DATA PROTECTION

We, Moore TK GmbH Steuerberatungsgesellschaft, together with our sister companies and subsidiaries as well as all companies of the Moore TK Group (hereinafter jointly referred to as: “the enterprise","we”Or“us“) take the protection of your personal data seriously and would like to inform you about data protection in our company. Our data protection officer Mr. Marc Conrad is available to answer any questions you may have.

As part of our responsibility under data protection law, the entry into force of the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: "GDPR") additional obligations have been imposed to ensure the protection of personal data of the data subject (hereinafter we also refer to you as the data subject as “client”, “user”, "She", "Them" or "Affected” on).

To the extent that we decide on the purposes and means of data processing either alone or jointly with others, this includes above all the obligation to inform you transparently about the type, scope, purpose, duration and legal basis of the processing (cf. Art. 13 and 14 GDPR). With this declaration (hereinafter: “Privacy Policy“) we inform you about how your personal data is processed by us.

Our data protection information has a modular structure. They consist of a general part for all processing of personal data and processing situations that come into play every time a website is accessed (A. General) and a special part, the content of which only relates to the processing situation specified there with the name of the respective offer or product refers, in particular to the visit to websites detailed here (e.g. visiting websites).

In order to be able to find the parts that are relevant to you, please note the following overview of the breakdown of the data protection information:

A. General

(1) Definitions

Following the example of Art. 4 GDPR, this data protection notice is based on the following definitions:

• “Personal data” (Article 4 No. 1 GDPR) is all information relating to an identified or identifiable natural person (“data subject”). A person is identifiable if he or she can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or with the help of information about his or her physical, physiological, genetic, mental, economic, cultural or social identity characteristics. Identifiability can also be achieved by linking such information or other additional knowledge. The origin, form or embodiment of the information is not important (photos, video or sound recordings can also contain personal data).
• “Processing” (Article 4 No. 2 GDPR) is any process in which personal data is handled, whether with or without the aid of automated (i.e. technology-based) procedures. This includes in particular the collection (i.e. procurement), recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or other provision, comparison, linking, restriction, erasure or destruction of personal data as well as the change of a target or purpose on which data processing was originally based.
• “Controller” (Article 4 No. 7 GDPR) is the natural or legal person, public authority, agency or other body which alone or jointly with others decides on the purposes and means of processing personal data.
• “Third party” (Article 4 No. 10 GDPR) means any natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons authorised to process the personal data under the direct responsibility of the controller or processor; this also includes other legal entities belonging to the group.
• “Processor” (Article 4 No. 8 GDPR) is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller, in particular in accordance with its instructions (e.g. IT service providers). In the sense of data protection law, a processor is in particular not a third party.
• “Consent” (Article 4 No. 11 GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes in the form of a statement or other unambiguous confirmatory act by which he or she signifies agreement to the processing of personal data concerning him or her.

(2) Name and address of the controller

We are the responsible party for processing your personal data within the meaning of Art. 4 No. 7 GDPR:

Moore TK GmbH Tax Consulting Company

Rennershofstraße 8-9, D-68163 Mannheim

Telefon: +49(0)621 42508-0

Telefax: +49(0)621 42508-50

E-Mail: info@moore-tk.de

For further information about our company, please refer to the imprint on our website: Imprint.

(3) Contact details of the data protection officer

Our company data protection officer is available at any time to answer any questions you may have and to act as your contact person on the subject of data protection. His contact details are:

Marc Conrad

c/o Moore TK Legal GmbH Law Firm

Rennershofstraße 8-9 D-68163 Mannheim

Email: Marc.Conrad@mtk-legal.de

(4) Legal basis for data processing

In principle, any processing of personal data is prohibited by law and is only permitted if the data processing falls under one of the following justifications:

• Art. 6 Para. 1 S. 1 lit. a GDPR (“consent”): If the data subject has voluntarily, in an informed manner and unambiguously indicated by a statement or other unambiguous confirmatory act that he or she agrees to the processing of personal data concerning him or her for one or more specific purposes;
• Art. 6 (1) sentence 1 lit. b GDPR: If the processing is necessary to fulfill a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract;
• Art. 6 Para. 1 Clause 1 Letter c GDPR: If the processing is necessary to fulfill a legal obligation to which the controller is subject (e.g. a statutory retention period);
• Art. 6 Para. 1 S. 1 lit. d GDPR: If processing is necessary to protect the vital interests of the data subject or of another natural person;
• Art. 6 para. 1 sentence 1 lit. e GDPR: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or
• Art. 6 (1) sentence 1 lit. f GDPR (“Legitimate Interests”): If the processing is necessary to safeguard the legitimate (in particular legal or economic) interests of the controller or a third party, unless the conflicting interests or rights of the data subject prevail (in particular if the data subject is a minor). 

