Your cookie settings

Privacy policy

We consider the protection and security of personal data to be of great importance. Below you will find the information required under the General Data Protection Regulation (“GDPR”) regarding the processing of personal data.

We would like to ensure that you receive exactly the information on the processing of your personal data that is important to you. Therefore, please select which information we may provide for you.

Content

1. General information on data protection

2. Online presences

3. Applicants (m/f/d)

4. Business contacts

1. General information on data protection

1.1 Responsible body

WAYES GmbH & Co. KG
Reese-Haus, Rathausmarkt 5
20095 Hamburg
+49 40 736768-0
kontakt@wayes.de
www.wayes.de

1.2 Contact details of our data protection officer

datenschutz@wayes.de

1.3 Your rights

Every data subject has the right of access under Article 15 of the GDPR, the right of rectification under Article 16 of the GDPR, the right of erasure under Article 17 of the GDPR, the right to restrict processing under Article 18 of the GDPR, the right of notification under Article 19 of the GDPR and the right to data portability under Article 20 of the GDPR.

IN ADDITION, YOU HAVE THE RIGHT TO OBJECT UNDER ART. 21 GDPR IF THE PROCESSING IS BASED ON THE LEGITIMATE INTERESTS REFERRED TO IN ART. 6 PARA. 1 LIT. F GDPR.

In addition, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you are of the opinion that the processing of your personal data is not lawful. In addition to the other supervisory authorities mentioned in Art. 77 GDPR, the supervisory authority of the place of the alleged infringement is responsible for the matter.

If the processing of data is based on your consent, you are entitled to revoke your consent to the use of your personal data at any time in accordance with Art. 7 (3) GDPR. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected. Please also note that we may need to retain certain data for a certain period of time in order to comply with legal requirements.

1.4 Changes to our privacy policy

We reserve the right to adapt this privacy policy so that it always complies with the current legal requirements or in order to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.

1.5 Contact

If you contact us (e.g. via contact form, email, telephone, social media), your personal data will be stored and processed by us for the purpose of processing the enquiry and any associated follow-up questions pursuant to Art. 6 (1) lit. b EU GDPR (within the scope of pre-contractual/contractual measures) or pursuant to Art. 6 (1) lit. f EU GDPR (general enquiries). We do not pass on this data without your respective consent.

The data you provide will remain with us until you request us to delete it, object to its storage or the purpose for storing the data no longer applies (i.e. after we have completed processing your enquiry), provided this does not conflict with any legal obligations to retain data.

2. Online presences

2.1 Collection of general information when visiting our website

Nature and purpose of the processing:

When you access our website, i.e. if you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your internet service provider, your IP address and the like. In particular, they are processed for the following purposes:

to ensure a problem-free connection of the website,
to ensure a smooth use of our website,
to evaluate system security and stability, and
to optimise our website.

We do not use your data to draw conclusions about your person. Information of this kind is statistically evaluated anonymously by us, if necessary, in order to optimise our website and the technology behind it. For security reasons, however, we reserve the right to subsequently check the log data if there is a justified suspicion of unlawful use based on concrete indications.

Legal basis and legitimate interest:

The processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

Recipients:

Recipients of the data may be technical service providers who act as order processors for the operation and maintenance of our website.

Third country transfer:

The collected data may be transferred to the following third countries: none

Storage period:

The data is deleted as soon as it is no longer required for the purpose for which it was collected. This is generally the case for data used to provide the website when the respective session has ended.

In the case of storage of data in log files, this is the case after fulfilment of the purpose. Storage beyond this is possible. In this case, the IP addresses of the users are anonymised so that it is no longer possible to assign the calling client.

Provision mandatory or required:

The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website cannot be guaranteed. In addition, individual services and services may not be available or may be restricted. For this reason, an objection is excluded.

2.2 Cookies

Like many other websites, we also use so-called “cookies”. Cookies are small text files that are stored on your end device (laptop, tablet, smartphone or similar) when you visit our website.

