Dominik von den Berg
パートナー
税理士
電話番号 : +49 151 21114842
メール :
d.vondenberg@nhsgroup.de
- パートナー
- 税理士
- 理学修士 (M.Sc.)
- 言語:ドイツ語、英語
主な事業内容:
- 国内外の企業に対する税務アドバイス
- 給与計算に関するアドバイス
- 海外駐在員に対する税務アドバイス
- 新規事業
- 年次財務諸表および税務申告
- 税務デューデリジェンス
パートナー
税理士
電話番号 : +49 151 21114842
メール :
d.vondenberg@nhsgroup.de
主な事業内容:
This statement was updated on 20 August 2026.
NHS GmbH Steuerberatungsgesellschaft (hereinafter ‘NHS’), is pleased that you are visiting our website. Data protection and data security are very important to us. We would like to inform you which of your personal data we collect when you visit our websites, NHSGROUP and NHSGROUP-KARRIERE, and for what purposes it is used. Changes to the law or changes to our internal company processes may make it necessary to adapt this data protection declaration, which is why this data protection declaration will be updated in good time.
The controller within the meaning of the EU General Data Protection Regulation (hereinafter: GDPR) and other national data protection laws of the member states as well as other data protection regulations is:
NHS GmbH Steuerberatungsgesellschaft
Am Wehrhahn 100
D-40211 Düsseldorf
Personal data is any information relating to an identified or identifiable natural person. This includes, for example, information such as your name, your age, your address, your telephone number, your date of birth, your e-mail address or technical (connection) data such as your IP address. Information for which we cannot (or can only with disproportionate effort) establish a link to your person, e.g. anonymous or anonymised information, is not personal data.
The processing of personal data (e.g. the collection, retrieval, use, storage, transmission or other processes) always requires a legal basis. Your personal data processed by us will be deleted as soon as the purpose of the processing has been achieved and there are no longer any statutory retention obligations to be complied with.
We will inform you below about the processes, the scope and purpose of the data processing, the legal basis for the processing, the respective storage period and, if applicable, the transfer of personal data to processors or to third countries.
Purpose
We collect and process personal data in order to provide tax consultancy services in accordance with Section 33 StBerG and auditing services in accordance with Section 2 WPO as well as related services and ancillary services. This includes, among other things, advice on tax and business matters, the preparation of tax returns, the preparation of annual financial statements and tax audits as well as representation in tax matters.
Data categories
We process the following personal data as part of our tax consultancy and auditing services:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes. Tax and accounting-related data is subject to statutory retention obligations of up to ten years (see, among others, Section 257 (1) HGB, Section 147 (1) AO). After this period has expired, the data will be deleted, provided there are no further legal obligations to retain it.
Legal basis
Order processing
We use the services of software and IT service providers to provide tax consulting and auditing services. These are processors in accordance with Art. 28 GDPR. For this purpose, we have concluded an order processing contract with these service providers in accordance with Art. 28 para. 3 GDPR. Your personal data will only be processed on our instructions.
Purpose
We process your personal data in order to provide you with our accounting software as a cloud application. This also includes data storage, maintenance and support of the software and ensuring its proper functioning.
Data categories
We process the following personal data as part of the provision and use of the accounting software:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes. Due to statutory retention obligations, certain data may be stored for up to ten years (see, among others, Section 257 (1) HGB, Section 147 (1) AO). After this period has expired, the data will be deleted, provided there are no further legal obligations to retain it. You can also instruct us at any time to delete personal data before these periods expire.
Legal basis
Order processing
We use the services of external software and IT service providers to provide the accounting software. These are processors in accordance with Art. 28 GDPR. For this purpose, we have concluded an order processing contract with these service providers in accordance with Art. 28 para. 3 GDPR. Your personal data will only be processed on our instructions.
Purpose
We collect and use the personal data of our users in order to provide a functional website as well as our content and services. When you access and use our website, we collect the personal data that your browser automatically transmits to our server. This information is stored temporarily. We process your personal data in order to offer the functional scope of the website and to be able to fulfill the user agreement entered into with you.
