Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation is:

IVA VALUATION & ADVISORY AG Wirtschaftsprüfungsgesellschaft
Savignystraße 34
60325 Frankfurt am Main
Phone: +49 (0) 69 9043 8793
E-mail: info@iva-valuation.de

No data protection officer has been appointed, as the statutory conditions requiring such an appointment (§ 38 BDSG, Art. 37 GDPR) are not met.

2. General information on data processing

We process personal data of website visitors only to the extent necessary to provide a functional website and our content and services. Processing takes place as a rule only with your consent or where a statutory legal basis permits it.

Where we obtain your consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary for the performance of a contract or for pre-contractual measures, Art. 6(1)(b) GDPR applies. Where processing is required to fulfil a legal obligation, Art. 6(1)(c) GDPR applies. Where processing is carried out to protect a legitimate interest of our company or a third party and your interests, fundamental rights and freedoms do not override, Art. 6(1)(f) GDPR applies.

All personal data arising in connection with this website are processed exclusively on servers located in Germany. No transfer to third countries outside the EU or EEA takes place. No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

3. Hosting

This website is operated on a server provided by our affiliated company, IVA DIGITAL ASSET GmbH, Savignystraße 34, 60325 Frankfurt am Main. IVA DIGITAL ASSET GmbH acts in this regard as our processor pursuant to Art. 28 GDPR under a data processing agreement, processing personal data exclusively on our instructions.

The server is leased from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (“Hetzner”), which is engaged as a sub-processor under a data processing agreement pursuant to Art. 28 GDPR. The server is located in Germany. Personal data collected on this website – in particular IP addresses, metadata and communication data, contact enquiries, application data and website access data – are processed exclusively on this server.

This hosting arrangement serves the legitimate interest of providing our online offering in a secure, fast and efficient manner (Art. 6(1)(f) GDPR). Further information on data protection at Hetzner: www.hetzner.com/de/legal/privacy-policy

4. Server log files

Each time our website is accessed, our system automatically collects data and information from the accessing computer system. The following are recorded: IP address, date and time of access, page/file accessed, data volume transferred, notification of successful retrieval, browser type and version, operating system and the previously visited page (referrer URL).

This data is processed to ensure a smooth connection and system security as well as for administrative purposes. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest follows from the purposes stated above. No merging of this data with other data sources or analysis for marketing purposes takes place. Log data is automatically deleted no later than 30 days after collection, unless a specific security-relevant incident requires longer retention.

5. SSL/TLS encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can identify an encrypted connection by the “https://” in the address bar and the padlock symbol in your browser.

6. Contact form

If you send us an enquiry via the contact form on our website, your details from the form (in particular name, e-mail address and message content) are processed and stored for the purpose of handling the enquiry and any follow-up questions. Processing takes place exclusively on the server described in section 3 in Germany. No external form service providers are used; no disclosure to third parties beyond the processors mentioned in section 3 takes place.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in the effective handling of enquiries addressed to us.

7. Contact by e-mail or telephone

If you contact us by e-mail or telephone, your details including the contact information you provide are stored and processed for the purpose of handling your enquiry and any follow-up questions. The legal bases are Art. 6(1)(b) GDPR (contractual or pre-contractual enquiries) and Art. 6(1)(f) GDPR (other enquiries; legitimate interest in processing).

8. Applications

You may apply to us via our online application form, by e-mail or by post. In the course of the application process, we process the data you provide, in particular contact and personal details, application documents (cover letter, CV, references) and any other information you communicate to us in connection with your application.

Processing takes place for the purpose of conducting the application process and deciding whether to establish an employment relationship. The legal basis is § 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR. Where you voluntarily provide special categories of personal data (e.g. information about a severe disability (Schwerbehinderung)), processing is based on Art. 9(2)(b) GDPR in conjunction with § 26(3) BDSG.

Your application data is transmitted via an encrypted connection and processed exclusively on the server described in section 3 in Germany. Access is restricted to persons involved in the application process. No disclosure to third parties beyond the processors mentioned in section 3 takes place.

If you are hired, your data will be transferred to your personnel file. If no employment relationship is established, your application data will be deleted no later than six months after the conclusion of the application process, unless deletion is precluded by our legitimate interests (in particular evidential obligations under the German General Equal Treatment Act). If you wish us to consider your application for future vacancies (talent pool), longer storage takes place only on the basis of your express consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future.

9. Cookies

Our website does not use cookies for analysis, tracking or marketing purposes. At most, technically necessary cookies may be used that are required for the operation of the website (legal basis: § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR). No consent is required for these.

10. Links to external services (LinkedIn)

Our website contains simple hyperlinks to our company and personal profiles on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). These are plain links without embedded content or plugins; no data is transmitted to LinkedIn when you access our website. Data is only transmitted when you click such a link and leave our website; from that point, LinkedIn’s privacy policy applies: www.linkedin.com/legal/privacy-policy

11. Professional duty of confidentiality

As an audit firm, we are subject to the professional duty of confidentiality (§ 43 WPO, § 203 StGB). Personal data entrusted to us in the context of client engagements is treated in accordance with these special confidentiality requirements.

12. Retention periods

Unless a more specific retention period is stated in this privacy policy, your personal data will remain with us until the purpose for the data processing ceases to apply. Data from contact enquiries will be deleted once the enquiry has been fully processed and no further correspondence is to be expected, but no later than twelve months.

Where an enquiry leads to a client engagement or where data is subject to statutory retention obligations – in particular under commercial and tax law (§ 257 HGB, § 147 AO: six or ten years respectively) as well as professional regulations – deletion will take place only after expiry of these periods. Until then, processing will be restricted.

13. Your rights as a data subject

With regard to your personal data, you have the following rights:

Right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR) and right to data portability (Art. 20 GDPR).

Right to object (Art. 21 GDPR): Where we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object at any time to the processing of your personal data on grounds arising from your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal is not affected.

To exercise your rights, an informal notification to info@iva-valuation.de is sufficient.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
– The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden
datenschutz.hessen.de

14. Obligation to provide data

The provision of personal data on our website is neither legally nor contractually required. However, without the details marked as mandatory in the contact or application form, we are unable to process your enquiry or application.

15. Currency and amendments to this privacy policy

This privacy policy is currently valid and has the date stated above. As our website develops or due to changes in legislation or regulatory requirements, it may be necessary to amend this privacy policy. The current version is always available on this page.