NOTES ON DATA PROCESSING & COOKIES

The following text is intended to inform you to what extent and for what purpose we collect and process your personal data and what rights you have when you visit our website, use our service offerings, or otherwise contact us. Please note that this privacy policy may change at any time; therefore, it is worthwhile to visit it regularly.

  1. Responsibility for Data Processing

UnionTax Steuerberatergesellschaft mbH (CH) and UnionTax Rechtsanwaltsgesellschaft mbH (hereinafter: UnionTax, we) are jointly responsible within the scope described above for the collection, processing, and use of your personal data. We take the issue of data protection seriously and comply with the provisions of the Swiss Federal Act on Data Protection (FADP) and other applicable data protection regulations, particularly the EU General Data Protection Regulation (GDPR). Data protection inquiries can be sent to the following addresses: office@uniontax.eu, UnionTax Rechtsanwaltsgesellschaft mbH, Roßheidestr. 197, D-45968 Gladbeck, Germany, or UnionTax Steuerberatergesellschaft GmbH (CH), Maria-Stader-Weg 4, CH-8590 Romanshorn.

  1. Scope and Purpose of the Processing of Personal Data When Visiting Our Website

The website uniontax.eu is hosted by Hosting Pilot GmbH (Germany) on servers located in Germany.

When visiting the UnionTax website, the servers temporarily store each access in a log file (so-called log files). The following data is collected and stored by us without your input:

  1. the IP address of the requesting computer;
  2. the date and time of access;
  3. protocol information such as protocol type, version, requested action, status codes, or information about the transferred data (e.g., the size of a request or response);
  4. error messages;
  5. application-specific information, such as details about the browser used (user-agent string), or the page from which the visitor reached the website, if applicable.

The collection and processing of this data is carried out for the purpose of enabling the use of our website (connection setup), ensuring system security and stability, and for internal statistical purposes. Only in the case of an attack on the network infrastructure or in the event of suspicion of other unlawful website use may the IP address be analyzed for clarification and defense purposes or used to identify the respective user in connection with civil or criminal proceedings. We consider the aforementioned purposes as our legitimate interest in data processing. Further information on data processing: https://hosting-pilot.com/datenschutzerklaerung/.

Lastly, we use cookies and tracking tools when you visit our websites. See separate sections 3 and 4.

  1. Borlabs Consent Tool

We use the cookie consent tool provided by Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany (Borlabs), on our website to obtain and document your consent(s) for storing certain cookies. Borlabs is prohibited from using your data for any other purpose. Borlabs is a German provider selected in accordance with the requirements of the General Data Protection Regulation (particularly Article 28 GDPR – data processing agreement). A technically necessary cookie (borlabs-cookie) is set to store your cookie consents. The Borlabs cookie does not process any personal data. If you want to revoke this consent, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked again for your cookie consent.

The use of Borlabs serves the purpose of obtaining and documenting legally required consents. Furthermore, the use of an effective tool is in our legitimate interests.

For more information, please refer to Borlabs’ privacy policy: https://de.borlabs.io/datenschutz/.

  1. Google Analytics

We use Google Analytics on our website, a web tracking service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The purpose of using the tool is to enable the analysis of your user interactions on websites and to improve and make our offering more interesting for you based on the statistics and reports obtained.

Your interactions with our website are recorded using cookies, device/browser data, IP addresses, and website activity. Your IP address is also collected to ensure the security of the service and to provide us as the website operator with information about your location (“IP location determination”). However, your IP address is truncated by Google within the EU/EEA using an anonymization function (“IP masking”) to protect your identity.

The information about your use of this website and your IP address may be transmitted to a Google server in the USA and processed there. According to its own information, Google complies with a data protection standard equivalent to the former EU-US Privacy Shield. In addition, standard contractual clauses have been agreed with Google to ensure an adequate level of data protection in third countries. Furthermore, the Data Privacy Framework applies to data transfers to the USA. Google stores the data for a maximum of 14 months.