We also process your data if it is necessary to protect our legitimate interests or those of third parties. This may be the case in particular to ensure IT security and IT operations, as well as to be able to trace and prove facts in the event of legal disputes. In addition, we process your data to fulfill legal obligations.
Data categories
When you use our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website during use. Consequently, the user has no option to object. After use has been completed, the data is deleted as soon as the purposes for which it was collected no longer apply. Further storage may take place in individual cases if this is required by law.
Order processing
We use the services of an external hosting provider and a web agency to operate the website. These are processors in accordance with Art. 28 GDPR. There is a possibility that your personal data may be passed on. For this purpose, we have concluded an order processing contract with these service providers in accordance with Art. 28 para. 3 GDPR. Your personal data will only be processed on our instructions.
Purpose
We use Content Delivery Networks (CDNs) to ensure the fast, secure, and reliable delivery of our website. A CDN is a geographically distributed network of servers used primarily to deliver HTML, JavaScript, and CSS files, images, documents, and other static content. To do this, your browser establishes a direct connection to a CDN server that is technically or geographically suitable. This helps reduce loading times, improve the website’s availability and stability, and fend off attacks. Resources are primarily retrieved from *.multiscreensite.com, *.cdn-website.com, *.elfsightcdn.com, and *.cloudfront.net for delivery. The first two domains mentioned are part of Duda’s website infrastructure; *.cloudfront.net is provided via Amazon CloudFront. *.elfsightcdn.com is used for the technical delivery of resources from integrated Elfsight widgets.
Data categories
When delivering content via a CDN, the following data in particular may be processed:
Storage period
The request data generated during pure CDN delivery is generally not stored as content data. The service providers used store log data only for as long as is necessary for technical provision, ensuring information security, error analysis, and preventing misuse, and as provided for in the respective contractual configuration. The data is subsequently deleted or anonymized, unless statutory retention requirements or the investigation of a specific security incident require longer-term storage.
Legal basis
If content from a third-party service requiring consent is delivered via a CDN, the relevant connection will only be established after you have given your consent in accordance with Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Order processing
For CDN delivery, we - or rather our website service providers, specifically Duda and Amazon Web Services (Amazon CloudFront) - use Elfsight for embedded widgets. Depending on the technical integration, processing takes place either directly on our behalf or as subprocessing within the respective service provider chain. The service providers are contractually obligated to process data in accordance with documented instructions and to ensure appropriate technical and organizational security measures. The necessary data processing agreements pursuant to Article 28 of the GDPR have been concluded.
Transfer to a third country
In connection with CDN deployment, personal data may be processed by service providers and subcontractors outside the European Economic Area, particularly in the United States. To the extent that an adequacy decision pursuant to Article 45 of the GDPR applies to the respective recipient, the transfer is made on that basis. In all other cases, the transfer is based in particular on the Standard Data Protection Clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR and, where applicable, supplementary safeguards. You may request a copy of the relevant safeguards via our contact address listed above.
Purpose
We provide general contact forms so that you can get in touch with us by e-mail.
Data categories
The data categories can be taken from the forms and generally include:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. The duration of storage depends largely on your request and the further purpose of processing and can therefore not be specified in general terms.
Legal basis
Purpose
We use the Google reCAPTCHA service to protect our website—and in particular the forms we provide—from malicious automated submissions, spam, and other attacks. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA analyzes website usage to distinguish between human input and automated access. To do this, it establishes a connection to Google’s servers. Data processing will only take place after you have given your consent.
Data categories
When using reCAPTCHA, the following data in particular may be processed:
Storage period
The result of the reCAPTCHA check is stored only for as long as necessary to protect the forms and investigate security incidents. The response token generated by reCAPTCHA is valid for verification only for a short period of time and is generally not stored permanently. The retention period for cookies and other data at Google depends on the respective technical configuration as well as Google’s contractual deletion and retention policies. If you withdraw your consent, reCAPTCHA will no longer be loaded on future visits; the lawfulness of the processing that took place prior to the withdrawal remains unaffected.
