Legal notice and privacy for trade websites

The duty does not apply to online shops alone. Section 5 of the German Digital Services Act covers digital services offered on a business basis, and a website is on a business basis as soon as it is run permanently and serves the business. A plain calling-card page with a phone number and three photographs falls under it just as much as a site with a quotation form and a careers page. In Germany 1,038,126 (ZDH 2025) businesses are entered in the registers of skilled crafts and in the register of trades similar to skilled crafts; for the vast majority the website has long been the first point of contact, and therefore the place where the provider identification has to appear.

A missing or incomplete legal notice is not a cosmetic flaw. A breach of the provider identification is an administrative offence under the Digital Services Act and can be met with a fine. Then there is the competition-law side: information and identification duties on the internet are a classic ground for a formal warning, even though the legislator has since limited the recovery of costs for such warnings against smaller businesses. For a trade business the practical conclusion is usually this: getting the details right from the outset takes considerably less effort than sorting them out afterwards.

In practice the error rarely stems from carelessness; it stems from copying. A block of text is taken from another site, the legal form no longer matches, the master craftsman title sits where the statutory professional title should be, and the privacy policy describes an order form the site does not have. Anyone setting up a website for trade businesses from scratch has the easier route: the details are gathered once from the business itself and then kept current, rather than assembled from other people's pages.

This is where a trade website parts company with the website of a service provider outside chamber membership. Anyone practising a trade listed in Annex A of the German Crafts Code — electrical engineering, plumbing and heating, roofing, joinery and the other licence-required trades — practises a regulated profession. For that case the law requires three additional details: the chamber to which the technical management belongs, the statutory professional title, and the state in which that title was conferred.

The third point is the one most often overlooked, because it seems self-evident. It is not: the requirement exists because professional qualifications are mutually recognised within the European Union and it must be apparent under which legal system a title was awarded. The full wording is therefore not merely "master electrical engineer" but "master electrical engineer, conferred in the Federal Republic of Germany". The governing professional rules belong there too, in the trades usually the Crafts Code, together with a note on where its text can be consulted.

The chamber is named in full with its address, not as an abbreviation. What matters is the location of the commercial establishment, not the owner's place of residence; for businesses around Hildesheim, Peine and Salzgitter it is the chamber of skilled crafts competent for that district. Anyone running several sites in different chamber districts clarifies the allocation with the chamber itself. On a page about our services this block sits in the same place for every licence-required trade; only the professional title changes.

Two lines appear regularly on trade websites although they have no place there. The first is the tax number: it is an internal identifier of the tax office and does not belong in the provider identification. What is required is the VAT identification number alone, and only where the business has one. Anyone using the small-business rule under section 19 of the German VAT Act as a rule has none and omits the line rather than inserting the tax number as a stand-in.

The second is the disclaimer that has been travelling from site to site for years: pages of statements about links, content and copyright, often citing a supposedly decisive judgment. These blocks have no independent legal effect and bury the details that matter. Much the same applies to the reference to the European online dispute resolution platform: the platform is no longer operated and the link leads nowhere. What should be checked instead is set out in the German Act on Alternative Dispute Resolution in Consumer Matters, which ties the information duty to a workforce of more than ten people.

The privacy policy is not a second legal notice but something different: it discharges the information duty under Article 13 of the General Data Protection Regulation. Anyone collecting personal data must state at the time of collection who is responsible, for what purpose and on what legal basis processing takes place, who receives the data, how long it is stored and what rights the data subject has. On a website this happens on a dedicated page reachable from anywhere on the site.

The most common mistake is not the missing policy but the ill-fitting one. A copied text describes processing that does not happen on the site at all — a newsletter, an order process, a customer account — and says nothing about what does happen: the contact form, the host's server logs, the call-back request, an application through the careers page. A privacy policy describing more than the site does is just as useless as one saying too little. Neither reflects what actually takes place.

A second point concerns language. Article 12 requires a concise, transparent, intelligible and easily accessible form in clear and plain language. That rules out blocks of text consisting largely of quoted legislation. For a trade website this means in concrete terms: short sections, each with a heading naming the subject, and beneath it a few sentences on purpose, legal basis, recipients and storage period.

As soon as somebody other than the business itself processes personal data, the role matters. The host stores server logs and incoming form submissions; the agency maintaining the site sees the same data during maintenance work; the email mailbox sits with a provider. All three act on instructions on behalf of the business and are therefore processors within the meaning of Article 28 of the General Data Protection Regulation. The business remains the controller; that role cannot be outsourced.

The processing contract is therefore not a formality but the evidence that the processing is governed. It sets out the subject matter, duration, nature and purpose of the processing, names the categories of data, imposes confidentiality, governs sub-processing, deletion and return, and describes the technical and organisational measures under Article 32. It is concluded in text form; an invoice or an assurance by email is no substitute. Where the server stands in Germany and the maintainer works domestically, the question of a transfer to a third country falls away at the same time.

A record of processing activities under Article 30 belongs here too. The much-quoted exemption for undertakings with fewer than 250 employees as a rule does not apply, because it covers only occasional processing and a permanently available contact form is not occasional. For a trade business the record nevertheless stays manageable: a few pages covering the website, the mailbox, quotation handling and personnel administration. A data protection officer must be appointed under section 38 of the German Federal Data Protection Act only where as a rule at least twenty people are constantly engaged in automated processing.

Alongside the legal notice and the privacy policy, the question of accessibility comes up regularly. The German Accessibility Strengthening Act exempts micro-enterprises offering or providing services from the corresponding duty. A micro-enterprise is one employing fewer than ten people (BFSG) that either achieves an annual turnover of at most 2 million euros (BFSG) or whose annual balance sheet total does not exceed that figure. That exemption applies to many trade businesses. It does not, however, release anyone from the legal notice or the information duty, and it is no reason for a website that is hard to use.

The last point concerns consent for storing information on a terminal device and accessing it. The German Telecommunications Digital Services Data Protection Act requires consent for that, unless the storage is strictly necessary for the service expressly requested. A trade website without reach measurement and without embedded third-party content as a rule manages without a consent dialogue, which makes the site faster and reduces the maintenance effort. Anyone with ongoing care and maintenance has this status reviewed once a year; what that costs is set out on the pricing page, and specific questions belong in a short conversation via the contact page.