Datenschutzhinweise
Privacy Notice
„Privacy Policy“ and „Information on the processing of personal data in accordance with Art. 13, 14 DSGVO“
Introduction
The following sections, “Privacy Policy” and “Information about the processing of personal data in accordance with Art. 13, 14 GDPR,” explain what data we collect about you, what we need this data for and to whom we pass on this data. In addition, they also include your rights in relation to your data and the contact persons to whom you can turn for further information or inquiries.
While the “Privacy Policy” is intended primarily to clarify what personal data we process, store and protect if you use “our website” and “Deloitte apps” (as defined below), the “Information about the processing of personal data in accordance with Art. 13, 14 GDPR” essentially describes how your data are processed in the context of our services for you / our customers and in the context of all other activities that are part of the performance of our business activities.
I. Privacy Policy
II. Information about the processing of personal data in accordance with Art. 13, 14 GDPR
Please ensure that, in addition to the information below, you are also familiar with Deloitte’s Privacy Policy. For questions of understanding or other queries, please contact us at privacy@deloitte.de.
Deloitte GmbH Wirtschaftsprüfungsgesellschaft provides services in the areas of auditing, risk advisory, tax consultancy, financial advisory and consulting for companies and institutions from all economic sectors; legal advice is provided in Germany by Deloitte Legal Rechtsanwaltsgesellschaft mbH (“Deloitte Legal”) (collectively “Deloitte” / “we”). As part of the commission to provide the above services, Deloitte processes personal data according to the individual order. This information complements the Privacy Policy above and provides a more concrete description of how Deloitte processes your personal information as part of the provision of the commissioned service.
Please note that this information refers exclusively to personal data within the meaning of Art. 4 No. 1 GDPR, i.e. not all data and information that Deloitte receives in relation to the underlying client relationship, but essentially only information that relates to an identified or identifiable natural person. Notwithstanding this, the professional secrecy and confidentiality obligations to which Deloitte and Deloitte employees are subject by the professional law of tax consultants, certified public accountants and lawyers, as applicable, shall apply in full to all data and information we receive from you under the client relationship, regardless of whether this is personal data within the meaning of the GDPR.
The controller within the meaning of the GDPR
The controller within the meaning of Art. 4 (7) EU General Data Protection Regulation (GDPR), which is responsible for processing your personal data in connection with all services not provided by Deloitte Legal, is:
Deloitte GmbH Wirtschaftsprüfungsgesellschaft
Rosenheimer Platz 4
81669 München
The controller within the meaning of Art. 4 (7) EU General Data Protection Regulation (GDPR), which is responsible for processing your personal data in connection with all services provided by Deloitte Legal is:
Deloitte Legal Rechtsanwaltsgesellschaft mbH
Erna-Scheffler-Straße 2
40476 Düsseldorf
If the contractor of a contract for the performance of our services is another German Deloitte company, then it acts as the responsible body in the case concerned. An overview of the German Deloitte companies can be found here.
Data protection officer & data protection supervisor
All German Deloitte companies have appointed data protection officers. You can contact the respective data protection officer at privacy@deloitte.de. The relevant supervisory authorities can be found here.
Purposes of processing and legal basis for processing
Deloitte processes your personal information for the purpose of fulfilling our (pre)contractual obligation to our customers. In particular, we process your contact details such as name, address, telephone number and e-mail address in this context in order to carry out pre-contractual measures (such as internal pre-contractual compliance checks or within the scope of the client / contract) and to carry out our respective contractual obligations, including administrative execution and settlement of the respective contract on the basis of Art. 6 para. 1 lit. b) GDPR. Deloitte uses IT systems to administer and store your personal information to manage and execute order requests / assignments, but with no automated decision-making or profiling.
