Protecting your personal data matters to us. As a tax advisory company (“Steuerberatungsgesellschaft”) we are bound not only by the General Data Protection Regulation (GDPR) but also by professional confidentiality under § 57 Abs. 1 StBerG and § 203 StGB, in the German Tax Advisory Act and the German Criminal Code.
Controller
FRADECO Deutsch-Französische Steuerberatungsgesellschaft mbH
Simrockstr. 92, 53619 Rheinbreitbach, Germany
Telephone: +49 2224 123 14 83
E-mail: contact@fradeco.de
Further details can be found in our legal notice.
Definitions
This privacy policy uses the terms of the General Data Protection Regulation. So that it is clear to every reader, we explain the most important ones first.
Personal data
Any information relating to an identified or identifiable natural person. A person is identifiable if they can be determined directly or indirectly — for example by a name, an identification number, location data, an online identifier or particular characteristics.
Data subject
Any identified or identifiable natural person whose personal data are processed.
Processing
Any operation performed on personal data — collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure or destruction.
Restriction of processing
The marking of stored data with the aim of limiting their processing in future.
Profiling
Any automated processing that evaluates personal aspects in order to analyse or predict, for example, economic situation, preferences, interests, reliability, behaviour or location.
Pseudonymisation
Processing after which the data can no longer be attributed to a specific person without additional information that is kept separately.
Controller
The body that determines, alone or jointly with others, the purposes and means of processing.
Processor
A body that processes personal data on behalf of the controller — a hosting provider, for example.
Recipient
A body to which personal data are disclosed, whether or not it is a third party.
Consent
Any freely given, specific, informed and unambiguous indication by which the data subject signifies agreement to the processing.
Visiting this website
Each time you visit, your browser automatically transmits information to the server of our hosting provider, where it is stored temporarily in log files: IP address, date and time of access, name and URL of the file retrieved, volume of data transferred, notification of successful retrieval, browser type and version, operating system and the page previously visited.
Purpose: delivering the website, system security, error analysis.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in secure and uninterrupted operation.
Retention: log files are deleted as soon as they are no longer needed for these purposes; as a rule this happens within seven days. If a security incident has to be investigated, the entries concerned are kept until it is resolved.
Hosting: ALL-INKL.COM — Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Processing takes place in a data centre in Germany; a data processing agreement under Art. 28 GDPR is in place.
Cookies
We distinguish two cases: cookies that are technically necessary, which we may set without your consent, and all others, for which we ask you beforehand.
Technically necessary. pll_language records which language version you are reading, so that you arrive there again on your next visit. It contains nothing but the language code — no identifier from which a link to you as a person could be established. Lifetime: one year. In addition there is fdc_einwilligung, which records your choice regarding all other cookies; without it we would have to ask you again on every page. Lifetime: six months; details under “Consent management”.
Legal basis: § 25 Abs. 2 Nr. 2 TDDDG, in the German Telecommunications Digital Services Data Protection Act — both are strictly necessary for a service you have expressly requested.
Subject to consent. For web analytics and for our advertising we set cookies only after you have agreed. Before you consent, these services are not loaded and no data are transmitted to Google. You can change or withdraw your choice at any time.
Consent management
We obtain your consent through our own banner, which runs entirely on our server. No external provider is involved, and the banner loads no third-party scripts. It appears on your first visit and offers, with equal weight, “Accept all”, “Reject all” and “Settings”. Under “Settings” you choose each purpose separately: statistics, ad measurement and personalised advertising.
Your choice on your device: the cookie fdc_einwilligung stores which purposes you have allowed, the time, the version of the banner and — if you have agreed to at least one purpose — a randomly generated identifier. It expires after six months, whether you accepted or refused; we then ask you again. We also ask again if the purposes or the services used change.
Record on our server: when you give, change or withdraw consent, we store in this website’s database the identifier from the cookie, the time, the version of the banner, your choice, the language version and the address of the page on which you decided. Your IP address and browser identifier are not stored; an entry can be linked to a person only through the cookie on their device. If you refuse without having agreed beforehand, we store nothing.
Purpose: obtaining your consent and demonstrating it, which Art. 7(1) GDPR requires of us.
Legal basis: Art. 6(1)(c) GDPR for the record, § 25 Abs. 2 Nr. 2 TDDDG for the cookie.
Retention: the records are deleted automatically after three years. This corresponds to the standard limitation period under German law, within which we must be able to demonstrate consent.
Changing or withdrawing your choice: the “Cookie settings” link at the foot of the page, or the button below, reopens your choice, which you can change or withdraw at any time. Withdrawal takes effect for the future; the lawfulness of processing carried out up to that point remains unaffected. Google services are then no longer loaded; you can also delete cookies already set in your browser.
Web analytics with Google Analytics
If you consent to statistics, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: to understand which content is read and by which routes visitors find us, so that we can shape the site accordingly.
Data processed: pages visited and time spent, approximate location at city level, device type, browser and operating system, the page previously visited, whether an enquiry was sent, an appointment booked or a telephone number tapped, and a pseudonymous identifier that recognises your device. Google Analytics does not receive the content of any form.
