Privacy policy

1. Controller

Alawihee Versicherungsservice & Marketing (MeinVertragsPlus), owner Ali Alawihee
Hirschberger Straße 9, 49086 Osnabrück, Germany
Email: kontakt@meinvertragsplus.de, phone: +49 163 2707146

2. Requests via our forms

When you fill in the insurance, electricity & gas or internet check or request a quote via “Request a quote”, we process your contact details (name, email, phone, home address), your date of birth, how you would like to be informed about quotes (WhatsApp, email or both), and your information on existing contracts and wishes – depending on the line of insurance, for example vehicle data (HSN/TSN, annual mileage) and the desired car cover (cover type, excess, choice of garage, extras), for dental insurance the reimbursement rate and desired modules, for liability and legal expenses insurance the insured persons, areas and excess, for contents and building insurance the living space and add-on modules, for internet the occasion (switch, move, new connection), desired technology, speed and extras as well as the address of the connection (availability depends on the address), as well as previous insurance and previous claims. You may voluntarily tell us when your current contract ends, what budget you have in mind and when we can best reach you. If you voluntarily upload documents or photos (e.g. policy, latest bill, letter from your insurer), we also store these files. With “Scan document” you crop a photo directly on your device – nothing is transferred. Automatic AI text recognition only takes place if you explicitly tap “Read details automatically” (section 11a). You may also voluntarily provide your contract number and exact end date. We also store the language (German, Arabic or English) in which you filled in the form so that we can reply in that language. After submitting, you receive a confirmation of receipt by email (see section 4).

In the detailed forms we also ask for your bank details (IBAN, account holder if applicable) and your consent to their use for the later contract. Nothing is debited: you only grant the SEPA direct debit mandate to the provider when you sign a quote in the customer portal. We also pay your bonus into the same account – you can change it at any time in the customer portal.

The purpose is to process your request, obtain a quote and handle your bonus. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and your consent under Art. 6(1)(a) GDPR.

Address suggestions while filling in forms

To save you typing, we fill in the town after you enter the postcode and suggest matching street names as you type. For this, your browser sends the postcode and the first letters of the street name to our server, which queries the public street and postcode directory “OpenPLZ API” operated by STÜBER SYSTEMS GmbH (Grabbeallee 31, 13156 Berlin, Germany). Neither the house number, your name nor your IP address is sent to OpenPLZ, and we do not store what you enter. To prevent misuse we briefly count (for at most 1 hour, in memory only) how many suggestions are requested per IP address. The legal basis is our legitimate interest in simple, error-free address entry (Art. 6(1)(f) GDPR). You can ignore the suggestions and type everything yourself.

Disclosure to partners

We only pass on your information with your express consent: for insurance to our cooperation partner PFS Professional Financial Solutions GmbH (insurance broker authorised under § 34d(1) GewO), for electricity and gas to the respective energy supplier or our cooperation partner PFS Professional Financial Solutions GmbH, for internet, DSL and fibre to the respective telecommunications provider or our cooperation partner PFS Professional Financial Solutions GmbH. They review your request and prepare a quote for you. You can withdraw your consent at any time by email with effect for the future.

Property and financing: If you send a property or financing request, we store your contact details and address as well as your answers. For property this is e.g. property type, postcode or region, budget or asking price and number of rooms; when buying also household net income and equity; when selling the year of construction, living or plot area and – voluntarily – uploaded photos and floor plans (photos are reduced in size in your browser). For financing it is the type of financing, loan amount, equity, employment status, monthly net income, whether and how much you already pay in instalments, your own assessment of your SCHUFA status, marital status and number of dependent children. This financial information is a voluntary self-disclosure: we do not obtain a SCHUFA report, do not assess it and make no automated decisions (Art. 22 GDPR); it only helps our partner advise you properly. We do not include it in automatic notifications (e.g. to our phone). The legal basis is Art. 6 (1) (b) GDPR (handling your request). We only pass this information on with your express consent (Art. 6 (1) (a) GDPR) – for property to PFS Professional Financial Solutions GmbH (Estate agent licensed under § 34c (1) sentence 1 no. 1 GewO), for financing to PFS Professional Financial Solutions GmbH (Mortgage credit intermediary licensed under § 34i (1) GewO and loan broker under § 34c (1) sentence 1 no. 2 GewO). We do not ask for bank details and do not obtain a SCHUFA credit report. You can withdraw your consent at any time by email with effect for the future.

