Mandatory information according to article 12 et seq. of the General Data Protection
Regulation (GDPR)
contents
1 Contact information of the
controller
2 Contact information of the internal data protection officer
3 In what scope do we process your
personal data?
3.1 In the context of services provided
by SMC
3.1.1 Where do we get your personal data?
3.1.2 Purpose and legal basis of processing
3.1.3 Who
receives the personal data provided by you?
3.1.4 Are
the data provided by you transmitted to other countries or international
organizations?
3.1.5 Is
automated decision-making including profiling performed?
3.1.6 Duration
of processing (criteria for erasure)
3.2 Marketing, customer loyalty, “Best Friends”
3.2.1 Where
do we get your personal data?
3.2.2 Purpose
and legal basis of processing
3.2.3 Who
receives the personal data provided by you?
3.2.4 Are
the data provided by you transmitted to other countries or international
organizations?
3.2.5 Is
automated decision-making including profiling performed?
3.3.2 Where do we obtain your personal data?
3.3.3 Purposes and legal basis of the processing
3.3.4 Who receives the personal data you provide?
3.3.5 Will the data you provide be transferred to third countries or
international organizations?
3.4.1 Where
do we get your personal data?
3.4.2 Purpose
and legal basis of processing
3.4.3 Who
receives the personal data provided by you?
3.4.4 Are
the data provided by you transmitted to other countries or international
organizations?
3.4.5 Is
automated decision-making including profiling performed?
3.5 Business relationships with suppliers and service providers
3.5.1 Where
do we get your personal data?
3.5.2 Purpose
and legal basis of processing
3.5.3 Who
receives the personal data provided by you?
3.5.4 Are
the data provided by you transmitted to other countries or international
organizations?
3.5.5 Is
automated decision-making including profiling performed?
4 Information about your rights
4.1 Right to information pursuant to Article 15 GDPR
4.2 Right to correction pursuant to Article 16 GDPR
4.3 Right to erasure (“right to be forgotten”) pursuant to Article 17 GDPR
4.4 Right to the restriction of processing pursuant to Article 18 GDPR, Section 35 BDSG
4.5 Right to data portability pursuant to Article 20 GDPR
4.6 Right to object pursuant to Article 21 GDPR
1
Contact information of the controller
The controller in terms of data protection law
is Schiff-Martini & Cie. GmbH Wirtschaftsprüfungsgesellschaft Steuerberatungsgesellschaft (SMC). See the imprint (https://www.schiffmartini.com/en/imprint/) of our website for the contact information.
2
Contact information of the internal data protection officer
Reinhold Goetz Dipl.Ing. Nachrichtentechnik
Kampstr.6, 50374 Erftstadt
e-mail: rgoetz@datenschutzservice.nrw
3
In what scope do we process your personal data?
3.1 In the
context of services provided by SMC
SMC offers a
wide variety of services related to tax advice and auditing. These services involve
the processing of personal data.
3.1.1
Where do we get your personal data?
Your data are generally
collected from our clients. Processing the personal data provided by them is necessary
to meet the contractual obligations pursuant to the contract concluded with us.
It is essential based on your duty to cooperate that you provide us with the
personal data we request, otherwise we are unable to meet our contractual
obligations. Otherwise, accounting and/or tax disadvantages for you can no longer
be excluded.
Providing your personal data is required in
the course of pre-contractual measures (such as master data recording in the
process for potential clients). A contract cannot be concluded if you do not
provide the requested data.
To provide our services, it may be necessary
to process personal data that we have permissibly obtained for the respective
purpose from other companies or third parties, such as fiscal authorities, your
business partners, and similar.
We may also process personal data from
publicly accessible sources such as websites, which we use permissibly and only
for the respective contractual purpose.
3.1.2
Purpose and legal basis of processing
The personal data provided by you are
processed according to the provisions of the European General Data Protection
Regulation (GDPR) and the Federal Data Protection Act (BDSG).