You can delete individual cookies or the entire cookie inventory. In addition, you will receive information and instructions on how to delete these cookies or block their storage in advance. Depending on the provider of your browser, you will find the necessary information under the following links:

Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-loeschen-daten-von-websites-entfernen
Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Google Chrome: https://support.google.com/accounts/answer/61416?hl=de
Opera: http://www.opera.com/de/help
Safari: https://support.apple.com/kb/PH17191?locale=de_DE&viewlocale=de_DE

Storage period and cookies used:

If you allow us to use cookies through your browser settings or consent, the following cookies may be used on our websites:

Borlabs Cookie, 1 year
YouTube, 6 months
Vimeo, 2 years

2.2.1 Borlabs – cookie consent management

We use the consent management service of Borlabs as a cookie consent management platform. The provider is Borlabs – Benjamin A. Bornschein, Rübenkamp 32, 22305 Hamburg. The tool is a software for controlling cookies. The purpose of data processing is to comply with legal obligations and to store consent. The legal basis is Art. 6 para. 1 lit. c EU GDPR. For more information on the processing of your data at Borlabs, please see: https://de.borlabs.io/datenschutz/.

2.2.2 Technically necessary cookies

Nature and purpose of the processing:

We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change.

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change.

We need cookies for the following applications: storage of visitors’ settings selected in the Borlabs Cookie Box.

Legal basis and legitimate interest:

The processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in a user-friendly design of our website.

Recipients:

Recipients of the data may be technical service providers who act as order processors for the operation and maintenance of our website.

Third country transfer:

The collected data may be transferred to the following third countries: none

Provision mandatory or required:

The provision of the aforementioned personal data is neither legally nor contractually required. However, without this data, the service and functionality of our website cannot be guaranteed. In addition, individual services and services may not be available or may be limited.

Objection

Please read the information about your right to object according to Art. 21 GDPR below.

2.2.3 Technically unnecessary cookies

Furthermore, we use cookies to better customise the offer on our website to the interests of our visitors or to generally improve it on the basis of statistical evaluations. To find out which providers use cookies, please see the information below on the display, tracking, remarketing and web analysis technologies used.

Legal basis:

The legal basis for this processing is in each case your consent, Art. 6 para. 1 lit. a GDPR.

Recipients:

Recipients of the data may be technical service providers who act as order processors for the operation and maintenance of our website. For further recipients, please refer to the information below on the display, tracking, remarketing and web analysis technologies used.

Third country transfer:

For information on this, please refer to the listings of the individual display, tracking, remarketing and web analytics providers.

Provision mandatory or required:

Of course, you can also view our website without cookies. Web browsers are regularly set to accept cookies. In general, you can deactivate the use of cookies at any time via your browser settings (see revocation of consent). Please note that individual functions of our website may not work if you have deactivated the use of cookies.

Revocation of consent:

Your can revoke your consent at any time using our Cookie-Consent-Tool.

Profiling:

To what extent we analyse the behaviour of website visitors with pseudonymised user profiles, please refer to the information below on the display, tracking, remarketing and web analysis technologies used.

2.3 Embedded Vimeo videos

We embed Vimeo videos on our website. The operator of the corresponding plugins is Vimeo, Inc., 555 West 18th Street, New York, New York 10011, USA. Authorised representative: Michael A. Cheah (General Counsel) (hereinafter “Vimeo”). When you visit a page with the Vimeo plugin, a connection to Vimeo servers is established. This tells Vimeo which pages you are visiting. If you are logged into your Vimeo account, Vimeo can assign your surfing behaviour to you personally. You can prevent this by logging out of your Vimeo account first.

When a Vimeo video is started, the provider uses cookies that collect information about user behaviour.

