mandatory information
pursuant to Art. 12 et seq. GDPR
Contact details of the controller
Surname: Radermacher
First name: Dipl.-Kfm. Peter
Contact details (business)
Company: VRT Partnerschaft mbB Auditors Tax Consultants Lawyers
Address: Graurheindorfer Str. 149a – 53117 Bonn
Telephone: +49 (0) 228 26792 0
Fax: +49 (0) 228 26792 30
Email: p.radermacher@vrt.de
Contact details of the data protection officer
Contact details (business)
Alexander Paesen
DATEV eG, Branch Office
Im MediaPark 5, 50670 Cologne, Germany
Email: Datenschutz@vrt.de
Where do we get your personal data from?
Your data is generally collected from you. The processing of the personal data you provide is necessary for the fulfilment of the contractual obligations arising from the contract concluded with us. Due to your obligations to cooperate, it is essential that you provide the personal data we request, as we will otherwise be unable to fulfil our contractual obligations. Otherwise, accounting and/or tax disadvantages for you cannot be ruled out.
The provision of your personal data is necessary in the context of pre-contractual measures (e.g. master data collection in the prospecting process). If you do not provide the requested data, a contract cannot be concluded.
In order to provide our services, it may be necessary to process personal data that we have received from other companies or other third parties, e.g. tax offices, your business partners or similar, in a permissible manner and for the respective purpose.
Furthermore, we may process personal data from publicly accessible sources, e.g. websites, which we use lawfully and only for the respective contractual purpose.
Purposes and legal bases of processing
The personal data you provide will be processed in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG):
On the basis of consent (pursuant to Art. 6(1)(a) GDPR)
The purposes of processing personal data arise from the granting of consent. You may revoke your consent at any time with effect for the future. Consent granted prior to the GDPR coming into force (25 May 2018) may also be revoked. Processing that took place before the revocation remains unaffected by the revocation. Example: Sending a newsletter, release from professional confidentiality to pass on the data you have provided to third parties at your request (e.g. banks, insurance companies, shareholders, etc.).
To fulfil contractual obligations (in accordance with Art. 6(1)(b) of the GDPR)
The purposes of data processing arise, on the one hand, from the initiation of pre-contractual measures preceding a contractually regulated business relationship and, on the other hand, from the fulfilment of obligations arising from the contract concluded with you.
Due to legal requirements (pursuant to Art. 6(1)(c) GDPR) or in the public interest (pursuant to Art. 6(1)(e) GDPR)
The purposes of data processing arise from legal requirements or are in the public interest (e.g. compliance with retention obligations, proof of compliance with the tax advisor’s duty to provide information and advice).
As part of the balancing of interests (pursuant to Art. 6(1)(f) GDPR)
The purposes of processing arise from the protection of our legitimate interests. It may be necessary to process the data you have provided beyond the actual fulfilment of the contract. Our legitimate interest may be used as a basis for further processing of the data you have provided, provided that your interests or fundamental rights and freedoms do not outweigh this. In individual cases, our legitimate interest may be: asserting legal claims, defending against liability claims, preventing criminal offences.
Who receives the personal data you provide?
Within our company, access to the personal data you provide is granted to those departments that require it to fulfil their contractual and legal obligations and that are authorised to process this data.
In fulfilment of the contract concluded with you, the data you provide will only be disclosed to those bodies that require it for legal reasons, e.g. tax authorities, social security institutions, competent authorities and courts.
As professionals bound by professional secrecy, we are obliged to observe and implement professional confidentiality. Other recipients will only receive the data you provide at your request if you release us from professional confidentiality.
As part of our service provision, we commission processors who contribute to the fulfilment of contractual obligations, e.g. data centre service providers, IT partners, document shredders, etc. These processors are contractually obliged by us to comply with professional secrecy and to comply with the requirements of the GDPR and the BDSG.
Will the data you provide be transferred to third countries or international organisations?
The data you provide will not be transferred to a third country or an international organisation under any circumstances. If, in individual cases, you wish the data you have provided to be transferred to a third country or an international organisation, we will only do so with your written consent and after being released from our professional confidentiality obligations.
Is automated decision-making, including profiling, used?
No fully automated decision-making (including profiling) pursuant to Art. 22 GDPR is used to process the data you provide.
Duration of processing (criteria for deletion)
The data you provide will be processed for as long as it is necessary to achieve the contractually agreed purpose, generally for as long as the contractual relationship with you exists. After termination of the contractual relationship, the data you have provided will be processed in order to comply with statutory retention obligations or on the basis of our legitimate interests. After expiry of the statutory retention periods and/or the cessation of our legitimate interests, the data you have provided will be deleted.
Expected time limits for our retention obligations and our legitimate interests:
Compliance with commercial, tax and professional law retention periods. The retention and documentation periods specified therein range from two to ten years. Preservation of evidence within the framework of the statute of limitations. According to Sections 195 et seq. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the regular limitation period being three years.
Information about your rights
Right to rectification pursuant to Art. 16 GDPR:
You have the right to request that the controller correct your inaccurate personal data without delay. Taking into account the purposes of the processing, you have the right to request that incomplete personal data be completed, including by means of a supplementary statement.
Right to erasure (‘right to be forgotten’) pursuant to Article 17 of the GDPR:
You have the right to request that the controller erase your data without undue delay. The controller is obliged to erase personal data without undue delay if one of the following reasons applies:
- The purposes for which the personal data was collected no longer apply.
- You revoke your consent to the processing. There is no other legal basis for the processing.
- You object to the processing. There is no other legal basis for the processing.
- The personal data has been processed unlawfully.
- The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
- The personal data has been collected in relation to information society services offered in accordance with Article 8(1).
Right to restriction of processing pursuant to Art. 18 GDPR & Section 35 BDSG:
You have the right to request the restriction of processing if one of the following conditions applies:
- You doubt the accuracy of the personal data.
- The processing is unlawful; however, you refuse to have the data deleted.
- Personal data is no longer required for the purposes of processing; however, you require the data to assert, exercise or defend legal claims.
- You have objected to the processing pursuant to Art. 21(1) GDPR. Processing will be restricted until it has been determined whether the legitimate reasons of the controller outweigh your interests.
Right to data portability pursuant to Art. 20 GDPR:
You have the right to receive the data you have provided in a structured, commonly used and machine-readable format from the controller. We may not prevent the data from being transferred to another controller.
Right to object pursuant to Art. 21 GDPR:
To exercise this right, please contact the controller (see above).
Right to lodge a complaint with the supervisory authority pursuant to Art. 13(2)(d) and Art. 77 GDPR in conjunction with Section 19 BDSG:
If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the supervisory authority. To do so, please contact the competent supervisory authority.
Withdrawal of consent pursuant to Art. 7(3) GDPR:
If the processing is based on your consent pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a (processing of special categories of personal data), you are entitled to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent until withdrawal.