GDPR, German Criminal Code & professional confidentiality: is DolmiDesk™ legally compliant?

For interpreters, and especially German Sign Language (DGS) interpreters, protecting sensitive client data isn't just a bureaucratic obligation under the General Data Protection Regulation (GDPR) [1] and the German Federal Data Protection Act (BDSG) [2] — it touches the very core of professional confidentiality.

If you work in a medical or legal context, you're often bound by the duty of confidentiality under § 203 StGB (German Criminal Code) [3]. A violation is a criminal offense that can be punished with a fine or imprisonment.

Skepticism toward cloud services is therefore understandable and widespread in Germany [4]. This article analyzes the facts, the technical architecture of DolmiDesk™, and the specific obligations that apply to you as a professional.

TL;DR (Summary)

Yes, DolmiDesk™ can be used in a legally compliant way. DolmiDesk™ is a web application operated exclusively in EU data centers. We process your content data as a processor under Art. 28 GDPR (Auftragsverarbeiter) – you remain the controller (Verantwortliche:r). You'll find the data processing agreement (AVV, Auftragsverarbeitungsvertrag), the technical and organizational measures (TOM, technische und organisatorische Maßnahmen), and the list of sub-processors (Unterauftragsverarbeiter) in the app under Einstellungen → Datenschutz (Settings → Privacy).

The architecture: who holds your data?

DolmiDesk™ is a classic SaaS application (Software-as-a-Service): your data lives in a database that we operate [5]. That's the honest starting point – and it's exactly why it matters where this data is stored, how it's protected, and who is legally responsible for what.

DolmiDesk™ architecture – processing exclusively within the EU

The pillars of this architecture:

• Hosting exclusively within the EU. The application, database, document storage, and dispatch of system emails run at Scaleway SAS (Paris) in data centers in France and the Netherlands [6]. No third-country transfer takes place.
• Tenant separation at the database level. Every account is separated from all others by database-level access rules – not just by application logic, but one level deeper.
• Field-level encryption. Especially sensitive fields are encrypted individually, each bound to tenant, table, record, and field. Keys are managed per tenant and can be rotated.
• Searchable despite encryption. So you can still search encrypted fields, DolmiDesk™ works with so-called blind indexes (HMAC short values) instead of plaintext search columns.
• Documents with their own keys. Generated PDFs and uploaded receipts are stored with per-file encryption in storage that isn't publicly accessible.
• Access protection. Server-side sessions, two-factor authentication, and passkeys.

Honestly speaking

Encryption where we manage the keys reliably protects against theft of storage media, against access through the database layer, and against other tenants – but it is not end-to-end encryption. An operator that has to run the application, generate invoices, and send emails must necessarily be able to process the data. This is exactly why the legal framework (the AVV, the binding instructions, the commitment to professional confidentiality) isn't a side note but the actual core of the protection.

Division of roles: Art. 28 GDPR

From a data protection standpoint, the division is clear [7]:

Role	Who	For what
Controller (Art. 4 No. 7)	You	The content data: clients, assignments, invoices. You decide the purposes and means.
Processor (Art. 4 No. 8)	DolmiDesk™	Processes this data strictly on your instructions, for the purpose of providing the application.
Own responsibility	DolmiDesk™	Only for our own contractual and billing data (your account, your payment).

Specific obligations follow from this, which we take on contractually: we do not evaluate your content data for our own purposes, we do not pass it on to third parties (other than the sub-processors named below), and we support you with data subject requests.

Your obligation: the data processing agreement

Art. 28(3) GDPR requires a written contract between you and us [1]. You'll find this AVV (data processing agreement) – together with the TOM document and the list of sub-processors – in the app under Einstellungen → Datenschutz (Settings → Privacy). Without it, using the app is not legally compliant, no matter how good the technology is.