Legal basis
Order processing
Google processes reCAPTCHA customer data on our behalf to provide the service. Google is contractually obligated to ensure appropriate measures for the security and confidentiality of the processed data. To this end, we have entered into a data processing agreement with Google pursuant to Article 28 of the GDPR. Google processes reCAPTCHA customer data only in accordance with our documented instructions.
Transfer to a third country
In connection with the provision of reCAPTCHA, personal data may be processed by Google LLC and other subprocessors outside the European Economic Area, particularly in the United States. To the extent that an adequacy decision pursuant to Article 45 of the GDPR applies to the respective recipient, the transfer is made on that basis. Furthermore, Google bases the transfer in particular on the Standard Data Protection Clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR. You may request a copy of the relevant safeguards via our contact address listed above.
Purpose
We offer you the option of contacting us and communicating by e-mail.
Data categories
The data categories cannot be specified in full, but depend on the data you provide us with. We usually process at least:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. E-mails are business letters and are therefore subject to archiving obligations under tax law. The longest retention period is 10 years (e.g. § 257 para. 1 HGB, § 147 para. 1 AO). E-mails are deleted year by year when the retention periods expire.
Legal basis
Purpose
We process your personal data so that we can send you our newsletter, which you have actively opted for. We use the double opt-in procedure to subscribe to our newsletter. After you have entered your e-mail address in the field provided or provided it to us in another way, you will receive an e-mail from us. This will contain a confirmation link. You only subscribe to our newsletter when you click on the link. If you click on the link in the confirmation e-mail you receive, we will process your personal data for a specific purpose in order to prove that we have received a declaration of consent.
Data categories
The data categories can be taken from the forms and generally include:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. As long as you are an active recipient of a newsletter, we will store your data. We usually delete your data immediately if you withdraw your consent and unsubscribe from the newsletter.
Legal basis
Order processing
To send our newsletter, we use the services of a processor in accordance with Art. 28 GDPR. This involves the transfer of your personal data. For this purpose, we have concluded an order processing contract with our service provider in accordance with the provisions of the GDPR. Your personal data will be processed exclusively on our instructions.
Purpose
We process your personal data for a specific purpose with the help of so-called “plug-ins” of the social media services YouTube and Spotify on our website. The integration of the services enables the playback of media content within our website.
Data categories
The following data is regularly processed for the use of social media:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is necessary for technical reasons. If you revoke your declaration of consent, we will delete your personal data. When integrating plug-ins of social media services on our website, so-called session cookies are regularly set. These can be used to store your personal data for the duration of your visit to the website. If you close our website, your personal data will be deleted. For further information, you can visit the data protection information of the respective social media service (YouTube, Spotify).
Legal basis
Order processing
When embedding social media plugs, personal data is regularly passed on to the provider of the social media service to provide the service. For this purpose, we have concluded an agreement with the provider on joint responsibility in accordance with Art. 26 GDPR. We transmit your personal data to:
Spotify: The social media service is headquartered in Sweden and has subsidiaries in other countries, including Germany (Spotify GmbH, Unter den Linden 10, 10117 Berlin). A data processing agreement has been concluded for the transfer of your personal data within the EU/EEA.
However, YouTube and Spotify do not process the data transmitted to them exclusively on our behalf or exclusively in accordance with our instructions. Both providers determine the purposes and means of their further processing themselves and may use the data, in particular, to provide their services, ensure security, measure and analyze usage, improve their offerings, and—depending on your settings and the respective legal basis—to personalize content or advertising. Google Ireland Limited and Spotify AB are each independently responsible under data protection law for this processing on their own behalf.