The legal basis for data collection and further processing is your consent. You may revoke your consent at any time with effect for the future. You can revoke it most easily using the consent tool on our website [CONSENT TOOL] or by installing the Google browser add-on, which can be found at: tools.google.com/dlpage/gaoptout?hl=en/.

Further information on data processing when using Google Analytics can be found at: support.google.com/analytics/answer/6004245?hl=en and www.google.com/intl/en/policies/privacy/. The data processing agreement concluded with Google can be found at: https://business.safety.google/adsprocessorterms/.

  1. Chatbot and Chat Function

You have the option to use a chatbot function when using our services. This chat service allows you to request information about our services in real time. Our chat service is based on specially developed software that uses artificial intelligence (AI) to automatically respond to user inquiries and provide information. The chat service uses interface access (APIs) to AI-based third-party services that specialize in processing natural language, analyzing data, and conducting informative conversations.

The use of the chatbot is voluntary.

We process and store the (personal) text inputs, queries, and responses you provide when interacting with our chatbot, as well as the associated IP address. The last two digits of the IP address are encrypted. This is done in accordance with our legitimate interest in optimizing our chat service and improving user satisfaction. In addition to the data mentioned above, browser log files are also processed. These include, for example, information about the time of access, the IP or DNS address, transmitted bytes, browser used, operating system used, etc.

The legal basis for processing this personal data is the performance of a contract or the implementation of pre-contractual measures with you, pursuant to Art. 6 para. 1 lit. b GDPR. In other cases, data processing is based on our overriding legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR to answer customer or prospect inquiries quickly and easily.

We use an API (interface access) to services provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Your inputs as a user in the chat service and your IP address are processed for the purpose of handling your inquiries, providing our chat service, and improving user satisfaction and the service itself. The legal basis for processing is our legitimate interest in ensuring the most reliable operation of our chatbot (Art. 6 para. 1 sentence 1 lit. f GDPR). For more information, please refer to the privacy notice: https://www.whatsapp.com/privacy, https://www.whatsapp.com/legal/privacy-policy-eea, and https://www.whatsapp.com/legal/.

A possible data transfer abroad takes place on the basis of EU standard contractual clauses to ensure an adequate level of data protection: https://www.whatsapp.com/legal/privacy-policy-eea.

  1. As Part of Our Service Provision

As part of pre-contractual measures and contract performance, names, addresses, email addresses, telephone numbers of clients and, where applicable, persons working for them are collected and processed.

UnionTax is a leading company in tax and legal services with a focus on income tax refunds and child benefit applications throughout Europe. For this purpose, UnionTax provides qualified services in the areas of customer service, client support, and office services. UnionTax also represents our clients before employers, tax offices, or family benefits offices, and provides international legal advice and legal services – and does so in many European languages.

To perform this service, UnionTax relies on the collection of personal data related both to the person making the request and to persons living in the same household. This data includes in particular names, addresses, marital status, date of birth, email, nationality, number and age of children, occupation, income, wage garnishments, rental obligations, maintenance obligations, household expenses, and tax data.

Money laundering legislation also requires us to request a certified copy of an ID and identify the beneficial owners of assets in the event of a contract being concluded. We are regularly audited to ensure that we manage client files carefully.

The legal bases for the processing of data are pre-contractual or contractual measures, your consent, and legal requirements.

The personal data we collect for the initiation or execution of a contract is stored until the end of the statutory retention period and then deleted, unless we are obliged to store it for a longer period due to tax and commercial retention and documentation obligations or you have given consent for extended storage. Continued storage of personal data is also possible in individual cases if necessary and appropriate, especially in the case of long-term client relationships, for ongoing and future consultation and to improve our services. Other personal data from third parties such as service providers is stored as long as required for the purposes described above.

  1. When Contacting Us by Email

You have the option to contact us by email.

You are responsible for the message and/or content you send us. The processing takes place to the extent necessary to respond to your inquiries or to carry out pre-contractual or contractual measures.

The legal basis for data processing is your consent and the implementation of pre-contractual or contractual measures.

  1. In the Context of Employment and Applications

As part of employment relationships, we process personal data to the extent necessary for the performance of the employment contract. We only use photos of employees for promotional and/or informational purposes if they have explicitly agreed. This consent can be revoked at any time and without disadvantage to the employee.

