly ruled on this (Judgment of January 9, 2025, C-394/23, Mousse, para. 52). This is why the “Privacy Notice on Payment Reconciliation” text module exists. Without it, this balancing test is invalid, no matter how well-founded it may be.

A.2 Necessity

The search is subject to two limitations: It takes place only if the payment cannot be assigned either automatically or based on the available information , and the name of the payer is divergent from the name of the person placing the order; and only if clarification appears promising in the specific case. It is therefore the exception, not the standard procedure. The European Court of Justice (ECJ) validates necessity in conjunction with the principle of data minimization (C-621/22, para. 43); the limitation applies to both.

Three less intrusive measures were validated:

Consulting the end customer. Not immediately effective. The purpose of the processing is precisely the prompt assignment of the payment; a consultation with an uncertain response time does not serve that purpose. In the meantime, the very disadvantages that the assignment is intended to prevent occur—failure to deliver and a Pre-collection letter despite payments.

Return to the sender’s account. Not a less intrusive measure, but rather the more disadvantageous alternative: it leads to the failure of the transaction at the end customer’s expense.

Assignment based solely on the available information. Already performed as a preliminary step. The investigation only begins if this step fails.

In the statistical analysis, the necessity relates to the field level: The comparison of allocation methods cannot be replicated without the names of the payer and the end customer and without the payment reference. These fields do not leave the analysis environment and are not included in the aggregated values.

A.3 Balancing of Interests

Reasonable expectation of the data subject (ECJ, Judgment of July 4, 2023, C-252/21, para. 77). Anyone who transfers an amount to a Merchant account expects the remittee to assign that payment to an order—that is the purpose of the transfer. If the name is divergent, the expectation that the remittee will clarify the assignment is stronger rather than weaker: otherwise, the payment would be ineffective.

Intensity of the interference. The limitations to which Komfortkasse has contractually committed itself toward you argue against the interests of the data subjects prevailing: no collection of characteristics beyond the information already available; no profiling; exclusively sources that are accessible without proof of a legal or legitimate interest; exclusion of registration records, debtor lists, insolvency notices, and credit bureaus; exclusion of all sources from which information under Article 9(1) can be derived, combined with the obligation to cancel a search and discard the result if such a connection becomes apparent during the course of the search; no transmission of information to external sources that would reveal the content of the order; no storage of the identified circumstances; and the restriction of what you, as a merchant, learn to the mere assignment.

These aretwo groups with differing levels of importance. A contractual relationship exists with end customers; processing is carried out in their interest. No relationship exists with payers, and they did not initiate the processing—except by triggering a payment. Their interest carries greater weight. Three provisions take this into account: the public disclosure of information under Article 14, the separate handling of their requests for information, and the commitment to cease executing any further searches regarding the subject in question in the event of an objection under Article 21.

Conclusion. In our view, the legitimate interests prevail. The intrusion is strictly limited, concerns only information that is already available from the payment transaction and the order, does not result in any assessment of the individual, and the processing essentially serves to fulfill precisely the transaction that the data subject initiated themselves.

[ Your divergent or supplementary assessment: … ]

Place, date, signature: [ … ]

Part B — Systematic Description of the Processing (Art. 35(7)(a))

B.1 Parties Involved

Data Controller: [ Your Company ]. Data Processor: LTC Information Services GmbH, Amraser Str. 119, 6020 Innsbruck, Austria. Legal Basis: Data Processing Agreement in the version dated [ Date ]. Other data processors: See the directory, which is available to you in electronic form at any time.

B.2 Process

Komfortkasse has received order and inventory data from you and extracts payment data from the account statements and Remittance advices of the accounts used for payment processing. The reconciliation is initially performed automatically based on the payment description, amount, name, and the transaction numbers you have assigned.

If the assignment fails and the name of the payer differs from the name of the person placing the order, a case-by-case review is conducted—only then, and only if it appears likely to be successful. Only the information already available regarding posting and the relevant orders is used. Artificial intelligence is used to search for and evaluate the results. The decision as to which payment belongs to which order is made by a human; there is no fully automated decision within the meaning of Article 22. The investigation ends as soon as the assignment question is answered or it is determined that it cannot be answered.

For statistical analysis, the data is transferred to an environment separate from the live system, aggregated there on a per-user basis, and only the aggregated values are combined across users. Personal data from multiple users is not combined.

B.3 Data Categories and Data Subjects

Those subject to this measure include your customers as well as individuals who initiate a payment without being customers themselves—family members, employers, companies, and organizations.

The following data is processed: master data (name, address, e-mail address, phone number); order data (amounts, order and delivery dates, order status, numbers and descriptions of the ordered items, your transaction numbers), and payment data (Account holder, IBAN, amount, value date, payment reference, payment type).

