Privacy Policy

1. Controller

The controller responsible for the processing of personal data in connection with this website is:

Klose Grüneberg Maric Steuerberater Partnerschaft mbB
Auguste-Viktoria-Straße 55 A
14199 Berlin

Telephone: 030 89 59 14 0
Email: info@kgm-steuer.de
Website: www.kgm-steuer.de

Represented by:

Dipl.-Kfm. Matthias Klose
Dipl.-Finanzwirtin (FH) Beate Grüneberg
Vinzenz Maric

If you have any questions about data protection or wish to exercise your data protection rights, you can contact us using the contact details provided above.

2. General information on data processing

We process personal data only insofar as this is necessary for the operation and security of this website, the handling of enquiries, the initiation or performance of contractual and client relationships, the conduct of application procedures, or the fulfilment of legal obligations.

Personal data means any information relating to an identified or identifiable natural person.

The processing of personal data is carried out in particular on the basis of Art. 6 para. 1 GDPR. Depending on the processing operation, the applicable legal basis may in particular be the performance of pre-contractual measures or a contract, compliance with a legal obligation, our legitimate interests, or consent granted by you.

According to the current technical configuration, we do not use any services for personalised advertising, retargeting, social-media tracking pixels, or external analytics or audience measurement services such as Google Analytics on this website.

3. Hosting and server log data

This website is hosted by the following service provider:

STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany

STRATO provides the technical infrastructure for operating the website. Insofar as STRATO processes personal data on our behalf, this takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR. STRATO provides an appropriate data processing agreement for this purpose.

When you access our website, your browser transmits technically necessary information to the web server. This may include, in particular, the IP address of your device, the date and time of access, the page or file accessed, the amount of data transferred, HTTP status codes, the previously visited page or referrer URL, as well as information about the browser, operating system and device.

The processing is carried out in order to provide the website technically, to enable the correct delivery of content, to identify technical errors, to ensure the security and stability of our systems, and to detect and defend against attacks or abusive access.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure, stable and functional operation of our website.

STRATO states that it stores the IP addresses of website visitors for a maximum of seven days in order to detect and defend against attacks. In addition, STRATO provides web server log files for the previous six weeks; according to STRATO, the host names or IP addresses contained therein are anonymised.

We do not combine these server log data with advertising profiles.

4. Technically necessary cookies

Our website uses only cookies that are technically or functionally necessary. They are not used for advertising or for creating user profiles.

4.1 Session cookie

The website uses a session cookie called kgm_session.

As a rule, this cookie contains only a randomly generated session identifier. The actual session information is stored on the server. The session is used in particular to provide the language version selected during a session. The server-side session also records whether the initial loading screen has already been displayed so that it does not appear unnecessarily again during subsequent page views within the same session.

No browser storage such as sessionStorage or localStorage is used for the loading screen.

As a rule, the cookie is deleted when the browser session ends. It is used with the HttpOnly attribute, with SameSite=Strict and, when an encrypted HTTPS connection is used, additionally with the Secure attribute.

Insofar as § 25 TDDDG applies to this storage, it is carried out as technically necessary storage within the meaning of § 25 para. 2 no. 2 TDDDG. This provision permits storage without separate consent where it is strictly necessary to provide a digital service expressly requested by the user.

4.2 No analytics or advertising cookies

The website does not use cookies or comparable technologies for personalised advertising, retargeting or personal audience measurement.

The external map services described in section 9 are likewise not loaded automatically, but only after your express selection and activation.

5. Contact form via DATEV SmartExperts

For the contact form embedded on our website, we use DATEV SmartExperts, a service provided by DATEV eG, Paumgartnerstraße 6–14, 90429 Nuremberg, Germany.

As soon as you open our contact form page – before you enter any information into the form or submit it – your browser automatically loads the DATEV SmartExperts component and establishes connections to DATEV or SmartExperts servers. In particular, your IP address is transmitted. Other technically necessary connection data, such as the date and time of the request, referrer information, and details of your browser, operating system and language, may also be processed.

The legal basis for this technical integration is Article 6(1)(f) GDPR. Our legitimate interest is to provide a functional and secure contact form.

DATEV eG acts as a processor on our behalf pursuant to Article 28 GDPR in connection with the provision of the contact form.

If you contact us via the embedded DATEV SmartExperts contact form, the data you enter there – in particular your message, email address and name as well as any additional information requested in the form – are processed by DATEV SmartExperts and transmitted via a TLS-encrypted API interface for handling your enquiry.

Which mandatory or additional fields are displayed depends on the configuration of the SmartExperts contact form. The information you provide is used to receive and process your enquiry and, where applicable, to initiate a client relationship.

Insofar as your enquiry relates to the initiation or performance of a client or other contractual relationship, our processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR. For other enquiries, it is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the proper handling and response to communications addressed to us.

DATEV provides its own information on the processing carried out within SmartExperts at www.smartexperts.de/data-protection.