Storage of information in the end user's terminal equipment or access to information already stored in the end equipment is only permitted if covered by one of the following justifications:

• § 25 Para. 1 TTDSG: If the end user has given their consent on the basis of clear and comprehensive information. The consent must be given in accordance with Art. 6 Para. 1 Sentence 1 lit. a GDPR;
• § 25 para. 2 no. 1 TTDSG: If the sole purpose is to carry out the transmission of a message via a public telecommunications network or
• Section 25 Paragraph 2 No. 2 TTDSG: If the storage or access is absolutely necessary so that the provider of a telemedia service can provide a telemedia service expressly requested by the user.

Below we provide the applicable legal basis for the processing operations we carry out. Processing can also be based on several legal bases.

(5) Data deletion and storage period

For the processing operations we carry out, we indicate below how long the data will be stored by us and when it will be deleted or blocked. Unless an express storage period is stated below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies. Your data will generally only be stored on our servers in Germany, subject to any transfer in accordance with the regulations in A.(7) and A.(8).

However, storage may take place beyond the specified period in the event of an (impending) legal dispute with you or other legal proceedings or if storage is required by legal provisions to which we as the controller are subject (e.g. Section 257 HGB, Section 147 AO). If the storage period prescribed by the legal provisions expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for doing so.

(6) Data Security

We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties (e.g. TSL encryption for our website), taking into account the state of the art and implementation costs and the nature, scope, context and purpose of the processing as well as the existing risks of a data breach (including their likelihood and impact) for the data subject. Our security measures are continuously improved in line with technological developments.

We will be happy to provide you with further information on this upon request. To do this, please contact our data protection officer (see under A.(3)).

(7) Cooperation with processors

As with any large company, we also use external domestic and foreign service providers to handle our business transactions (e.g. for IT, logistics, telecommunications, sales and marketing). They only act on our instructions and have been contractually obliged to comply with data protection regulations within the meaning of Art. 28 GDPR.

If personal data from you is passed on by us to our subsidiaries or is passed on to us by our subsidiaries (e.g. for advertising purposes), this occurs on the basis of existing order processing relationships.

(8) Conditions for the transfer of personal data to third countries

As part of our business relationships, your personal data may be passed on or disclosed to third parties. These may also be located outside the European Economic Area (EEA), i.e. in third countries. Such processing is carried out exclusively to fulfill contractual and business obligations and to maintain your business relationship with us (the legal basis is Art. 6 Para. 1 lit. b or lit. f in conjunction with Art. 44 ff. GDPR). We will inform you about the respective details of the transfer below at the relevant points.

The European Commission has certified that some third countries have data protection comparable to the EEA standard through so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). In other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. Where this is the case, we ensure that data protection is adequately guaranteed. This is possible through binding company rules, standard contractual clauses of the European Commission for the protection of personal data in accordance with Art. 46 Para. 1, 2 lit. c GDPR (the standard contractual clauses from 2021 are available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0915&locale-en), certificates or recognized codes of conduct. Please contact our data protection officer (see A.(3)) if you would like more information on this.

(9) No automated decision-making (including profiling)

We do not intend to use personal data collected from you for any automated decision-making process (including profiling).

(10) No obligation to provide personal data

We do not make the conclusion of contracts with us dependent on you providing us with personal data beforehand. As a client, you are generally not under any legal or contractual obligation to provide us with your personal data; however, we may be unable to provide certain services to a limited extent or not at all if you do not provide the necessary data. If this should exceptionally be the case within the scope of the services we offer presented below, e.g. data collection within the scope of the Money Laundering Act, you will be informed of this separately.