Legal basis: Art. 6(1)(a) GDPR and § 25 Abs. 1 TDDDG — your consent alone.
Cookies: _ga and _ga_<identifier>, each with a lifetime of 13 months.
Retention at Google: the retention of user-level data is set to 14 months; after that it is deleted automatically.
Your IP address is used to determine the approximate location; according to Google it is not stored in Google Analytics 4.
Google Ads: ad measurement and personalised advertising
We place advertisements through Google Ads, likewise a service of Google Ireland Limited. We use two of its functions, to which you can agree separately in the banner.
Ad measurement shows us which advertisement led to an enquiry. An enquiry means sending one of our forms — applications excepted — or booking an appointment; we also record when a telephone number is tapped. Google does not receive the content of an enquiry.
Enhanced conversions: so that an enquiry can be attributed to an advertisement even where cookies are not sufficient, we additionally send Google your e-mail address and, if provided, your telephone number when you make an enquiry. Both are hashed in your browser before transmission, that is, converted into a string of characters that cannot be reversed. Google compares this value with the details of signed-in Google accounts, converted in the same way, and uses it solely for this attribution. This happens only if you have consented to ad measurement.
Personalised advertising: your device is recognised so that we can show suitable advertisements on other websites to people who have visited ours (remarketing).
Legal basis: Art. 6(1)(a) GDPR and § 25 Abs. 1 TDDDG — your consent alone, given separately for each of the two functions.
Cookies: _gcl_au, _gcl_aw and _gcl_dc with a lifetime of 90 days, IDE on doubleclick.net (13 months) and test_cookie (15 minutes). They are set as soon as you have agreed to either of the two functions.
Withdrawal: via the cookie settings at the foot of the page. You can also switch off personalised advertising in your Google ad settings.
Google’s role and transfer to the United States — for Google Analytics and Google Ads: for Google Analytics and for enhanced conversions, Google processes the data on our behalf; a data processing agreement under Art. 28 GDPR is in place. For the remaining ad measurement and for personalised advertising, Google acts as an independent controller; Google’s data protection terms for controllers apply. Google describes its role for each of its services in its overview of advertising services. Processing by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. Details can be found in Google’s privacy policy.
Contacting us
If you contact us by e-mail or telephone, we process your details in order to deal with your enquiry and any follow-up questions.
Legal basis: Art. 6(1)(b) GDPR for enquiries relating to an engagement, otherwise Art. 6(1)(f) GDPR.
Retention: erasure once the matter has been dealt with, unless retention obligations apply. For client engagements, § 66 StBerG and §§ 147 AO and 257 HGB apply.
Contact form
A form is available on our contact page; you are equally welcome to reach us informally by e-mail or telephone at any time.
Mandatory details: name, e-mail address, company, the topic selected under “What is it about?” and your message. Optional: your telephone number.
Purpose: dealing with your enquiry and any follow-up questions.
Legal basis: Art. 6(1)(b) GDPR where your enquiry is aimed at establishing or performing an engagement; otherwise Art. 6(1)(f) GDPR — legitimate interest in answering enquiries. No consent is required for this; the box you tick before sending merely confirms that you were able to take note of this policy.
Retention: erasure once your enquiry has been dealt with, and after six months at the latest. If the enquiry leads to an engagement, § 66 StBerG and §§ 147 AO and 257 HGB apply.
Your details are sent as an e-mail to contact@fradeco.de — the address you provide is entered as the reply address — and are additionally stored in this website’s database so that no enquiry is lost. Access to it is limited to people with a personal, password-protected login to the website administration. The time of sending and the address and title of the page are stored as well; your IP address and browser identifier are expressly not stored. Your details are neither passed on to third parties nor used to advertise to you. The only exception, and only if you have consented to ad measurement: after sending, we transmit your e-mail address and, where applicable, your telephone number to Google in hashed form so that the enquiry can be attributed to an advertisement (see “Google Ads”).
If you reach us through one of our campaign pages, we also record which campaign the enquiry came from. Only the campaign parameters in the address line are evaluated for this; no identifier that would make you recognisable is stored.
Objection and erasure: you may object to the processing at any time and ask for your enquiry to be deleted. An informal message to contact@fradeco.de is enough.
Spam protection on our forms
All forms are protected against automated submissions. The checks run exclusively on our own server: three fields that are invisible to you and must remain empty; the interval between the form being built and being sent, of which only the duration in milliseconds is transmitted — no clock time and no point in time; and a limit on the number of submissions per connection within ten minutes.
For that limit, your IP address is converted into a check value using a secret key held only on our server. Only this check value is stored, and it is deleted automatically after ten minutes; the IP address itself is never stored, and it cannot be recovered from the check value without the key — this is pseudonymisation in the sense described above.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in preventing misuse of our forms.
No cookies are set in the process and no data are transmitted to third parties. No external service such as Google reCAPTCHA or Akismet is used.