Depending on the category of documents, Deloitte will store personal data for record keeping / documentation and archival purposes in accordance with relevant legislation for a varying period of time:
- Auditors’ reference files: 10 years from the end of the calendar year of completion of the order
- Lawyers’ reference files: 6 years from the end of the calendar year of the completion of the order
- Accounting documents: 10 years
- Received commercial or business letters and reproductions of the dispatched commercial or business letters as well as other tax-relevant documents: 6 years
As a rule, Deloitte receives the necessary personal data from the customers. In this respect, Deloitte has, in accordance with Art. 6 para. 1. f) GDPR, a legitimate interest in the processing of this personal data, as Deloitte is obliged to carry out the contracted service on the basis of the underlying contract. In this context, it is essential for Deloitte to process any personal data related to the contact persons of our customer (including at an early stage within the context of the offer preparation).
If you have commissioned Deloitte to perform certain services, such additional personal data relating to you will be processed in the context of order processing in addition to your contact details to the extent that they are necessary for the provision of the service agreed with you and that you have forwarded such information to us. In this respect, the processing of your personal data is justified to ensure the fulfillment of the contract between you and Deloitte and according to Art. 6 para. 1 b) GDPR.
Please note that Deloitte’s General Terms and Conditions generally require the client to be obliged to provide Deloitte with all the documents and information necessary to complete the contract. In this respect, the processing of the respective order and the associated fulfillment of the contractually agreed service by Deloitte is not possible or possible only to a limited extent if and insofar as the necessary information is not provided.
As Deloitte is required by law to ensure proper record keeping, extensive documentation of its clients and assignments (also beyond the conclusion of an order) as well as compliance with further retention and documentation obligations (including due to professional, accounting or commercial and corporate law requirements), Deloitte processes your personal data in the context of documents to be recorded, work results or related customer-related correspondence (also for the purpose of file management), documentation and archiving both in the form of paper files and in the context of IT systems used for this purpose on the basis of Art. 6 para. 1. c) GDPR for the fulfillment of our aforementioned legal obligations.
Notwithstanding the foregoing purposes, Deloitte will, to the extent permitted by applicable law, also process your contact information (including name, address, e-mail address) for marketing and advertising purposes, in other words, for example, to provide you with information about our further offers or events. This is done on the basis of consents and / or a legitimate economic interest of Deloitte as defined in Art. 6 para. 1. f) to inform their customers about further offers and events they provide and thus to establish and maintain a long-term customer relationship.
Finally, Deloitte also processes your contact information for the purpose of maintaining our business contacts when we receive them in the course of a business event, as part of a business appointment (e.g. by exchanging business cards) or as part of an order, and transfer these into the CRM system we use (Customer Relationship Management System).
Because Deloitte has a legitimate commercial interest in maintaining contacts in the context of business relations beyond the initial contact, to use them for establishing a business relationship and to remain in contact with the data subject for this purpose, the above processing of your personal data takes place on the basis of Art. 6 para. 1. f) GDPR.
Categories of data recipients and transfers to third countries
In connection with the implementation of the above-mentioned processing, personal data may also be received from third parties, as specified below. Your personal data may be stored within and outside the EU/European Economic Area (EEA). Data may be transferred to both European and non-European countries, whereby the transfer of data may be temporary and does not necessarily lead to storage.
To other Deloitte member firms1 for the purpose of cooperation in the provision of our services
Where necessary for the provision of the service, i.e. in the case of a foreign assignment or where the expertise of a foreign colleague is required, Deloitte cooperates with other companies from the global Deloitte network. If such a transfer is made to a network company outside the EU/EEA, the member firms of the Deloitte network have entered into an internal data protection agreement, containing the EU standard contractual clauses of the EU Commission within the meaning of Art 46 para 2 lit c) GDPR. This agreement requires a consistent level of data protection across all Deloitte entities worldwide. It therefore allows for global transfers of data in accordance with applicable European privacy laws.
Deloitte's internal IT service providers and external IT service providers within the EU/EEA
Deloitte uses other German or foreign Deloitte network companies as internal network and third parties as external IT service providers, which provide services for the operation, maintenance and care of the IT systems and applications used by the Deloitte network companies. Both internal and external IT service providers are bound by instructions.
To Deloitte's internal IT service providers and external IT service providers outside of the EU/EEA
To the extent that access is provided by an internal IT service provider outside the EU/EEA, an adequate level of data protection is ensured by our internal data protection agreement and contracts we have in place with those network companies. containing Standard Contractual Clauses (SCC) of the EU Commission within the meaning of Art. 46 (2) (c) GDPR.