(11) Legal obligation to transmit certain data

We may, under certain circumstances, be subject to a special statutory or legal obligation to make the lawfully processed personal data available to third parties, in particular public authorities (Article 6 (1) sentence 1 lit. c GDPR).

(12) Your Rights

You can assert your rights as a data subject regarding your processed personal data at any time using the contact details provided at the beginning of A.(2). As a data subject, you have the right:

• to request information about your data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the purposes of processing, the category of data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected from us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information on its details;
• to immediately request the correction of inaccurate data or the completion of your data stored by us in accordance with Art. 16 GDPR;
• to request the deletion of your data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
• to request the restriction of the processing of your data in accordance with Art. 18 GDPR if you contest the accuracy of the data or if the processing is unlawful;
• pursuant to Art. 20 GDPR, to receive the data you have provided to us in a structured, common and machine-readable format or to request that it be transmitted to another controller (“data portability”);
• to object to processing pursuant to Art. 21 GDPR, provided that the processing is carried out on the basis of Art. 6 Paragraph 1 Clause 1 Letter e or Letter f GDPR. This is particularly the case if the processing is not necessary to fulfill a contract with you. Unless it is an objection to direct advertising, when exercising such an objection we ask you to explain the reasons why we should not process your data as we do. If your objection is justified, we will examine the situation and will either stop or adapt the data processing or show you our compelling legitimate reasons on the basis of which we continue the processing;
• pursuant to Art. 7 Para. 3 GDPR, you have the right to revoke your consent (even before the GDPR came into force, i.e. before 25.5.2018 May XNUMX) – i.e. your voluntary, informed and unambiguous will, made clear by a declaration or other unambiguous affirmative action, that you agree to the processing of the personal data concerned for one or more specific purposes – at any time, if you have given such consent. This means that we may no longer continue the data processing based on this consent in the future and
• pursuant to Art. 77 GDPR, to complain to a data protection supervisory authority about the processing of your personal data in our company, for example to the data protection supervisory authority responsible for us: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, PO Box 10 29 32 70025 Stuttgart, email: pststelle@lfdi.bwl.de

(13) Sharing and transmission of personal data within Moore TK’s organization

We may share personal data with other companies in the Moore TK Group if this is necessary in connection with the purposes described in this privacy policy. For example, if we offer professional services to a client, we may share personal data with other companies in the Moore TK Group in different countries that are involved in advising that client. The legal basis for the transfer of data is Art. 6 Para. 1 lit. b) GDPR.

(14) Use of the Fathom AI Notetaker

For recording, archiving and structured follow-up of video conferences, we use the Fathom AI Notetaker This tool from Fathom Video Inc. transcribes spoken content and automatically creates a summary overview, including relevant tasks and topics. Personal data is processed based on your prior consent in accordance with Art. 6 (1) (a) GDPR. Fathom is certified under the EU-US Data Privacy Framework. We have also concluded a data processing agreement with Fathom Video Inc., which contains special provisions for those bound by professional secrecy. Further information on Fathom's data protection can be found at: https://fathom.video/privacy. Detailed information on data security, existing certifications, and current documents is available from the provider at the following link: https://trust.fathom.video/.

(15) Changes to the data protection information

As part of the further development of data protection law as well as technological or organizational changes, our data protection information is regularly reviewed for the need for adjustment or additions. You will be informed of changes in particular on our German website at https://moore-tk.de/. This data protection information is dated 05/2025.

B. Visiting websites

(1) Explanation of the function

Information about our company and the services we offer can be found in particular at https://moore-tk.de/ including the associated subpages (hereinafter jointly: “websites”). When you visit our websites, your personal data may be processed.

(2) Personal data processed

When you use the websites for information purposes, we collect, store and process the following categories of personal data:

“Protocol data”: When you visit our websites, a so-called protocol data record (so-called server log files) is temporarily and anonymously stored on our web server. This consists of:

• the page from which the page was requested (so-called referrer URL)
• the name and URL of the requested page
• the date and time of the call
• the description of the type, language and version of the web browser used
• the IP address of the requesting computer, which is shortened so that a personal reference can no longer be established
• the amount of data transferred
• the operating system
• the message whether the call was successful (access status/Http status code)
• the GMT time zone difference

“Contact form data”: When using contact forms, the data transmitted through them is processed (e.g. gender, first and last name, address, company, email address and the time of transmission).