Sub-processors: the complete list

Art. 28(2) GDPR requires transparency about engaged sub-processors. Complete, with the legal basis for the transfer:

Service	Provider & location	Purpose	Place of processing	Basis for transfer
Scaleway	Scaleway SAS, Paris (FR) [6]	Application, database, documents, system emails	France, Netherlands	No third-country transfer (EU)
Cloudflare	Cloudflare, Inc., San Francisco (US) [8]	Delivery (CDN), protection against attacks	Global network, connection data	DPF + Standard Contractual Clauses
Stripe	Stripe Payments Europe, Ltd., Dublin (IE) [9]	Payment processing (your subscription)	EEA, group headquartered in the US	DPF + Standard Contractual Clauses
PostHog	PostHog, Inc., San Francisco (US) [10]	Anonymous usage statistics – only with consent	EU cloud, Frankfurt am Main	Data hosted in the EU; DPF + SCC for support
Google	Google Ireland/LLC [11]	Reading the calendar, calculating routes	Google infrastructure	DPF [12]

Important context: your client data – names, assignment locations, invoice contents – lives exclusively with Scaleway in the EU. Cloudflare sees connection data (in particular IP addresses), not the content of your assignments. Stripe sees your payment data, not that of your clients. PostHog collects no content data and is completely disabled without your consent.

Google's role

Google is only involved in two clearly defined places.

1. The calendar – read-only access

When you connect it, DolmiDesk™ requests only read access to your calendar (calendar.readonly), plus your email address so you can see which account is connected [11]. Write access is never technically requested – so DolmiDesk™ can neither change nor delete your appointments.

What this means in practice

The calendar stays in your control and in your Google account. The data protection relationship for the calendar itself exists between you and Google – not between us and Google. If you keep professional appointments with client data there, the considerations from the following section still apply.

2. Route calculation – with plaintext addresses

For distance and travel time, DolmiDesk™ queries the Google Routes API [13]. In doing so, the start and destination address are transmitted to Google in plaintext; only the distance and duration are returned.

Please read carefully

Addresses of assignment locations can be personally identifiable – for instance, the private address of the person you're interpreting for. These addresses are sent to Google during route calculation. In our own database, we store the associated cache entries only under an HMAC short value rather than in plaintext; that's pseudonymization on our side, but it doesn't replace the transmission to Google.

If you want to avoid this for a specific assignment, enter the distance and travel time manually on the order – then no query takes place for that order.

If you use Google for calendar and email

Because your calendar lives with Google, the classic Google question is relevant here – but only for your own Google account, not for DolmiDesk™'s data storage.

Feature	Private account (@gmail.com)	Business account (Google Workspace)
Cost	Free	Paid (starting at roughly €6/month)
Business model	Data analysis & advertising	Software license fees
Data protection	Google may scan some data	No ad scanning, data belongs to you [14]
Data processing agreement	Not available	Included & GDPR-compliant
Suitable for § 203 StGB	❌ NO	✅ YES (under conditions)

Many data protection concerns stem from the use of private accounts, where Google grants itself broad rights to analyze data [15]. In the business context (Workspace), Google contractually guarantees that no data is scanned for advertising purposes [14].

Warning

If you keep professional, client-related appointments in a free @gmail.com account, you're processing professional secrets in an account without a data processing agreement. So for the calendar as the source of your assignments, this remains true without exception: no private Gmail account for professional client data.

Legal certainty: the US & third-country transfer

For a long time, a major point of criticism was data transfer to the US (known through the CJEU's "Schrems II" ruling [16]). After the Privacy Shield agreement fell away, it was unclear whether US providers could offer sufficient data protection guarantees.

For DolmiDesk™, this question is considerably defused: your content data lives with Scaleway in France and the Netherlands – no third-country transfer takes place here at all [6]. The question only remains relevant for the peripheral areas: delivery (Cloudflare), payment (Stripe), and – if you use them – calendar and routes (Google).

Current status (Data Privacy Framework)

Since July 10, 2023, the European Commission's adequacy decision has applied to the EU-US Data Privacy Framework (DPF).

• This means: the US is no longer considered an unsafe third country under data protection law, provided the US company is certified [17].
• Google LLC is certified under this framework and appears on the official list maintained by the US Department of Commerce; as of the writing of this article (2025), the certification is valid until September 13, 2026 [12].

In addition, we also base the relevant processing activities on Standard Contractual Clauses under Art. 46(2)(c) GDPR – a second legal basis, independent of the adequacy decision. Should the DPF decision fall, as happened to Privacy Shield, the legal basis wouldn't collapse without a fallback.

Your obligation: the data processing agreement with us

To satisfy Art. 28 GDPR, you need a data processing agreement (Auftragsverarbeitungsvertrag) with us [1]. You'll find it in the app under Einstellungen → Datenschutz (Settings → Privacy), together with the TOM document and the list of sub-processors.

If you additionally use Google Workspace for your calendar, you'll also need the data processing agreement with Google – that's a separate contract, independent of ours.

How? In the Google Admin console under Account > Account settings > Legal and compliance. There you need to agree to the "Cloud Data Processing Addendum (CDPA)".

Google Admin console: location of the data processing agreement

Shared responsibility: who protects what?

Even with a hosted application, a shared responsibility model applies – only the split shifts:

• You are responsible for:

  • the content you enter (data minimization, no unnecessary diagnoses)
  • selecting and binding your service providers (see § 203 StGB below)
  • your access credentials: strong login, two-factor authentication or passkeys
  • who has a user account within your account
  • concluding the data processing agreement

• DolmiDesk™ is responsible for:

  • operating, maintaining the availability, and securing the application
  • encryption, tenant separation, and key management
  • selecting and monitoring the sub-processors
  • complying with the data processing agreement and supporting data subject requests
  • notifying you of data breaches (Art. 33(2) GDPR)

This model means: as long as you don't record unnecessary sensitive details and secure your access, the technical protection sits with us – the content-level protection sits with you.

§ 203 StGB: are we even allowed to see your data?

This is the decisive question. When you use a hosted application, a third party is involved – there's no way around that. The good news: this exact situation is expressly regulated in the Criminal Code.

The legal situation since 2017

Until 2017, involving external IT service providers was legally tricky for professionals bound by confidentiality. With the Act on the New Regulation of the Protection of Secrets in Connection with the Involvement of Third Parties in the Professional Activities of Persons Bound by Confidentiality, §§ 203(3) and (4) StGB were introduced [18].

Since then, the following applies [3]:

• § 203(3) sentence 2 StGB: Disclosure to "other participating persons" is not an unauthorized disclosure, provided it's necessary for making use of these persons' services. IT service providers are explicitly covered.
• § 203(4) StGB: For this, you must carefully select the participating person and bind them to confidentiality. If you fail to do so, you make yourself criminally liable – not the service provider.

This is your obligation, not ours

§ 203(4) StGB addresses you as the person bound by professional confidentiality. Carefully selecting and binding the service provider is your task. We provide you with the documents for it – but concluding them is up to you.

What we provide for this

• A commitment to professional confidentiality (Verpflichtung auf das Berufsgeheimnis) under § 203(4) StGB, covering everyone who could potentially have access on our side.
• The TOM document, as evidence for your selection decision.
• The list of sub-processors (Liste der Unterauftragsverarbeiter), so you know who else is involved – because sub-processors, too, must be bound accordingly under § 203(4) sentence 2 StGB.

You'll find all three in the app under Einstellungen → Datenschutz (Settings → Privacy).

Why encryption matters here

The less plaintext is accessible at all, the smaller the circle of people to whom something is "disclosed." Field-level encryption, tenant separation, and per-file encrypted documents reduce the actual possibility of access – and thereby support your selection decision under § 203(4) StGB.

Professional confidentiality, GDPR & sending invoices by email

This is where it gets specific for interpreters. You often process data under Art. 9 GDPR (health data, e.g. "interpreting during an oncology consultation"). But here, too, two worlds collide: strict confidentiality and the digital reality of the funding bodies (Kostenträger).

Am I allowed to send invoices by email?

In principle, an unencrypted email is as open as a postcard. The law and professional codes of conduct prohibit sending sensitive data unencrypted. But: issuing an invoice is necessary to fulfil your assignment – and the funding bodies (Kostenträger, e.g. health insurers, courts) expect to receive an invoice by email.

In principle, an unencrypted email is considered insecure (the "postcard principle"). However, exceptions apply to invoicing, based on necessity.

The legal basis for sending

You're allowed to transmit the data because there's no payment without transmission. The GDPR explicitly permits this:

1. Performance of a contract (Art. 6(1)(b) GDPR [1]): issuing the invoice is an essential part of your contract with the funding body (Kostenträger). Without transmitting the invoice, the contract cannot be fully performed.
2. Establishing legal claims (Art. 9(2)(f) GDPR [1]): even with sensitive health data, processing (and transmission) is permitted where it's "necessary for the establishment, exercise or defence of legal claims" (here: your claim to payment).
3. Administration of the social security system (Art. 9(2)(h) GDPR [1]): if you bill health insurers or social welfare bodies, this falls under the administration of health services.

Accordingly, sending invoices by email is legally permissible, provided appropriate security measures under Art. 32 GDPR are taken.

tip

What may an invoice contain – and what shouldn't it?

An invoice for interpreting services generally doesn't need to contain any special category health data.

Unproblematic:

• Name of the funding body (Kostenträger)
• Name of the person you interpreted for (where required)
• Date and duration of the service
• A description of the service such as "sign language interpreting"
• The authority's case reference number
• Location of the service

Problematic and to be avoided:

• Diagnoses ("HIV counseling", "oncology consultation", "psychotherapy")
• Particularly intimate information ("crisis intervention following a suicide attempt")
• Specific medical details in the subject line or email body

If you observe these principles, most invoices don't fall under Art. 9 GDPR at all, but count as ordinary administrative data – which significantly reduces the risk.

Technical security (TLS vs. end-to-end)

Germany's data protection supervisory authorities (DSK) ideally call for end-to-end encryption (PGP/S/MIME), but acknowledge that this is often missing in business correspondence [19].

Accordingly, transport encryption (TLS) is considered an acceptable minimum standard for normal correspondence, provided no highly sensitive medical details (e.g. detailed psychological reports) are transmitted in plaintext [20].

At DolmiDesk™, sending happens via Scaleway's transactional email infrastructure in the EU [6] – not via your Gmail inbox. The transmission is TLS-secured; if the recipient authority (e.g. AOK, a court) also supports TLS – which is the norm today – the email is transmitted encrypted on its way across the internet [19].

warning

The German Data Protection Conference (DSK) explicitly emphasizes in its guidance that, for "normal risk," transport encryption can constitute a sufficient protective measure under Art. 32 GDPR [21]. Only in the case of high risk or particularly sensitive medical content do they call for end-to-end encryption.

So you remain responsible for content-level data minimization, and we remain responsible for the technical security of the sending infrastructure.

What actually goes out with the invoice

The invoice contains the date and duration of the service, the assignment location, the description of the service, and – depending on the funding body – a case reference number or the name of the person you interpreted for. What doesn't automatically appear are diagnoses or content-related details about the conversation: the service description comes from your invoice template and the title of your calendar appointment.

So if you name your calendar appointment "Oncology consultation, Ms. M.", that text carries over into the order and can end up on the invoice. A neutral title like "Interpreting assignment, clinic" prevents that from the outset – and you can adjust the subject on the order at any time before sending.

Why TLS is sufficient in many cases

Art. 32 GDPR doesn't require perfect security measures, only appropriate ones. Appropriateness depends on the risk. For simple administrative data such as invoices, the risk is low if:

• no diagnoses are included
• the recipient authority supports TLS
• you secure your DolmiDesk™ access with two-factor authentication or passkeys

That puts the protection level frequently above that of many conventional practice solutions, where invoices sit unencrypted on a laptop or smartphone.

Checklist for § 203 StGB & GDPR compliance

With DolmiDesk™:

• I have concluded the data processing agreement under Art. 28 GDPR with DolmiDesk™ (Einstellungen → Datenschutz / Settings → Privacy).
• I have concluded the commitment to professional confidentiality under § 203(4) StGB.
• I have read the TOM document and the list of sub-processors and documented them as the basis for my selection decision.
• I have secured my access with two-factor authentication or passkeys.
• I have added DolmiDesk™ to my record of processing activities (Art. 30 GDPR).

For my calendar:

• I use Google Workspace (Business) for professional appointments, not a private Gmail account.
• I have digitally signed the data processing agreement (Cloud Data Processing Addendum) with Google.
• My appointment titles contain no diagnoses – they carry over into the order and the invoice.

Content-wise:

• I avoid diagnoses or intimate details in the free-text fields of the invoice.
• For particularly sensitive assignments, I check whether the route should be entered manually instead of calculated.

Conclusion

Using DolmiDesk™ can be done in a data-protection-compliant way, but it requires discipline during setup.

The fact that a service provider is involved with a hosted application is not a special case, but the normal case provided for by law: §§ 203(3) and (4) StGB have expressly regulated this since 2017 [18]. What matters is that this service provider is bound contractually, technically, and under criminal law – and that your content data never leaves the EU.

In many practical scenarios, a professional cloud service — especially with MFA, TLS, backups, redundancy, and certified data centers — can offer a higher level of security than locally stored files on unencrypted devices [22].

Use DolmiDesk™ thoughtfully, stick to the checklist, and you can run your everyday work as an interpreter efficiently and in compliance with the law.

Disclaimer

Not legal advice

The content of this article was created with the greatest possible care and serves general information purposes only. It does not constitute legal advice and cannot replace individual advice from a lawyer.

Despite careful research, no guarantee is given for the accuracy, completeness, or currency of the information provided. Legal assessments can change, particularly in the area of data protection law and international data transfers.

The author accepts no liability for damages or losses arising directly or indirectly from the use of the information in this article.

Disclaimer for the use of DolmiDesk™

DolmiDesk™ is a hosted web application. For the content data that you process within it, you are, under data protection law, the controller (Verantwortliche:r); in this respect we act as the processor (Auftragsverarbeiter) under Art. 28 GDPR. The scope, purpose, and limits of this processing follow from the data processing agreement; our technical and organizational measures are described in the TOM document. Where this article and those documents differ, the contractual documents take precedence.

Responsibility for the content of invoices, calendar entries, and emails, for data minimization, and for securing one's own access (e.g. two-factor authentication, passkeys, assignment of user accounts) lies with the users.

No liability is accepted for:

• incorrect use or configuration,
• data protection violations resulting from inadequately secured user access,
• the content of processed or sent documents,
• outages, changes, or restrictions of third-party services (e.g. Google Calendar).

Users are obliged to independently review and comply with the professional, contractual, and legal requirements applicable to them — in particular the GDPR, the BDSG, and § 203 StGB. This applies specifically to the careful selection and binding of participating persons under § 203(4) StGB.

Use of DolmiDesk™ is at your own responsibility.

---

1. Europäisches Parlament und Rat, Verordnung (EU) 2016/679 (Datenschutz-Grundverordnung). 2016. [Online]. Available: https://eur-lex.europa.eu/eli/reg/2016/679/oj ⤴
2. Bundesrepublik Deutschland, Bundesdatenschutzgesetz (BDSG). 2017. [Online]. Available: https://www.gesetze-im-internet.de/bdsg_2018/ ⤴
3. Bundesrepublik Deutschland, Strafgesetzbuch (StGB) § 203 Verletzung von Privatgeheimnissen. [Online]. Available: https://www.gesetze-im-internet.de/stgb/__203.html ⤴
4. B. Gribl, “Von Speicher zu Smart: Was Nutzer heute von der Cloud erwarten,” Cloudcomputing Insider, Oct. 2025, [Online]. Available: https://www.cloudcomputing-insider.de/datenspeicherung-in-deutschland-und-eu-a-61a8c732cda320422173c3c442a8a324/ ⤴
5. P. Mell and T. Grance, “The NIST Definition of Cloud Computing,” Gaithersburg, MD, techreport Special Publication 800-145, 2011. ⤴
6. Scaleway SAS, “Privacy Policy.” [Online]. Available: https://www.scaleway.com/en/privacy-policy/ ⤴
7. European Data Protection Board, “Guidelines 07/2020 on the concepts of controller and processor in the GDPR.” 2021. [Online]. Available: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en ⤴
8. Cloudflare, Inc., “Cloudflare Privacy Policy.” [Online]. Available: https://www.cloudflare.com/privacypolicy/ ⤴
9. Stripe Payments Europe, Ltd., “Stripe Datenschutzerklärung.” [Online]. Available: https://stripe.com/de/privacy ⤴
10. PostHog, Inc., “PostHog Privacy Policy.” [Online]. Available: https://posthog.com/privacy ⤴
11. Google LLC, “Google Calendar API: Choose Auth Scopes.” [Online]. Available: https://developers.google.com/calendar/api/auth ⤴
12. U.S. Department of Commerce, “Data Privacy Framework List: Google LLC.” [Online]. Available: https://www.dataprivacyframework.gov/list ⤴
13. Google LLC, “Routes API Documentation.” [Online]. Available: https://developers.google.com/maps/documentation/routes ⤴
14. Google Cloud, “Google Workspace Trust & Privacy.” [Online]. Available: https://workspace.google.com/intl/de/security/ ⤴
15. I. Redaktion, “Was weiß Google über mich? Google-Daten einsehen und verwalten,” IONOS Digital Guide, Oct. 2022, [Online]. Available: https://www.ionos.de/digitalguide/online-marketing/suchmaschinenmarketing/was-weiss-google-ueber-mich/ ⤴
16. Gerichtshof der Europäischen Union, “Urteil des Gerichtshofs (Große Kammer) vom 16. Juli 2020. Data Protection Commissioner gegen Facebook Ireland Limited, Maximillian Schrems.” July 16, 2020. [Online]. Available: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX:62018CJ0311 ⤴
17. European Commission, “Adequacy decision for the EU-US Data Privacy Framework.” Brussels, July 2023. [Online]. Available: https://commission.europa.eu ⤴
18. Bundesrepublik Deutschland, Gesetz zur Neuregelung des Schutzes von Geheimnissen bei der Mitwirkung Dritter an der Berufsausübung schweigepflichtiger Personen. 2017. [Online]. Available: https://www.gesetze-im-internet.de/stgb/__203.html ⤴
19. Bundesamt für Sicherheit in der Informationstechnik, “TR-03108 Sicherer E-Mail-Transport,” BSI, Bonn, techreport, 2024. [Online]. Available: https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr03108/tr-03108.html ⤴
20. Datenschutzkonferenz (DSK), “Orientierungshilfe der Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder vom 27. Mai 2021,” Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder, techreport, June 2021. [Online]. Available: https://www.datenschutzkonferenz-online.de/media/oh/20210616_orientierungshilfe_e_mail_verschluesselung.pdf ⤴
21. “Maßnahmen zum Schutz personenbezogener Daten bei der Übermittlung per E-Mail,” Datenschutzkonferenz (DSK), Mar. 2020, [Online]. Available: https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/publikationen/DSK/orientierungshilfen/2020-DSK_OH-E-Mail-Verschluesselung.pdf ⤴
22. K. K. The Investopedia Team, “Cloud Security: Definition, How Cloud Computing Works, and Safety,” Investopedia, Sept. 2022, [Online]. Available: https://www.investopedia.com/terms/c/cloud-security.asp ⤴