Typical purposes of processing at SMC include tax consulting, business consulting, auditing and legal consulting activities involving the collection, processing, use, and, where applicable, transfer of personal data for the purpose of preparing or completing current bookkeeping, payroll accounting, financial statements, tax returns, participation and consultation in connection with external audits (tax field audits, audit on value added taxes, audit on wage taxes, audit on social security issues, audit on workmen´s compensation), consulting on tax and economic matters, audits, and for the purpose of consulting and representation in judicial and extrajudicial disputes.
The legal basis is as follows:
3.1.2.1 To meet contractual
obligations (pursuant to point (b) of Article 6(1) GDPR)
When the processing of data serves to meet
contractual obligations, the contractual agreement forms the legal basis. The
purpose of data processing on this basis is to initiate pre-contractual measures
on the one hand, preceding a contractual business relationship, and to meet the
obligations under the contract concluded with you on the other hand.
3.1.2.2 Based on consent
(pursuant to point (a) of Article 6(1) GDPR)
Consent to the processing of personal data
forms the legal basis. It defines the purpose of processing. You may withdraw
your consent at any time with future effect. Consent given before the GDPR came into force (25 May 2018) can also
be withdrawn. Processing that takes place prior to withdrawal remains
unaffected by the withdrawal. Example: Sending a newsletter, release from
professional secrecy for of the data provided by you to third parties on your
behalf (e. g. banks, insurers, shareholders, etc.).
3.1.2.3 Based on legal
requirements (pursuant to point (c) of Article 6(1) GDPR) or in the public
interest (pursuant to point (e) of Article 6(1) GDPR)
Auditors and tax advisors are subject to legal requirements that may result in an obligation or permission to process personal data, e.g., Section 11 StBerG, Section 320 HGB, WPO, GwG.
3.1.2.4 In the course of the
balancing of interests (pursuant to point (f) of Article 6(1) GDPR)
The purposes of processing are based on the
protection of our legitimate interests. It may be necessary to process the data
provided by you beyond contractual performance as such. Our legitimate
interests can justify the further processing of the data provided by you,
insofar as your interests or fundamental rights and freedoms do not outweigh
them. On a case-by-case basis, our legitimate interests may be: Asserting legal
claims, defense against liability claims, preventing crimes, safeguarding IT
security and IT operations.
3.1.3
Who
receives the personal data provided by you?
In general, we only transmit
the personal data provided by you to the recipients named by you.
In the course of fulfilling the contract
concluded with you, the data provided by you are transmitted only to third
parties that require the data for legal reasons, e. g. fiscal authorities,
social insurance providers, applicable public authorities, and courts.
We are obligated to maintain professional
secrecy and to implement corresponding measures.
In the course of our service provision, we
commission processors that contribute to meeting the contractual obligations,
e.g. data center service providers, IT partners, document shredders, etc. These
processors are contractually obligated by us to maintain professional secrecy
and to comply with the requirements of the GDPR and BDSG.
In specific cases we collaborate with freelancers or
cooperation partners to provide our services. These are contractually obligated by us to maintain
professional secrecy and to comply with the requirements of the GDPR and BDSG.
3.1.4
Are
the data provided by you transmitted to other countries or international
organizations?
We generally do not transmit
the data provided by you to third parties in a non-EU country for which there
is no so-called adequacy decision of the EU Commission on an appropriate level
of protection. If you want the data provided by you to be transmitted to
another country or international organization in a specific case, we shall do
so only upon receiving your written consent and release from professional
secrecy.
Insofar as you instruct us to exchange data with a company affiliated
with you or a third party named by you that is located in another country, we
shall assume that you have examined the question of whether transmitting the
data to a foreign country is permissible, and that authorization exists within
your group of companies for the transmission of these data to an affiliated
company and to another country where the company in question is located.
3.1.5
Is
automated decision-making including profiling performed?
Fully automated decision-making (including
profiling) pursuant to Article 22 GDPR is not used for processing the data provided
by you.