Further information on the purpose and scope of data collection and processing by Vimeo can be found in the provider’s privacy policy, where you will also find further information on your rights in this regard and setting options for protecting your privacy: https://vimeo.com/cookie_policy

Revocation of consent:

No option for a simple opt-out or blocking of data transmission is currently offered by the provider. If you wish to prevent your activities on our website from being tracked, please revoke your consent for the corresponding cookie category or all technically unnecessary cookies and data transfers in the cookie consent tool. In this case, however, you may not be able to use our website or only to a limited extent.

2.4 Embedded YouTube videos

We embed YouTube videos on our website. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The integration of the videos on our website takes place in the extended data protection mode. The domain is replaced with the official YouTube nocookie domain. When using this variant, information about visitors to the website is only stored when the video is played. However, like most websites, YouTube also uses cookies to collect information about visitors to their website. YouTube uses these to collect video statistics, prevent fraud and improve user experience, among other things.

When a YouTube video is started, the provider uses cookies that collect information about user behaviour.

Further information on the purpose and scope of data collection and processing by YouTube can be found in the provider’s privacy policy, where you will also find further information on your rights in this regard and setting options for protecting your privacy: https://policies.google.com/privacy

Revocation of consent:

2.5 SSL encyption

To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS.

2.6 Third-party content and services

On the basis of the provider’s legitimate interest, it may happen that links to other providers that complement our offer are integrated within this online offer. When calling up Internet pages that are referred to within the framework of this website, information such as name, IP address, browser properties, etc. may be requested again. This privacy policy does not regulate the collection, disclosure or handling of personal data by third parties. In this context, please note the specific privacy policies of individual third-party providers and service providers whose links we include on our website.

2.7 Objection to advertising e-mails

IIn accordance with the legal obligation to publish our imprint, we must disclose our contact details. These are sometimes used by third parties to send unsolicited advertising and information. We hereby object to any sending of advertising material of any kind not expressly authorised by us. Furthermore, we expressly reserve the right to take legal action against the unwanted and unsolicited sending of advertising material. This applies in particular to so-called spam e-mails, spam letters and spam faxes. We would like to point out that the unauthorised transmission of advertising material can affect both competition law, civil law and criminal law offences. Spam e-mails and spam faxes in particular can lead to high claims for damages if they disrupt business operations by overfilling mailboxes or fax machines.

2.8 Social Media

We maintain publicly accessible online presences in social networks for communication with the customers and interested parties active there as well as for the presentation of our services.

We would like to point out that user data may be processed outside the European Union. Furthermore, user data is usually processed for market research and advertising purposes. To the best of our knowledge, the providers also use cookies that store your usage behaviour (also across different end devices). This allows targeted advertising to be placed within the framework of their own platform and on third-party sites.

The processing of users’ personal data is based on our legitimate interests in effectively informing users and communicating with users pursuant to Art. 6 para. 1 lit. f. EU GDPR. If the users are asked by the respective providers of the platforms for consent to data processing or if the user voluntarily sends information to our online presences, the legal basis of the processing is Art. 6 (1) lit. a EU GDPR in conjunction with Art. 7 EU GDPR. If this information contains contract-relevant content, Article 6 (1) (b) EU GDPR serves as the legal basis.

For a detailed description of the respective processing and the options to object (opt-out), we refer to the information of the providers linked below.

In the case of requests for information and the assertion of user rights, we also point out that these can be exercised most effectively with the providers. Only the providers have access to the users’ data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

Instagram: Facebook Ireland Ltd., Grand Canal Square, Grand Canal Harbour, Dublin 2 and Facebook Inc., 1601 Willow Road, Menlo Park, California 94025. Privacy policy: https://www.facebook.com/about/privacy/, Opt-out: https://www.facebook.com/settings?tab=ads
kununu: kununu GmbH, Neutorgasse 4-8, Top 3.02, A-1010 Wien. Privacy policy/Opt-out: https://privacy.xing.com/de/datenschutzerklaerung.
LinkedIn: LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Irland. Privacy policy: https://www.linkedin.com/legal/privacy-policy. Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
Xing: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Deutschland. Privacy policy/Opt-out: https://privacy.xing.com/de/datenschutzerklaerung.