6. Contact by email or telephone

If you contact us by email, we process in particular your email address, your name where applicable, the content of your message and the information generated in the course of further correspondence.

If you contact us by telephone, your name, telephone number, the time and subject matter of the call, and any necessary notes on the conversation may in particular be processed.

The processing is carried out in order to handle your enquiry. Insofar as the communication serves to initiate or perform a client or contractual relationship, Art. 6 para. 1 lit. b GDPR is the legal basis. Otherwise, the processing is carried out on the basis of our legitimate interest in handling enquiries addressed to us pursuant to Art. 6 para. 1 lit. f GDPR.

The data are deleted once the communication has been concluded and there are no statutory, professional, contractual or other legitimate reasons for further retention.

If a client relationship is established, additional statutory and professional requirements may apply to further processing and retention.

7. Applications

We provide information about vacancies on our website. Applications may in particular be submitted to our firm by email or post.

As part of an application, we process the data you provide to us. This may include, in particular, your name and contact details, cover letter, curriculum vitae, certificates, information on qualifications and professional experience, as well as further communication during the application procedure.

We process your application data to conduct the application procedure and to decide whether to establish an employment relationship on the basis of Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract).

If an employment relationship is established, the application data required for this purpose may be transferred to the personnel records and further processed for the purpose of carrying out the employment relationship.

If no employment relationship is established, the application documents are deleted as soon as they are no longer required for the application procedure and there are no statutory retention or evidentiary obligations, or legitimate interests in legal defence, that prevent deletion.

When submitting an application, please provide only such personal data as are necessary for the application procedure.

8. External links

Our website contains links to external websites and services.

As a rule, a connection to the respective external provider is established only when you access the relevant link. From that point onwards, further data processing takes place under the responsibility of the respective provider.

We have no influence over the nature and scope of the processing of personal data on third-party websites. Please refer to the data protection information provided there.

9. Maps and route planning

In the contact section of our website, we offer the “Map and Route” function.

OpenStreetMap and Google Maps are available for displaying a map.

For data protection reasons, neither of the two map services is loaded automatically when the website is accessed or when the contact modal is opened.

The respective connection is established only after you have expressly selected and activated a map service.

Without your activation, no data are transmitted to Google Maps or OpenStreetMap via the map function.

Activation is voluntary. The address, telephone number and email address of our firm can also be used without using an external map service.

The legal basis for the processing of personal data triggered by the activation is your consent pursuant to Art. 6 para. 1 lit. a GDPR. Insofar as the respective provider stores information on your device or accesses information already stored there, this is additionally carried out – where required – on the basis of your consent pursuant to § 25 para. 1 TDDDG.

9.1 OpenStreetMap

If you select OpenStreetMap, a map is loaded using services provided by:

OpenStreetMap Foundation
St John’s Innovation Centre
Cowley Road
Cambridge CB4 0WS
United Kingdom

The map tiles used by our website are retrieved directly via tile.openstreetmap.org. This service forms part of the standard tile service operated by the OpenStreetMap Foundation.

Upon activation, your browser establishes a direct connection to services of the OpenStreetMap Foundation. In particular, your IP address, the date and time of the request, requested map content, as well as browser, device, referrer and technical connection information may be processed.

The OpenStreetMap Foundation states that it operates its services as an independent controller and is not a processor acting on behalf of a website operator. According to the Foundation, the API servers and databases are currently located, among other places, in the United Kingdom, Ireland and the Netherlands. Map tiles are delivered via Fastly’s content delivery network; the cache server used in each case depends on network routing.

We have no influence over further processing by the OpenStreetMap Foundation.

Further information can be found in the OpenStreetMap Foundation’s Privacy Policy.

9.2 Google Maps

If you select Google Maps, map content is loaded from Google.

For users in the European Economic Area, the following company in particular is the relevant contact:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Maps is loaded on our website only after your express activation.

After activation, your browser establishes a direct connection to Google. In particular, your IP address, browser and device information, the date and time of the request, referrer information, as well as information about the use of the map service may be processed.

Depending on the device used, the settings and the Google functions you use, Google may also process location information. Google states that this may include the IP address and – where the relevant permission has been granted and the device is configured accordingly – GPS and other sensor data. Google may also use cookies and comparable technologies.

Technically, Google Maps may be provided, for example, via embedded map content or an iframe. Google expressly describes the Maps Embed API as a means of embedding interactive Google Maps content in websites.

Google operates servers worldwide. Personal data may therefore also be processed outside the European Economic Area, in particular in the USA. Google states that it uses, among other mechanisms, the EU-U.S. Data Privacy Framework and, where required, Standard Contractual Clauses for corresponding data transfers. Google LLC is currently registered as an active participant in the EU-U.S. Data Privacy Framework.

We do not have full control over the nature, scope, duration and further purposes of processing by Google.