3.1.6
Duration
of processing (criteria for erasure)
Expected terms of the retention obligations applicable to us and our
legitimate interests:
–
Compliance with retention
periods under commercial and tax laws and professional duty. The applicable
specified periods for the retention of documents are two to ten years.
–
Preservation of evidence
under the statute of limitations. Pursuant to Section 195 et seq. of the
German Civil Code (BGB), these limitation periods can be up to 30 years. The regular
limitation period is three years.
3.2 Marketing, customer
loyalty, “Best Friends”
SMC engages in permissible marketing activities to boost brand awareness,
gain new customers, and improve customer loyalty. This includes maintaining a
“Best Friends” database with the contact information of SMC business associates as well as hosting events.
Personal data are inevitably also processed in this context.
3.2.1
Where
do we get your personal data?
The data processed in
marketing are generally collected from you, mostly in the form of business
cards exchanged at business events (such as symposiums, trade fairs, etc.) or
by filling signing up for an event or newsletter. SMC also uses sources accessible to the public to
the extent permitted (such as websites of potential clients, published lists of
participants for public events, and social networks of a business nature).
Furthermore, SMC receives the data in question from mutual business partners.
3.2.2
Purpose
and legal basis of processing
The personal data provided by you are
processed according to the provisions of the European General Data Protection
Regulation (GDPR) and other applicable standards. The legal basis is as follows:
3.2.2.1 Based on consent
(pursuant to point (a) of Article 6(1) GDPR)
Insofar as SMC bases the processing of personal data in the
course of marketing on your consent, this defines the purpose and content of
the measures. In this case, the legal basis is point (a) of Article 6(1) GDPR. You may withdraw your consent at any time with future effect. Example:
Sending a newsletter, release from professional secrecy for the transfer of the
data provided by you to third parties on your behalf (e.g. banks, insurers,
shareholders, etc.).
3.2.2.2 In the course of the
balancing of interests (pursuant to point (f) of Article 6(1) GDPR)
The marketing activities of SMC and the associated processing of personal
data, which are only pursued to the extent permitted, serve to protect our
legitimate interests pursuant to point (f) of Article 6(1) GDPR. Photographing or filming takes place is
based our legitimate interest to do marketing.
3.2.3
Who
receives the personal data provided by you?
Photographs taken during events may be user in
brochures or on our website. Apart from that we do not transmit the personal
data provided to us to third parties without your express consent. As a bearer
of professional secrets, we are subject to professional secrecy.
We utilize the services of external partners
in certain cases, for example data center operators, IT partners, document
shredders, etc. These companies as processors are contractually obligated by us
to maintain professional secrecy and to comply with the requirements of the GDPR and BDSG.
3.2.4
Are
the data provided by you transmitted to other countries or international
organizations?
In no case are the data provided by you transmitted
to third parties in a non-EU country for which there is no so-called adequacy decision of the EU
Commission on an appropriate level of protection.
We generally do not transmit the data provided
by you to third parties in a non-EU country for which there is no so-called adequacy decision of the EU
Commission on an appropriate level of protection. If you want the data provided
by you to be transmitted to another country or international organization in a
specific case, we shall do so only upon receiving your written consent and
release from professional secrecy.
Insofar as you instruct us to exchange data
with a company affiliated with you or a third party named by you that is
located in another country, we shall assume that you have examined the question
of whether transmitting the data to a foreign country is permissible, and that
authorization exists within your group of companies for the transmission of
these data to an affiliated company and to another country where the company
in question is located.
3.2.5
Is
automated decision-making including profiling performed?
Fully automated decision-making (including
profiling) pursuant to Article 22 GDPR is not used for processing the data provided
by you.
3.2.6
Duration
of processing
The personal data are erased as soon as there
is no legitimate interest, unless you have expressly agreed to their storage
beyond this period.
3.3
Video
conferencing
3.3.1
What
data is involved?