B.4 Sources for Case-by-Case Verification

Permitted: public registers of companies, associations, and other legal entities—commercial registers/trade registers, company registers, association registers, the Central Association Register, and corresponding registers of other countries—public business directories, public subscriber and address directories, and general search engines. Only extracts from registers that are accessible without proof of a legal or legitimate interest may be used.

Excluded: resident registration records, debtor lists, insolvency notices, credit bureaus, and all sources and queries from which information under Art. 9(1) can be directly or indirectly derived—in particular social networks and relationship status information, obituaries and death notices, as well as information regarding religion or belief, health, political opinion, union membership, and sexual orientation.

B.5 Remittes, Third Countries, Retention Period

No information that reveals the content of the order is transferred to external sources. Some processing takes place outside the EU and the EEA, specifically in [Switzerland, the United States, the United Kingdom]; the legal basis for this is the Commission’s adequacy decisions or the certification of the respective remittee under the EU-U.S. Data Privacy Framework, or alternatively, standard contractual clauses along with an impact assessment. The circumstances identified during the search are not saved; only the assignment decision is saved. You specify the retention period: [ … ].

Part C — Necessity and Proportionality (Art. 35(7)(b))

Legal basis and balancing of interests: see Part A. In addition to the other principles of Art. 5:

Purposelimitation. The list of purposes in the data processing agreement is exhaustive and expressly includes both types of processing. Statistical analysis is classified as further processing for statistical purposes under Art. 5(1)(b); its results are not used for measures or decisions affecting individual persons.

Data minimization. No collection of data beyond the information provided, no profiling, no storage of search details, and field minimization for each analysis.

Storage Limitation. Upon expiration of the period you have specified, the data will be deleted or anonymized; anonymization also includes your transaction numbers, because otherwise the data could be assigned to you via your shop system and would thus only be pseudonymized.

Data Subject Rights. Requests received by Komfortkasse are redirected to you; for payers with whom we have no customer relationship, the response is coordinated with you beforehand, and their data is transmitted to you only to the extent required to respond. If a person objects under Article 21, the search will be suspended for that person until you have decided on the objection.

Transparency. For end customers, this is provided via your privacy policy (text module). There is no contact channel for payers; therefore, the information is made publicly available in accordance with Article 14(5)(b), second sentence.

⚠️ An open issue you should be aware of: Whether public disclosure is sufficient for payers is a matter of disputed interpretation. The requirement of Article 14(5)(b) is met here in its most robust form—there is absolutely no contact channel for this group of individuals, so the issue is one of impossibility rather than mere effort. We consider the provision to be sufficient, but we would like to point out that the issue has not been conclusively resolved.

Part D — Risks and Remedial Measures (Art. 35(7)(c) and (d))

[ Add risks arising from your product range, customer structure, or configuration: … ]

Part E — Residual Risk and Conclusion

Based on the assessment presented here, the remaining risk to the rights and freedoms of data subjects after the measures have been implemented is low. Accordingly, prior consultation with the supervisory authority pursuant to Art. 36(1) is not required.

This determination is yours to make, not ours. If you reach a different conclusion—for example, due to your product range or customer structure—you must consult the supervisory authority before beginning processing.

Conclusion: [ … ] · Place, date, signature: [ … ]

Part F — Formalities

Advice from the Data Protection Officer (Art. 35(2)), if appointed: obtained on [ … ], opinion: [ … ]

Views of the data subjects (Art. 35(9)), where appropriate. Generally not required, because there is no channel of communication with the payers and obtaining consent from end customers would lead to further processing beyond that assessed. Document rationale: [ … ]

Review (Art. 35(11)). In the event of a change in risk, but at least with each new version of this module. Next review: [ … ]

Notes on Use

This is a resource provided by us; it is not an impact assessment. You are responsible. We provide you with a description of our procedure and a proposed assessment; the assessment itself, the adaptation to your specific circumstances, and the decision remain your responsibility. For a good reason, this document does not bear a signature from Komfortkasse: You decide on the purposes and means of processing.

Please fill it out rather than simply copying it. The [ … ] fields are not a mere formality. An impact assessment without details on scope, retention period, and product range is worthless in the event of an audit.

Only Part A is mandatory for all entities that have been granted instructions. You’ll need Parts B through F if Part 0 results in a data protection impact assessment. If you conclude that one isn’t required, keep Part 0 on file as a documented finding.

Updates. We keep this module up to date. Please validate whether your documentation needs to be updated when a new version is released.

Questions

Questions about this module: datenschutz@Komfortkasse.eu

These texts are intended as drafting guides and do not replace legal advice. Whether and how they apply to your company depends on your business setup, product range, and customer base.