Privacy Policy

Privacy Notice (Information Obligations under Art. 13 GDPR)

In our view, data protection should be transparent, easy to understand and, above all, fair to all parties. In this Privacy Notice, we therefore wish to inform you about the personal data we collect from and use about you, whether and, if so, to which third parties such data may be disclosed, how long we store the data and what rights you have should you ever disagree with our responsible handling of your data. If you still have any questions after reading this detailed Privacy Notice, please do not hesitate to contact us using the contact details provided below.

‍Definitions:

To ensure that we are working on the same basis, we would first like to clarify some definitions. This ensures that everyone involved understands what we mean and what assumptions underlie the information below.

Personal data:

‍This means any information relating to an identified or identifiable natural person (hereinafter the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data or online identifier, or to one or more factors specific to that natural person’s physical, physiological, genetic, mental, economic, cultural or social identity.

Processing:

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing:

This means marking stored personal data with the aim of limiting its processing in the future.

Profiling:

Profiling means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, particularly to analyse or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation:

Pseudonymisation means processing personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.

Controller:

This means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of such processing are determined by European Union or Member State law, the controller or the specific criteria for its nomination may be provided for by European Union or Member State law.

Recipient:

Any natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. However, public authorities that may receive personal data in the context of a particular inquiry in accordance with European Union or Member State law are not regarded as recipients; the processing of such data by those public authorities must comply with the applicable data protection rules according to the purposes of the processing.

Third party:

This means a natural or legal person, public authority, agency or other body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Consent: This means any freely given, specific, informed and unambiguous indication of the data subject’s wishes, in the form of a statement or other clear affirmative action, by which the data subject signifies agreement to the processing of personal data relating to them.

1. Name and contact details of the controllerThe controller responsible for data processing is

SPIELMANN Steuerberatung GmbH
Hennes-Weisweiler-Allee 23
41179 Mönchengladbach
Tel.: +49 2161 8473190
Email: info@spielmann.nrw
Website: www.spielmann.nrw

2. Collection of personal data when using the website for informational purposes

If you use the website solely for informational purposes, i.e. if you do not register or otherwise provide us with information, we collect only the personal data transmitted by your browser to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and ensure its stability and security (the legal basis is Art. 6(1), first sentence, point (f) GDPR):

– IP address
– Date and time of the request
– Time zone difference from Greenwich Mean Time (GMT)– Content of the request (specific page)
– Access status/HTTP status code

– Volume of data transmitted in each case
– Website from which the request originates
– Browser
– Operating system and its interface
– Language and version of the browser software.

3. Use of cookies

(1) In addition to the data listed above, cookies are stored on your computer when you use our website. Cookies are small text files stored on your hard drive and assigned to the browser you use, through which certain information is transmitted to the party that places the cookie (in this case, us). Cookies cannot run programs or transmit viruses to your computer. They are used to make the website as a whole more user-friendly and effective (the legal basis is Art. 6(1), first sentence, point (f) GDPR).

a) This website uses the following types of cookies, whose scope and operation are explained below:

– Transient cookies (see b)

– Persistent cookies (see c).

b) Transient cookies are deleted automatically when you close your browser. These include session cookies in particular. They store a session ID that allows different requests from your browser to be assigned to the same session. This enables your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close your browser.

c) Persistent cookies are deleted automatically after a specified period, which may vary depending on the cookie. You may delete cookies at any time in your browser’s security settings.

d) You can configure your browser settings according to your preferences and, for example, refuse third-party cookies or all cookies. Please note that you may then be unable to use all functions of this website.

e) We use cookies to identify you on subsequent visits if you have an account with us. Otherwise, you would have to log in again each time you visit.

(2) This stored information is kept separately from any other data you may provide to us. In particular, cookie data is not linked to your other data.

(3) You may object to this data processing at any time with effect for the future.

4. Use of functions on our website

(1) In addition to using our website purely for informational purposes, we offer various services that you may use if interested. To do so, you will generally need to provide additional personal data, which we use to provide the relevant service. Where additional voluntary information may be provided, it is marked accordingly.

(2) If you contact us by email or using the contact form, we store your email address and, if you provide them, your name and telephone number in order to answer your questions. (The legal basis is Art. 6(1), first sentence, point (b) GDPR.)

5. Disclosure of data to third parties

(1) We will disclose your personal data to third parties only where participation in promotions, prize competitions, bookings or contracts are offered by us jointly with a third-party provider. In this case, you will be informed separately of the disclosure to third parties before your data is transferred.

