The end of the year is time to tidy up: stock room, filing cabinet, desk. The website form inbox belongs on that list, because two obligations meet there. One requires business letters to be kept for six years. The other requires personal data not to be stored for longer than its purpose demands. For the turn of the year 2026/2027 this means: commercial and business letters received or sent in 2020 may usually be destroyed from 1 January 2027, unless the period has been suspended. And enquiries that did not turn into business usually have no place in the files any more. This article shows how to tell the two apart, where the copies of an enquiry actually sit, and what a year-end routine looks like that you can plan as a fixed date in December. It is not tax advice; it sorts the rules so that you can ask your tax adviser the right questions.
Why 31 December decides about enquiries
Retention periods for business records do not run from the day a letter arrives but from the end of the year.
Under Section 257(5) of the German Commercial Code (HGB) the period begins at the end of the calendar year in which the commercial letter was received or sent; Section 147(4) of the Fiscal Code (AO) says the same for tax law. The duration is set out one subsection earlier: commercial letters received and copies of those sent must be kept for six years (Section 257(4) HGB), accounting vouchers such as invoices for eight years, and books, inventories and annual financial statements for ten years; the Fiscal Code gives the same figures (Section 147(3) AO). This leads to simple arithmetic: a business letter from March 2020 and one from December 2020 share the same starting point, the end of 2020. At the end of 31 December 2026 the period ends for both, and the entire batch usually becomes free from 1 January 2027. This bundling is why tidying up at year end pays off: one fixed date is enough to review a complete batch instead of recalculating every case individually.
The word “usually” is not a courtesy. Section 147(3), sentence 5 AO stops the clock: the retention period does not expire as long as the records are relevant for taxes whose assessment period has not yet expired. That assessment period is usually four years (Section 169(2) AO). Where a tax return has to be filed, it begins only at the end of the year in which the return is submitted, and at the latest at the end of the third year after the tax arose (Section 170(2) AO). An example: if the return for 2020 was not filed until 2023, the assessment period runs until the end of 2027. Records from 2020 that matter for this tax then stay in the files for another year. Whether that applies to your business is something your tax adviser, who knows the returns and assessment notices, can tell you.
The sentence that is not quite right
Two obligations pulling in opposite directions
On the other side stands the General Data Protection Regulation.
Personal data must be kept in a form that permits identification of the people concerned for no longer than is necessary for the purposes for which the data are processed (Article 5(1)(e) GDPR). That is the principle of storage limitation. Article 17(1)(a) GDPR turns it into an obligation to erase as soon as the data are no longer necessary for their purpose. A contact enquiry has usually served its purpose once it has been answered and no business follows. The fact that the mailbox still has room does not make it a case for the files.
Where both rules concern the same enquiry, the retention obligation prevails, but only as far as it reaches. Article 17(3)(b) GDPR lifts the obligation to erase to the extent that processing is necessary for compliance with a legal obligation under the law of a Member State. Section 257 HGB and Section 147 AO are such obligations. Two things follow: whatever has to be kept as a business letter stays until the period ends, even if the person who sent it asks for erasure. And whatever carries no retention duty falls under storage limitation and is deleted as soon as it is no longer needed. “Keep everything, just in case” looks like diligence, but it is exactly what the Regulation sets out to avoid.
How the Regulation imagines this in practice is set out in its recitals: to ensure that personal data are not kept longer than necessary, the controller should establish time limits for erasure or for a periodic review (Recital 39 GDPR). A fixed review at year end is exactly such a periodic review. Recording it with date and outcome also provides evidence for the accountability duty in Article 5(2) GDPR, under which the controller must be able to demonstrate compliance with the principles. Under Article 30(1)(f) GDPR, the record of processing activities should contain, where possible, the envisaged time limits for erasure of the different categories of data. For website enquiries that means at least two lines: enquiries with an order and enquiries without one.
When an enquiry becomes a business letter
The Commercial Code requires every merchant to keep the commercial letters received and copies of those sent in an orderly manner (Section 257(1) HGB, items 2 and 3).
Subsection 2 defines the term narrowly: commercial letters are only documents that concern a commercial transaction. The word “only” is the most important limit for website enquiries. A message asking about opening hours, offering advertising or simply sent to the wrong address does not concern a commercial transaction of the business. An enquiry followed by a quote and an order, on the other hand, is part of that transaction’s correspondence. It is often the first letter in the file, because it states what the customer wanted.
The Commercial Code applies only to merchants. A merchant within the meaning of the Code is anyone who carries on a commercial business (Section 1(1) HGB). There is no commercial business if, by its nature or size, the enterprise does not require a commercially organised business operation (Section 1(2) HGB). Small trades of this kind therefore usually do not fall under Section 257 HGB, and neither do freelancers in the liberal professions who do not run a trade. A GmbH is different: it is deemed a commercial company (Section 13(3) GmbHG), and the provisions on merchants also apply to commercial companies (Section 6(1) HGB), regardless of size.