In addition to the purely informational use of our website, we offer the subscription to our newsletter (“client newsletter”), with which we inform you about current developments in tax law and events. If you sign up for our newsletter, the following “newsletter data” will be collected, stored and further processed by us:

• the page from which the page was requested (so-called referrer URL)
• the date and time of the call
• the description of the type of web browser used
• the IP address of the requesting computer, which is shortened so that a personal reference can no longer be established
• the email address
• the date and time of registration and confirmation

We would like to point out that we can evaluate your user behavior when sending the newsletter. For this evaluation, the emails sent contain so-called web beacons or tracking pixels, which are single-pixel image files stored on our website. For the evaluations, we link the data mentioned above and the web beacons with your email address and an individual ID. Links included in the newsletter also contain this ID. The data is collected exclusively in pseudonymized form, i.e. the IDs are not linked to your other personal data, and direct personal reference is excluded.

When you place your order, we generally ask for your consent as to whether you would like to receive an analogue or digital client newsletter. For this purpose, we usually send you an email once a month with a link to the current newsletter as a PDF file. We use rapidmail to send our digital newsletter. Your data (email address) is therefore transmitted to rapidmail GmbH. rapidmail GmbH is prohibited from using your data for purposes other than sending the newsletter. rapidmail GmbH is not permitted to pass on or sell your data. rapidmail is a German, certified newsletter software provider that has been carefully selected in accordance with the requirements of the GDPR and the BDSG. You can revoke your consent to the storage of data and its use for sending newsletters at any time, e.g. via the unsubscribe link in the newsletter. The data protection declaration of rapidmail, which is operated by rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg im Breisgau, can be viewed at https://www.rapidmail.de/datenschutz.

We also use mailchimp for our newsletter. The above principles apply. The privacy policy of mailchimp, which is operated by the Rocket Science Group, LLC 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA, can be found at https://www.intuit.com/privacy/statement/ You can find out how the provider complies with GDPR at https://mailchimp.com/gdpr/ to find out.

(3) Purpose and legal basis of data processing

We process the personal data specified above in accordance with the provisions of the GDPR, the other relevant data protection regulations and only to the extent necessary. Insofar as the processing of personal data is based on Art. 6 Para. 1 Clause 1 Letter f of GDPR, the purposes mentioned also represent our legitimate interests.

The processing of the log data serves statistical purposes and to improve the quality of our website, in particular the stability and security of the connection (the legal basis is Art. 6 Para. 1 S. 1 lit. a or lit. f GDPR).

Contact form data is processed to process mandate requests (the legal basis is Art. 6 Para. 1 S. 1 lit. b or lit. f GDPR).

The newsletter data is processed for the purpose of sending the newsletter. When you register for our newsletter, you consent to the processing of your personal data (the legal basis is Art. 6 Para. 1 lit. a GDPR). We use the so-called double opt-in procedure to register for our newsletter. This means that after you register, we will send you an e-mail to the e-mail address you provided, asking you to confirm that you wish to receive the newsletter. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data. You can revoke your consent to the sending of the newsletter and unsubscribe from the newsletter at any time. You can revoke your consent by clicking on the link provided in each newsletter e-mail, by e-mail to info@moore-tk.de or by sending a message to the contact details provided in the imprint.

If the processing of the data requires the storage of information in your terminal equipment or access to information that is already stored in the terminal equipment, Section 25 (1) and (2) TTDSG is the legal basis for this.

(4) Duration of data processing

Your data will only be processed for as long as is necessary to achieve the processing purposes mentioned above; the legal bases specified in the context of the processing purposes apply accordingly. Regarding the use and storage period of cookies, please note point A.(5) as well as the Cookie Policy.

Third parties used by us will store your data on their system for as long as is necessary in connection with the provision of services for us in accordance with the respective order.

Further details on the storage period can be found under A.(5) and the Cookie Policy.