2.8.1 Instagram

When you interact with our social media page on Instagram (comment, like posts or send us a message), your data is stored by us. This social network is operated by Facebook Ireland Ltd, Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hence: Facebook).

The operation of a company profile on the channel is a joint responsibility under data protection law pursuant to Art. 26 EU GDPR between Facebook Ireland Ltd. and our company. Accordingly, we have entered into an agreement with Facebook Ireland which sets out the respective obligations under the EU GDPR: https://www.facebook.com/legal/terms/page_controller_addendum.

Facebook provides profile operators with statistics and insights into the types of actions our profile visitors take (“Page Insights”). We have no influence on the fact that this data is collected by Facebook. According to Facebook, this data is only provided to us anonymously, so that the user cannot be identified from the information.

Personal data is deleted as soon as the purpose of the storage no longer applies. Data may also be stored if this is required by statutory retention obligations to which our company is subject.

Please note that when using and calling up our Instagram page, your personal data will also be processed by the provider “Facebook”. Facebook is operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland and by Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA, which is based in the USA. Facebook processes your data in addition to the above-mentioned processing for analysis and advertising purposes. To the best of our knowledge, Facebook also uses cookies that store your usage behaviour (also across different end devices). This enables Facebook to display targeted advertising within its own platform and on third-party sites. You can find more information in the privacy policy of Instagram: https://help.instagram.com/519522125107875. IInstagram also offers the option of objecting to certain data processing; information and opt-out options in this regard can be found at: https://www.instagram.com/accounts/privacy_and_security/. Please note that according to Facebook’s privacy policy, user data is also processed in the USA or other third countries. Facebook only transfers user data to countries for which an adequacy decision has been issued by the European Commission in accordance with Art. 45 EU GDPR or on the basis of appropriate safeguards in accordance with Art. 46 EU GDPR.

With regard to data processing via our Instagram page, you also have the option of claiming your data subject rights against Facebook. Further information on this can be found in Facebook’s privacy policy: https://www.facebook.com/about/privacy/.

3. Applicants (m/f/d)

WAYES GmbH & Co. KG carries out recruiting and applicant management both for itself and for WAYES & Kollegen Steuerberatungsgesellschaft mbH.

3.1 Purpose and legal basis of the processing

We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), insofar as this is necessary for the decision to establish an employment relationship with us. The legal basis for this is Article 88 of the GDPR in conjunction with Section 26 of the BDSG for the initiation or implementation of contractual relationships. If special categories of personal data within the meaning of Art. 9 (1) EU GDPR are voluntarily disclosed during the application process, they are also processed in accordance with Art. 9 (2) b EU GDPR.

Furthermore, we may process your personal data if this is necessary for the fulfilment of legal obligations (Art. 6 para. 1 lit. c GDPR) or for the defence of asserted legal claims against us. The legal basis for this is Art. 6 para. 1 lit. f GDPR. The legitimate interest is, for example, a duty of proof in proceedings under the General Equal Treatment Act (AGG).

If you give us express consent to process personal data for specific purposes (e.g. longer storage for consideration in future advertised vacancies), the lawfulness of this processing is given on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR. Consent given can be revoked at any time, with effect for the future. (see 1.3).

Should an employment relationship be established between you and WAYES GmbH & Co. KG or WAYES & Kollegen Steuerberatungsgesellschaft mbH, we may, in accordance with Article 88 of the GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG), continue to process the personal data already received from you for the purposes of the employment relationship, insofar as this is necessary for the implementation or termination of the employment relationship or for the exercise or fulfilment of the rights and obligations of the employee representation resulting from a law or a collective agreement, a company or service agreement (collective agreement).