Booking an appointment
On our home page you can book a free initial consultation and choose the day and time yourself. You are equally welcome to arrange an appointment informally by e-mail or telephone.
Mandatory details: name, e-mail address and the appointment you select. Optional: company, telephone number and a short description of your matter.
Purpose: arranging, confirming and holding the initial consultation, and preventing double bookings.
Legal basis: Art. 6(1)(b) GDPR — the initial consultation serves to establish an engagement. No consent is required for this; the box you tick before sending merely confirms that you were able to take note of this policy.
Retention: erasure once the conversation has taken place and any proposal has been dealt with, and after six months at the latest. If an engagement comes about, § 66 StBerG and §§ 147 AO and 257 HGB apply.
The booking is stored in this website’s database so that the appointment is firmly recorded and not allocated twice. We also send two e-mails: a confirmation to you, in the language in which you are reading the site, and a notification to contact@fradeco.de. The time of booking, the language version and the address and title of the page are stored as well; IP address and browser identifier are expressly not stored. Both e-mails include an appointment file in iCalendar format (.ics), which is generated solely for sending and deleted from the server immediately afterwards. If you have consented to ad measurement, the booking is treated like the contact form: we transmit your e-mail address and, where applicable, your telephone number to Google in hashed form (see “Google Ads”).
Video conference: the initial consultation is held via Microsoft Teams; we send you the access details by e-mail before the appointment. When you join, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, processes the data arising — in particular your display name, connection data and picture and sound during the conversation. A transfer to the United States cannot be ruled out in this context; Microsoft is certified under the EU-US Data Privacy Framework, and a data processing agreement under Art. 28 GDPR is in place. Details can be found in Microsoft’s privacy statement. Joining is voluntary — on request we will hold the conversation by telephone.
Cancellation, objection and erasure: you may cancel the appointment at any time, object to the processing and ask for your details to be deleted. Replying to the confirmation e-mail is enough.
Applications
You can send us a speculative application through the form on our careers page; you are equally welcome to send us your documents informally by e-mail.
Data processed: name, e-mail address, the field of work you are interested in, your message and the documents you upload. Telephone number and earliest starting date are optional.
Purpose: assessing your application and conducting the recruitment process.
Legal basis: Art. 6(1)(b) GDPR; for any details beyond that, your consent under Art. 6(1)(a) GDPR.
Retention: if we do not work together, we delete your application six months after the process ends. This period reflects the fact that claims under the German General Equal Treatment Act can be asserted within two months (§ 15 Abs. 4 AGG) and that proceedings may follow. If you are hired, the documents pass into your personnel file.
Your documents are not stored on this website. Uploaded files are attached to the application e-mail and deleted from the server immediately after it is sent; only the entries from the text fields remain in the database. Your application is read solely by people within our firm who are involved in the selection process — no recruitment agency and no applicant tracking software is used. Applications are not reported to Google either. The spam protection described above applies here too.
A photograph, your date of birth or details of your marital status are not required for an application; you may leave them out without any disadvantage. If we would like to keep your documents beyond the period stated for future opportunities, we will ask you separately beforehand. You may withdraw your application and ask for your data to be deleted at any time; an informal message to contact@fradeco.de is enough.
Data backups
Backup copies of the website and its database are made weekly so that operation can be restored after a technical fault. They also contain the enquiries, bookings and consent records received. A deleted enquiry may therefore still be contained in a backup copy until that copy is overwritten or deleted.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in being able to restore our systems.
Storage location and retention: the automatic backups are held on the same server in Germany as the website. The six most recent are kept and older ones are overwritten automatically — a period of around six weeks. In addition we occasionally make backups on external media, which are kept physically secured and erased after 90 days at the latest. No cloud or third-party service is used for this, and no transfer to a third country takes place.
Recipients
Your data are not passed on to third parties unless we are legally obliged to do so or you have consented. Beyond the bodies named in this policy — our hosting provider, Google for web analytics and advertising and, solely for the video conference, Microsoft — no other service provider is involved. We run consent management ourselves.
Legal bases and legitimate interests
The applicable legal basis is stated above for each processing operation: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), compliance with legal obligations such as tax retention duties or demonstrating consent (Art. 6(1)(c)), the pursuit of legitimate interests (Art. 6(1)(f)) or — where expressly stated — your consent (Art. 6(1)(a)). The legitimate interests consist in the security of our systems, the prevention of misuse and the answering of enquiries.
Your rights
You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7(3)); the lawfulness of processing carried out up to that point remains unaffected.
An informal message to contact@fradeco.de is enough.
Automated decision-making
No automated individual decision within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you takes place. Which advertisements Google shows you in remarketing is based on an evaluation by Google; it takes place only with your consent to personalised advertising.
Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is:
Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, the data protection commissioner for Rhineland-Palatinate
Hintere Bleiche 34, 55116 Mainz, Germany
www.datenschutz.rlp.de
Language versions
This page is also available in German and French. The translations are provided to aid understanding; in the event of any discrepancy, the German version prevails.