According to Spotify’s Terms of Service, Spotify may monitor the use of the embedded player and use the corresponding usage data, in particular to ensure quality, improve the Spotify service, and verify compliance with its Terms of Service. For more information, see: https://developer.spotify.com/documentation/embeds/terms as well as https://www.spotify.com/de/legal/privacy-policy/
When you use the embedded YouTube player, Google may process, in particular, technical data, device and browser information, your IP address, referrer URL, information about the content being played, and details about your interaction with the player. If you are signed in to a Google service at the time, this data may be associated with your Google account. For more information, visit: https://policies.google.com/privacy?hl=de
Transfer to a third country
YouTube: The social media service is based in the USA and its subsidiaries are based in Ireland. Nevertheless, data is regularly transferred to a third country. For the transfer of your personal data to the USA, there is an adequacy decision by the Commission of the European Union in accordance with Art. 45 GDPR. There is also a standard data protection clause for the transfer in accordance with Art. 46 para. 2 lit. c GDPR, which the Commission has issued in the review procedure in accordance with Art. 93 para. 2 GDPR. You can request a copy of this guarantee via our e-mail address above.
Purpose
Our website offers a sharing feature that allows you to share individual pieces of content via the following social networks and messaging services:
When you click a share button, the share page or app of the service you selected will open. The URL of the content to be shared and, if applicable, the page title or a pre-formulated text will be transmitted to the service. The content will not be published until you confirm the action yourself with the respective provider. If you are logged in there, the provider can associate the visit and the subsequent action with your user account.
If the buttons are implemented as simple, locally displayed links, simply visiting our website does not establish a connection to Facebook, WhatsApp, Telegram, X, or LinkedIn. If resources from a social network are loaded before you click on the button, this occurs only with your prior consent.
Data categories
When you click a sharing button, the following data, in particular, may be transmitted to or collected by the selected provider:
Storage period
As a general rule, we do not separately store information about which sharing service you selected or what content you shared there. The length of time the selected provider retains this information depends on its privacy policy, your account settings, and the way you chose to publish the content. You can regularly edit or delete shared posts yourself within the respective service.
Legal basis
The subsequent sharing and further processing within the selected service take place at your initiative and in accordance with the privacy policy of the respective provider.
Order processing
The providers listed process the data transmitted when you click on their links under their own responsibility under data protection law and not as data processors under Article 28 of the GDPR. They themselves determine the purposes and means of further processing within their services.
Transfer to a third country
When using the sharing feature, the selected provider may process personal data outside the European Economic Area, particularly in the United States. To the extent that an adequacy decision pursuant to Article 45 of the GDPR applies to the respective recipient, the transfer may take place on that basis. Furthermore, according to their statements, the providers base data transfers in particular on the Standard Data Protection Clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR and, where applicable, on supplementary safeguards. Details can be found in the privacy policies of the respective selected service.
Purpose
We maintain publicly accessible company profiles on the following social media platforms:
These profiles serve the purposes of public relations, presenting our company and our services, publishing professional, company-related, and career-related content, communicating with prospective clients, clients, applicants, and other users, and analyzing the reach and impact of our posts.
When you visit a profile, a direct connection is established with the respective platform provider. In doing so, the provider processes usage and device data and may associate your profile visit and interactions with your user account if you are logged in there. We have only limited influence over the nature and scope of the independent data processing carried out by the platform providers. If our website merely provides a link to the respective profile, the connection to the platform is established only after you click on the link.
Data categories
Depending on your usage and the settings of the respective network, the following data in particular may be processed:
Please do not submit any special categories of personal data via publicly visible areas of the platforms. For job applications and other confidential matters, please use the contact channels provided for this purpose.
Storage period
We store messages, comments, and inquiries only for as long as necessary to process them, facilitate further communication, conduct a business or employment relationship, comply with legal retention requirements, or assert, exercise, or defend legal claims. Publicly visible posts and comments generally remain in place until they are deleted by you, by us, or by the platform provider, or until the respective profile is closed. Aggregated page and account statistics are available to us only for the period specified by the provider. The further retention period with the platform provider is governed by its privacy policy and your account settings; we have only limited influence over this storage and deletion.
Legal basis
Platform providers also process data for their own purposes and based on the legal grounds they have established. Information on this, as well as on options for objection and opt-out, can be found in the privacy policy of the respective provider.
