Data protection notice

Mandatory Information according to Art. 12 ff. GDPR

Contact Details of the person responsible 

 Name:                          Kammer
Surname:                      Ralf

Contact Details (business)

Company:                    Muth & Partner Wirtschaftsprüfer Steuerberater Rechtsanwälte mbB
Address:                      Rangstraße 5, 36037 Fulda
Phone:                         0661 / 97 36 - 153

Contact Details of the Data Protection Officer

Contact Details (business)

Company:                    Herr Peter Lindner, BerIsDa GmbH
Address:                       Justus-Liebig-Straße 4, 36093 Künzell
Phone:                         0661 / 29 69 80 91


Where do we obtain your personal data?

In principle, we collect your data directly from you as data subject. The processing of personal data provided by you is necessary to fulfil the contractual obligations arising from the contract concluded with us. Due to your duties to cooperate, it is unavoidable to provide the personal data requested by us; otherwise, we will not be able to fulfil our contractual obligations. Otherwise, legal, accounting and/or tax disadvantages for you can no longer be excluded.

Within the framework of pre-contractual measures (e.g. master data entry in the interested party process), the provision of your personal data is necessary. If you do not provide the requested data, a contract cannot be concluded.

In order to provide our services, it may be necessary to process personal data that we have received from other companies or other third parties, e.g. tax offices, your business partner or similar, for the respective purpose.

Furthermore, we may process personal data from publicly accessible sources, e.g. websites, which we use legitimately and only for the respective contractual purpose.


Purposes and legal bases of the processing

The personal data provided by you will be processed in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) in our business areas of auditing (including company valuation, business management consulting etc.), tax consulting (including payroll and financial accounting, preparation of annual financial statements and tax returns etc.), legal advice and enforcement (including legal proceedings, etc.) and notary services:


On the basis of a consent (according to Art. 6 para. 1 lit. a GDPR)

The purposes of processing personal data result from the granting of consent. Your consent can be revoked at any time with effect for the future. Consents granted before the validity of the GDPR (25 May 2018) can also be revoked. Processing that took place before the revocation remains unaffected by the revocation. Example: Sending a newsletter, release from professional secrecy to pass on the data you have provided to third parties (e.g. banks, insurance companies, shareholders, etc.) at your request.


For the fulfilment of contractual obligations (according to Art. 6 para. 1 lit. b GDPR)

The purposes of data processing result on the one hand from the introduction of pre-contractual measures, which precede a contractually regulated business relationship and on the other hand from the fulfilment of obligations from the contract concluded with you.


Due to legal requirements (according to Art. 6 para. 1 lit. c GDPR) or in the public interest (according to Art. 6 para. 1 lit. e GDPR)

The purposes of data processing result from legal requirements or are in the public interest (e.g. compliance with retention obligations, proof of compliance with the tax consultant's notification and information obligations).


Within the scope of the balancing of interests (according to Art. 6 para. 1 lit. f GDPR)

The purposes of the processing result from the protection of our legitimate interests or the legitimate interests of Muth & Co. GmbH Wirtschaftsprüfungsgesellschaft, Fulda. It may be necessary to process the data provided by you beyond the actual performance of the contract. This legitimate interest may be used to justify the further processing of the data you have provided, if your interests or fundamental rights and freedoms do not prevail. The legitimate interest may be in individual cases: Enforcement of legal claims, defense against liability claims, prevention of criminal offences, use of data by Muth & Co. GmbH Wirtschaftsprüfungsgesellschaft, Fulda for its activities, promotional purposes (such as sending a newsletter, invitations to events or similar promotional purposes).


Who receives your personal data?

Within our company, those areas receive access to the personal data provided by you, which are necessary for the fulfilment of contractual and legal obligations and which are entitled to process this data.

In fulfilment of the contract concluded with you, only those bodies that require the data you have provided for legal reasons, e.g. tax authorities, social insurance carriers, competent authorities and courts, will receive it.