Further information can be found in Google’s Privacy Policy.

9.3 External route planning

The “Open route in …” function may redirect you to an external map service or its route-planning function.

The external service is accessed only when you activate this external link or the corresponding button. From that point onwards, further processing of personal data is governed by the data protection provisions of the respective provider.

In particular, when using location or navigation functions, the respective provider may process additional location information if you allow this on your device or within the respective service.

10. Recipients of personal data

Personal data are disclosed only insofar as this is necessary for one of the purposes described in this Privacy Policy or there is a legal basis for doing so.

Recipients or categories of recipients may include: our hosting and IT service provider STRATO; DATEV eG, Paumgartnerstraße 6–14, 90429 Nuremberg, Germany, acting as a processor pursuant to Article 28 GDPR in connection with the provision and use of the embedded DATEV SmartExperts contact form; communication and email service providers engaged by us; authorised employees of our firm; authorities and public bodies where a legal obligation exists; and – exclusively after your activation – OpenStreetMap or Google in connection with the map function.

In the case of applications, access to the application documents is granted only to those persons involved in the application procedure.

We do not disclose personal data for advertising purposes.

11. Transfers to third countries

Insofar as we use services in connection with which personal data may be processed outside the European Union or the European Economic Area, we ensure that the data protection requirements for such a transfer are observed.

In the case of Google, data may in particular be processed in the USA. Google states that it uses, among other mechanisms, the EU-U.S. Data Privacy Framework and Standard Contractual Clauses as transfer mechanisms.

In the case of OpenStreetMap, according to the OpenStreetMap Foundation, processing takes place, among other locations, via servers in the United Kingdom, Ireland and the Netherlands; the map tiles are additionally delivered via Fastly’s global CDN.

12. Retention period

As a rule, we store personal data only for as long as is necessary for the respective processing purpose.

Server and security data are deleted or anonymised as soon as they are no longer required for secure technical operation, unless statutory obligations or specific security incidents require longer retention.

According to information provided by STRATO, IP addresses generated in connection with hosting are retained for a maximum of seven days for the purpose of detecting and defending against attacks. The web server log files subsequently made available contain anonymised host names or IP addresses and are available for up to six weeks.

Contact enquiries are deleted once the communication has been concluded and there are no statutory, contractual, professional or legitimate reasons for further retention.

If a client, contractual or employment relationship is established, the relevant data may be retained for longer due to statutory retention and documentation obligations.

Application data relating to unsuccessful applicants are deleted as soon as the application procedure has been concluded and there are no longer any statutory retention, evidentiary or legal-defence reasons for further retention.

13. Rights of data subjects

Where the statutory requirements are met, you have, in particular, the right to obtain information about the personal data processed concerning you, to have inaccurate data corrected or incomplete data completed, to erasure, restriction of processing, data portability, and to object to certain processing operations. If you have given consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a competent data protection supervisory authority. These rights arise in particular from Arts. 15 to 21 GDPR.

Statutory retention and documentation obligations, as well as professional duties of confidentiality, may restrict individual rights to the extent provided by law.

To exercise your rights, you can contact us using the contact details stated in section 1.

14. Withdrawal of consent

Insofar as processing is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR, you may withdraw this consent at any time with effect for the future.

The lawfulness of processing carried out on the basis of consent up to the time of withdrawal remains unaffected.

This applies in particular to the voluntary activation of Google Maps or OpenStreetMap.

A transfer of data to an external map service that has already taken place cannot be retrospectively undone by a subsequent withdrawal of consent.

15. Right to object

Insofar as we process personal data on the basis of Art. 6 para. 1 lit. f GDPR, you have the right pursuant to Art. 21 GDPR to object to the processing at any time on grounds relating to your particular situation.

Following an effective objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

16. Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.

The following authority is, in particular, responsible for our firm:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin

Telephone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de

The Berlin Commissioner for Data Protection and Freedom of Information is responsible for private entities based in Berlin and provides appropriate complaint options.

You may also contact another data protection supervisory authority competent pursuant to Art. 77 GDPR, in particular at the place of your habitual residence or place of work or at the place of the alleged infringement.

17. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, manipulation, disclosure and other unlawful processing.

In particular, the website is provided via an encrypted HTTPS connection. The embedded DATEV SmartExperts contact form is provided and technically secured by DATEV. Access to administrative or technical systems is restricted to those persons for whom such access is necessary.

Our security measures are reviewed and adapted in line with technical developments and the existing risks.

However, even with appropriate security measures, data transmission over the internet can never be guaranteed to be completely risk-free.

18. No automated decision-making and no profiling

No decision-making based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR takes place in connection with this website.

In particular, website visitors are not profiled for advertising, creditworthiness or comparable decision-making purposes.

19. Changes to this Privacy Policy

We may amend this Privacy Policy if the website, the technical services used, our processing activities or the legal requirements change.

The version published on this website at the relevant time applies.