Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Tax Tech Lab GmbH, [[TO BE COMPLETED: street and house number of the business address]], [[TO BE COMPLETED: postcode and city]], [[TO BE COMPLETED: country of the registered office]]

Represented by: [[TO BE COMPLETED: first and last name of every authorised managing director]]

Email: kontakt@taxtec-lab.de · Phone: [[TO BE COMPLETED: telephone number]]

Data protection officer

Whether our company is required to appoint a data protection officer follows from Art. 37 GDPR in conjunction with section 38 BDSG and depends, among other things, on the number of persons engaged in processing and on the nature of the processing activities. This has to be determined separately for our company.

[[TO BE COMPLETED: name and contact details of the data protection officer – or an explicit statement that no appointment is required]]

Principles of processing

We process personal data only to the extent necessary to provide this website and its content, or where you have given your consent. You can use this website without providing personal data.

Personal data means any information relating to an identified or identifiable natural person, such as a name, an email address or an IP address.

Data transmission over the internet can have security gaps; complete protection of data against access by third parties is not possible. This website is delivered over an encrypted HTTPS connection.

Hosting and server log files

This website is operated on Microsoft Azure infrastructure (Microsoft Corporation / Microsoft Ireland Operations Limited). The hosting provider processes the data that technically arise when the website is accessed on our behalf.

Each time a page is requested, the server automatically records access data in what are known as server log files. These are typically: the IP address of the requesting device, the date and time of the request, the requested URL, the HTTP status code and the amount of data transferred, the browser and operating system used including version (user agent) and – where transmitted by the browser – the previously visited page (referrer).

This processing is technically necessary in order to deliver the website, to ensure its stability and security, and to detect and defend against attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and fault-free operation of this website. The log file data are not combined with other data sources and are not evaluated for advertising or analytics purposes.

[[TO BE COMPLETED: hosting region or data centre location, the specific Azure service used, and the retention period of the server log files]]

[[TO BE COMPLETED: confirmation of the data processing agreement (DPA) under Art. 28 GDPR with the hosting provider and – where processing takes place outside the EU/EEA – the safeguards under Art. 44 et seq. GDPR]]

Cookies and consent

When you first open this website, a consent banner is displayed. It distinguishes two categories: “strictly necessary” (always active and not deselectable) and “audience measurement” (switched off by default).

The “audience measurement” category is currently empty: no analytics or tracking service is integrated, and even if you consent to this category, no such service is loaded at present. The category exists solely so that any future integration is tied to prior consent.

The banner itself stores your choice in a first-party cookie named “cc_cookie” on your device. It contains only your decision about the categories and the time of that decision, and has a lifetime of approximately six months. Without this cookie we would have to ask for your choice again on every page view. Apart from this, the website sets no cookies of its own.

The legal basis for storing information on your device and accessing it is section 25 (2) no. 2 TDDDG (formerly TTDSG) for the strictly necessary consent cookie. For all optional categories, the legal basis is section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR. You may withdraw consent at any time with effect for the future by reopening the cookie preferences via the corresponding link and changing your selection.

[[TO BE COMPLETED: name, provider, purpose, legal basis, retention period and any third-country transfer for each analytics service – mandatory before any such service is activated]]

Fonts

This website uses web fonts to display text consistently. The font files are served exclusively from our own server and are embedded locally.

No connection is established to servers operated by Google Fonts, Adobe Fonts or any other font provider. Your IP address is therefore not transmitted to a third-party font provider.

Contacting us by email

If you contact us by email, we process the data you send us – in particular your email address, your name and the content of your message – solely in order to handle your enquiry and for any follow-up questions.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at entering into or performing a contract, and otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in responding to enquiries.

We delete these data once your enquiry has been dealt with conclusively and no statutory retention obligations prevent deletion.

[[TO BE COMPLETED: provider of the email mailbox and the retention or deletion periods for email correspondence]]

Demo request

A request form is displayed on the “Demo” page. This form is currently presentation only: it is not connected to any recipient, it transmits no data and it stores no input. Your entries do not leave your browser and do not reach us. You can contact us only via the email address given above.

[[TO BE COMPLETED: once the form is technically connected, add the recipient or processor, the data fields processed, the purpose, the legal basis and the retention period here – this section must not be left unchanged]]

Your rights

As a data subject, you have the following rights vis-à-vis the controller:

Access (Art. 15 GDPR): you may request confirmation of whether and which personal data concerning you we process, and obtain a copy of those data.

Rectification (Art. 16 GDPR): you may request that inaccurate data be corrected and incomplete data completed.

Erasure (Art. 17 GDPR): you may request the erasure of your data, unless statutory retention obligations or other exceptions apply.

Restriction of processing (Art. 18 GDPR): under certain conditions you may request that we restrict the processing of your data.

Data portability (Art. 20 GDPR): you may request that we transmit data you have provided to us in a structured, commonly used and machine-readable format.

Objection (Art. 21 GDPR): you may object to processing based on Art. 6 (1) (f) GDPR on grounds relating to your particular situation.

Withdrawal of consent (Art. 7 (3) GDPR): you may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

An informal message to kontakt@taxtec-lab.de is sufficient to exercise these rights.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, Art. 77 GDPR gives you the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement.

Supervisory authority competent for us: [[TO BE COMPLETED: name and full postal address of the data protection supervisory authority competent for the registered office]]

Changes to this privacy policy

We will amend this privacy policy as soon as the actual data processing on this website or the legal requirements change – for example, when an analytics service is integrated or the request form is technically connected. The version available on this page applies to your visit.

Version

Version of this privacy policy: [[TO BE COMPLETED: date of the current version]]