Application documents that do not lead to an employment contract are returned or destroyed once the application process is completed.

  1. Cookies

A cookie is a small file that is sent to your computer or automatically stored on your computer or mobile device by the web browser you are using when you visit our website. When you return to the website, we can recognize you even if we do not know who you are. In addition to cookies that are only used during a session and deleted after your website visit (“session cookies”), cookies can also be used to store user settings and other information over a longer period (“persistent cookies”). However, you can set your browser to reject cookies, to save them only for a session, or to delete them prematurely; however, please note that in this case you may not be able to use all functions of this website to their full extent. Most browsers are preset to accept cookies. We use the following cookies:

NamePurposeDuration
PHPSESSID CookieRecognizes the user during the website visitSession
WordPress_test CookieChecks cookie settings in the browserSession
  1. Google Maps

We have integrated Google Maps, a map service provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland and Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA (hereinafter both referred to as Google) on our website. This is intended to make it easier for you to find us.

When you access the “Contact” subpage where Google Maps is embedded, your browser establishes a connection to a Google server, which may also be located in the USA. Google receives information about your use of our website (e.g., IP address). This happens regardless of whether you are logged in to a Google account at the time. If you are logged in while accessing the page, Google may also associate this data with your Google account. If you do not want this, log out of your Google account beforehand. Google stores your data (even for users who are not logged in) as user profiles and analyzes them. We do not receive any data in this regard and have no influence on how Google uses the data.

Further information on Google’s data processing can be found in Google’s privacy policy (https://policies.google.com/privacy?hl=en) and the terms of use for Google Maps (https://www.google.com/intl/en/help/terms_maps/).

By accessing the Contact subpage, you agree to the data processing described above. We also have a legitimate interest in providing you with a map service on our website to make it easier for you to find us.

  1. Social Media / Communication Platform

We currently use the following social media and communication platform links on our website: Facebook and X (formerly Twitter). We offer you the opportunity to communicate directly with the provider via a link. Only when you click the marked field and thereby activate it do these platforms receive the information that you have accessed the respective page of our online offering (usage data). Additionally, contact data (e.g., email, user IDs), content data (e.g., entries in online forms), and meta and communication data (e.g., IP addresses, identification numbers) are apparently transmitted. According to these platforms, the IP address is immediately anonymized upon collection in Germany. However, by activating the link, personal data is transmitted to these platforms and also stored outside the EU, including in the USA. A data protection level comparable to European law is ensured through the conclusion of standard contractual clauses approved by the European Commission and/or participation in the EU-US Data Privacy Framework.

Since the platforms collect data primarily via cookies, we recommend deleting all cookies in your browser’s security settings before clicking the link. However, we have no influence over the data collected and data processing procedures, nor do we know the full extent of data collection, the purposes of processing, or the retention periods. We also do not have information about the deletion of data collected by the social media and communication platform providers.

These platforms store the data collected about you as user profiles and use them for advertising, market research, and/or the customized design of their websites. This evaluation is carried out in particular (even for users not logged in) to display personalized advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, although you must contact the respective platform to exercise this right.

Data transfer takes place regardless of whether you have an account with the respective platform and are logged in. If you are logged in, the data collected by us will be directly associated with your account on the respective platform. If you activate the button (e.g., share the page), the respective platform will also store this information in your user account and may share it publicly with your contacts. We recommend logging out regularly after using a social network, especially before activating the button, to avoid associating it with your profile on the respective platform.

Through these links, we offer you the opportunity to interact with the social network, the communication platform, and other users, so that we can improve our offering and make it more interesting for you as a user. The legal basis for the use of the links is our legitimate interest.

We are also active on the social network and communication platform ourselves (Facebook and X). If you contact us via these channels, post content, or interact with our posts, we process your data provided there to respond to your inquiries. The risks described above apply here. If we collect additional data from you, we will inform you separately about its scope and use. The legal basis is our legitimate interest unless we obtain your separate consent for data processing.

