Source: https://revision-nord.com/en/data-security/
Timestamp: 2019-04-23 14:30:24+00:00

Document:
From which source do we obtain your personal data?
In principle, the collection of your data takes place on your premises. The processing of personal data provided by you is necessary to fulfill the obligations arising from the contract you have concluded with us. Due to your duties to cooperate, it is inevitable to provide the personal data requested by us, otherwise, we will not be able to fulfill our contractual obligations. Otherwise, accounting or tax disadvantages can no longer be ruled out for you.
Provision of your personal data is necessary within the framework of pre-contractual measures (e.g., master data entry in the interested party process). If the requested data is not provided by you, a contract cannot be concluded.
In order to provide our services, it may be necessary to process personal data that we have received from other companies or other third parties, e.g., revenue offices, your business partner, or the like, permissibly and for the respective purpose.
Furthermore, we may process personal data from sources that are publicly accessible, e.g., websites, which we use legitimately and only for the respective contractual purpose.
The purposes of data processing result from legal requirements or lie in the public interest (e.g., compliance with retention obligations; proof of compliance with the tax consultant’s notification and information obligations).
On the one hand, the purposes of the data processing result from the introduction of pre-contractual measures that precede a contractually regulated business relation, and on the other hand from the fulfillment of the obligations from the contract that was closed with you.
The purposes of processing personal data result from giving consent. Your consent can be revoked at any time with effect for the future. Consents given before the GDPR took effect (25 May 2018) can also be revoked. Processing that took place before the revocation remains unaffected by the revocation. For example: Sending a newsletter; rlease from professional secrecy to data disclosure to third parties at your request (e.g., banks, insurances, shareholders, etc.).
The purposes of the processing result from the protection of our legitimate interests. It may be necessary to process the data you have provided to us beyond the actual performance of the contract. Our legitimate interest may be used to justify further data processing that you have provided to us, subject to the condition that your interests or fundamental rights and freedoms do not prevail. Our legitimate interest may be in individual cases: enforcement of legal claims; defense of liability claims; prevention of criminal offenses.
The purposes of the data processing result on the one hand from the introduction of pre-contractual measures which precede a contractually regulated employment relationship, and on the other hand from the fulfillment of the obligations from the employment contract concluded with you.
Your personal data may be processed to detect criminal offences if there are actual grounds for suspecting that you have committed a criminal offence in your employment; if, moreover, the processing is necessary for detection and your legitimate interest in the exclusion of the processing does not outweigh, in particular, if the nature and extent are not disproportionate to the cause.
The purposes of processing personal data result from granting consent. You may revoke your consent at any time with effect for the future. Consents granted before the GDPR took effect (25 May 2018) can also be revoked. Processing that took place before the revocation remains unaffected by the revocation. For example: Publication of your image on our website.
Who receives the personal data you provide us with?
Within our company, only those divisions receive access to the personal data that you have provided to us, which are required to fulfill contractual and legal obligations and which are entitled to process this data.
In fulfillment of the contract that has been concluded with you, only those divisions receive the data that you have provided to us, which require this data for legal reasons, e.g., tax authorities; social insurance carriers; competent authorities and courts.
As professional secrecy holders, we are obliged to observe and implement professional secrecy. Other recipients will only receive the data you have provided to us at your request if you give us the necessary consent.
Within the scope of our services, we commission contractors who contribute to the fulfillment of contractual obligations, e.g., computer center service providers; EDP partners; companies who shredder documents, etc. We contractually oblige these data processors to observe professional confidentiality and to comply with the requirements of the GDPR and the BDSG.
Will the data you provide to us be transferred to third countries or international organizations?
Data that you provide to us will in no case be transferred to a third country or an international organization. If in individual cases, you wish the data you have provided to us to be transferred to a third country or an international organization, we will only do so with your written consent and release from professional secrecy.
No fully automated decision making (including profiling) according to art. 22 GDPR is applied to process the data you have provided to us.
The data you have provided to us will be processed for as long as it is necessary to achieve the contractually agreed purpose, in principle, as long as the contractual relationship with you exists. After the end of the contractual relationship, the data you have provided to us will be processed to comply with legal retention obligations or on the basis of our legitimate interests. After the legal retention periods have expired or our legitimate interests have ceased to exist, the data that you have provided to us will be deleted.
Fulfillment of commercial, tax, and professional retention periods: The periods for storage and documentation specified therein range from two to ten years.
Preservation of evidence under the statute of limitations: According to sections 195 contd. of the German Civil Code (BGB), the limitation period can be up to 30 years, whereas the standard limitation period is three years.
When you send us an application, we will only use the information you have provided. In addition to the legal bases mentioned above, this is done for the implementation of pre-contractual measures acc. to art. 6 para. 1 subpara. b GDPR, and for the decision on the establishment of an employment relationship acc. to art. 26 para. 1 sentence 1 BDSG.
During the application process, only those persons who are involved in the application process within our company will have access to your data.
If your application leads to the establishment of an employment relationship, your personal data will continue to be processed for the purpose of carrying out the employment relationship.
If your application does not lead to the establishment of an employment relationship, your personal data will still be processed after the end of the application procedure on the basis of justified interests, e.g., for asserting or defending claims for damages, and will be deleted after our justified interests have ceased to exist and after the expiry of legal retention periods. This is usually the case after three months after a cancellation unless you have given us your consent to a longer storage.
Upon request, you have the right to receive information free of charge as to whether and what data about you is stored and for what purpose it is stored.
You have the right to request from the Data protection officer to correct your incorrect personal data without delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data – also by means of a supplementary declaration.
a) Purposes shall cease to apply for which the personal data was collected.
b) You are revoking your consent to the processing. There is no other legal basis for the processing.
c) You object to the processing. There is no other legal basis for the processing.
e) The deletion of personal data is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the Data protection officer is subject.
f) The personal data has been collected in relation to information society services provided in accordance with article 8 para. 1.
a) You doubt the accuracy of the personal data.
b) The processing is unlawful, but you refuse to have it deleted.
c) Personal data is no longer required for the purposes of processing; however, you will need the data to assert, exercise, or defend legal claims.
d) You have filed an objection against the processing acc. to art. 21 para. 1 GDPR. As long as it has not yet been determined whether the legitimate reasons of the responsible person outweigh you, the processing will be restricted.
You have the right to receive the data you provided from the person responsible in a structured, current, and machine-readable format. Forwarding it to another responsible person may not be hindered by us.
In this case, please contact the person responsible for processing (see above).
If the processing is based on your consent acc. to art. 6 para. 1 subpara. a or art. 9 para. 2 subpara. a (processing of special categories of personal data), you are at any time entitled to withdraw the appropriately bound consent without prejudice to the legality of the processing which has taken place on the basis of the consent until revocation.

References: art. 22
 art. 6
 art. 26
 art. 21
 art. 6
 art. 9