(5) Transfer of personal data to third parties; justification

The following categories of recipients, who are usually processors (see A.(7)), may have access to your personal data:

• Service providers for the operation of our website and the processing of data stored or transmitted by the systems (e.g. for data center services, payment processing, IT security). The legal basis for the transfer is then Art. 6 Para. 1 Clause 1 Letter b or Letter f GDPR, unless they are contract processors;
• State bodies/authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the transfer is then Art. 6 Para. 1 Clause 1 Letter c of GDPR;
• Persons employed to carry out our business operations (e.g. auditors, banks, insurance companies, legal advisors, supervisory authorities, those involved in company acquisitions or the establishment of joint ventures). The legal basis for the transfer is then Art. 6 Para. 1 Clause 1 Letter b or Letter f of GDPR.

For guarantees of an appropriate level of data protection when data is transferred to third countries, see A.(8). 

Furthermore, we will only pass on your personal data to third parties if you have given your express consent in accordance with Art. 6 Paragraph 1 Clause 1 Letter a of GDPR.

(6) Use of cookies, plugins and other services on our website

a) Cookie

We use cookies on our websites. Cookies are small text files that are assigned and stored on your hard drive by the browser you are using using a characteristic string and through which certain information flows to the place that sets the cookie. Cookies cannot run programs or transmit viruses to your computer and therefore cannot cause any harm. They serve to make the Internet offering more user-friendly and effective overall, i.e. more pleasant for you.

Cookies can contain data that makes it possible to recognize the device used. In some cases, cookies only contain information about certain settings that are not personally identifiable. However, cookies cannot directly identify a user. 

A distinction is made between session cookies, which are deleted as soon as you close your browser, and permanent cookies, which are stored beyond the individual session. In terms of their function, cookies are differentiated between:

• • Technical cookies: These are essential to move around the website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes, nor do they store which websites you have visited;
  • Performance cookies: These collect information about how you use our website, which pages you visit and, for example, whether errors occur during website usage; they do not collect any information that could identify you - all information collected is anonymous and is only used to improve our website and find out what interests our users;
  • Advertising cookies, targeting cookies: These are used to offer the website user needs-based advertising on the website or offers from third parties and to measure the effectiveness of these offers; advertising and targeting cookies are stored for a maximum of 13 months;
  • Sharing cookies: These are used to improve the interactivity of our website with other services (e.g. social networks); sharing cookies are stored for a maximum of 13 months.

The legal basis for cookies that are absolutely necessary to provide you with the service you have expressly requested is Section 25 Paragraph 2 No. 2 TTDSG. Any use of cookies that is not technically necessary for this purpose constitutes data processing that is only permitted with your express and active consent in accordance with Section 25 Paragraph 1 TTDSG in conjunction with Article 6 Paragraph 1 Sentence 1 Letter a of GDPR. This applies in particular to the use of performance, advertising, targeting or sharing cookies. In addition, we will only pass on your personal data processed by cookies to third parties if you have given your express consent to do so in accordance with Article 6 Paragraph 1 Sentence 1 Letter a of GDPR.

b) Cookie Policy

For more information about the cookies we use and how you can manage your cookie settings and opt out of certain types of tracking, please see our Cookie Policy.

c) Social media plugins

We do not use social media plug-ins on our websites. If our websites contain symbols from social media providers (e.g. Facebook, LinkedIn and Instagram), we only use these to passively link to the pages of the respective providers.

(7) Social Media

We maintain publicly accessible profiles on various social networks. Visiting these profiles sets a variety of data processing operations in motion. Below we provide you with an overview of which of your personal data we collect, use and store when you visit our profiles. Personal data is information that can be assigned to you as a specific person (e.g. name, age, address, photos, email addresses, and possibly IP addresses). We also inform you of the rights you have with regard to the processing of your personal data by us. You are not obliged to provide us with your personal data. However, this may be necessary for individual functions of our profiles on social networks. These functions are not available to you or only available to a limited extent if you do not provide us with your personal data.