We use
Microsoft 365 and Microsoft Teams©, to conduct our usual office communications as
well as for conference calls, online meetings and/or video conferences, and
desktop sharing. If we record online meetings, we will inform you before we
start and ask for verbal consent where necessary. If you do not wish to be
recorded, you can, of course, leave the online meeting.
If it is
necessary for the purposes of an online meeting to keep a written record, we
will log the chat content.
Microsoft
365 and Microsoft Teams© are a service of Microsoft Ireland Operations,
Ltd.
When using
Microsoft Teams©, various types of data are processed. The scope of the data also depends
on the data you provide before or during the use of Microsoft Teams©.
In the
context of desktop sharing, you can show your screen to the participants of the
online meeting. In this case, the screen content you display will be
processed.
To enable
the display of video and the playback of audio, data from the microphone of
your device and from a video camera of the device are processed during the
online meeting. You can turn off the camera or mute the microphone yourself at
any time through the Microsoft Teams© applications.
3.3.2
Where
do we obtain your personal data?
The data
processed as part of using Microsoft Teams© is provided by you.
3.3.3
Purposes
and legal basis of the processing
The
personal data you provide will be processed in accordance with the provisions
of the European General
Data Protection Regulation (GDPR) and the German
Federal Data Protection Act (BDSG). The legal basis is as follows:
When the processing of data serves to meet contractual obligations, the
contractual agreement forms the legal basis. The purpose of data processing on
this basis is to initiate pre-contractual measures on the one hand, preceding
a contractual business relationship, and to meet the obligations under the
contract concluded with you on the other hand.
If there is
no contractual relationship with you, the legal basis for the processing of
your personal data is point (f) of Article 6(1) GDPR. Here, our interest is in effective office
communication, for example in the form of online meetings or telephone calls.
3.3.4
Who
receives the personal data you provide?
Data processing outside the European Union (EU) does not take place as a matter of principle, as we have restricted our storage location to data centers in the European Union. However, we cannot rule out the possibility that data may be routed via internet servers located outside the EU. This may be the case in particular if participants in an online meeting are located in a third country.
However, the data is encrypted during transport via the Internet and is therefore protected against unauthorized access by third parties.
The data you provide will not be transferred to international organizations under any circumstances.
3.3.5
Will
the data you provide be transferred to third countries or international
organizations?
In no case are the data provided by you transmitted to international
organizations.
In
principle, no data is processed outside the European Union (EU), as we have restricted our storage
location to data centers in the European Union. However, we cannot rule out the
possibility that data may be routed via Internet servers located outside the EU. This may be the case in particular
if participants in an online meeting are located in a third country.
However,
the data is encrypted during transport over the Internet and thus secured
against unauthorized access by third parties.
3.3.6
Duration
of processing
The
duration of the processing depends on the purpose of the use of Microsoft Teams©, see in this respect the other
sections of this text (client support, marketing, …).
3.4 Job application
process
SMC is always interested in new employees. In addition to actively
searching through recruiters, SMC appreciates unsolicited applications. Personal data about you as an
applicant are inevitably also processed in the context of the application
process:
3.4.1
Where
do we get your personal data?
As a rule, we obtain the
data directly from you or from recruiters. We may also process personal data
from publicly accessible sources such as websites, which we use permissibly and
only for the purpose of the application process.
3.4.2
Purpose
and legal basis of processing
The personal data provided by you are processed
according to the provisions of the European General Data Protection Regulation
(GDPR) and the Federal Data
Protection Act (BDSG). The legal basis is as follows:
3.4.2.1 To establish an
employment relationship (pursuant to Section 26(1), sentence 1 BDSG)
Processing the personal data provided by you
is necessary to evaluate whether an employment relationship can be considered
and whether the corresponding legal requirements are met. The legal basis for
this purpose is Section 26(1), sentence 1 BDSG.
3.4.2.2 Based on consent
(pursuant to Section 26(2) BDSG)
The processing of personal data may also be
based on your consent, e.g. for subsequent applications for other positions or
at a later date. This consent determines the respective purpose of processing.
You may withdraw your consent at any time with future effect.
