Datenschutz | HCSM.de

Our privacy policy

1. General Information

1.1 What Are Personal Data?

Personal data is any information that reveals or can reveal the identity of a user. We adhere to the principle of data minimization. Wherever possible, the collection of personal data is avoided.

1.2 Processing of Personal Data

Personal data is processed exclusively for the establishment, content-related design, execution, or performance of contractual relationships (Art. 6(1)(b) GDPR).

In addition, personal data is processed only where we have obtained your consent (Art. 6(1)(a) GDPR), or where the processing is necessary for our legitimate interests and a balancing of interests shows that no overriding interests, fundamental rights, or freedoms on your part oppose such processing (Art. 6(1)(f) GDPR).

For the processing of your personal data, we may use data processors with whom we have concluded data processing agreements where required. Apart from this, personal data will generally not be disclosed to third parties.

For the processing of payments, the payment data required for this purpose will be transferred to the financial institution responsible for the payment and, where applicable, to the selected payment service provider.

Your personal data is processed within the EU and in countries that the EU considers safe or adequate. If personal data is processed in the United States, we ensure that the services we use are certified under the Data Privacy Framework.

1.3 Usage Data

When you visit our website, general technical information is collected. This includes the IP address used, the time and duration of the visit, the browser type, and, where applicable, the referring website. This usage data is technically recorded in a log file and may be stored and used for statistical evaluation of the website. This usage data is not linked to any other personal data relating to you.

1.4 Storage Period

We store your personal data after the purpose for which it was collected has ended only for as long as required by statutory provisions (particularly tax and commercial law requirements).

The following retention periods apply in particular:

Tax and Commercial Record-Keeping Obligations

6 years (general records)
10 years (accounting documents)

The retention period begins at the end of the calendar year in which the last entry was made in the records, the annual financial statements were prepared, a commercial or business letter was received or sent, the accounting document was created, the record was made, or other relevant documents were generated.

Invoices

10 years

Data Protection Consents

For the duration during which data subjects may assert legal claims.

(Electronic) Correspondence Without Tax Relevance

As long as necessary to fulfill the relevant purpose, unless processing serves the establishment, exercise, or defense of legal claims.

Usage Data According to Section 1.3

• Maximum 30 days

2. Ihre Rechte

2.1 Right of Access

You may request confirmation as to whether we process personal data concerning you. If this is the case, you have the right to access such personal data and to receive the additional information specified in Art. 15 GDPR.

2.2 Right to Rectification

You have the right to request the correction of inaccurate personal data concerning you and, pursuant to Art. 16 GDPR, to request the completion of incomplete personal data.

2.3 Right to Erasure

You have the right to request that we erase personal data concerning you without undue delay. We are obliged to erase such data without undue delay, particularly where one of the following grounds applies:

Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
You withdraw your consent on which the processing was based, and there is no other legal basis for the processing.
Your data has been processed unlawfully.

The right to erasure does not apply where your personal data is required for the establishment, exercise, or defense of legal claims.

2.4 Right to Restriction of Processing

You have the right to request restriction of the processing of your personal data if:

You contest the accuracy of the data and we are verifying its accuracy.
The processing is unlawful and you oppose erasure and request restriction of use instead.
We no longer need the data, but you require it for the establishment, exercise, or defense of legal claims.
You have objected to the processing, and it has not yet been determined whether our legitimate grounds override yours.

2.5 Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent or a contract and is carried out by automated means.

2.6 Right to Withdraw Consent and Right to Object

Where the processing of your personal data is based on your consent (Art. 6(1)(a) GDPR), you have the right to withdraw this consent at any time. The withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

Where the processing of your personal data is based on Art. 6(1)(e) or Art. 6(1)(f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object at any time to the processing of personal data relating to you on grounds relating to your particular situation.

In such a case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defense of legal claims.

2.7 General Information and Right to Lodge a Complaint

The exercise of the rights described above is generally free of charge.

You have the right to lodge a complaint directly with the supervisory authority responsible for us, namely the competent State Data Protection Commissioner.

3. Data Security

3.1 Data Security

All data on our website is protected against loss, destruction, unauthorized access, alteration, and dissemination through appropriate technical and organizational measures.

3.2 Sessions and Cookies

To operate our website, we use cookies or server-side sessions in which data may be stored. Cookies are small files that are stored on your hard drive by a website in order to automatically recognize you during your next visit.

