Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Dallman Steuerberatung
Dipl.-Kffr. Irina Dallman
Tax Adviser (Steuerberaterin)
Am Zirkus 3
10117 Berlin
Germany

Phone: +49 (0) 30 91 555 477
Email: info@dallman.de

2. General Notes on Data Processing

The protection of personal data and the confidential handling of information entrusted to us are of particular importance to us.

As a tax adviser, I am subject to statutory and professional duties of confidentiality. Personal data are only processed to the extent necessary for the operation of this website, the handling of enquiries, the initiation or performance of a mandate, the fulfilment of legal obligations, or the safeguarding of legitimate interests.

In the context of tax advisory services, data processed may in particular include identification and contact details, tax and financial information, income and asset data, banking and payment data, contractual and corporate data, and other personal data required for the advisory work.

Depending on the subject matter of the mandate, special categories of personal data within the meaning of Article 9 GDPR may also be involved.

This privacy policy provides information in particular about the processing of personal data in connection with the use of this website and with contacting our practice.

3. Website Access and Server Log Files

When this website is accessed, the visitor's browser automatically transmits technically necessary information to the website's server.

This may in particular include:

• IP address of the device used,
• date and time of access,
• name and URL of the page or file accessed,
• referrer URL,
• browser type and version,
• operating system used,
• access provider, and
• other technically necessary connection data.

Processing is carried out for the purpose of the technical provision of the website, ensuring uninterrupted operation, and maintaining the stability and security of our IT systems.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically sound provision of our website.

This data is not merged with other data sources or evaluated for the purpose of creating personal user profiles.

Server log files are retained only for as long as necessary for the purposes described above and are then deleted, unless a legal obligation, a security incident, or another legitimate reason requires longer retention.

4. Hosting

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

In the context of hosting, personal data arising from the use of this website may be processed. This includes in particular IP addresses, technical access data and communication data.

The hosting provider processes personal data in the course of providing and securing the website in accordance with applicable data protection law.

A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO.

5. Contact by Email

This website provides a contact form. The information entered there is not transmitted to our practice via the web server and is not stored on the web server. The contact form is used solely to prepare an email in the visitor's own email application or email client. The email is then sent by the visitor themselves using their own email service.

We only process the personal data and any documents contained in the email once it has been received by our practice — for the purpose of handling the enquiry, initiating a mandate, or in connection with an existing mandate.

This may in particular include:

• name and contact details,
• information about your company or professional activity,
• information about the subject matter of your enquiry,
• tax and financial information, and
• documents and materials you send us.

If the contact is made with a view to entering into a mandate, processing is carried out on the basis of Article 6(1)(b) GDPR for the performance of pre-contractual measures at the request of the data subject.

Where the contact does not serve the initiation or performance of a contractual relationship, processing may be based on Article 6(1)(f) GDPR. Our legitimate interest consists in the appropriate handling and response to enquiries addressed to us.

Where legal obligations require processing, Article 6(1)(c) GDPR may apply as an additional legal basis.

6. Submission of Documents by Email

In connection with an enquiry or an existing mandate, you may submit documents and information to us by email.

This may include in particular tax, financial and personal information, as well as documents containing personal data. Depending on the circumstances, these materials may also contain personal data requiring heightened protection or special categories of personal data within the meaning of Article 9 GDPR.

Email transmission takes place via the email infrastructure chosen by the sender. We draw your attention to the fact that unencrypted email transmission cannot guarantee full confidentiality during transit from a technical standpoint.

For information or documents with a particularly high protection requirement, a suitable secure transmission method can be agreed with our practice prior to submission.

Upon receipt, mandate-related data and documents are processed within the secure practice and DATEV system environment we use.

7. Processing in the Context of Mandate Initiation and Tax Advisory Services

Where an enquiry leads to a mandate or an existing mandate is concerned, we process the personal data required to perform the tax advisory, representation and other commissioned services.

This may in particular include:

• master and contact data,
• tax identification and tax registration numbers,
• tax and financial circumstances,
• income and asset data,
• banking and payment information,
• bookkeeping and accounting data,
• payroll data,
• contractual and corporate data,
• information on shareholding structures,
• data of employees, corporate officers, business partners or family members to the extent required for the mandate,
• correspondence with authorities and other parties, and
• other information required for the respective advisory or representation services.

Processing is carried out in particular on the basis of Article 6(1)(b) GDPR for the performance of pre-contractual measures or the fulfilment of the mandate, and on the basis of Article 6(1)(c) GDPR where legal obligations apply.

Where special categories of personal data within the meaning of Article 9(1) GDPR are processed, this is done only where a legal basis under Article 9(2) GDPR or another statutory permission exists.

8. Professional Duty of Confidentiality

As a tax adviser, I am subject to the statutory professional duty of confidentiality.