Business customers: If you send a request for your company, we store your contact details as the contact person, the company address as well as the company name, legal form, industry and number of employees. Depending on the service, we also store: for business loans and leasing the project, amount, desired term, age of the company and approximate annual turnover; for business electricity and gas the annual consumption, type of metering, number of supply points, current supplier and contract end; for business insurance the details of the cover you want (e.g. activity, sum insured, vehicles, data backups), approximate annual turnover, an existing contract and the number of previous claims. The legal basis is Art. 6 (1) (b) GDPR (handling your request). We do not include turnover, amounts or consumption in automatic notifications. We only pass this information on with your express consent (Art. 6 (1) (a) GDPR) – for loans and leasing to PFS Professional Financial Solutions GmbH, for business insurance to PFS Professional Financial Solutions GmbH (and from there to the insurers requested), for electricity and gas to the respective energy supplier or our cooperation partner PFS Professional Financial Solutions GmbH. You can withdraw your consent at any time by email with effect for the future.

Health insurance and health information

In the health insurance check we additionally ask about your insurance status and employment status. Whether treatment is ongoing or a treatment plan exists – and, for dental insurance, whether teeth are missing or dental treatment is ongoing or recommended – is health information (special category under Art. 9 GDPR). We only store it with your explicit consent (Art. 9(2)(a) GDPR) and pass it on exclusively to our cooperation partner PFS Professional Financial Solutions GmbH. We do not ask for diagnoses. If you choose “Prefer to discuss in person”, we do not store any health information. You can withdraw your consent at any time by email; the information will then be deleted.

3. Customer portal and bonus payout

For the customer portal we store your email address, an encrypted password (or you sign in with Apple or Google), your name, your date of birth (we ask for it on your first login if it is missing), your home address and – if you provide them – account holder and IBAN for paying out your bonus. The legal basis is Art. 6(1)(b) GDPR. From the provider or partner we receive confirmation that the contract has been concluded and that the cancellation period has ended so that we can release your bonus automatically.

Signing in with Apple or Google: If you tap “Continue with Apple” or “Continue with Google”, we forward you to the sign-in page of Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) or Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Data is only transferred to the provider once you click; before that we do not embed anything from Apple or Google on our site. After you sign in, the provider sends us an identifier, your email address (with Apple, an anonymous relay address if you wish) and – where available – your name and a link to your profile picture. Our database service provider (section 6) stores this information with your customer account; we only copy your name into your profile. The provider learns that you are signing in with us. The legal basis is Art. 6(1)(b) GDPR (you choose this sign-in method for your customer account). Apple and Google may transfer data to the USA; both are certified under the EU-US Data Privacy Framework. You can disconnect at any time in your Apple or Google account.

Login with a confirmation code: To protect your account, after your password or Apple or Google we send you a 6-digit code by email every time you log in – and when you have forgotten your password (sent via our email service provider, section 4). We only store the code as an encrypted check value together with the purpose, time and number of attempts; it is valid for at most 10 minutes, and we delete these entries after 24 hours. After the correct code has been entered, we record your login as confirmed (for at most 30 days) and set a technically necessary cookie for this (section 7). If you choose “sign out everywhere” or change your password, we end all logins. The legal basis is Art. 6(1)(b) and (f) GDPR in conjunction with Art. 32 GDPR (security of processing).

Date of birth and analysis by age group: We use your date of birth for your requests (some tariffs depend on age) and – only in aggregated form – for an internal statistic showing how our customers are distributed across age groups (18–25, 26–35, 36–50, over 50). The statistic only shows counts, never individual people; there is no profiling and no automated decision. The legal basis is Art. 6(1)(b) GDPR and, for the statistic, our legitimate interest in tailoring our services (Art. 6(1)(f) GDPR). You can object to this at any time (Art. 21 GDPR).

4. Quotes, notifications and digital signature

As soon as our partner’s experts have put together quotes for you, we inform you via the channel you chose, with a link to the customer portal. We only write to you about your request, not for advertising purposes. The legal basis is Art. 6(1)(b) GDPR. You can change the channel at any time in the customer portal.

• Email: for automatic sending we use Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA as a processor. Your email address, first name and the content of the message are processed; data is transferred to the USA on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR).
• WhatsApp: if you choose WhatsApp, we send the message to your mobile number – via the WhatsApp Business Platform or the WhatsApp app of WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland). Your phone number, first name and the content of the message are processed; data may be transferred to Meta Platforms Inc. in the USA (EU-US Data Privacy Framework).

