Privacy policy and general data protection information for clients

We will inform you below how and on what basis we process your personal data and what rights you have.

1. Who is responsible for data processing?

PM GmbH Wirtschaftsprüfungsgesellschaft
Steuerberatungsgesellschaft
represented by the Managing Directors

Innere Wiener Strasse 11 a
81667 Munich
Email: info@pm-wpg.de
Telephone: +49 (89) 520 348-0 

You can reach our data protection officer at 
E-Mail: datenschutz@pm-wpg.de

2. Processing purposes and legal basis

Your personal data are processed in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other relevant data protection regulations. Further details and additions to the processing purposes can be found in our contract documents, forms, declarations of consent and the other information provided to you (e.g. the website or the general terms and conditions).

We process personal data for the purposes of

• Execution and processing of the client relationship including correspondence,
• Fulfillment of our contractual and legal obligations as tax consultants and auditors and
• Processing within the framework of mutual claims from the contractual relationship (e.g. invoicing, claims for performance, remuneration and liability, etc.).

2.1 Consent (Art. 6 Para. 1 a GDPR)

If you have given us explicitly your consent for the processing of personal data for certain purposes, the respective consent is the legal basis for the aforementioned processing. You can withdraw your consent at any time with withstanding future effect.

2.2 Implementation of pre-contractual measures and fulfillment of contractual obligations (Art. 6 Para. 1 b GDPR)

We process your personal data to carry out measures and activities in the context of pre-contractual relationships, in particular for contract negotiations. Furthermore, your personal data will be processed to fulfill our mandate contract and to use our services.

2.3 Fulfillment of legal obligations (Art. 6 Para. 1 lit. c GDPR)

We process your personal data insofar as this is necessary to fulfill commercial and tax law retention requirements or other legal standards (e.g. according to the Money Laundering Act).

2.4 Protection of the legitimate interests of us or a third party (Art. 6 Para. 1 lit.f GDPR)

We can also process your personal data based on a balance of interests to protect the legitimate interests of us or a third party. In particular, the continuous business relationship with our clients is in our legitimate interest.

3. Categories of personal data that we process

The following data categories are processed:

• First and last name,
• Title, if applicable
• Postal addresses
• Phone numbers
• Fax numbers
• Email address

Information required for the appropriate execution of the mandate

4. Who receives your data?

We process your personal data within our company to the extent that we need this data to fulfill the contractual and legal obligations or to implement our legitimate interest. 

The transfer of personal data to third parties takes place only on your behalf and with your consent. We pass on personal data within the scope of the mandate to the following recipients:

• Tax authorities and courts
• Social security funds
• Bundesanzeiger Verlag GmbH
• Banks, credit institutions, insurance companies and professional associations
• Processors (e.g. data centers, IT service providers, print service providers, waste disposal companies, etc.) whose services we only use insofar as they, as contributors, ensure that our professional secrets are protected in accordance with Section 203 (3) of the Criminal Code.
• Depending on each individual case, to other recipients, whom we will coordinate with you in advance

5. Transmission of your data to a recipient in a third country or to an international organization

Data is only transferred to third countries (countries outside the European Economic Area - EEA) if this is necessary for the execution of the mandate contract (e.g. payment orders) or you have given us your consent or this is otherwise permitted by law. In this case, we take measures to ensure the protection of your data, for example through contractual regulations. We only transmit to recipients who ensure the protection of your data in accordance with the provisions of the GDPR for transmission to third countries (Art. 44 to 49 GDPR).

6. How long do we store your data?

If necessary, we process your personal data for the duration of our contractual relationship with you. 

In addition, we are subject to various storage and documentation obligations, which may a. result from the legal framework. As a rule, this is 10 years plus a waiting period of a further 4 years in order to record cases of possible inhibition of expiry.

After 14 years, we will check whether there are reasons for further storage.  Ultimately, the storage period is also assessed according to the statutory limitation periods, which, for example, according to §§ 195 ff. Of the German Civil Code (BGB) can generally be three years, but in certain cases up to thirty years.

7. To what extent is there automated decision-making in individual cases (including profiling)?

We do not use purely automated decision-making procedures in accordance with Article 22 GDPR. If we use these procedures in individual cases, we will inform you of this separately.

8. No obligation to provide us with your data

You are not obliged to provide us with your personal data. Without the provision, however, the execution of a mandate contract would not be properly possible, which would ultimately result in the refusal to conclude or the termination of the mandate relationship. In this context, you only need to provide the data

• which are necessary for the establishment and execution of the contractual relationship with us,
• we are legally obliged to collect or
• there is a legitimate interest on our part to collect them.

If we also request data beyond that from you, you will be informed of the voluntary nature of the information.

9. Data subject rights

You have the right: 

• to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can obtain information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to correction, deletion, restriction of processing or opposition, the existence of a Right to lodge a complaint, the origin of your data, unless it was collected by us, and the existence of automated decision-making, including profiling and, if necessary, meaningful information about its details;
• to request the correction of incorrect or incomplete personal data stored by us without delay in accordance with Art. 16 GDPR;
• According to Art. 17 GDPR, to request the deletion of your personal data stored by us, unless the processing for exercising the right to freedom of expression and information, for fulfilling a legal obligation, for reasons of public interest or for asserting, exercising or defending legal claims is required;
• to demand the restriction of the processing of your personal data in accordance with Art. 18 GDPR, provided that the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to delete it and we no longer need the data, but you need it for the assertion, exercise or need to defend legal claims or you have objected to processing in accordance with Art. 21 GDPR;
• in accordance with Art. 20 GDPR to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another person responsible;
• to revoke your consent given to us at any time in accordance with Art. 7 Para. 3 GDPR. As a result, we are no longer allowed to continue processing the data based on this consent in the future.

If you want to assert one of these rights, please contact us or, if applicable, our privacy  protection officer.

10. Your right to file a complaint with the respective supervisory authority

You have the right to file a complaint with the data protection supervisory authority if you believe that the processing of your data violates the GDPR (Art. 77 GDPR). The supervisory authority responsible for us is: 

Bayerisches Landesamt für Datenschutzaufsicht
PO Box 606
91511 Ansbach

Telephone: +49 (0) 981 53 1300
E-Mail: poststelle@lda.bayern.de