Falling outside the Commercial Code does not automatically mean being off the hook. Section 147 AO requires commercial or business letters received and sent to be kept for tax purposes, and according to the principles issued by the Federal Ministry of Finance, tax record-keeping duties arise not only from commercial law but also from individual tax acts such as Section 22 of the VAT Act or Section 4(3), sentence 5 of the Income Tax Act (GoBD, margin number 4). For everyday practice the tax authorities’ view of e-mails helps, because in most businesses a form enquiry arrives as an e-mail. The GoBD look at content and function rather than the label: e-mails that function as a commercial or business letter or as an accounting voucher must be kept in electronic form (GoBD, margin number 121). An e-mail that serves only as a “means of transport” and contains nothing else that has to be kept is not subject to retention. For a website enquiry, then, what counts is not the route by which it arrived but the role it plays in a transaction.
Scroll table sideways
| How the enquiry developed | Usual classification | Period | At year end |
|---|---|---|---|
| Question answered, no quote, no order | not a business letter, purpose served | no retention duty | delete, including in the mailbox |
| Quote sent, no order | not clearly regulated | agree a line with your tax adviser | handle according to that line |
| Enquiry leads to an order | part of the transaction’s correspondence | six years from the end of the year of receipt | file in the order folder |
| Invoice for the order | accounting voucher | eight years from the end of the year | kept in accounting, not in the form inbox |
| Job application via the contact form | separate process | own periods depending on the procedure | move into the recruiting process |
| Advertising, misdirected mail, spam | not a business letter | none | delete straight away |
The second row is the only one that calls for a decision. A quote that has been sent concerns a possible transaction; whether it counts as a business letter even without an order is not answered explicitly by the statutory text. Two lines are defensible: keeping such quotes as a precaution, or deleting them after a fixed grace period. What matters is that the business picks one line, applies it consistently and records it in its deletion policy. According to the GoBD, you certainly do not need to keep mere drafts of commercial or business letters that were not actually sent (GoBD, margin number 5). The half-finished quote in the drafts folder therefore does not belong in the six-year archive.
Three questions for your tax adviser
What XICflow deletes on its own and what it does not
If your website runs on XICflow, incoming requests appear in the “Requests” area with the statuses “New”, “Read” and “Archived”.
Retention there is deliberately short: by default, requests are kept for 180 days and are then deleted automatically and for good, the archived ones as well (XICflow documentation). The list shows the 500 most recent submissions; older ones are available through the CSV export, which covers up to 5,000 entries, starts with the most recent and includes archived entries (XICflow documentation). In the file, the status appears as “new”, “read” or “archived”, and the date as year-month-day with the time. How requests reach the dashboard and are managed per website is described in the documentation on requests and team.
This default is the data protection side of the equation. Article 25(2) GDPR requires default settings that process only what is necessary and explicitly includes the period of storage. On the retention side, it creates a task that is easily overlooked: 180 days are far shorter than the commercial and tax retention period for business letters. An enquiry from May is no longer in the list at the end of November, even if it turned into an order. Anyone who collects the year’s orders only in December will no longer find any enquiry there that arrived before June. The archive copy is therefore ideally made when the order comes in, and at the latest once a quarter by export. According to the documentation, anything you want to keep longer should be saved in good time using the CSV export (XICflow documentation).
The automatic deletion affects only the list in XICflow. As soon as notifications are switched on, a second collection builds up in the mailbox: so that you do not have to check regularly, XICflow forwards every new request by e-mail (XICflow documentation). The notification contains name, e-mail, phone, message and all custom fields. If no separate notification address is set, it goes to the e-mail address in the website’s company details. These e-mails remain until someone deletes them. The same applies to replies in the sent folder and to copies passed on to industry software via webhook; how that works securely is explained in the article Forwarding enquiries automatically to your industry software. The year-end routine therefore starts where the copies are, not just where the original arrived.
List in XICflow
Statuses New, Read and Archived. Deleted automatically 180 days after arrival by default, archived entries included.
Notification e-mail
One e-mail per request with all fields. It stays in the mailbox until deleted, including in distribution lists and colleagues’ inboxes.
Sent folder
Replies often quote the enquiry in full. For orders they are copies of business letters sent; otherwise they are copies without a purpose.
CSV files
Every export contains all stored requests, not only those with an order. Old exports on the desktop undermine the deletion.
Forwarded copies
Requests transferred via webhook sit in the receiving software and follow its deletion rules, not those of the website.
Account export
“Export my data” contains the requests of all websites in the account. Whoever downloads it is managing one more copy.