3.4.2.3 In the course of the
balancing of interests (pursuant to point (f) of Article 6(1) GDPR)
In specific cases, processing may continue
beyond the end of the application process even if an employment relationship is
not established. This is the case when the personal data are needed to assert
or defend against legal claims. The personal data are erased as soon as there
is no legitimate interest, unless you have expressly agreed to their storage
beyond this period.
3.4.3
Who
receives the personal data provided by you?
Within our company, access to the personal
data provided by you is given to the departments that require said data to
fulfill employment contract and legal obligations, and that are authorized to
process these data.
We engage external service providers to
maintain and verify the security of our IT structure. These processors are
contractually obligated by us to maintain professional secrecy and to comply
with the requirements of the GDPR and BDSG.
Other recipients only receive the data
provided by you if you give us your written consent.
3.4.4
Are
the data provided by you transmitted to other countries or international
organizations?
In no case are the data
provided by you transmitted to third parties in a non-EU country or to
international organizations.
3.4.5
Is
automated decision-making including profiling performed?
Fully automated decision-making (including
profiling) pursuant to Article 22 GDPR is not used for processing the data provided
by you.
3.4.6
Duration
of processing
Generally the data provided by you are erased
after the end of the application process, provided an employment relationship
is not established. In specific cases, processing may continue beyond that if
the personal data are needed to assert or defend against legal claims, or if
there is another legitimate interest.
3.5 Business
relationships with suppliers and service providers
SMC purchases goods and obtains services from business partners as required
for business operations. Personal data are also exchanged within the scope of
the business relationship.
3.5.1
Where
do we get your personal data?
We obtain the
aforementioned data from our business partners or their employees, or from
publicly accessible sources such as websites, which we use permissibly and only
for the respective contractual purpose.
3.5.2
Purpose
and legal basis of processing
The personal data provided by you are
processed according to the provisions of the European General Data Protection
Regulation (GDPR) and the Federal Data Protection Act (BDSG). The legal basis is as follows:
3.5.2.1 To meet contractual
obligations (pursuant to point (b) of Article 6(1) GDPR)
Data processing serves to meet contractual
obligations pursuant to point (b) of Article 6(1) GDPR. The purpose of data processing on this basis
is to initiate pre-contractual measures on the one hand, preceding a
contractual business relationship, and to meet the obligations under the
contract concluded with you on the other hand.
3.5.2.2 Based on legal
requirements (pursuant to point (c) of Article 6(1) GDPR) or in the public interest (pursuant to point
(e) of Article 6(1) GDPR)
The purpose of data processing is defined by
legal requirements or the public interest (e.g. compliance with retention
obligations).
3.5.2.3 In the course of the
balancing of interests (pursuant to point (f) of Article 6(1) GDPR)
In specific cases, the purpose of processing
can also be based on a legitimate interest pursuant to point (f) of Article
6(1) GDPR. Such cases include: Asserting legal claims or defense against
liability claims.
It may be necessary to process the data
provided by you beyond contractual performance as such.
3.5.3
Who
receives the personal data provided by you?
In the course of fulfilling the contract
concluded with our suppliers and service providers, the data provided by you
are transmitted only to third parties that require the data for legal or
contractual reasons.
We utilize the services of external specialist
companies in certain cases, for example data center operators, IT partners,
document shredders, etc. These companies as processors are contractually
obligated by us to maintain professional secrecy and to comply with the
requirements of the GDPR and BDSG.
3.5.4
Are
the data provided by you transmitted to other countries or international
organizations?
In no case are the data provided by you
transmitted to international organizations. We generally do not transmit the
data provided by you to third parties outside the EU.
3.5.5
Is
automated decision-making including profiling performed?
Fully automated decision-making (including
profiling) pursuant to Article 22 GDPR is not used for processing the data provided
by you.
3.5.6
Duration
of processing
Processing of the data provided by you
continues as long as necessary to accomplish the contractually agreed purpose,
in principle as long as the contractual relationship with you is maintained.