When using external IT service providers outside the EU/EEA, an adequate level of data protection is ensured through the use of standard contractual clauses (SCC) of the European Commission within the meaning of Art. 46 (2) (c) GDPR.
Depending on the recipient country, external data transfers further undergo a Transfer Impact Assessment to evaluate the legal and practical implications in the recipient country. This assessment includes a review of local laws and practices to determine if additional protective measures are necessary.
To authorities, courts or other bodies
In connection with the performance of our services, it may be necessary to transmit information, work results and documents to authorities, courts or other public or private bodies (including transfers abroad in the case of a foreign assignment). The same applies to cases in which Deloitte is obliged by law, administrative or court order to disclose personal data. This shall only occur if there are no professional secrecy obligations to the contrary.
Your rights in connection with data processing
The GDPR essentially grants data subjects the following rights, which you can assert at any time by contacting the data protection officer named in this information at
In principle, you can request information from Deloitte at any time as to whether personal data about you are processed or stored at Deloitte and which personal data are affected. Please note that your right to information may be restricted to the extent that such information conflicts with professional secrecy and to the extent that information requiring secrecy would be disclosed.
In addition to your right to information, you can request the correction of your data at any time. In addition, you have the right to delete your data if and when the data are no longer needed for the purposes for which it was collected or, if the processing is based on your consent, you have revoked your consent. The aforementioned right to delete your data is waived if your data must not be deleted due to a legal obligation or must be processed due to a legal obligation or if data processing is required for the assertion, exercise or defense of legal rights.
In addition, you have the right to request that Deloitte restrict the processing of your personal information.
Added to this is a right to data portability, i.e. you may request that Deloitte retain the data you provide in a structured, common and machine-readable format and / or that such data be transmitted to another controller. Please note that this does not apply if you have made the data available to us on the basis of consent or on the basis of a contract concluded with you or if the processing is carried out using automated procedures.
If Deloitte processes your personal data on the basis of Art. 6 para. 1. f) GDPR (e.g. if your employer, as a Deloitte customer, has provided us with your personal information as a contact in your company, or if we use your contact information to send you information about offers and events provided by Deloitte), you can object to this processing at any time.
Right of appeal to a data protection supervisory authority
In addition to the data subject rights listed above, you also have the right to complain to a data protection supervisory authority in accordance with Art. 77 GDPR if you believe that the processing of your personal data violates data protection law. In each case, the supervisory authority of the federal state in which the controller has its seat is responsible.
Duration of data storage
Please note that Deloitte will store and process your personal information for as long as it is necessary for the fulfillment of the above mentioned processing purposes. Insofar as personal data are subject to statutory retention obligations or are part of documents subject to statutory retention requirements, Deloitte will store this data for the duration of the statutory retention period.
Depending on the category of documents, Deloitte will generally store personal information for the following varying periods of time, based on applicable statutory retention requirements:
- Auditors’ reference files: 10 years from the end of the calendar year of completion of the order,
- Lawyers’ reference files: 6 years from the end of the calendar year of completion of the order,
- Accounting records as per legal requirement: 10 years,
- Received commercial or business letters and reproductions of the dispatched commercial or business letters as well as other tax-relevant documents: 6 years.
If the data are subject to different retention periods, the longest retention period applies, and the legally required retention period may be extended depending on the individual case, e.g. if the information is required to assert, exercise or defend legal rights even after expiration of the retention period.
1 Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited (DTTL), its global network of member firms, and their related entities (collectively, the “Deloitte organization”). DTTL (also referred to as “Deloitte Global”) and each of its member firms and related entities are legally separate and independent entities, which cannot obligate or bind each other in respect of third parties. DTTL and each DTTL member firm and related entity is liable only for its own acts and omissions, and not those of each other. DTTL does not provide services to clients. Please see www.deloitte.com/de/UeberUns to learn more.
Deloitte Legal refers to the legal practices of Deloitte Touche Tohmatsu Limited member firms, their affiliates or partner firms that provide legal services. Please see deloittelegal.de/dl/en/about to learn more.