When you visit our profiles, your personal data is collected, used and stored not only by us, but also by the operators of the respective social network. This also happens if you do not have a profile in the respective social network yourself. The individual data processing operations and their scope differ depending on the operator of the respective social network and they are not necessarily comprehensible to us. For details on the collection and storage of your personal data as well as the type, scope and purpose of their use by the operator of the respective social network, please refer to the data protection statements of the respective operator:

• The privacy policy for the social network Facebook, which is operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, can be viewed at https://www.facebook.com/about/privacy/update?ref=old_policy;
• The privacy policy for the social network Instagram, which is operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA, can be viewed at https://help.instagram.com/155833707900388;
• The privacy policy for the social network LinkedIn, which is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, can be viewed at https://de.linkedin.com/legal/privacy-policy;
• the privacy policy for the social network XING, which is operated by New Work SE
• Am Strandkai 1, 20457 Hamburg and internationally from XING Spain
• Consell de Cent, 334-336, 1º 1ª 08009 Barcelona Spain, can be viewed at https://privacy.xing.com/de/datenschutzerklaerung;
• The privacy policy for the social network YouTube, which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, can be viewed at https://www.gstatic.com/policies/privacy/pdf/20190122/f3294e95/google_privacy_policy_de_eu.pdf.

As the operator of a social media page, we can only see the information stored in your public profile, and this only if you have such a profile and are logged into it while you access our social media page. In addition, the respective operator usually provides us with anonymous usage statistics, which we use to improve the user experience when visiting our social media page. We do not have access to the usage data that the respective operator collects to create these statistics. The respective operator has committed to us to assume primary responsibility under the GDPR for the processing of this data, to fulfill all obligations under the GDPR with regard to this data and to make the essence of this obligation available to those affected. This data processing serves our and your legitimate interest in improving the user experience when visiting our social media page in a target group-appropriate manner. The legal basis for the data processing is therefore Art. 6 Para. 1 lit. f) GDPR. In addition, the respective operator uses so-called cookies, which are stored on your device when you visit our social media page, even if you do not have your own profile or are not logged into it during your visit to our social media page. These cookies allow the respective operator to create user profiles based on your preferences and interests and to show you tailored advertising within and outside of the respective social media page. Cookies remain on your device until you delete them. You can find details about this in the operator's privacy policy above.

If you use our profiles on social networks to contact us (e.g. by creating your own posts, reacting to one of our posts or by sending us private messages), the data you provide to us will be processed by us solely for the purpose of being able to contact you. The legal basis for data collection is therefore Art. 6 Paragraph 1 Letters a) and b)12 GDPR. We delete stored data after three years, unless a longer period is prescribed by law, as soon as their storage is no longer necessary or you request us to delete them. In the case of statutory retention periods, we restrict the processing of the stored data accordingly.

C. Applicant

We intend to continue to store applicant data after an application process has been unsuccessful and to use it to compare it with the requirements of other vacant positions with us in order to contact you again as an applicant if a suitable vacancy occurs and, if necessary, to initiate a new application process.

The applicant declares his consent that we may use his personal data for the stated purpose,

• which he has submitted during the application process (e.g. through application documents and interviews) and
• which may have been legitimately collected during the application process (e.g. from publicly accessible professional networks, questionnaires),
• including those that can be assigned to special categories (e.g. racial and ethnic origin, political opinions, religious or ideological beliefs, trade union membership or severely disabled status) that have become known through his application

not only in the ongoing application process for its implementation, but also after a possible unsuccessful conclusion of the process and notifies me after the above-mentioned comparison has been successful in order to initiate the application process for another vacant position. We will obtain your express consent for this in advance, if possible.

The applicant also agrees that his application data may be passed on to and stored within the MTK Group for the aforementioned purposes in addition to the following companies:

• Moore TK Audit & Advisory GmbH Wirtschaftsprüfungsgesellschaft
• MOORE TK Legal GmbH Rechtsanwaltsgesellschaft

We undertake not to pass on the data to any other external third parties.

The applicant's consent is given voluntarily. He can refuse it without giving reasons and without fearing any disadvantages. He is aware that giving his consent has no positive or negative impact on the application process.

The above consent remains valid until he revokes it. He can revoke this consent at any time later without giving reasons by telephone, in writing or by email. The applicant is also entitled to the other rights set out in the data protection declaration.

The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation. If there is another legal basis for the further processing of the applicant's data, we are entitled to do so. Otherwise, the applicant's data will be deleted if the consent is revoked.