After the contractual relationship ends, the data provided by you are processed
for the purpose of complying with statutory retention obligations or to
protect our legitimate interests. The data provided by you are erased after the
end of the statutory retention periods and/or as soon as there is no legitimate
interest.
Expected terms of the retention obligations applicable to us and our
legitimate interests:
–
Compliance with retention
periods under commercial and tax laws and professional duty. The applicable
specified periods for the retention of documents are two to ten years.
–
Preservation of evidence
under the statute of limitations. Pursuant to Section 195 ff of the German
Civil Code (BGB), these limitation periods can be up to 30 years. The regular
limitation period is three years.
4
Information about your rights
4.1 Right to information
pursuant to Article 15 GDPR
4.2
Right to correction pursuant to Article 16 GDPR
You have the right to ask the controller to
promptly correct your personal data that are incorrect. Under consideration of
the purposes of processing, you have the right to request the completion of
incomplete personal data – also by means of a supplementary statement.
4.3 Right to erasure
(“right to be forgotten”) pursuant to Article 17 GDPR
You have the right to request the prompt
erasure of your data from the controller. The controller is obligated to
promptly erase personal data, insofar as one of the following reasons apply and
this does not conflict with any other legal regulations:
a) The purposes for
which the personal data were collected no longer apply.
b) You
withdraw your consent to processing. There is no other legal basis for
processing.
c) You
object to processing. There is no other legal basis for processing.
d) The
personal data were processed unlawfully.
e) The
erasure of the personal data is required to meet a legal obligation pursuant to
European Union law or the laws of the member states that apply to the
controller.
f) The
personal data were collected in the context of information society services
pursuant to Article 8(1) GDPR.
4.4 Right to the
restriction of processing pursuant to Article 18 GDPR, Section 35 BDSG
You have
the right to request the restriction of processing if one of the following
conditions is met and this does not conflict with any other legal regulations:
a) You
doubt the accuracy of the personal data.
b) The
processing is unlawful, but you object to erasure.
c) Personal
data are no longer needed for the purpose of processing, but you still need the
data for the establishment, exercise or defense of legal claims.
d) You
have objected to processing pursuant to Article 21(1) GDPR. As long as it has not been established whether
the legitimate reasons of the controller outweigh yours, processing is
restricted.
4.5 Right to data
portability pursuant to Article 20 GDPR
You have the right to receive the data
provided by you from the controller in a structured, common and machine-readable
format. We are not permitted to hinder transmission to another controller.
4.6 Right to object
pursuant to Article 21 GDPR
You have the right to object at any time, on
grounds relating to your personal situation, to the processing of personal
data concerning you which is based on point (f) of Article 6(1) GDPR (data processing based the weighing of
interests). If you object, we will no longer process your personal data unless
we can demonstrate compelling legitimate grounds for the processing which
override your interests, rights and freedoms, or in case of processing for the
establishment, exercise, or defense of legal claims.
4.7 Right to
lodge a complaint with a supervisory authority pursuant to point (d) of Article
13(2) GDPR in conjunction with Section 19 BDSG
If you believe that the processing of your
data violates the GDPR, you have the right to lodge a complaint with a supervisory authority.
Please contact the applicable supervisory authority to do so:
Der Hessische Datenschutzbeauftragte
Postfach 3163
65021 Wiesbaden, Germany
Phone: +49 611 1408 – 0
E-mail: Poststelle@datenschutz.hessen.de
4.8 Revocation of
consent
If the processing is based on point (a) of Article 6(1) or
point (a) of Article 9(2) (processing of special categories of
personal data) or Section 26(2) BDSG (application process), you have the right to withdraw consent for a
specific purpose at any time, which does not affect the lawfulness of
processing based on consent before its withdrawal.
* * *
[1] Article 4(26) GDPR: “‘international organisation’ means an organisation
and its subordinate bodies governed by public international law, or any other
body which is set up by, or on the basis of, an agreement between two or more
countries.”