Order processing
Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, generally process data in the operation of their platforms under their own responsibility under data protection law and not as our data processors under Article 28 of the GDPR. In particular, these providers are responsible for the technical provision of the platforms, data security, and handling platform-related inquiries from data subjects; we determine the purposes of our profiles and content, respond to interactions, and analyze the aggregated statistics provided to us.
Transfer to a third country
The platform providers, as well as affiliated companies and service providers, may process personal data outside the European Economic Area, particularly in the United States. To the extent that an adequacy decision pursuant to Article 45 of the GDPR applies to the respective recipient, the transfer may take place on this basis. Furthermore, according to their statements, the providers base international data transfers in particular on the European Commission’s Standard Data Protection Clauses pursuant to Article 46(2)(c) of the GDPR and, where applicable, supplementary safeguards. Content you publish publicly may be accessible worldwide. Details can be found in the privacy policies of Meta and LinkedIn.
Purpose
We use technologies to analyze user behavior and for tracking. For this purpose, we use the analysis tool Google Analytics from the provider Google LLC, which is provided by the subsidiary Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The processing of your personal data serves the purpose of improving our website, improving our offer and making our website more customer-friendly. Your consent is obtained for processing.
Data categories
With the help of cookies used by the analysis tool Google Analytics, we can process various personal data of our users. Among other things, we process:
The IP address is processed automatically when the connection is established. However, according to Google, IP addresses of users from the European Union, Switzerland, and the United Kingdom are not logged or stored. The IP address is used to derive approximate location information and is subsequently deleted. We do not transmit any data via Google Analytics—such as names, email addresses, or other information that could be used to directly identify you. For more information on how Google Analytics processes data, please visit: https://support.google.com/analytics/answer/12017362?hl=de
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. We require your consent to process your data for this purpose. You can withdraw your consent at any time. If you withdraw your declaration of consent, we will delete your personal data.
When Google Analytics is integrated, so-called session cookies are set on a regular basis. These cookies allow your personal data to be stored for the duration of your visit to the website. The actual storage period can be shortened through browser settings and browser-based restrictions. For more information about the cookies used by Google Analytics, please visit: https://support.google.com/analytics/answer/11397207?hl=de
If you configure your browser settings accordingly, you can generally prevent cookies from being stored. Please note, however, that in this case, not all features of our website may be available to you.
We store your personal data only for as long as necessary to fulfill the intended purpose. If you revoke your consent, we will delete your personal data. We can access your personal data for 14 months. After this period expires, the relevant data will be automatically deleted by Google Analytics.
Google Analytics stores cookies in your web browser for a period of two years from your last visit. These cookies contain a user ID that allows Google to recognize you during future visits to the website.
Legal basis
Order processing
Google Ireland Limited processes the customer data collected through Google Analytics on our behalf in accordance with Google’s Data Processing Terms. We have entered into the necessary data processing agreements with Google Ireland Limited in accordance with Article 28 of the GDPR. Google Ireland Limited may engage affiliated companies and other subprocessors to provide the service. This may include, in particular, Google LLC, which is headquartered in the United States.
Transfer to a third country
The service is based in the USA and its subsidiaries are based in Ireland. Nevertheless, data is regularly transferred to a third country. For the transfer of your personal data to the USA, there is an adequacy decision by the Commission of the European Union in accordance with Art. 45 GDPR.
There is also a standard data protection clause for the transfer in accordance with Art. 46 para. 2 lit. c GDPR, which the Commission has issued in the review procedure in accordance with Art. 93 para. 2 GDPR. You can request a copy of this guarantee via our e-mail address above.
Purpose
We operate our own careers site at https://www.nhsgroup-karriere.de/. It is used to present NHS as an employer, post job openings, provide information, images, videos, employee testimonials, and location details, as well as to conduct electronic application processes.
The following services and domains are used in particular for technical provision and specific functions:
When accessing external resources, your browser establishes a direct connection to the respective provider. Technically necessary access data is transmitted in the process. External videos, widgets, maps, and other non-essential content are loaded only after you have given your consent. The actual processing of your application is additionally governed by the following section, “Processing of Your Application.”