Our website uses both technically necessary cookies and analytics and marketing cookies. Where cookies are used that are not technically necessary, we obtain your prior consent through a consent management tool (Usercentrics). The legal basis for this processing is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw your consent at any time through the cookie settings on our website.

Technically necessary cookies that are essential for providing the service expressly requested by you are used on the basis of our legitimate interest in ensuring the error-free and functional operation of our website (Art. 6(1)(f) GDPR in conjunction with Section 25(2) No. 2 TDDDG).

4. Contact Form

If you contact us by telephone, email, or via the contact form, your inquiry, including all personal data arising from it, will be stored by us for the purpose of processing your request and handling any follow-up questions.

We will not disclose this data without your consent.

The legal basis for data processing is our overriding legitimate interest in handling your inquiry in accordance with Art. 6(1)(f) GDPR.

The data you enter in the contact form will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed). Mandatory legal provisions, in particular statutory retention periods, remain unaffected.

5. Presence on Social Media Platforms

We maintain profiles on the following social media platforms for corporate presentation and communication purposes. Reference is expressly made to the privacy policies and opt-out options linked below.

(LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)

Opt-Out:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

XING

(New Work SE, Dammtorstraße 29–32, 20354 Hamburg, Germany)

These social media platforms may process personal data outside the European Union. In this respect, we refer to the privacy policies of the respective social media platforms.

The respective social media platforms may create user profiles based on your usage behavior and the interests and actions derived from it. They may also store cookies on your device that record your usage behavior. If you have an account with the respective platform and are logged in, your usage behavior may even be stored across devices.

Your user profile may be used, for example, to display advertisements that are presumed to match your interests.

We process personal data exclusively for communicating with you through the social media platform you have chosen and for optimizing our online presence. We ensure that no interests on your part are affected that outweigh our legitimate interest in such processing (Art. 6(1)(f) GDPR).

Where you have already given effective consent to the respective social media platform operator for the relevant data processing, your personal data will also be processed on the basis of that consent (Art. 6(1)(a) GDPR).

6. Third-Party Services

6.1 Wix (Website Builder)

Our website was created using the Wix website builder (operated by Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel). Wix provides us with the technical platform and tools that enable us to create and manage our website.

When using the Wix platform, personal data may be processed, particularly when you interact with features of the website provided by Wix. This may include, among other things:

IP address
Browser type and version
Operating system used
Referrer URL
Date and time of the server request
Technical information regarding website usage

The legal basis for using Wix is our legitimate interest in the professional presentation of our company on the internet and in the efficient management of our website (Art. 6(1)(f) GDPR).

We have entered into a Data Processing Agreement (DPA) with Wix. Wix.com is certified under the EU-U.S. Data Privacy Framework.

Wix's Privacy Policy is available at:
https://www.wix.com/about/privacy

6.2 Google Search Console

We use Google Search Console (operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), a webmaster tool for analyzing and optimizing our website.

Google Search Console enables us to monitor and improve the visibility of our website in Google search results.

As part of using Google Search Console, data relating to our website's performance in Google Search is collected, such as:

Search queries
Click-through rates
Impressions
Technical information about the website structure

This data is processed by Google and made available to us in aggregated and anonymized form.

The legal basis for using Google Search Console is our legitimate interest in the analysis, optimization, and economic operation of our website (Art. 6(1)(f) GDPR).

Google is certified under the EU-U.S. Data Privacy Framework.

Further information about Google's data processing practices can be found in Google's Privacy Policy:
https://policies.google.com/privacy

6.3 External Hosting via ALL-INKL

Our website is hosted by the external service provider ALL-INKL (ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany).

The personal data collected on this website is stored on the hoster's servers. This may include, in particular:

IP addresses
Contact details
Contract data
Website access data
Other data generated through the website

The use of the hosting provider is necessary for the performance of contracts with our prospective and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).

Our hosting provider will process your data only to the extent necessary to fulfill its contractual obligations and will follow our instructions regarding such data.

We have concluded a Data Processing Agreement with our hosting provider.

ALL-INKL's Privacy Policy is available at:
https://all-inkl.com/datenschutzinformationen/

6.4 Personio (Applicant Management)

We use the software Personio, provided by Personio SE & Co. KG, Rundfunkplatz 4, 80335 Munich, Germany, to manage job applications.