Further information on the purpose and scope of data collection and its processing by the social media provider and communication platform can be found in their respective privacy policies. There you will also find more information about your rights and settings options to protect your privacy:

Facebook: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
http://www.facebook.com/policy.php
Further information: http://www.facebook.com/help/186325668085084
http://www.facebook.com/about/privacy/your-info-on-other#applications
http://www.facebook.com/about/privacy/your-info#everyoneinfo
Joint controller agreement: https://www.facebook.com/legal/terms/page_controller_addendum
Page Insights: https://www.facebook.com/legal/terms/information_about_page_insights_data
Standard contractual clauses: https://www.facebook.com/legal/EU_data_transfer_addendum

X (formerly Twitter): Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.
Privacy Policy: https://twitter.com/privacy?lang=en
Accessing your data: https://help.twitter.com/en/managing-your-account/accessing-your-twitter-data
Privacy contact: https://support.twitter.com/forms/privacy
Manage personalization: twitter.com/personalization

  1. Disclosure of Your Data to Third Parties

UnionTax only discloses your personal data if you have expressly consented to it, if there is a legal obligation to do so, or if this is necessary to carry out pre-contractual measures, fulfill the contractual relationship, or enforce our rights.

The use of personal data by third parties is strictly limited to the purposes mentioned above (see section 2).

Primary recipients of your personal data are your creditors (tax offices, credit companies, etc.). Additional recipients are mentioned in section 4.

  1. Transfer of Personal Data Abroad, Especially to the USA

If we are allowed to disclose data to third parties, we may also transfer your data to third parties located abroad. If these third parties are located in the EU, the level of data protection is at least as high as in Switzerland. Such third-party companies are obligated to protect personal privacy to the same extent as we do. Where the use of Google, Google Maps, Facebook, or X is concerned and data may be transferred to the USA, please refer to the respective information.

For completeness, we inform you that U.S. authorities may implement surveillance measures under U.S. legislation that allow for the general storage of all data transmitted from the European Union or Switzerland to the USA. To ensure data protection, the Data Privacy Framework applies to data transfers to the USA.

  1. Data Security

We use appropriate technical and organizational security measures to protect your personal data stored with us against manipulation, partial or complete loss, and unauthorized access by third parties. Our security measures are continuously improved in line with technological development.

We also take internal data protection seriously. Our employees are obliged to maintain confidentiality and comply with data protection regulations. In addition, access to personal data is granted only to the extent necessary.

  1. Retention Periods

We store personal data only as long as necessary to perform our services that you have requested or to which you have consented, to protect our legitimate interests (e.g., pre-contractual measures), and to fulfill our legal obligations.

Server log data remains stored until it is no longer operationally necessary and is then automatically deleted. For most log data, this is a maximum of six months.

Contact requests that do not result in a contract are destroyed within one year, unless you request their deletion earlier.

Please note that we store contract data for longer periods because statutory retention requirements mandate this. Retention obligations arise from accounting and tax regulations. According to these regulations, business correspondence, concluded contracts, and accounting records must be stored for up to 10 years.

  1. Rights of Data Subjects

Depending on the applicable data protection regulations, you have the following rights. You may send your request to the address provided in section 1. Please note that we usually require proof of identity to process your request:

Right of access: You have the right to request access to your personal data stored with us at any time, free of charge, if we process it. This allows you to verify what personal data we process about you and that we use it in accordance with applicable data protection laws.

Right to rectification: You have the right to have inaccurate or incomplete personal data corrected and to be informed of the correction. We will inform data recipients of the correction unless this is impossible or requires disproportionate effort.

Right to erasure: You have the right to have your personal data deleted under certain circumstances.

Right to restriction of processing: You have the right, under certain conditions, to request that the processing of your personal data be restricted.

Right to withdraw consent: You generally have the right to withdraw any consent you have given at any time. However, processing activities based on your past consent remain lawful.

Right to data portability: Under certain circumstances, you have the right to receive the personal data you have provided to us in a readable format, free of charge.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the competent data protection authority. The competent authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).

Romanshorn, May 2025.