Data categories
When using the careers page and the softgarden applicant management system, the following data in particular may be processed:
Special categories of personal data as defined in Article 9 of the GDPR will only be processed if you voluntarily provide such information or if processing is required by law as part of the application process.
Storage period
Technical access and log data are stored only for as long as necessary for the provision of services, security, error analysis, and the prevention of misuse. Technically necessary session cookies from the softgarden portal are generally deleted at the end of the session. Application data from rejected applicants is regularly deleted no later than six months after the conclusion of the application process, unless longer storage is required due to legal obligations or to assert, exercise, or defend legal claims. If a candidate is hired, the necessary data is transferred to the personnel file. Inclusion in an applicant or talent pool occurs only on the basis of separate consent and for the period specified therein or until such consent is revoked. The retention period for Vimeo, Google, Elfsight, Duda, onecdn.io, and CARTO is additionally governed by the privacy policies and technical settings of the respective providers.
Legal basis
Order processing
For the job portal and the electronic management of applications, we use software provided by softgarden e-recruiting GmbH, Tauentzienstraße 14, 10789 Berlin, as a data processor pursuant to Article 28 of the GDPR. softgarden processes applicant data in accordance with our documented instructions; a data processing agreement has been concluded for this purpose. For the technical provision of the careers page and its content, website, CDN, and widget service providers—particularly in connection with onecdn.io and elfsightcdn.com—may also be used as data processors or subprocessors. Vimeo and Google may also process data generated by activated external content within the scope of their services under their own data protection responsibility, where applicable. The specific processing depends on the function used and the respective contractual agreements.
Transfer to a third country
According to softgarden, applicant data from the applicant management system is hosted in data centers in Germany; as a general rule, there are no plans to transfer this applicant data to third countries. However, when loading resources via onecdn.io, elfsightcdn.com, Vimeo, gstatic.com, or cartocdn.com, processing may be carried out by providers, affiliated companies, or service providers outside the European Economic Area, particularly in the United States. To the extent that an adequacy decision pursuant to Article 45 of the GDPR applies to the respective recipient, the transfer may take place on this basis. In all other cases, international transfers are based on appropriate safeguards, in particular the European Commission’s Standard Data Protection Clauses pursuant to Article 46(2)(c) of the GDPR and, where applicable, supplementary protection measures. Details can be found in the privacy policies of the respective providers.
Purpose
Your personal data is generally collected from you as part of the recruitment process, in particular from the application documents, the job interview and the personnel questionnaire. We also receive data from third parties (e.g. from personnel service providers or the employment agency as part of the job placement process).
We process your personal data in the course of your application to us in order to establish the employment relationship. Your data will only be processed to fill the position for which you have applied. If your application is to be considered for other vacancies in the company, we require a declaration of consent from you. If you would like to be included in our applicant pool in the event of a rejection, we require a declaration of consent for this.
Data categories
We process the following personal data as part of the application process:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. If you are hired, we will transfer your application documents to your personnel file. After termination of the employment relationship, we will continue to store the personal data that we are legally obliged to retain. The storage periods thereafter are up to ten years. In addition, personal data may be stored for the period during which claims can be asserted against us (statutory limitation period of at least three to a maximum of thirty years).
In the event of a rejection, your application documents will be deleted for reasons of proof (for example, a burden of proof in proceedings under the General Equal Treatment Act) no later than six months after completion of the application process, unless you have given us your consent for longer storage (applicant pool).
Legal basis
Purpose
We use technologies to display map content and to provide interactive maps. To do so, we use the API (Application Programming Interface) provided by Google LLC through its subsidiary Google Cloud EMEA Limited (70 Sir John Rogerson’s Quay, Dublin 2, Ireland). Within the Google corporate group, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is generally responsible for processing the personal data of users who are habitually resident in the European Economic Area or Switzerland. The processing of your personal data is necessary to enable the use of interactive maps directly on the NHS website.