3.2 Data sources

We process personal data that we receive from you by post or e-mail in the course of your contact or application.

3.3 Data recipients

We only pass on your personal data within our company to those departments and persons who need this data to fulfil contractual and legal obligations or to implement our legitimate interest.

If your application relates to a position for WAYES & Kollegen Steuerberatungsgesellschaft mbH, your data will be passed on to WAYES & Kollegen Steuerberatungsgesellschaft mbH within the course of applicant management.

Any further transfer of data to recipients outside the company will only take place if this is permitted or required by law, if the transfer is necessary to fulfil legal obligations or if we have your consent.

3.4 Third country transfer

We make a point of processing your data within the EU / EEA. However, we may use service providers who process data outside the EU / EEA. In these cases, we ensure that an adequate level of data protection comparable to the standards within the EU is established at the recipient before transferring your personal data. This can be achieved, for example, via EU standard contracts or Binding Corporate Rules or special agreements to whose regulations the company can submit.

3.5 Duration of data storage

We store your personal data as long as this is necessary for the decision on your application. Your personal data or application documents will be deleted a maximum of six months after the end of the application process (e.g. notification of the rejection decision), unless longer storage is legally required or permitted. We store your personal data beyond this only insofar as this is required by law or in the specific case for the assertion, exercise or defence of legal claims for the duration of a legal dispute.

In the event that you have consented to a longer storage of your personal data, we will store it in accordance with your declaration of consent.

If an employment relationship, apprenticeship or trainee relationship is established following the application process, your data will initially continue to be stored, insofar as this is necessary and permissible, and then be entered into the personnel file of WAYES GmbH & Co. KG or WAYES & Kollegen Steuerberatungsgesellschaft mbH. WAYES GmbH & Co. KG acts accordingly in the personnel management process for WAYES & Kollegen Steuerberatungsgesellschaft mbH as a processor in accordance with Article 28 of the GDPR.

If applicable, you will receive an invitation to join our talent pool following the application process. This allows us to continue to consider you in our selection of applicants for suitable vacancies in the future. If we have your consent to do so, we will store your application data in our talent pool in accordance with your consent or any future consent.

3.6 Requirement for the provision of personal data

The provision of personal data within the context of application processes is neither legally nor contractually required. You are therefore not obliged to provide information about your personal data. However, please note that these are required for the decision on an application or the conclusion of a contract in relation to an employment relationship with us. If you do not provide us with any personal data, we will not be able to make a decision regarding the establishment of an employment relationship. We recommend that you only provide personal data in your application that is required to complete the application process.

3.7 Automated decision-making

Since the decision on your application is principally not based on automated processing, no automated decision in individual cases according to Art. 22 GDPR takes place.

4. Business contacts

This information regarding data protection applies to WAYES GmbH & Co. KG as well as WAYES Interim GmbH.

4.1 Purpose and legal basis of the processing

We process your personal data for the purpose of fulfilling our (pre-) contractual obligations towards our customers and service providers. In this context, we process in particular your contact data such as name, address, telephone number and e-mail address for the performance of pre-contractual measures (e.g. in the context of customer/contract creation) as well as for the performance of our respective contractual performance obligations including the administrative performance and billing of the respective order on the basis of Art. 6 (1) lit. b) GDPR. As a rule, we receive the personal data required for this from you / our customers. In this context, it is essential for us to process any personal data of the contact persons and contact persons of our customers (also already in the context of the preparation of the offer).

Since we are legally obliged to maintain proper records, to extensively document our clients and orders (even beyond the conclusion of an order) as well as to comply with further retention and documentation obligations (among others, due to professional, accounting or commercial and corporate law requirements), we process your personal data within the scope of records to be documented, work results or related client-related correspondence on the basis of Art. 6 (1) lit. c) GDPR for the fulfilment of our aforementioned legal obligations.

