*This is a translation for your convenience. The German version is legally binding.*
Last updated: October 2026
In this policy we inform you, in accordance with Art. 13 of the General Data Protection Regulation (GDPR), which personal data we process when you visit this website or send us an enquiry, for what purpose and on what legal basis.
1. Controller
Steuerberater Marek Hejzel
Schloßstraße 108, 22041 Hamburg, Germany
Phone: +49 40 285 144 10
Email: mail@stb-hejzel.de
2. Data protection officer
We are not obliged to appoint a data protection officer (§ 38 BDSG). Please send any data protection questions to the address above.
3. Professional secrecy
As tax advisers we are bound by professional secrecy (§ 57 StBerG). This also applies to enquiries sent through this website. Service providers that may technically have access to data, such as our hosting provider, are bound to secrecy in text form (§ 62a StBerG) and have signed a data processing agreement with us (Art. 28 GDPR).
4. Hosting and server logs
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The servers are located in Germany. A data processing agreement is in place with the provider.
When you open the website, the server automatically stores information transmitted by your browser: IP address, date and time, page requested, amount of data transferred, referrer URL, browser and operating system. We need this data to deliver the website, keep it secure and detect faults. The legal basis is our legitimate interest in secure and reliable operation (Art. 6 (1) (f) GDPR). The logs are deleted after 14 days unless they are needed to investigate a security incident.
5. Encryption
This website uses TLS encryption, recognisable by the padlock symbol and “https://” in the address bar. Data you send through the form cannot be read by third parties in transit.
6. Enquiry form, email and phone
When you contact us through the form, by email or by phone, we process the information you provide: usually your name, email address, phone number if given, and your message describing your request. Mandatory fields in the form are marked. Without them we cannot process your enquiry.
The purpose is to answer your enquiry and, where applicable, to prepare an engagement. The legal basis is Art. 6 (1) (b) GDPR where your enquiry aims at concluding a contract, otherwise our legitimate interest in handling enquiries (Art. 6 (1) (f) GDPR).
Form enquiries are stored in the website’s database and sent to us by email. If no engagement follows, we delete the data after 6 months. If an engagement follows, the statutory and professional retention periods apply. No automated decision is made about your enquiry.
To protect against automated spam, the form contains a check field that is invisible to people and a minimum time for filling it in. We also accept no more than five enquiries per hour from one connection. For this, your IP address is only kept in irreversibly encrypted (hashed) form for one hour and then deleted. No data is passed to third parties in the process.
7. Cookies and browser storage
This website sets no cookies when you visit it and stores nothing else in your browser. Only if you object to audience measurement (section 8) do we store this choice in your browser’s local storage (entry “umami.disabled”) so that it also applies on your next visit. This happens at your request and is strictly necessary for that purpose (§ 25 (2) no. 2 TDDDG). We do not set cookies for advertising or analytics.
8. Audience measurement
To understand which pages are read and how visitors find our website, we use the open-source software Umami. Umami does not run at an analytics provider but on a server that our web service provider operates for us. The server is located in the data centre of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in Nuremberg.
Umami sets no cookies and stores nothing on your device. The following is recorded: page requested (without parameters in the address), page title, time, the page you came from, browser, operating system, device type, screen size, language setting and approximate location (country, region, city). Your IP address is only used at the moment of the request to determine the approximate location and is not stored. From the IP address, browser information and a key that changes every month, Umami creates a random-looking identifier. This allows several page views within one month to be counted as one visit without it being possible to identify you. We delete the measurement data after 180 days. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, no measurement takes place. The data is not passed on to third parties.
The legal basis is our legitimate interest in designing the website according to demand (Art. 6 (1) (f) GDPR). You can object to the measurement at any time:
9. Fonts
The fonts of this website are loaded from our own server. No connection is made to servers of Google or other providers.
10. Downloads and links to other websites
The templates in the Downloads section are loaded directly from our server. We do not collect any additional data in the process.
The website contains links to third-party services, for example the chamber of tax advisers or the associations the practice is a member of. Data is only transferred to the respective provider when you click such a link. Their privacy policy applies there.
11. Recipients and transfers to third countries
Apart from us, the only recipients of your data are our processors, STRATO GmbH (website hosting and email) and, for audience measurement, our web service provider with the data centre operator Hetzner Online GmbH. No data is transferred to countries outside the European Union.
12. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7 (3) GDPR). Simply contact us at the address above.
Right to object: Where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
13. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 7th floor, 20459 Hamburg, Germany
Phone: +49 40 428 54-4040, email: mailbox@datenschutz.hamburg.de
www.datenschutz-hamburg.de
14. Changes
We update this policy when the website or the law changes. The version published here applies.