Privacy policy
This is a translation; the German version is authoritative.
1. Controller
GKM Global GmbH, GKM Buchhaltung division
Gerhofstraße 1–3, 20354 Hamburg, Germany
Phone +49 40 2989 6395, e-mail info@gkm-buchhaltung.de
Represented by the managing director Gagik Kreuz.
2. General
We only process personal data insofar as this is necessary to operate this website, handle your enquiries, take pre-contractual measures, perform contracts or pursue our legitimate interests. We do not sell data.
3. Hosting and server log files
The website and client portal run on our own server provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, in a data centre in Spain, i.e. within the EU. When you visit the site, your browser transmits technically necessary data: IP address, date and time, requested address, amount of data transferred, status code, referring page as well as browser and operating system.
The purpose is the secure and stable operation of the website. The legal basis is Art. 6 (1) (f) GDPR. Log data are deleted after seven days unless a security incident has to be investigated. The provider processes the data as a processor under Art. 28 GDPR.
4. Cookies, analytics and external services
This website does not set any cookies that would require consent under Section 25 (1) TDDDG and does not use any analytics or advertising services. In the client portal we only set a technically necessary session cookie, see section 7. We deliver fonts from our own server. Visiting the site therefore does not create connections to Google or other third parties. If this changes, we will update this policy beforehand and obtain your consent where necessary.
5. Contact by e-mail or phone
If you call or write to us, we process your details to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR if a contract with you is concerned, otherwise Art. 6 (1) (f) GDPR. Normal e-mails are not end-to-end encrypted. Please send confidential documents via the client portal or as agreed.
6. Contact form and “Become a client” request
In the contact form we process name, company, phone, e-mail, topic and message. In the “Become a client” request additionally legal form, industry, requested services, approximate number of entries and employees, choice of tax advisor and preferred start. Mandatory fields are marked.
The details are sent to us by e-mail and are used to reply and prepare a quote. The legal basis is Art. 6 (1) (b) GDPR, for details provided on behalf of a company Art. 6 (1) (f) GDPR. For e-mail we use Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as processor under Art. 28 GDPR.
7. Client portal
In the client portal we process the data we need for access and cooperation: name, e-mail address, the password only as a hash, if you wish the key for the second factor, uploaded and provided documents as well as electronic signatures with time, IP address and checksum of the document.
For signing in we set a technically necessary session cookie. It ends when you sign out, at the latest after twelve hours, and does not require consent (Section 25 (2) no. 2 TDDDG). We log sign-ins, signatures and document downloads as evidence and to protect against misuse. The legal basis is Art. 6 (1) (b) GDPR, for the log Art. 6 (1) (f) GDPR. Details are set out in the privacy notice for clients that you receive in the portal.
8. Recipients
Only GKM employees who handle your enquiry have access, as well as our service providers for hosting, e-mail and IT as processors. If you choose our partner tax advisors, we pass on your contact details and information about the engagement to them with your consent. They then process these under their own responsibility. Authorities only receive data where the law requires it.
9. Transfers to third countries
The website itself does not transfer any data to countries outside the EU and EEA. Microsoft generally processes our e-mails in the EU. Access by the parent company Microsoft Corporation in the USA cannot be ruled out. It is based on the adequacy decision for the EU-US Data Privacy Framework, under which Microsoft is certified (Art. 45 GDPR), and additionally on standard contractual clauses (Art. 46 GDPR).
10. Storage period
Server log files seven days. Client portal access data until the access ends. Enquiries without a contract are deleted at the latest six months after the last message. If a contract is concluded, the statutory retention periods apply: six years for business letters, eight years for accounting vouchers, ten years for books and annual accounts.
11. Data security
The connection to the website is encrypted with TLS, recognisable by “https://” in the address. We take appropriate technical and organisational measures to protect your data.
12. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. A message to info@gkm-buchhaltung.de is sufficient.
You may lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information.
13. Automated decisions
We do not make solely automated decisions and do not create profiles.
Last updated: October 2026