In the customer portal you can compare quotes, choose one and sign it digitally – on screen or with a photo of your signature (the photo is reduced in size and cropped in your browser). We store the image of the signature, your declarations and the SEPA direct debit mandate (IBAN, account holder, payee), the chosen quote, the time, your customer account, your IP address and your browser’s user agent as well as checksums. From this we create a PDF that you will find under “Documents”. The purpose is to forward your order to our cooperation partner or the provider (Art. 6(1)(b) GDPR) and to prove that you signed (Art. 6(1)(f) GDPR). Signature and PDF are kept in protected storage that only you (PDF) and we can access. We keep them for as long as the contract exists and thereafter until the end of the statutory retention periods (6 or 10 years under Section 257 HGB and Section 147 AO).

5. Cancellation service and support mandate

If you cancel a contract or our support mandate via the customer portal or the “Cancel contracts here” page, we process your name, email address, postal address and – if you provide it – your date of birth, the provider, the type and number of the contract, the reason and requested date, the time of cancellation, the language in which you use the site, your IP address and your browser’s user agent. From this we create the confirmation and the cancellation letter (PDF), forward the cancellation to the provider – via our cooperation partner if a support mandate is active – and send you the confirmation by email and, if you chose WhatsApp, via WhatsApp (see section 4). Without a customer account, we match your name and email address against existing customer accounts in order to assign the cancellation. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for proof of cancellation. To prevent misuse, we briefly count (for at most 24 hours, in memory only) how many cancellations are sent from your IP address.

If you grant the voluntary support mandate, we additionally store your signature, the confirmed declarations, the time and checksums and create a PDF from them under “Documents”. The mandate applies to our cooperation partner PFS Professional Financial Solutions GmbH, who looks after your insurance policies and may obtain information from your insurers for this purpose (Art. 6(1)(b) GDPR). If you end the mandate, support ends immediately; we keep the mandate, cancellations and confirmations as proof until the end of the statutory retention periods (usually 6 years under Section 257 HGB).

6. Hosting and database

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit it, technically necessary data (e.g. IP address, time, page visited) is processed (Art. 6(1)(f) GDPR). Vercel is certified under the EU-US Data Privacy Framework.

We store requests, quotes, customer accounts, signatures and documents with Supabase Inc. on servers in the EU (Frankfurt region). A data processing agreement under Art. 28 GDPR is in place with both service providers.

7. Cookies and consent

We set technically necessary cookies and storage entries (login session, your cookie choice) on the basis of § 25(2) TDDDG. When you sign in, this includes two short-lived cookies: a security key during sign-in with Apple or Google and – with confirmation links sent by email – the page you go to after clicking (“vp_next”, at most 1 hour). After you enter the confirmation code we set the cookie “vp_2fa” (a signed identifier of your login, at most 30 days) so that you do not have to enter the code again on every page. If you choose a language at the top of the page, we remember this choice in the cookie “vp-locale” (content only “de”, “ar” or “en”, stored for 1 year) so that you land directly in your language on your next visit; this is also technically necessary (§ 25(2) no. 2 TDDDG). If you choose “Light” or “Dark” (switch at the top or in the menu), your browser stores only this choice in your device’s local storage (“vp-theme”, content only “light” or “dark”, until you change it; nothing is stored for “System”). It is not sent to us and is required for the display you asked for (§ 25(2) no. 2 TDDDG). If you close an offer notice below the header, your browser stores only the identifier of that offer in local storage (“vp-aktion-ausgeblendet”, e.g. “aktion-herbst”, until you clear the storage) so the notice does not appear again – again without sending it to us (§ 25(2) no. 2 TDDDG). All other cookies are only set with your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change your choice at any time: Cookie settings.

8. Google Ads conversion tracking

Only if you agree to “Marketing” do we use Google Ads conversion tracking from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It measures whether someone submits a request or books a consultation after clicking on an ad. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

9. Contact via WhatsApp

Our website (and the chat assistant) contains a link to WhatsApp. Only when you click it does WhatsApp open (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland) and your message is processed via WhatsApp; data may be transferred to Meta Platforms Inc. in the USA. No data is sent to WhatsApp beforehand. The legal basis is your decision to contact us via WhatsApp (Art. 6(1)(a) and (b) GDPR). If you do not want this, you can also reach us by phone or email.

