Dear Posteo users, 



Today our payment process has been superseded by our new, extended single-use code system for anonymised payments. Until now, our code-based payment system was used exclusively to separate payment data from the email accounts. From now on, the single-use codes also contain an encoded country determination, such that we can continue to maintain our concept of data economy despite new legal requirements.

On January 1st, the so-called “Kroatiengesetz” came into effect. This law is the German implementation of an EU regulation. It specifies that for electronic services, value added tax must be paid in the country in which the user lives. Previously, the service provider’s headquarters determined the tax location. From January 1st we are therefore required for each payment process to determine which country each payment comes to us from, using multiple measures. This can be done, for example, with the help of a Geo-IP determination or an evaluation of the payment information. The lawmakers require at least two attributes to be ascertained, which do not differ. Fulfilling these new legal requirements was a challenge for us as we don’t save any of your personal information and wish to continue not to do so.

We have therefore extended our anonymous payment process for the event of the new law coming into effect, in order to maintain our consistent concept of data economy. We are now required to conduct a legally-specified country determination. Its result is encoded in a part of our payment codes that only you receive, when you now start a payment process. This part of the code contains the result of a Geo-IP determination and a browser region determination (your IP address is not saved). The part of the code that is in our system is somewhat shorter and does not contain this sensitive information. The encoded part is “outsourced” to you until the payment is completed. This is important, because otherwise we would have personal data connected to your account in our system until completion of the payment, which is something we don’t want.

You provide us with the complete code, and thereby also the result of the country determination, in the purpose/description field of your payment. When a payment arrives at Posteo via bank transfer or in the post, our payment system automatically evaluates the code and can then allocate the payment to your account. The encoded country determination in the last three characters is also automatically evaluated, to determine the value added tax payable in the relevant EU country. The result is not connected with your account. The evaluation process only takes a fraction of a second. When the code is evaluated, credit is added to your account and the single-use code is deleted from the system. Thus it is no longer possible to tell which account you have transferred funds for. Nor is it possible to tell which country the user of an account lives in.

PayPal and credit card payments occur directly after starting a payment process. The use of a code system is therefore unnecessary here. Information on the country determination is also immediately evaluated and does not need to be temporarily saved. Neither the PayPal or credit card payment nor the country determination collected is connected with the email account.

We understand the lawmakers’ intention to block tax loopholes with the new law. It is, however, problematic that companies who want to operate with data reduction can become required to collect and save users’ personal information via this EU regulation. Providers generally do not have complicated code-based systems allowing data reduction available to them – plainly, they must then retrieve and save the information. This is how mounds of data pile up. In addition, a bank account is very secure against manipulation. We doubt whether additional measures such as geolocation would markedly increase reliability.

Further information on Posteo’s anonymous payment system can be found on the payment info page that we have set up.

Kind regards and all the best in the new year,

The Posteo team