If you use and consent to the use of the plug-in, personal data and other metadata will be forwarded to Google. If you are logged in to a Google service, the data passed on will be assigned to your Google user account or summarized in a user profile. If you do not wish to be associated with your Google user account, log out of all Google services and delete your cache. The transferred data is used for the purposes of advertising, market research and/or needs-based advertising. To object to the creation of user profiles or the assignment to your Google account, please address your right of objection directly to Google.
Data categories
With the help of cookies, which use the Google Maps API, various personal data and other metadata of our users can be processed. This includes, among other things:
Google may link the collected data to your Google Account if you are signed in. The specific data that Google processes and the purposes for which Google uses it are governed by Google’s privacy policy and settings.
For more information, see: https://policies.google.com/privacy?hl=de
For information about the processing of data from websites and apps that use Google services, see: https://policies.google.com/technologies/partner-sites?hl=de
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. We require your consent to process your data for this purpose. You can revoke your consent at any time. If you revoke your declaration of consent, we will delete your personal data.
Session cookies are regularly set when Google Maps is integrated. These can be used to store your personal data for the duration of your visit to the website. If you close our website, your personal data will be deleted. For further information, you can visit Google's privacy policy (https://policies.google.com/privacy).
If you set your browser software accordingly, you can generally prevent the storage of cookies. Please note, however, that in this case not all functions on our website may be available to you and the map function will be deactivated.
We only store your personal data for as long as the purpose requires. If you revoke your declaration of consent, we will delete your personal data.
Legal basis
Order processing
When Google Maps loads, personal data is transmitted directly from your browser to Google. We and Google each process the personal data generated in connection with Google Maps as independent data controllers within the meaning of Article 4(7) of the GDPR. Google does not process the data transmitted to it exclusively on our behalf or exclusively in accordance with our instructions. Therefore, this processing does not constitute commissioned processing under Article 28 of the GDPR.
Google determines the purposes and means of its own processing. According to the Google Maps Terms of Service, users may transmit personal data directly to Google. In particular, Google collects IP addresses, search terms, and, where applicable, longitude and latitude coordinates, and processes this data in accordance with the Google Privacy Policy.
Google and we have agreed to the controller-to-controller data protection terms provided by Google for the processing operations in question. Accordingly, each party is responsible for its own processing operations and for fulfilling the applicable data protection obligations. You may exercise your data subject rights with respect to our processing by contacting us, and with respect to Google’s independent processing by contacting Google directly.
Transfer to a third country
The service is based in the USA and its subsidiaries are based in Ireland. Nevertheless, data is regularly transferred to a third country. For the transfer of your personal data to the USA, there is an adequacy decision by the Commission of the European Union in accordance with Art. 45 GDPR.
There is also a standard data protection clause for the transfer in accordance with Art. 46 para. 2 lit. c GDPR, which the Commission has issued in the review procedure in accordance with Art. 93 para. 2 GDPR. You can request a copy of this guarantee via our e-mail address above.
For more information about international data transfers, please see Google's Privacy Policy and Terms of Service: https://policies.google.com/privacy?hl=de
Purpose
We process your personal data to provide the ‘kicktipp’ service. The service is provided by Kicktipp GmbH, Klever Straße 35, 40477 Düsseldorf, Germany, and is integrated on the NHS website as a link in the header menu. By clicking on the link, you will be redirected from our website to the kicktipp membership page for our betting community. A valid e-mail address and a password are required to participate in the service.
Data categories
In order to use the service, the following data is processed by you during forwarding:
In addition, the following data may be stored by kicktipp:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. The respective retention period of different data records can be found in kicktipp's privacy policy (https://www.kicktipp.de/info/service/datenschutz/). Storage takes place within the EU/EEA.
Legal basis
Order processing
Kicktipp processes the data for the use of the service on our behalf. The company is contractually obliged to guarantee measures for the security and confidentiality of the processed data. For this purpose, we have concluded an order processing contract with the service provider Kicktipp GmbH (address: Klever Straße 35, 40477 Düsseldorf, Germany) in accordance with Art. 28 GDPR. Kicktipp GmbH processes your personal data only on our instructions.