(2) In some cases, we use external service providers to process your data. We have carefully selected and commissioned these service providers in writing. They are bound by our instructions and are regularly monitored by us. The service providers will not disclose this data to third parties. Where these service providers are based in the USA, we will inform you of this in connection with the relevant functions. This data processing is also carried out in accordance with applicable law.

6. Recipients or categories of recipientsWhere we disclose your personal data to third parties, this will be explicitly stated in the

description of the relevant data processing activity (e.g. when our contact form is used). We also use external service providers for technical and organisational purposes, with whom we have entered into appropriate data processing agreements within the meaning of Art. 28 GDPR. These include, for example, service providers for web hosting, sending emails and letters, and maintaining and servicing our IT systems.

7. Storage period

Your data will be stored for as long as strictly necessary to achieve the relevant purpose, but no longer than required by any applicable statutory provisions (for example, under commercial law, we are required to retain business correspondence, which may include emails, for 10 years). As soon as the purpose of storage no longer applies or a retention period prescribed by the aforementioned provisions expires, the personal data will routinely be blocked or erased.

8. Your rights

This section provides comprehensive information about your rights.

8.1 Right of access

You have the right to ask us at any time whether we process personal data relating to you. If this is the case, you are entitled to access the information specified in Art. 15(1), second half-sentence, GDPR. You also have the right to ask whether personal data relating to you is transferred to a third country or an international organisation. In this context, you may request information about the appropriate safeguards under Art. 46 GDPR in connection with the transfer.

8.2 Right to rectification

Under Art. 16 GDPR, you also have the right to require us to rectify inaccurate personal data relating to you without undue delay. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.

8.3 Right to erasure (“right to be forgotten”)

You also have the right to require us to erase personal data relating to you without undue delay. We are obliged to comply with this request and erase personal data unless we are legally required or entitled to continue processing your data. For details, please refer to Art. 17 GDPR.

8.4 Right to restriction of processing

You have the right to require us to restrict processing where the statutory requirements under § 18 GDPR are met.

8.5 Right to be informed

Under Art. 19 GDPR, if you have exercised your right to rectification, erasure or restriction of processing against us, we are obliged to notify each recipient to whom the personal data relating to you has been disclosed of the rectification or erasure of data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by us about those recipients.

8.6 Right to data portability

Where we process your data on the basis of your consent or a contract, you have the right to receive the personal data relating to you in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller where the statutory requirements under Art. 20 GDPR are met.

8.7 Right to object

‍Right to object on grounds relating to your particular situation

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you based on Art. 6(1), point (e) or (f) GDPR; this also applies to profiling based on those provisions. We will no longer process the personal data relating to you unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

Right to object to the processing of data for direct marketing purposes

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data relating to you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data relating to you will no longer be processed for those purposes. In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8.8 Right to withdraw consent under data protection law

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

8.9 Automated individual decision-making, including profiling You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

is necessary for entering into or performing a contract between you and the controller;
is authorised by European Union or Member State law to which the controller is subject and which also lays down appropriate measures to safeguard your rights, freedoms and legitimate interests; or
is based on your explicit consent.

However, these decisions may not be based on special categories of personal data referred to in Art. 9(1) GDPR unless Art. 9(2), point (a) or (g) applies and appropriate measures have been taken to safeguard your rights, freedoms and legitimate interests. In the cases referred to in points a. and c., the controller will implement appropriate measures to safeguard your rights, freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

8.10 Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

is necessary for entering into or performing a contract between you and the controller;
is authorised by European Union or Member State law to which the controller is subject and which also lays down appropriate measures to safeguard your rights, freedoms and legitimate interests; or
is based on your explicit consent.

8.10 Right to lodge a complaint

9. Legal bases for processing

Where not already stated for the individual processing activities in the preceding sections, the legal bases on which we process data are set out below.Where we obtain the data subject’s consent to the processing of personal data, Art. 6(1), point (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

Where processing personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1), point (b) GDPR serves as the legal basis. This also applies to processing operations necessary in order to take steps prior to entering into a contract.

Where processing personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1), point (c) GDPR serves as the legal basis.

Where processing personal data is necessary to protect the vital interests of the data subject or another natural person, Art. 6(1), point (d) GDPR serves as the legal basis.

Where processing is necessary for the purposes of the legitimate interests pursued by our company or a third party and these interests are not overridden by the data subject’s interests or fundamental rights and freedoms, Art. 6(1), point (f) GDPR serves as the legal basis for the processing.

Privacy Policy