Protecting your personal data matters to us. As a tax advisory company (“Steuerberatungsgesellschaft”) we are bound not only by the General Data Protection Regulation (GDPR) but also by professional confidentiality under § 57 Abs. 1 StBerG and § 203 StGB, in the German Tax Advisory Act and the German Criminal Code.
Controller
FRADECO Deutsch-Französische Steuerberatungsgesellschaft mbH
Simrockstr. 92, 53619 Rheinbreitbach, Germany
Telephone: +49 2224 123 14 83
E-mail: contact@fradeco.de
Further details can be found in our legal notice.
Definitions
This privacy policy uses the terms of the General Data Protection Regulation. So that it is clear to every reader, we explain the most important ones first.
Personal data
Any information relating to an identified or identifiable natural person. A person is identifiable if they can be determined directly or indirectly — for example by a name, an identification number, location data, an online identifier or particular characteristics.
Data subject
Any identified or identifiable natural person whose personal data are processed.
Processing
Any operation performed on personal data — collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure or destruction.
Restriction of processing
The marking of stored data with the aim of limiting their processing in future.
Profiling
Any automated processing that evaluates personal aspects in order to analyse or predict, for example, economic situation, preferences, interests, reliability, behaviour or location.
Pseudonymisation
Processing after which the data can no longer be attributed to a specific person without additional information that is kept separately.
Controller
The body that determines, alone or jointly with others, the purposes and means of processing.
Processor
A body that processes personal data on behalf of the controller — a hosting provider, for example.
Recipient
A body to which personal data are disclosed, whether or not it is a third party.
Consent
Any freely given, specific, informed and unambiguous indication by which the data subject signifies agreement to the processing.
Visiting this website
Each time you visit, your browser automatically transmits information to the server of our hosting provider, where it is stored temporarily in log files: IP address, date and time of access, name and URL of the file retrieved, volume of data transferred, notification of successful retrieval, browser type and version, operating system and the page previously visited.
Purpose: delivering the website, system security, error analysis.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in secure and uninterrupted operation.
Retention: log files are deleted as soon as they are no longer needed for these purposes; as a rule this happens within seven days. If a security incident has to be investigated, the entries concerned are kept until it is resolved.
Hosting: ALL-INKL.COM — Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Processing takes place in a data centre in Germany; a data processing agreement under Art. 28 GDPR is in place.
Cookies
We distinguish two cases: cookies that are technically necessary, which we may set without your consent, and all others, for which we ask you beforehand.
Technically necessary. pll_language records which language version you are reading, so that you arrive there again on your next visit. It contains nothing but the language code — no identifier from which a link to you as a person could be established. Lifetime: one year. In addition there is the cookie of our consent management tool, which records your choice; without it we would have to ask you again on every page.
Legal basis: § 25 Abs. 2 Nr. 2 TDDDG, in the German Telecommunications Digital Services Data Protection Act — both are strictly necessary for a service you have expressly requested.
Subject to consent. For web analytics and for our advertising we set cookies only after you have agreed. Before you consent, these services are not loaded and no data are transmitted to Google. You can change or withdraw your choice at any time.
Consent management
To obtain and document your consent, and to let you withdraw it, we use CCM19, a tool provided by Papoo Software & Media GmbH, add the provider’s address. The banner shown on your first visit comes from this tool.
Data processed: your choice, that is, which categories you have allowed or refused, the time and version of the consent, and a pseudonymous identifier by which the record of your choice can be attributed.
Purpose: obtaining your consent and demonstrating it, which Art. 7(1) GDPR requires of us.
Legal basis: Art. 6(1)(c) GDPR for the documentation, § 25 Abs. 2 Nr. 2 TDDDG for storage on your device.
Cookie and retention: add the cookie name, its lifetime and the retention of consent records after installation.
Processing on our behalf: the service is operated as a cloud solution; the consent records are held on servers add the storage location. A data processing agreement under Art. 28 GDPR is in place.
Withdrawal: you can change your choice at any time via the “Cookie settings” link at the foot of the page. The lawfulness of processing carried out up to that point remains unaffected.
Web analytics with Google Analytics
After you have consented, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: to understand which content is read and by which routes visitors find us, so that we can shape the site accordingly.