Purpose
We use services for the digital exchange of data records and files as well as for the centralised storage and versioning of Dracoon GmbH. The contractor Dracoon GmbH (address: Galgenbergstraße 2a, 93053 Regensburg, Germany) provides software solutions for this purpose and is responsible for the maintenance and updating of server and software configurations.
Data categories
The following categories of data can usually be processed when using the service:
In addition, the following categories of server log files are affected by the processing when using Dracoon:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary.
Due to the processing and storage of all files and documents within the Dracoon software solution, documents with a retention period of several years may be necessary, depending on the purpose of use. It is therefore not possible to provide a generalised storage period. In the order processing agreement, the contractor undertakes to return or delete all data in its possession upon termination of the contractual relationship. A log of the deletion can be provided.
The storage duration of the automatically generated server log files when visiting the website are either deleted immediately after closing your browser or anonymised after 7 days at the latest, so that it is no longer possible to draw conclusions about your person and are processed in anonymised form for statistical purposes.
Legal basis
Order processing
Dracoon processes the data for website use and provision of the service on our behalf. The company is contractually obliged to guarantee measures for the security and confidentiality of the processed data. For this purpose, we have concluded an order processing contract with the service provider Dracoon GmbH (address: Galgenbergstraße 2a, 93053 Regenburg, Germany) in accordance with Art. 28 GDPR. Dracoon processes your personal data only on our instructions.
Purpose
We process your personal data to provide the ‘DATEV Online’ service on our website. By integrating DATEV content, e.g. videos, banners, etc., your personal data is automatically processed for the purpose of statistical analysis and error tracking. The recipient of the data is DATEV eG (address: Paumgartnerstr. 6-14, 90429 Nuremberg).
Data categories
Technical metadata required to access the website:
Other data processed by DATEV Online:
Data that is processed within the software solutions of DATEV eG:
(This data has a retention period of 10 years)
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary.
Due to the processing and storage of all files and documents within the DATEV software solution, documents with a retention period of several years may be applicable and necessary depending on the purpose of use. The files stored in the DATEV eG software solutions usually have a retention period of 10 years and a deletion period of 14 years (10+4).
Legal basis
Order processing
DATEV eG processes the data to provide the service on our behalf. The company is contractually obliged to guarantee measures for the security and confidentiality of the processed data. For this purpose, we have concluded an order processing contract with the service provider DATEV eG (address: Paumgartnerstr. 6-14, 90429 Nuremberg) in accordance with Art. 28 GDPR. DATEV eG processes your personal data only on our instructions.
Purpose
We offer you the option of booking an appointment.
Data categories
The data categories cannot be specified in full, but depend on the data you provide us with. We usually process at least the following categories of data:
Technical metadata required to access the website:
Further data categories when booking an appointment:
Storage period
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. E-mails are business letters and are therefore subject to archiving obligations under tax law. The longest retention period is 10 years (e.g. § 257 para. 1 HGB, § 147 para. 1 AO). E-mails are deleted year by year when the retention periods expire.
Legal basis
As a data subject, you have the following rights when your personal data is processed:
In order to prevent manipulation, loss or misuse of your data stored by us, we take extensive technical and organisational security precautions, which are regularly reviewed and adapted to technological progress. These include the use of recognised encryption methods (SSL or TLS). However, we would like to point out that due to the structure of the Internet, it is possible that the rules of data protection and the above-mentioned security measures may not be observed by other persons or institutions outside our area of responsibility. In particular, unencrypted data - e.g. when sent by e-mail - can be read by third parties. We have no technical influence on this. It is the responsibility of the user to protect the data provided by him/her against misuse through encryption or in any other way.
Copyright © 2025 - ZIP.ch SA
You can contact our external data protection officer by post or e-mail:
NHS GmbH Steuerberatungsgesellschaft
Stephan Lipensky (ext. DPO)
Am Wehrhahn 100
D-40211 Düsseldorf
E-mail: datenschutz@nhsgroup.de
私たちに何ができるか、お話しましょう。
住所・アクセス
デュッセルドルフ事務所
Am Wehrhahn 100