10. Online appointment booking

If you book a consultation via “Book an appointment”, we process the topic, contact method, date and time, your name, email address, phone number (for phone and WhatsApp calls), your optional message, the language in which you use the site, the time of booking, your IP address and your browser’s user agent. You receive a confirmation in your language by email with a calendar file (.ics) and – for a WhatsApp call – a message via WhatsApp (see section 4). If you come directly from a request form, we link the appointment to your request if the email address matches. So that you do not have to type anything twice, your name, email address and phone number are briefly held in your browser’s session storage until then; it is cleared when you close the tab (§ 25(2) no. 2 TDDDG). The “Add to Google Calendar” button only opens Google when you click it.

For video calls we use WhatsApp (provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). Only when you accept the video call is data such as your name, phone number, image, sound and IP address processed by this provider; call content is end-to-end encrypted. This may involve a transfer to Meta Platforms, Inc. in the USA on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis for appointment booking is Art. 6(1)(b) GDPR (pre-contractual measures), and Art. 6(1)(f) GDPR for proof and protection against misuse; for this we briefly count (for at most 24 hours, in memory only) how many appointments are booked from your IP address. Please do not include any health information in your message – we will discuss it in the conversation. We delete appointment data no later than 12 months after the appointment if no contract results from it.

Reminder of your appointment: 24 hours and 2 hours before the appointment we automatically send you a reminder by email and – if you use our app with notifications – as a push notification (section 11g). This is a service message about the appointment you booked, not advertising (Art. 6(1)(b) GDPR). You can unsubscribe via the link in every reminder; we note this on the appointment. We store when each reminder was sent for up to 90 days after the appointment.

11. AI assistant in the chat

At the bottom right of the website, in the customer portal and in our app you can ask a chat assistant general questions about MeinVertragsPlus, insurance, electricity, gas and internet. Even in the customer portal the assistant does not see any data from your account. The chat window is only loaded when you open it. Only when you send a message is it transferred to our server. There we automatically remove recognisable personal information (e.g. IBAN, email address, phone number, date of birth) and forward the message together with the previous chat history to the AI service Claude from Anthropic (Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland), which generates the answer. Data may be transferred to the USA; the basis is the EU standard contractual clauses (Art. 46(2)(c) GDPR). According to Anthropic, data transmitted via the API is not used to train AI models.

We do not store the content of the chat. To prevent misuse, we briefly count (for at most 24 hours, in memory only) how many messages are sent from your IP address. We only store your language choice in the chat (German/Arabic/English) locally in your browser (§ 25(2) no. 2 TDDDG). The legal basis is our legitimate interest in answering questions quickly (Art. 6(1)(f) GDPR) or the initiation of a contract (Art. 6(1)(b) GDPR). Please do not enter any personal data or health information in the chat – that is what our forms are for. If the AI service is not set up, our server answers questions with fixed texts; no data is then transferred to Anthropic.

11a. AI text recognition when uploading (optional)

If, after uploading a policy or bill, you tap “Read details automatically”, we send this one image or PDF to the AI service Claude from Anthropic (Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland). The AI only reads the provider, contract number, end date and premium; we fill these values into the form, and you check and change them. Neither we nor Anthropic store the image for this purpose; according to Anthropic, data transmitted via the API is not used for training. Data may be transferred to the USA; the basis is the EU standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is your consent by tapping (Art. 6(1)(a) GDPR). To prevent misuse, we briefly count (for at most 1 hour, in memory only) the requests per IP address. Without the tap, nothing is transferred.

Quote documents from our partner: so that your quotes appear in your customer portal faster, we also have the quote PDF from our cooperation partner (with your name, date of birth, address and the tariff details) read by Claude. We only take over the quote details (provider, tariff, premium, benefits) and a PDF with the benefit comparison; we use your name and date of birth only to match the document to your request. According to Anthropic, data transmitted via the API is not used for training; the EU standard contractual clauses also apply to the transfer to the USA. The legal basis is taking steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR).

11b. AI-assisted market research for your request

So that we can find suitable quotes faster, our server has the AI service Claude (Anthropic, with web search) prepare market research for insurance, electricity and gas requests. For this, we only transmit tariff-relevant information without a direct personal reference: line of insurance, desired cover, postcode and town, for car and dental insurance your age in years, vehicle data and your current premium – never your name, contact details, street, date of birth, bank details, free-text notes, health information or documents. The result is internal drafts; you only receive quotes after our licensed partner has checked them. No automated decision within the meaning of Art. 22 GDPR takes place. The legal basis is the processing of your request (Art. 6(1)(b) GDPR) and our legitimate interest in a quick, good selection (Art. 6(1)(f) GDPR). Real estate, financing and health insurance requests are excluded.