Data processed: pages visited and time spent, approximate location at city level, device type, browser and operating system, the page previously visited and a pseudonymous identifier that recognises your device.
Legal basis: Art. 6(1)(a) GDPR and § 25 Abs. 1 TDDDG — your consent alone.
Cookies: _ga and _ga_<identifier>, each with a lifetime of two years.
Retention at Google: the retention of user-level data is set to 14 months; after that it is deleted automatically.
Your IP address is used to determine the approximate location; according to Google it is not stored in Google Analytics 4.
Google Ads: conversion measurement and remarketing
We place advertisements through Google Ads, likewise a service of Google Ireland Limited. After you have consented, we use two of its functions.
Conversion measurement shows us which advertisement led to an enquiry. What is recorded is that a form was sent, not its content.
Remarketing and audiences: your device is recognised so that we can later show you advertisements matching your interest and build audiences for further advertisements.
Legal basis: Art. 6(1)(a) GDPR and § 25 Abs. 1 TDDDG — your consent alone.
Cookies: _gcl_au with a lifetime of 90 days, together with cookies that Google sets on its own domains when serving advertisements.
Withdrawal: via the cookie settings at the foot of the page. You can also switch off personalised advertising in your Google ad settings.
Transfer to the United States — for both of the above services: processing by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. For both services a data processing agreement under Art. 28 GDPR is in place. Details can be found in Google’s privacy policy.
Contacting us
If you contact us by e-mail or telephone, we process your details in order to deal with your enquiry and any follow-up questions.
Legal basis: Art. 6(1)(b) GDPR for enquiries relating to an engagement, otherwise Art. 6(1)(f) GDPR.
Retention: erasure once the matter has been dealt with, unless retention obligations apply. For client engagements, § 66 StBerG and §§ 147 AO and 257 HGB apply.
Contact form
A form is available on our contact page; you are equally welcome to reach us informally by e-mail or telephone at any time.
Mandatory details: name, e-mail address, company, the topic selected under “What is it about?” and your message. Optional: your telephone number.
Purpose: dealing with your enquiry and any follow-up questions.
Legal basis: Art. 6(1)(b) GDPR where your enquiry is aimed at establishing or performing an engagement; otherwise Art. 6(1)(f) GDPR — legitimate interest in answering enquiries. No consent is required for this; the box you tick before sending merely confirms that you were able to take note of this policy.
Retention: erasure once your enquiry has been dealt with, and after six months at the latest. If the enquiry leads to an engagement, § 66 StBerG and §§ 147 AO and 257 HGB apply.
Your details are sent as an e-mail to contact@fradeco.de — the address you provide is entered as the reply address — and are additionally stored in this website’s database so that no enquiry is lost. Access to it is limited to people with a personal, password-protected login to the website administration. The time of sending and the address and title of the page are stored as well; your IP address and browser identifier are expressly not stored. There is no disclosure to third parties and no use for advertising purposes.
If you reach us through one of our campaign pages, we also record which campaign the enquiry came from. Only the campaign parameters in the address line are evaluated for this; no identifier that would make you recognisable is stored.
Objection and erasure: you may object to the processing at any time and ask for your enquiry to be deleted. An informal message to contact@fradeco.de is enough.
Spam protection on our forms
All forms are protected against automated submissions. The checks run exclusively on our own server: three fields that are invisible to you and must remain empty; the interval between the form being built and being sent, of which only the duration in milliseconds is transmitted — no clock time and no point in time; and a limit on the number of submissions per connection within ten minutes.
For that limit, your IP address is converted into a check value using a secret key held only on our server. Only this check value is stored, and it is deleted automatically after ten minutes; the IP address itself is never stored, and it cannot be recovered from the check value without the key — this is pseudonymisation in the sense described above.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in preventing misuse of our forms.
No cookies are set in the process and no data are transmitted to third parties. No external service such as Google reCAPTCHA or Akismet is used.
Booking an appointment
On our contact page you can book a free initial consultation and choose the day and time yourself. You are equally welcome to arrange an appointment informally by e-mail or telephone.
Mandatory details: name, e-mail address and the appointment you select. Optional: company, telephone number, preferred language for the conversation and a short description of your matter.
Purpose: arranging, confirming and holding the initial consultation, and preventing double bookings.
