Germany & Austria · Global delivery09:00–13:30 CETEUR
Engineering for German companies.
German companies do the diligence properly. The Article 28 processor agreement, the Standard Contractual Clauses, the transfer impact assessment and EU data residency are all standard here, and all already prepared. What we cannot do is deliver in German.
Working with Germany
Hours, money,
and paperwork.
The three things that decide whether a cross-border engagement works. Everything here is specific to Germany.
Time overlap
09:00–13:30 CET
CET is four and a half hours behind IST in winter and three and a half under CEST in summer. Our working day ends at your 13:30 in winter and 14:30 in summer, so the overlap covers your morning: four and a half hours, rising to five and a half in summer. Standups, reviews and stakeholder demos sit inside it. Your afternoon falls outside our day and is carried by written reporting.
Currency and tax
EUR
Quoted and invoiced in euros. No Indian tax is levied on services exported from India, so there is no foreign tax line to reconcile. We are a non-EU supplier to an EU business, so you account for VAT under the reverse charge, which is the standard treatment.
Data protection
- Governing law
- GDPR (EU 2016/679), with the BDSG in Germany and the DSG in Austria
- Authority
- The competent Landesdatenschutzbehörde in Germany, or the Datenschutzbehörde in Austria
- Our role
- Processor, on your instructions
Named sub-processors, written consent before any addition.
Engagements run under an Article 28 processor agreement (Auftragsverarbeitungsvertrag) naming every sub-processor, with your written consent required before another is added. Transfers to India are covered by the 2021 Standard Contractual Clauses with a transfer impact assessment supplied alongside. EU data residency is available and written into the agreement; for engagements where personal data must not leave the EEA, that constraint shapes the architecture from the first phase, including where build and test environments sit.
City by city
Local hours and
local rules.
The shared working window in local time, and any rule that applies in a city on top of the national ones.
Berlin
Berlin
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
Supervisory authority: the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
Munich
Bavaria
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
Private companies in Bavaria are supervised by the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) in Ansbach.
Hamburg
Hamburg
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
Supervisory authority: the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.
Frankfurt
Hesse
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
Supervisory authority: the Hessische Beauftragte für Datenschutz und Informationsfreiheit. Financial entities also manage ICT suppliers under the EU's Digital Operational Resilience Act (DORA), applicable since January 2025.
Vienna
Austria
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
Austria has a single national authority, the Datenschutzbehörde, and the Datenschutzgesetz (DSG) supplements the GDPR.
Cologne
North Rhine-Westphalia
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
Private companies in North Rhine-Westphalia are supervised by the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.
Düsseldorf
North Rhine-Westphalia
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
Supervised by the same North Rhine-Westphalia authority as Cologne.
Stuttgart
Baden-Württemberg
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
Supervisory authority: the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
Graz
Austria
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
National rules apply, with no city-specific additions.
Linz
Austria
09:00–13:30 CET, 09:00–14:30 CEST
CET, CEST in summer
National rules apply, with no city-specific additions.
What your procurement will ask
Answered
before you ask.
The questions procurement teams in Germany typically ask, with our answers. Where we do not hold something, the answer says so.
Auftragsverarbeitungsvertrag (Article 28 DPA)
Prepared and available before the first technical call. It includes the sub-processor list, technical and organisational measures, and audit rights.
Standard Contractual Clauses and TIA
The 2021 SCCs with the relevant modules, plus a transfer impact assessment addressing Indian legal access. The two are supplied together.
Technical and organisational measures (TOMs)
Documented once against the ISO 27001:2022 control set and used for every buyer, so the answers are consistent, auditable and externally verified.
German-language delivery
We do not offer it. Engineering, documentation and reporting are in English. German-language interfaces are built properly as a localisation architecture, but German copy is authored by a specialist named in the engagement.
Certificate numbers, accreditation status and the verification route are published on our trust page. Check them without asking us.
Work we take on in Germany
Common problems
we build for.
Common work for teams in Germany. If one of these is yours, send us a brief.
Industrial and manufacturing data
Plant-floor and machine data that exists but is unusable. The work covers production visibility, quality records and the integration layer between systems that were never meant to talk.
Mittelstand platform modernisation
A business-critical system, a decade or more old, that cannot be switched off. The work is incremental extraction behind stable interfaces while it keeps running.
GDPR-first product engineering
Products where data minimisation, retention and consent are designed into the architecture from the start.
Why we suit teams in Germany
- The Article 28 DPA, SCCs, transfer impact assessment and TOMs exist as documents before you ask, all anchored to an externally audited ISO 27001 control set.
- EU data residency treated as an architectural constraint from the first phase, including build and test environments.
- Four and a half hours of overlap across your whole morning, rising to five and a half in summer.
We do not deliver in German. All engineering, documentation and reporting is in English, and if your stakeholders need German-language delivery we are the wrong supplier. We have no EU entity, so India is the default governing jurisdiction unless we agree otherwise. This page covers Germany and Austria only. Switzerland sits outside the EU and EEA, falls under the revised FADP and uses CHF, so we contract there separately.
Germany & Austria · Questions
Asked from
Germany.
General questions about pricing, process, IP and security are answered on the FAQ page.
- Do you provide a GDPR Article 28 processor agreement?
- Yes, our Article 28 processor agreement is prepared in advance and available before the first technical call. The Auftragsverarbeitungsvertrag names every sub-processor, sets out the technical and organisational measures, grants audit rights, and requires your written consent before a sub-processor is added. Transfers to India are covered by the 2021 Standard Contractual Clauses, supplied together with a transfer impact assessment.
- Can all our data stay inside the EU?
- Yes, all your data can stay inside the EU, and we treat that as an architectural constraint from the first phase. It covers build and test environments as well as production. EU regions are supported by both major cloud providers and residency is written into the agreement.
- Do you work in German?
- No, we deliver in English only. Every meeting, every written report, every decision record and every code comment is in English, so a stakeholder who is only comfortable in German cannot participate directly. What we do build is the localisation architecture underneath German-language interfaces: externalised strings, correct declension handling in dynamic copy, DIN date and decimal formatting, and layouts that hold up with long German compound words. Authorship comes from a specialist named in the engagement. If your steering group needs German-language delivery, we are the wrong supplier.
Other markets
Where else
we work.
Working hours, currency and data protection, covered for every market we serve.
Working with Germany.
Contracted in EUR, governed by GDPR (EU 2016/679), with the BDSG in Germany and the DSG in Austria, delivered inside the 09:00–13:30 CET overlap window.
Cognimit Technologies LLP · Monday to Friday, 10:00–18:00 IST · IST (UTC+5:30)