Information and documents entrusted to us or brought to our knowledge in connection with the initiation or performance of a mandate are treated confidentially in accordance with statutory and professional requirements.

Employees and other persons who have access to confidential information in the course of their work are likewise required to maintain confidentiality in accordance with legal requirements.

Data protection requirements apply in addition to professional confidentiality and secrecy obligations.

9. Use of DATEV

For the professional processing of tax and mandate-related data, we use in particular software, communication and data centre services provided by

DATEV eG
Paumgartnerstraße 6–14
90429 Nuremberg
Germany

In connection with the use of DATEV services, personal data and client data may be processed in DATEV systems and DATEV data centres.

Where DATEV processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Article 28 GDPR.

DATEV implements technical and organisational measures for the security of processing within its area of responsibility pursuant to Article 32 GDPR.

10. Recipients of Personal Data

Personal data are only transferred to third parties to the extent necessary for the handling of an enquiry, the performance of a mandate, the fulfilment of legal or professional obligations, or the technical operation of our systems, or where another legal basis for the transfer exists.

Depending on the mandate and legal requirements, recipients may in particular include:

• tax authorities,
• courts and other authorities,
• social security institutions,
• banks and financial institutions,
• other professionals subject to professional confidentiality obligations,
• advisers and service providers engaged or authorised by the client,
• DATEV eG, and
• technical service providers and data processors.

Where service providers process personal data on our behalf, the statutory requirements for data processing agreements are observed.

Personal data are not passed on for unrelated advertising, profiling or address trading purposes.

11. Cookies and Local Storage Technologies

This website does not set any cookies. To provide certain technically necessary or user-requested functions, only entries in the browser's local storage (Local Storage) are used.

The information stored comprises the language preference (lang), so that the user's chosen language version is retained, and a flag (cookie_notice) recording that the privacy notice has already been displayed and acknowledged.

This information is not used for analytics, tracking, profiling or advertising purposes. It remains in the browser's local storage until deleted by the user.

Where personal data are processed in this context, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest consists in the secure and functional provision of our website.

12. No Analytics or Tracking Services

This website does not use any web analytics, tracking or profiling services such as Google Analytics.

Individual user behaviour is not analysed for marketing or advertising purposes.

No personal user profiles are created for advertising purposes.

13. No Automated Decision-Making

No decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR takes place in connection with this website.

14. Retention Periods

Personal data are retained only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

Data from general enquiries are deleted once the enquiry has been fully handled and no statutory retention, documentation or limitation obligations or other legitimate grounds for further retention exist.

Where a mandate is entered into, data and documents collected during the initial contact may be incorporated into the client file. The statutory and professional retention periods applicable to the mandate then apply to such data.

Upon expiry of the applicable retention periods, data are deleted unless a statutory or other legal basis for further retention exists.

15. Data Security

Taking into account the state of the art, the nature, scope, circumstances and purposes of processing, and the varying likelihood and severity of possible risks, we implement appropriate technical and organisational measures to protect personal data.

These measures are designed in particular to protect personal data against loss, destruction, unauthorised access, unauthorised alteration or unauthorised disclosure.

This website uses an encrypted connection (TLS/SSL). Data transmitted between the visitor's browser and the server are thereby protected during transmission.

Mandate-related data and documents are processed within our practice organisation using professional IT and DATEV systems designated for this purpose.

16. Rights of Data Subjects

Where the statutory conditions are met, you have in particular the following rights:

Right of Access – Article 15 GDPR

You may request information about whether and which personal data we process about you.

Right to Rectification – Article 16 GDPR

You may request the rectification of inaccurate or the completion of incomplete personal data.

Right to Erasure – Article 17 GDPR

You may, under the statutory conditions, request the erasure of your personal data.

The right to erasure does not apply in particular where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

Right to Restriction of Processing – Article 18 GDPR

You may, under the statutory conditions, request the restriction of processing of your personal data.

Right to Data Portability – Article 20 GDPR

Where the statutory conditions are met, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format, or to request their transmission to another controller.

Right to Object – Article 21 GDPR

Where processing is based on Article 6(1)(e) or (f) GDPR, you have, under the statutory conditions, the right to object at any time to processing on grounds relating to your particular situation.

Withdrawal of Consent – Article 7(3) GDPR

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal on the basis of consent is not affected.

17. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law.

The supervisory authority with primary jurisdiction for the controller is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
(Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61
10555 Berlin
Germany

This right exists without prejudice to other administrative or judicial remedies.

18. Amendments to this Privacy Policy

We reserve the right to update this privacy policy if legal requirements, the technical design of this website, the services used, or the nature of data processing change.

The current version published on this website applies at all times.

Last updated: August 2026