Legal basis: Art. 6(1)(b) GDPR — the initial consultation serves to establish an engagement. No consent is required for this; the box you tick before sending merely confirms that you were able to take note of this policy.
Retention: erasure once the conversation has taken place and any proposal has been dealt with, and after six months at the latest. If an engagement comes about, § 66 StBerG and §§ 147 AO and 257 HGB apply.
The booking is stored in this website’s database so that the appointment is firmly recorded and not allocated twice. We also send two e-mails: a confirmation to you and a notification to contact@fradeco.de. The time of booking and the address and title of the page are stored as well; IP address and browser identifier are expressly not stored. Both e-mails include an appointment file in iCalendar format (.ics), which is generated solely for sending and deleted from the server immediately afterwards.
Video conference: the initial consultation is held via Microsoft Teams; we send you the access details by e-mail before the appointment. When you join, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, processes the data arising — in particular your display name, connection data and picture and sound during the conversation. A transfer to the United States cannot be ruled out in this context; Microsoft is certified under the EU-US Data Privacy Framework, and a data processing agreement under Art. 28 GDPR is in place. Details can be found in Microsoft’s privacy statement. Joining is voluntary — on request we will hold the conversation by telephone.
Cancellation, objection and erasure: you may cancel the appointment at any time, object to the processing and ask for your details to be deleted. Replying to the confirmation e-mail is enough.
Applications
You can send us a speculative application through the form on our careers page; you are equally welcome to send us your documents informally by e-mail.
Data processed: name, e-mail address, the field of work you are interested in, your message and the documents you upload. Telephone number and earliest starting date are optional.
Purpose: assessing your application and conducting the recruitment process.
Legal basis: Art. 6(1)(b) GDPR; for any details beyond that, your consent under Art. 6(1)(a) GDPR.
Retention: if we do not work together, we delete your application six months after the process ends. This period reflects the fact that claims under the German General Equal Treatment Act can be asserted within two months (§ 15 Abs. 4 AGG) and that proceedings may follow. If you are hired, the documents pass into your personnel file.
Your documents are not stored on this website. Uploaded files are attached to the application e-mail and deleted from the server immediately after it is sent; only the entries from the text fields remain in the database. Your application is read solely by people within our firm who are involved in the selection process — no recruitment agency and no applicant tracking software is used. The spam protection described above applies here too.
A photograph, your date of birth or details of your marital status are not required for an application; you may leave them out without any disadvantage. If we would like to keep your documents beyond the period stated for future opportunities, we will ask you separately beforehand. You may withdraw your application and ask for your data to be deleted at any time; an informal message to contact@fradeco.de is enough.
Data backups
Backup copies of the website and its database are made weekly so that operation can be restored after a technical fault. They also contain the enquiries and bookings received. A deleted enquiry may therefore still be contained in a backup copy until that copy is overwritten or deleted.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in being able to restore our systems.
Storage location and retention: the automatic backups are held on the same server in Germany as the website. The six most recent are kept and older ones are overwritten automatically — a period of around six weeks. In addition we occasionally make backups on external media, which are kept physically secured and erased after 90 days at the latest. No cloud or third-party service is used for this, and no transfer to a third country takes place.
Recipients
Your data are not passed on to third parties unless we are legally obliged to do so or you have consented. Beyond the bodies named in this policy — our hosting provider, the provider of our consent management tool, Google for web analytics and advertising and, solely for the video conference, Microsoft — no other service provider is involved.
Legal bases and legitimate interests
The applicable legal basis is stated above for each processing operation: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), compliance with legal obligations such as tax retention duties (Art. 6(1)(c)), the pursuit of legitimate interests (Art. 6(1)(f)) or — where expressly stated — your consent (Art. 6(1)(a)). The legitimate interests consist in the security of our systems, the prevention of misuse and the answering of enquiries.
Your rights
You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7(3)); the lawfulness of processing carried out up to that point remains unaffected.
An informal message to contact@fradeco.de is enough.
Automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is:
Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, the data protection commissioner for Rhineland-Palatinate
Hintere Bleiche 34, 55116 Mainz, Germany
www.datenschutz.rlp.de
Language versions
This page is also available in German and French. The translations are provided to aid understanding; in the event of any discrepancy, the German version prevails.