As a party to professional secrecy, we are obliged to observe and implement professional discretion. Other recipients will only receive the data provided by you at your request if you release us from professional confidentiality or if this results from the contractual relationship.

Within the scope of our services, we commission processors and contractors who contribute to the fulfilment of contractual obligations, e.g. computer center service providers (DateV eG), EDP partners, document shredding companies, etc., to perform the services. We contractually oblige these processors and contractors to observe professional confidentiality and to comply with the requirements of the GDPR and the BDSG.


Will the data you provide be transferred to third countries or international organizations?

Under no circumstances will the data you provide be transferred to a third country or an international organization. Should you wish to transfer the data you have provided to a third country or an international organization in individual cases, we will only do so after your written consent and release from professional discretion.


Does automated decision-making, including profiling, take place?

No fully automated decision-making (including profiling) according to Art. 22 GDPR is used to process the data you provide.


Duration of processing (criteria for erasure)

The data provided by you will be processed for as long as it is necessary to achieve the contractually agreed purpose, in principle as long as the contractual relationship with you exists. After termination of the contractual relationship, the data provided by you will be processed to comply with legal storage obligations or based on our legitimate interests. After expiry of the legal retention periods and/or the loss of our legitimate interests, the data provided by you will be erased.

Expected periods of the storage obligations applicable to us and our legitimate interests:

  • Fulfilment of commercial, tax and professional retention periods. The periods for storage and documentation specified there range from two to ten years.
  • Preservation of evidence under the statute of limitations.  According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is three years.


Information about your rights

  • Right to information according to Article 15 DS- GDPR:

You have the right to ask für information whether personal data are being processed and, if so, the purpose for which the data were collected, the category of personal data concerned, the specification of the recipients or the planned storage period, etc.


  • Right to rectification in accordance with Article 16 GDPR:

You have the right to request the person responsible to correct your accurate personal data immediately. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data - also by means of a supplementary declaration.


  • Right to erasure ("right to be forgotten") according to Art. 17 GDPR:

You have the right to demand that the person responsible erase your data immediately. The person responsible is obliged to erase personal data immediately if one of the following reasons applies:

a)      Purposes for which the personal data was collected no longer apply

b)     You revoke your consent to the processing. There is no other legal basis for the processing.

c)      You object to the processing. There is no other legal basis for the processing.

d)     The personal data have been processed unlawfully.

e)      The erasure of personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the data controller is subject.

f)       The personal data have been collected in relation to information society services provided in accordance with Art. 8 para. 1 GDPR.


  • Right to restriction of processing in accordance with Art. 18 GDPR &. § 35 BDSG:

You have the right to request a limitation of the processing if one of the following conditions is met:

a)      You doubt the accuracy of the personal data.

b)     The processing is unlawful, but you refuse to erase it.

c)      Personal data is no longer required for the purposes of processing; however, you will need the data to assert, exercise or defend legal claims.

d)     You have filed an objection against the processing pursuant to Art. 21 para. 1 GDPR. As long as it has not been determined whether the legitimate reasons of the responsible person override your legitimate reasons, the processing will be restricted.


  • Right to data transferability in accordance with Art. 20 GDPR:

You have the right to receive the data provided by you in a structured, commonly used and machine-readable format from the person responsible. We may not hinder a forwarding to another responsible person.


  • Right of objection according to Art. 21 GDPR:

To do this, please contact the person responsible for processing (see above).


  • Right of appeal to the supervisory authority pursuant to Art. 13 para. 2 lit. d, 77 GDPR, § 19 BDSG:

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the regulatory authority. For this purpose, please contact the responsible supervisory authority


  • Withdrawal of consent pursuant to Art. 7 para. 3 GDPR:

If the processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (processing of special categories of personal data), you are entitled to withdraw the appropriately bound consent at any time without affecting the legality of the processing carried out on the basis of the consent until revocation.