If you apply via our careers page, you will be redirected to an application platform hosted by Personio.

Your application data is processed as part of the recruitment process on the basis of:

Art. 6(1)(b) GDPR (pre-contractual measures), and
Section 26 German Federal Data Protection Act (BDSG) (data processing in the employment context).

If you provide separate consent (e.g., for inclusion in our applicant pool), processing will additionally be based on Art. 6(1)(a) GDPR.

Your personal data will be deleted without undue delay after completion of the recruitment process or after a maximum of six months, unless you have expressly consented to longer storage of your data or an employment contract has been concluded.

We have concluded a Data Processing Agreement with Personio.

Further information regarding data processing by Personio can be found at:
https://www.personio.com/privacy-policy/

6.5 Usercentrics (Consent Management Tool)

We use Usercentrics, a consent management platform (cookie banner) provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.

Usercentrics enables us to obtain, manage, and document your consent regarding various tracking and marketing tools.

When you visit our website, the following personal data may be transmitted to Usercentrics:

Your IP address
Your consent decisions (acceptance/rejection of individual services)
Browser type
Pages visited
Date and time of your visit

This data is stored in order to recognize your consent preferences during future visits and to fulfill our documentation obligations under the GDPR.

The legal basis for using Usercentrics is:

Art. 6(1)(c) GDPR (legal obligation to obtain consent), and
Art. 6(1)(f) GDPR (legitimate interest in legally compliant collection and management of user consent).

We have concluded a Data Processing Agreement with Usercentrics.

Data is stored exclusively on servers located within the European Union.

Further information is available in Usercentrics' Privacy Policy:
https://usercentrics.com/privacy-policy/

6.6 Wix Analytics

Our website uses Wix Analytics, an analytics tool provided by Wix.com Ltd., to evaluate website usage and continuously improve our website.

Wix Analytics collects, stores, and presents various user data in anonymized statistical reports for optimization and marketing purposes.

The following data may be collected, among others:

IP address (anonymized)
Browser type and version
Operating system used
Referrer URL
Hostname of the accessing device
Time of the server request
Time spent on the website
Page views
Click paths

Data processing is based on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, provided you have granted such consent through our consent management tool (Usercentrics).

You may withdraw your consent at any time with future effect by changing the cookie settings on our website.

Further information regarding Wix Analytics can be found in Wix's Privacy Policy:
https://www.wix.com/about/privacy

6.7 Zoho Forms and Zoho Desk

We use Zoho Forms and Zoho Desk (operated by Zoho Corporation GmbH, Trinkausstraße 7, 40213 Düsseldorf, Germany) to provide certain online forms on our website (e.g., our contact form) and to process inquiries.

The data entered into these forms is transmitted both to us and to Zoho. Zoho requires this data in order to provide the service.

Please note that, in addition to your IP address, any other personal data that you enter into the form fields may also be transmitted to us and to Zoho.

The use of these services is based on our legitimate interest in enabling fast and uncomplicated communication with us (Art. 6(1)(f) GDPR).

We have concluded a Data Processing Agreement with Zoho.

Zoho's Privacy Policy is available at:
https://www.zoho.com/privacy.html

7. Recruitment Process

You may apply to us electronically, by telephone, or in writing. Your information will, of course, be used exclusively for processing your application and will not be disclosed to third parties.

Please note that if you submit your application by email, unencrypted emails are not transmitted in a manner protected against unauthorized access.

Your personal data will be deleted without undue delay after completion of the recruitment process, or after a maximum period of six months, unless you have expressly consented to a longer retention period for your data or an employment contract has been concluded.

The legal basis for processing is Art. 6(1)(a), (b), and/or (f) GDPR, as well as Section 26 of the German Federal Data Protection Act (BDSG).

For further details regarding our recruitment process, please refer to our separate Privacy Notice for Applicants.

8. Controller

HCSM Steuerberatung GmbH Steuerberatungsgesellschaft
Kaiser-Friedrich-Ring 98
65185 Wiesbaden
Germany

Phone: +49 (0) 611 999 70-0
Email: info@hcsm.de

Data Protection Officer

Mr. Daniel Jonetat
Email: datenschutz@hcsm.de