11c. Reminders before your contract ends

If you state the end date of your contract (or we enter it with you), our cancellation radar reminds you in the customer portal in good time before the notice period ends. We only remind you by email or WhatsApp if you have expressly allowed this – in the form or in the customer portal under “Profile” (Art. 6(1)(a) GDPR, § 7 UWG). You can unsubscribe at any time via the link in every reminder or in your profile; we then note that you no longer want reminders.

11d. Processing by our team

Besides us, employees and advisers of our team who are bound to confidentiality may process your request. Advisers only see the requests assigned to them. For our accounting with the partner, we record internally which contract was concluded (e.g. line of insurance, date of conclusion, premium); we keep this information for up to 10 years due to commercial and tax law obligations.

Customer file: To look after you, the owner and admins of our team can view your customer account with requests, documents, cancellations and appointments, add an internal note, end your logins or lock the account in case of misuse. Bank details are only shown shortened. Every access is logged (who, when, which action) so that we can prove that your data is handled carefully (Art. 5(2), Art. 32 GDPR); we delete this log after 24 months. The legal basis is Art. 6(1)(b) and (f) GDPR.

11e. MeinVertragsPlus as an app (web app)

You can “install MeinVertragsPlus as an app” on your smartphone or computer. For this, your browser only stores our offline page and our logo so that a notice appears when there is no internet connection – no content from the customer portal and no personal data. If you close the “Install as app” notice, your browser remembers this for 30 days in local storage; this information is not transmitted to us. The legal basis is Section 25 (2) No. 2 TDDDG (strictly necessary for the service you requested). You can remove the app at any time like any other app and delete the stored data in your browser settings.

11f. Job applications

If you apply via our careers page, we process your name, email address and phone number, the position you want, your message and the documents you upload (CV, references, certificates). Photos are reduced in size in your browser. The documents are kept in protected, non-public storage with Supabase Inc. on servers in the EU; only we and admins of our team can open them, not our advisers. We use your information solely for the application process – without AI analysis, profiling or automated decisions (Art. 22 GDPR); we do not store an IP address with your application. The legal basis is Art. 6 (1) (b) GDPR (steps prior to an employment relationship). If email sending is set up, you receive a confirmation of receipt.

After a rejection, we automatically delete your application and documents after 6 months – the time we need to defend ourselves against possible claims under the German General Equal Treatment Act (AGG) (Art. 6 (1) (f) GDPR). Otherwise we delete them no later than 12 months after receipt. If you would like them deleted earlier, simply email kontakt@meinvertragsplus.de. If you are hired, we only transfer the necessary documents to your personnel file.

11g. App for iPhone and Android: Face ID, Touch ID and notifications

In our app for iPhone and Android you can enable login with Face ID, Touch ID or fingerprint. Your face or fingerprint is matched exclusively on your device; we do not receive any biometric data. For your device we only store a random identifier, a device name (e.g. “iPhone”), the operating system, timestamps and a secret key as an encrypted check value; the key itself is kept protected in your device's keychain and renewed with every use. You can remove devices at any time in the customer portal under “Profile”. The legal basis is your activation (Art. 6(1)(a) GDPR); storing the key on your device is strictly necessary for the login you requested (§ 25(2) no. 2 TDDDG).

We only send notifications (e.g. appointment reminders) if you allow them in the app. For this we use Firebase Cloud Messaging of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as a processor; a device identifier for notifications (push token) and the text of the notification are processed, on iPhone additionally via the Apple Push Notification Service. Data may be transferred to the USA; Google and Apple are certified under the EU-US Data Privacy Framework. A notification only contains the time and type of the appointment. You can turn notifications off at any time in your phone's settings. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

11h. Invoices

If we issue you an invoice (e.g. as a business partner), we process your name or company, address, email address, your VAT identification number if applicable, the services, amounts and payment status. The legal basis is Art. 6(1)(b) and (c) GDPR. We keep invoices for as long as tax and commercial law require (§ 147 AO, § 14b UStG, § 257 HGB) and do not change them after they have been issued.

12. Storage period

We delete requests that do not result in a contract no later than 12 months after processing has been completed. We keep data on bonus payouts for up to 10 years due to commercial and tax law obligations. We delete login codes after 24 hours, confirmed logins after at most 30 days and the access log of the customer file after 24 months. You can have your customer account deleted at any time.

13. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) as well as the right to withdraw consent you have given. You can also lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen).