Skip to main content

GDPR, German Criminal Code & professional confidentiality: is DolmiDesk legally compliant?

For interpreters, and especially German Sign Language (DGS) interpreters, protecting sensitive client data isn't just a bureaucratic obligation under the General Data Protection Regulation (GDPR) [1] and the German Federal Data Protection Act (BDSG) [2] — it touches the very core of professional confidentiality.

If you work in a medical or legal context, you're often bound by the duty of confidentiality under § 203 StGB (German Criminal Code) [3]. A violation is a criminal offense that can be punished with a fine or imprisonment.

Skepticism toward cloud services is therefore understandable and widespread in Germany [4]. This article analyzes the facts, the technical architecture of DolmiDesk, and the specific obligations that apply to you as a professional.

The architecture: who holds your data?​

DolmiDesk is a classic SaaS application (Software-as-a-Service): your data lives in a database that we operate [5]. That's the honest starting point – and it's exactly why it matters where this data is stored, how it's protected, and who is legally responsible for what.

The pillars of this architecture:

  • Hosting exclusively within the EU. The application, database, document storage, and dispatch of system emails run at Scaleway SAS (Paris) in data centers in France and the Netherlands [6]. No third-country transfer takes place.
  • Tenant separation at the database level. Every account is separated from all others by database-level access rules – not just by application logic, but one level deeper.
  • Field-level encryption. Especially sensitive fields are encrypted individually, each bound to tenant, table, record, and field. Keys are managed per tenant and can be rotated.
  • Searchable despite encryption. So you can still search encrypted fields, DolmiDesk works with so-called blind indexes (HMAC short values) instead of plaintext search columns.
  • Documents with their own keys. Generated PDFs and uploaded receipts are stored with per-file encryption in storage that isn't publicly accessible.
  • Access protection. Server-side sessions, two-factor authentication, and passkeys.

Division of roles: Art. 28 GDPR​

From a data protection standpoint, the division is clear [7]:

RoleWhoFor what
Controller (Art. 4 No. 7)YouThe content data: clients, assignments, invoices. You decide the purposes and means.
Processor (Art. 4 No. 8)DolmiDeskProcesses this data strictly on your instructions, for the purpose of providing the application.
Own responsibilityDolmiDeskOnly for our own contractual and billing data (your account, your payment).

Specific obligations follow from this, which we take on contractually: we do not evaluate your content data for our own purposes, we do not pass it on to third parties (other than the sub-processors named below and – if you use address suggestions and route calculation – addresses to Google as an independent controller, and – if you switch on showing your orders in Google Calendar – your orders into the calendar “DolmiDesk” in your own Google account), and we support you with data subject requests.

Sub-processors: the complete list​

Art. 28(2) GDPR requires transparency about engaged sub-processors. Complete, with the legal basis for the transfer:

ServiceProvider & locationPurposePlace of processingBasis for transfer
ScalewayScaleway SAS, Paris (FR) [6]Application, database, documents, system emailsFrance, NetherlandsNo third-country transfer (EU)
CloudflareCloudflare, Inc., San Francisco (US) [8]Delivery (CDN), protection against attacksGlobal network, connection dataDPF + Standard Contractual Clauses
StripeStripe Payments Europe, Ltd., Dublin (IE) [9]Payment processing (your subscription)EEA, group headquartered in the USDPF + Standard Contractual Clauses
PostHogPostHog, Inc., San Francisco (US) [10]Anonymous usage statistics – only with consentEU cloud, Frankfurt am MainData hosted in the EU; DPF + SCC for support
Google WorkspaceGoogle Cloud EMEA Limited, Dublin (IE) [11]Support mailbox: emails to support@ and enquiries from the contact formGoogle data centres worldwide, including the EU and the USDPF + Standard Contractual Clauses
Mistral AIMistral AI, Paris (FR) [12]Text recognition on receipts without a text layer and on imported invoicesEU endpoint only: EU/EFTAEU provider; no transfer by us, SCCs in the DPA

Not a sub-processor: Google Maps Platform. For address suggestions and route calculation, DolmiDesk sends addresses to Google as soon as you use these functions – on your instructions. Google does not process them on our behalf but as an independent controller under the Google Controller-Controller Data Protection Terms; for data from the EEA and Switzerland, that is Google Ireland Limited. That's why Google Maps is not in the table of the list of sub-processors but under "Other Recipients". Details are in the privacy policy under "Address Suggestions and Route Calculation (Google Maps Platform)".

Important context: your client data – names, assignment locations, invoice contents – lives with Scaleway in the EU and leaves that infrastructure at two points, named in this same paragraph. Cloudflare sees connection data (in particular IP addresses), not the content of your assignments. Stripe sees your payment data, not that of your clients. PostHog collects no content data and is completely disabled without your consent. The first point is Mistral AI: when DolmiDesk cannot read an uploaded receipt on its own servers – a photo or a scan with no text layer – the file goes for text recognition to that French provider's European endpoint, inside the body of the request and without a file being stored there. Likewise, when you import your own invoices from an earlier program, every PDF file that contains no e-invoice whose items name the assignments goes there – with at most its first twelve pages. Everything shown on that receipt or invoice is therefore fully visible to the provider. The second is the Google Maps Platform: for address suggestions and route calculation, addresses such as assignment locations go to Google (see "Google's role"). There is one more point only if you switch it on yourself: if you show your orders in Google Calendar, they go into the calendar “DolmiDesk” in your own Google account (also under "Google's role"). Receipts with a text layer, e-invoices, in the invoice import XRechnungen and e-invoices whose items name the assignments, and all other data never leave our servers.

Google's role​

Apart from our support mailbox (Google Workspace, see the table), Google is only involved in two clearly defined places: the calendar – for the import including the files in Google Drive that are attached to imported appointments, and, if you switch it on, for showing your orders – and address suggestions and route calculation.

The calendar – read access for the import, a calendar of its own for showing your orders​

For the import, DolmiDesk requests read access only when you connect it [13]:

  • calendar.readonly and calendar.events.readonly, to read your calendars and the appointments in them;
  • drive.readonly, to fetch files attached to an imported appointment (such as an order confirmation) and store them on the order. Google grants this permission only for the whole Drive, but DolmiDesk uses it solely to fetch the attachments of imported appointments and reads no other files;
  • openid and email, so you can see which account is connected and DolmiDesk can tell whether a later permission comes from the same account.

With these permissions DolmiDesk can neither change nor delete your appointments or files.

DolmiDesk requests write access only if you switch on Aufträge in Google Kalender anzeigen (Show orders in Google Calendar) under Einstellungen → Konnektoren (Settings → Connectors) – and then separately and narrowly: calendar.app.created only allows DolmiDesk to create a calendar of its own and to write in calendars it created itself. DolmiDesk creates the calendar “DolmiDesk” in your Google account and keeps your orders up to date there; even with this permission it can neither change nor delete your other calendars, appointments or files. You choose what the appointment says: Vollständig (Complete: kind and occasion of the assignment, date and time, for on-site assignments the address and the means of transport, the labels of the clients and of the cost bearer, a link to the order) or Nur Zeit + Auftragsnummer (Time + order number only: no names, no occasion, no address). Prices, invoices, contact details, travel times and attachments never go to Google, and past orders are not transferred for the first time. When you switch it off, you can have the calendar “DolmiDesk” deleted with all its appointments. The details are in the privacy policy under "Showing Your Orders in Google Calendar".

Route calculation – with plaintext addresses​

For distance and travel time, DolmiDesk queries the Google Routes API [14]. In doing so, the start and destination address are transmitted to Google in plaintext; only the distance and duration are returned.

The same applies to the address suggestions while you type an address (Places API). Google does not process these addresses on our behalf but as an independent controller under the Google Controller-Controller Data Protection Terms, and under its privacy policy it may also use them for its own purposes, for example to improve its services.

If you use Google for calendar and email​

Because your calendar lives with Google, the classic Google question is relevant here – but only for your own Google account, not for DolmiDesk's data storage.

FeaturePrivate account (@gmail.com)Business account (Google Workspace)
CostFreePaid (starting at roughly €6/month)
Business modelData analysis & advertisingSoftware license fees
Data protectionGoogle may scan some dataNo ad scanning, data belongs to you [11]
Data processing agreementNot availableIncluded & GDPR-compliant
Suitable for § 203 StGB❌ NO✅ YES (under conditions)

Many data protection concerns stem from the use of private accounts, where Google grants itself broad rights to analyze data [15]. In the business context (Workspace), Google contractually guarantees that no data is scanned for advertising purposes [11].

Legal certainty: the US & third-country transfer​

For a long time, a major point of criticism was data transfer to the US (known through the CJEU's "Schrems II" ruling [16]). After the Privacy Shield agreement fell away, it was unclear whether US providers could offer sufficient data protection guarantees.

For DolmiDesk, this question is considerably defused: your content data lives with Scaleway in France and the Netherlands – no third-country transfer takes place here at all [6]. The question only remains relevant for the peripheral areas: delivery (Cloudflare), payment (Stripe), text recognition on receipts without a text layer and on imported invoices (Mistral AI – a French provider, though some of its own sub-processors sit outside the EU), and – if you use them – calendar and routes (Google).

Current status (Data Privacy Framework)​

Since July 10, 2023, the European Commission's adequacy decision has applied to the EU-US Data Privacy Framework (DPF).

  • This means: the US is no longer considered an unsafe third country under data protection law, provided the US company is certified [17].
  • Google LLC is certified under this framework and appears on the official list maintained by the US Department of Commerce; as of the writing of this article (2025), the certification is valid until September 13, 2026 [18].

In addition, we also base the relevant processing activities on Standard Contractual Clauses under Art. 46(2)(c) GDPR – a second legal basis, independent of the adequacy decision. Should the DPF decision fall, as happened to Privacy Shield, the legal basis wouldn't collapse without a fallback.

Your obligation: the data processing agreement with us​

To satisfy Art. 28 GDPR, you need a data processing agreement (Auftragsverarbeitungsvertrag) with us [1]. You'll find it in the app under Einstellungen → Datenschutz (Settings → Privacy), together with the TOM document and the list of sub-processors.

If you additionally use Google Workspace for your calendar, you'll also need the data processing agreement with Google – that's a separate contract, independent of ours.

How? In the Google Admin console under Account > Account settings > Legal and compliance. There you need to agree to the "Cloud Data Processing Addendum (CDPA)".

Google Admin console: location of the data processing agreement
Google Admin console: location of the data processing agreement

Shared responsibility: who protects what?​

Even with a hosted application, a shared responsibility model applies – only the split shifts:

  • You are responsible for:

    • the content you enter (data minimization, no unnecessary diagnoses)
    • selecting and binding your service providers (see § 203 StGB below)
    • your access credentials: strong login, two-factor authentication or passkeys
    • who has a user account within your account
    • concluding the data processing agreement

  • DolmiDesk is responsible for:

    • operating, maintaining the availability, and securing the application
    • encryption, tenant separation, and key management
    • selecting and monitoring the sub-processors
    • complying with the data processing agreement and supporting data subject requests
    • notifying you of data breaches (Art. 33(2) GDPR)

This model means: as long as you don't record unnecessary sensitive details and secure your access, the technical protection sits with us – the content-level protection sits with you.

§ 203 StGB: are we even allowed to see your data?​

This is the decisive question. When you use a hosted application, a third party is involved – there's no way around that. The good news: this exact situation is expressly regulated in the Criminal Code.

Until 2017, involving external IT service providers was legally tricky for professionals bound by confidentiality. With the Act on the New Regulation of the Protection of Secrets in Connection with the Involvement of Third Parties in the Professional Activities of Persons Bound by Confidentiality, §§ 203(3) and (4) StGB were introduced [19].

Since then, the following applies [3]:

  • § 203(3) sentence 2 StGB: Disclosure to "other participating persons" is not an unauthorized disclosure, provided it's necessary for making use of these persons' services. IT service providers are explicitly covered.
  • § 203(4) StGB: For this, you must carefully select the participating person and bind them to confidentiality. If you fail to do so, you make yourself criminally liable – not the service provider.

What we provide for this​

  • A commitment to professional confidentiality (Verpflichtung auf das Berufsgeheimnis) under § 203(4) StGB, covering everyone who could potentially have access on our side.
  • The TOM document, as evidence for your selection decision.
  • The list of sub-processors (Liste der Unterauftragsverarbeiter), so you know who else is involved – because sub-processors, too, must be bound accordingly under § 203(4) sentence 2 StGB.

You'll find all three in the app under Einstellungen → Datenschutz (Settings → Privacy).

The Google Maps Platform is not covered. Google receives addresses not as a sub-processor but as an independent controller (see "Google's role"), and is not bound to confidentiality under § 203 StGB, neither by us nor by these documents. If an assignment location itself can be a third party's secret – for instance, the private address of the person you interpret for, together with the appointment –, read the "Please read carefully" note in the section "Route calculation – with plaintext addresses" before you enter it: it says when an address goes to Google and how far you can avoid that.

Professional confidentiality, GDPR & sending invoices by email​

This is where it gets specific for interpreters. You often process data under Art. 9 GDPR (health data, e.g. "interpreting during an oncology consultation"). But here, too, two worlds collide: strict confidentiality and the digital reality of the funding bodies (Kostenträger).

Am I allowed to send invoices by email?​

In principle, an unencrypted email is as open as a postcard. The law and professional codes of conduct prohibit sending sensitive data unencrypted. But: issuing an invoice is necessary to fulfil your assignment – and the funding bodies (Kostenträger, e.g. health insurers, courts) expect to receive an invoice by email.

In principle, an unencrypted email is considered insecure (the "postcard principle"). However, exceptions apply to invoicing, based on necessity.

You're allowed to transmit the data because there's no payment without transmission. The GDPR explicitly permits this:

  1. Performance of a contract (Art. 6(1)(b) GDPR [1]): issuing the invoice is an essential part of your contract with the funding body (Kostenträger). Without transmitting the invoice, the contract cannot be fully performed.
  2. Establishing legal claims (Art. 9(2)(f) GDPR [1]): even with sensitive health data, processing (and transmission) is permitted where it's "necessary for the establishment, exercise or defence of legal claims" (here: your claim to payment).
  3. Administration of the social security system (Art. 9(2)(h) GDPR [1]): if you bill health insurers or social welfare bodies, this falls under the administration of health services.

Accordingly, sending invoices by email is legally permissible, provided appropriate security measures under Art. 32 GDPR are taken.

Technical security (TLS vs. end-to-end)​

Germany's data protection supervisory authorities (DSK) ideally call for end-to-end encryption (PGP/S/MIME), but acknowledge that this is often missing in business correspondence [20].

Accordingly, transport encryption (TLS) is considered an acceptable minimum standard for normal correspondence, provided no highly sensitive medical details (e.g. detailed psychological reports) are transmitted in plaintext [21].

At DolmiDesk, sending happens via Scaleway's transactional email infrastructure in the EU [6] – not via your Gmail inbox. The transmission is TLS-secured; if the recipient authority (e.g. AOK, a court) also supports TLS – which is the norm today – the email is transmitted encrypted on its way across the internet [20].

So you remain responsible for content-level data minimization, and we remain responsible for the technical security of the sending infrastructure.

Why TLS is sufficient in many cases​

Art. 32 GDPR doesn't require perfect security measures, only appropriate ones. Appropriateness depends on the risk. For simple administrative data such as invoices, the risk is low if:

  • no diagnoses are included
  • the recipient authority supports TLS
  • you secure your DolmiDesk access with two-factor authentication or passkeys

That puts the protection level frequently above that of many conventional practice solutions, where invoices sit unencrypted on a laptop or smartphone.

Checklist for § 203 StGB & GDPR compliance​

With DolmiDesk:

  • I have concluded the data processing agreement under Art. 28 GDPR with DolmiDesk (Einstellungen → Datenschutz / Settings → Privacy).
  • I have concluded the commitment to professional confidentiality under § 203(4) StGB.
  • I have read the TOM document and the list of sub-processors and documented them as the basis for my selection decision.
  • I have secured my access with two-factor authentication or passkeys.
  • I have added DolmiDesk to my record of processing activities (Art. 30 GDPR).

For my calendar:

  • I use Google Workspace (Business) for professional appointments, not a private Gmail account.
  • I have digitally signed the data processing agreement (Cloud Data Processing Addendum) with Google.
  • My appointment titles contain no diagnoses – they carry over into the order and the invoice.
  • If I show my orders in Google Calendar, I choose Nur Zeit + Auftragsnummer (Time + order number only) as soon as names, cost bearer and occasion could together reveal health data.

Content-wise:

  • I avoid diagnoses or intimate details in the free-text fields of the invoice.
  • For particularly sensitive assignments, I create the order by hand and enter the distance and travel time myself instead of having them calculated (see "Route calculation – with plaintext addresses").

Conclusion​

Using DolmiDesk can be done in a data-protection-compliant way, but it requires discipline during setup.

The fact that a service provider is involved with a hosted application is not a special case, but the normal case provided for by law: §§ 203(3) and (4) StGB have expressly regulated this since 2017 [19]. What matters is that this service provider is bound contractually, technically, and under criminal law – and that your content data leaves our European infrastructure at two points, described above under Sub-processors: a receipt without a text layer and, in the invoice import, every PDF file without an e-invoice whose items name the assignments go for text recognition to Mistral AI's European endpoint, which processes in the EU and EFTA, and addresses for address suggestions and route calculation go to the Google Maps Platform – which is not bound under § 203 StGB (see "What we provide for this"). If you switch on showing your orders in Google Calendar, your orders also go into the calendar “DolmiDesk” in your own Google account. Everything else stays where it is.

In many practical scenarios, a professional cloud service — especially with MFA, TLS, backups, redundancy, and certified data centers — can offer a higher level of security than locally stored files on unencrypted devices [23].

Use DolmiDesk thoughtfully, stick to the checklist, and you can run your everyday work as an interpreter efficiently and in compliance with the law.

Disclaimer​

The content of this article was created with the greatest possible care and serves general information purposes only. It does not constitute legal advice and cannot replace individual advice from a lawyer.

Despite careful research, no guarantee is given for the accuracy, completeness, or currency of the information provided. Legal assessments can change, particularly in the area of data protection law and international data transfers.

The author accepts no liability for damages or losses arising directly or indirectly from the use of the information in this article.

Disclaimer for the use of DolmiDesk​

DolmiDesk is a hosted web application. For the content data that you process within it, you are, under data protection law, the controller (Verantwortlicher); in this respect we act as the processor (Auftragsverarbeiter) under Art. 28 GDPR. The scope, purpose, and limits of this processing follow from the data processing agreement; our technical and organizational measures are described in the TOM document. Where this article and those documents differ, the contractual documents take precedence.

Responsibility for the content of invoices, calendar entries, and emails, for data minimization, and for securing one's own access (e.g. two-factor authentication, passkeys, assignment of user accounts) lies with the users.

No liability is accepted for:

  • incorrect use or configuration,
  • data protection violations resulting from inadequately secured user access,
  • the content of processed or sent documents,
  • outages, changes, or restrictions of third-party services (e.g. Google Calendar).

Users are obliged to independently review and comply with the professional, contractual, and legal requirements applicable to them — in particular the GDPR, the BDSG, and § 203 StGB. This applies specifically to the careful selection and binding of participating persons under § 203(4) StGB.

Use of DolmiDesk is at your own responsibility.

​

  1. Europäisches Parlament und Rat, Verordnung (EU) 2016/679 (Datenschutz-Grundverordnung). 2016. [Online]. Available: https://eur-lex.europa.eu/eli/reg/2016/679/oj ⤴
  2. Bundesrepublik Deutschland, Bundesdatenschutzgesetz (BDSG). 2017. [Online]. Available: https://www.gesetze-im-internet.de/bdsg_2018/ ⤴
  3. Bundesrepublik Deutschland, Strafgesetzbuch (StGB) § 203 Verletzung von Privatgeheimnissen. [Online]. Available: https://www.gesetze-im-internet.de/stgb/__203.html ⤴
  4. B. Gribl, “Von Speicher zu Smart: Was Nutzer heute von der Cloud erwarten,” Cloudcomputing Insider, Oct. 2025, [Online]. Available: https://www.cloudcomputing-insider.de/datenspeicherung-in-deutschland-und-eu-a-61a8c732cda320422173c3c442a8a324/ ⤴
  5. P. Mell and T. Grance, “The NIST Definition of Cloud Computing,” Gaithersburg, MD, techreport Special Publication 800-145, 2011. ⤴
  6. Scaleway SAS, “Privacy Policy.” [Online]. Available: https://www.scaleway.com/en/privacy-policy/ ⤴
  7. European Data Protection Board, “Guidelines 07/2020 on the concepts of controller and processor in the GDPR.” 2021. [Online]. Available: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en ⤴
  8. Cloudflare, Inc., “Cloudflare Privacy Policy.” [Online]. Available: https://www.cloudflare.com/privacypolicy/ ⤴
  9. Stripe Payments Europe, Ltd., “Stripe Datenschutzerklärung.” [Online]. Available: https://stripe.com/de/privacy ⤴
  10. PostHog, Inc., “PostHog Privacy Policy.” [Online]. Available: https://posthog.com/privacy ⤴
  11. Google Cloud, “Google Workspace Trust & Privacy.” [Online]. Available: https://workspace.google.com/intl/de/security/ ⤴
  12. Mistral AI, “Privacy Policy.” [Online]. Available: https://legal.mistral.ai/terms/privacy-policy ⤴
  13. Google LLC, “Google Calendar API: Choose Auth Scopes.” [Online]. Available: https://developers.google.com/calendar/api/auth ⤴
  14. Google LLC, “Routes API Documentation.” [Online]. Available: https://developers.google.com/maps/documentation/routes ⤴
  15. I. Redaktion, “Was weiß Google über mich? Google-Daten einsehen und verwalten,” IONOS Digital Guide, Oct. 2022, [Online]. Available: https://www.ionos.de/digitalguide/online-marketing/suchmaschinenmarketing/was-weiss-google-ueber-mich/ ⤴
  16. Gerichtshof der Europäischen Union, “Urteil des Gerichtshofs (Große Kammer) vom 16. Juli 2020. Data Protection Commissioner gegen Facebook Ireland Limited, Maximillian Schrems.” July 16, 2020. [Online]. Available: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX:62018CJ0311 ⤴
  17. European Commission, “Adequacy decision for the EU-US Data Privacy Framework.” Brussels, July 2023. [Online]. Available: https://commission.europa.eu ⤴
  18. U.S. Department of Commerce, “Data Privacy Framework List: Google LLC.” [Online]. Available: https://www.dataprivacyframework.gov/list ⤴
  19. Bundesrepublik Deutschland, Gesetz zur Neuregelung des Schutzes von Geheimnissen bei der Mitwirkung Dritter an der Berufsausübung schweigepflichtiger Personen. 2017. [Online]. Available: https://www.gesetze-im-internet.de/stgb/__203.html ⤴
  20. Bundesamt für Sicherheit in der Informationstechnik, “TR-03108 Sicherer E-Mail-Transport,” BSI, Bonn, techreport, 2024. [Online]. Available: https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr03108/tr-03108.html ⤴
  21. Datenschutzkonferenz (DSK), “Orientierungshilfe der Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder vom 27. Mai 2021,” Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder, techreport, June 2021. [Online]. Available: https://www.datenschutzkonferenz-online.de/media/oh/20210616_orientierungshilfe_e_mail_verschluesselung.pdf ⤴
  22. “Maßnahmen zum Schutz personenbezogener Daten bei der Übermittlung per E-Mail,” Datenschutzkonferenz (DSK), Mar. 2020, [Online]. Available: https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/publikationen/DSK/orientierungshilfen/2020-DSK_OH-E-Mail-Verschluesselung.pdf ⤴
  23. K. K. The Investopedia Team, “Cloud Security: Definition, How Cloud Computing Works, and Safety,” Investopedia, Sept. 2022, [Online]. Available: https://www.investopedia.com/terms/c/cloud-security.asp ⤴
Portrait photo of Dmitry Dugarev

Best regards

Dmitry Dugarev

Developer of DolmiDesk & IT compliance expert. I originally built this system to save my wife (a DGS interpreter) her weekends. Today I make sure your invoicing runs securely and fully automatically.

On this page

Need help? - Write us an email