Privacy notice

1. Controller

Matthias Steger Consulting Steuerberatungsgesellschaft mbH
Dennis-Gabor-Strasse 2
14469 Potsdam, Germany
Phone: +49 331 76 99 100
Email: info@steger-consulting.de

Represented by its managing director, Matthias Steger, German certified tax advisor.

Data protection officer

Ms Liliya Frank
Email: l.frank@steger-consulting.de
Postal address: c/o the address given above

2. Professional confidentiality

As a German tax advisory company we are bound by statutory professional confidentiality under section 57 of the Tax Advisory Act and section 203 of the Criminal Code. Client data is not passed to third parties unless you expressly release us from confidentiality or disclosure is required by law. This duty sits alongside data protection law and protects you in addition to it.

3. Server logs

Each time a page is opened, your browser transmits technically necessary data which our web server records:

• IP address of the requesting device
• date and time of access
• name and address of the file retrieved
• volume of data transferred and whether the request succeeded
• browser and operating system used
• the page previously visited, where your browser transmits it

Purpose and legal basis: secure and stable operation of the website and defence against attacks, based on our legitimate interest under Art. 6(1)(f) GDPR. This data is not merged with other sources and is not evaluated for advertising purposes.

Retention: log files are deleted after seven days at the latest, unless required to investigate a specific security incident.

Processor: the website is operated at our hosting provider, with whom a data processing agreement under Art. 28 GDPR is in place.

4. Encryption

This website is delivered exclusively over an encrypted connection, shown by the padlock symbol in your address bar and the prefix https. Data you send us cannot be read by third parties in transit.

5. Cookies

This website sets no advertising, analytics or recognition cookies.

When you submit the call-back form, a technically necessary session identifier is set. It serves only to protect the form against forged submissions and automated bulk requests, contains no personal content and expires when you close your browser. The legal basis is section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR; no consent is required for this.

6. Web fonts

For consistent presentation we use the typefaces Archivo, IBM Plex Mono and Source Serif 4. These fonts are served exclusively from our own server. No connection to third-party servers – in particular not to Google Fonts – is established, and no data is transmitted to third parties for this purpose.

All three typefaces are licensed under the SIL Open Font License 1.1.

7. Bundestag hearing video

A recording from the German Bundestag's parliamentary broadcasting service is embedded on the home page and on the Expertise page. The video does not load automatically. As long as you do not click the play button, no connection to the Bundestag is established and no data is sent there.

Only your click loads the player. The German Bundestag then learns your IP address and further technical data about your browser. Your click constitutes your consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw it by reloading the page and not starting the video again. The German Bundestag is then the controller for that processing; see its own privacy notice for details.

8. Call-back form

If you request a call back, we process:

• your name
• your phone number
• your preferred time window
• the topic you state, if any
• the time of submission

Purpose: solely to call you back and prepare for your enquiry. No use for advertising, no disclosure to third parties.

Legal basis: your consent under Art. 6(1)(a) GDPR, given expressly in the form, and Art. 6(1)(b) GDPR for steps taken prior to entering into an engagement. You may withdraw consent at any time without formality; the lawfulness of processing carried out until then is unaffected.

Transmission and storage: the details are sent to us by email and additionally recorded on the web server in a file blocked against external access, so that no enquiry is lost if email delivery fails.

Retention: if no engagement results, we delete the details after 90 days at the latest. If an engagement results, professional and commercial retention periods apply, in particular section 66 of the Tax Advisory Act and the tax retention periods of six to ten years.

Abuse prevention: to deter automated bulk requests we check whether a field invisible to humans was filled in, how long completion took, and how many requests arrive from the same session. No additional personal data is stored for this.

9. Contact by phone, email and WhatsApp

If you call or write to us, we process your details in order to deal with your enquiry, on the basis of Art. 6(1)(b) and (f) GDPR.

Our pages contain links to WhatsApp. Clicking one opens the service operated by WhatsApp Ireland Limited, subject to its terms, and transmits data to that company, which belongs to the Meta group. We use WhatsApp only for first contact and scheduling. Please do not send us documents or details of your tax affairs via WhatsApp. We provide an encrypted channel for exchanges within an engagement.

10. Links to other websites

This site links to external services including the German Bundestag, the Federal Fiscal Court, professional associations, trade media and our own projects TaxTobi.AI and Krypto-Steuerakademie. A link alone transmits no data. Once you follow a link, the privacy notice of that provider applies.

Referral links to third-party software contain an identifier used to attribute commission. Only when you click such a link does the provider learn that you arrived via our website.

11. Your rights

You have the following rights regarding your personal data:

• Access to whether and which data we process (Art. 15 GDPR)
• Rectification of inaccurate details (Art. 16 GDPR)
• Erasure, unless a retention obligation applies (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal message to info@steger-consulting.de is sufficient.

Right to lodge a complaint

You may also lodge a complaint with a supervisory authority. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany
www.lda.brandenburg.de

12. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place on this website.

13. Changes to this notice

We update this notice whenever the technical setup of the website or the legal position changes. The version published here is the applicable one.