The year-end routine in seven steps
- Reconcile the year’s orders. Check that every enquiry that turned into an order in 2026 is in the order file. Retrieve anything missing from the mailbox or, as long as the 180 days are not over, from a current CSV export.
- Export and narrow down. Download the CSV export, transfer the rows for orders into your files and then delete the export. A complete export that sits on a computer for years is a collection without a purpose.
- Decide on the original. Determine which version counts as the business letter and put it in an archive folder that is not emptied automatically.
- Clean up the mailbox. Delete notifications and replies for enquiries without an order whose purpose has been served, including the sent folder, the deleted items and copies in distribution lists.
- Review the 2020 batch. Check with your tax adviser whether assessment periods for 2020 are still open. If not, the business letters of that year are usually destroyed from 1 January 2027.
- Include forwarded copies. Check industry software, account exports and working folders for enquiries without an order.
- Record the result. Note the date, scope and responsible person, and update the deletion periods in the record of processing activities if anything has changed.
The order matters: first secure what has to stay, then delete what may go. Doing it the other way round can, in the worst case, lose exactly the enquiry that belongs to an order. The second half of December, when the year is almost over, is a good date, and one named person is responsible. One detail from the permission settings belongs here: in XICflow every team member may view and export requests, including the “Viewer” role; changing the status or deleting is reserved for “Editor” and above (XICflow documentation). That is practical for daily work, but it means exports can be created in several places. Decide where exports are stored and include that location in the routine. For the annual plan, a template like the one below is enough; agree it once with your tax adviser and reuse it every year.
Category Period Location Owner
Enquiry without order purpose served: delete mailbox, XICflow [name]
Quote without order [line agreed with tax adviser] mailbox, quotes [name]
Enquiry with order 6 years from end of year received order file [name]
Invoice for the order 8 years from end of voucher year accounting [name]
CSV exports delete after transfer [storage location] [name]
Review date: annually, second half of December
Export of orders: when the order comes in, at the latest quarterly
Evidence: date, scope, personThe archive copy in the right format
Once an enquiry becomes a business letter, the rules on orderly record keeping apply to how it is kept.
Electronic storage is permitted if the reproduction matches the letter received visually and remains available at any time during the period, can be made readable without delay and can be evaluated by machine (Section 147(2) AO). The GoBD are more explicit: records subject to retention that arrived electronically must also be kept in that form and must not be deleted before the retention period expires (GoBD, margin number 119). A printout alone is then not enough, and neither is a conversion in which information is lost.
For website enquiries this suggests a practical division of labour. If the case is handled via the notification e-mail, that e-mail is the document the business actually worked with; it is therefore a natural candidate for the original and stays in its original format in the archive folder of the order file. The row from the CSV export serves as a searchable index: date, status, name and message in a table that can be sorted by year. When a batch becomes free can then be read from a single column. Decide once which version counts as the original in your business and record it in your process documentation. Backing up the archive folder belongs in the same plan as backing up the website, described in the article Website backup and restore: a plan for when things go wrong.
Erasure requests and access during the year
Not everything waits until December. If someone asks for their enquiry to be deleted, first check whether a retention duty applies.
Without an order that is usually not the case; in XICflow “Delete” on the entry is then enough, and the record is removed completely (XICflow documentation). Delete the notification e-mail and the replies in the mailbox at the same time, or the copy that lives longest will remain. If the enquiry led to an order, the business letter stays until the period ends; tell the person why and until when. How to answer a request for access to stored data completely and on time is covered in the article Responding to a GDPR subject access request. Job applications that come in through the same form move into the recruiting process and follow its own periods, explained in the article Online job applications: fields, deadlines, deletion. Seasonal group enquiries, such as for Christmas parties at a restaurant, on the other hand, often turn into orders within a short time. The same question applies to them as to any other enquiry: did it turn into business?
A calendar for the coming year
The result is a small calendar that spreads the work over the year. When an order comes in, the enquiry goes into the order file, and once a quarter there is an export so that nothing is lost at the 180-day limit.
In the second half of December the seven-step routine runs, and at the beginning of January the batch whose period ended on 31 December is destroyed: in 2027 that is usually the 2020 batch, a year later the 2021 batch. For websites run with XICflow, part of this is already built in: the list tidies itself up after 180 days, the CSV export delivers the table from which you take the order rows, and the privacy policy that XICflow generates for every website contains the note on processing form data. Which period applies to your own business’s orders remains a decision you make with your tax adviser. How requests arrive in the dashboard is shown in the overview of services, the path from briefing to finished website is described under how it works, and if you want to review your website forms more fundamentally, the article Contact forms: turning visitors into leads covers everything from field selection to response time.
What counts on 1 January