Notwithstanding the above purposes, we also process your contact data (in particular name, address, e-mail address) within the scope of what is legally permissible for direct marketing purposes, i.e. for example to send you an information circular. This is done on the basis of a legitimate economic interest on our part as defined in Art. 6 para. 1 lit. f) GDPR and insofar as this is permitted by law, such as in the case of existing customer advertising under the legal requirements of Section 7 para. 3 UWG, to inform our business contacts about current economic events and thus to be able to establish and maintain a long-term business relationship. For this purpose, we process your contact data for the maintenance of our business contacts if we have received them in the context of a business event, a business appointment (e.g. by exchanging business cards) or an order. If you do not wish to receive such information or recommendations from us by e-mail, you can object to the use of your address for this purpose at any time in accordance with Art. 21 EU GDPR, without incurring any costs other than the transmission costs according to the base rates. A notification in text form is sufficient for this purpose.

Accordingly, we process your personal data for the above purposes on the basis of the following legal grounds: (a) because of our legitimate interest in the effective provision of our services to you / our clients; (b) because of our legitimate interest in the effective and lawful conduct of our business, unless your interests override that interest; (c) because of legal and regulatory obligations applicable to us, such as record keeping for tax purposes; (d) because the data is necessary for the provision of our services to you / our clients.

Where we process sensitive personal data relating to you for any of the above purposes, we do so either because: (i) you have given us your explicit consent to process that data; (ii) we are required by law to process that data; (iii) the processing is necessary for us to comply with our obligations under employment, social security or social protection law; (iv) the processing is necessary for the establishment, exercise or defence of legal claims; or (v) you have made the data public.

4.2 Data sources

We process personal data that we receive from you in the course of establishing contact or a contractual relationship or in the course of pre-contractual measures.

4.3 Data recipients

In connection with one or more of the purposes set out above, we may share details about you with the following people / service providers:

Employees of WAYES GmbH & Co. KG as well as WAYES Interim GmbH,
IT service providers and other service providers used by us,
responsible authorities, courts or other public or private bodies (the same applies to cases in which we are obliged by a statutory, official or court order to hand over / disclose personal data. This only takes place if this does not conflict with any professional confidentiality obligations.),
Insurances on the occasion of the conclusion of an insurance contract on the benefit or the occurrence of the insured event (e.g. liability insurance),
Clients, insofar as it concerns data of the partners, executive bodies and other employees of the respective client,
Cooperation partners and legal representatives working for us as well as
Other recipients designated by the customer (e.g. group companies of the customer).

In any case, disclosure will only take place if this is also permissible in consideration of relevant professional confidentiality obligations. We may also need to share your personal data if we are required to do so by law, by a supervisory authority or as part of a legal process.

4.4 Third country transfer

4.5 Duration of data storage

As far as necessary, we process and store your personal data for the duration of our business relationship or for the fulfilment of contractual purposes. This also includes, among other things, the initiation and execution of a contract.

In addition, we are subject to various storage and documentation obligations, which result, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The periods specified there for storage and documentation are two to ten years.

Finally, the storage period also depends on the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code (BGB), are usually three years, but in certain cases can be up to thirty years.

4.6 Requirement for the provision of personal data

As a rule, the provision of personal data for the purpose of establishing, implementing or fulfilling a contract or for the performance of pre-contractual measures is not required by law. You are therefore not obliged to provide personal data. Please note, however, that these are usually necessary for the decision on the conclusion of a contract, the fulfilment of the contract or for pre-contractual measures. If you do not provide us with personal data, we may not be able to make a decision within the scope of contractual measures. We recommend that you only provide personal data that is required for the conclusion of a contract, the fulfilment of a contract or for pre-contractual measures.

4.7 Automated decision-making

For the establishment, fulfilment or implementation of the business relationship as well as for pre-contractual measures, we principally do not use fully automated decision-making pursuant to Art. 22 GDPR.

_{Chapter 2 was created with the help of activeMind AG, the experts for external data protection officers}