Privacy Policy

With the following Privacy Policy, we would like to inform you how we process your personal data (hereinafter also referred to as “Data”) in the course of our services for the preparation of your tax return. Personal data within the meaning of Art. 4 of the EU General Data Protection Regulation (“GDPR”) is all data that can be related to you personally, e.g. your name, your address or your e-mail address. With regard to the further terms used below, such as “controller” or “processor”, we refer to the definitions in Art. 4 GDPR.

The terms used in this Privacy Policy are not gender-specific.

I. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation and other data protection provisions is:

Lapis Tax & Audit GmbH Wirtschaftsprüfungsgesellschaft

Köpenicker Str. 122

10179 Berlin

info@Lapis-Kanzlei.de

II. Contact Person

For all questions regarding this Privacy Policy and the processing of your data, you can reach us at info@Lapis-Kanzlei.de

III. General Information on Data Processing

1. Scope of the processing of personal data

We generally process your personal data only insofar as this is necessary to provide our services or you have given us your consent to the processing. An exception applies only in cases where the processing of the data is permitted by statutory provisions on the basis of our legitimate interests. We will inform you separately about such cases.

2. Type of data processed

When you engage us, we process in particular the following personal data in the course of our activities:

Master data (e.g. name, address, contact information such as e-mail, telephone number and internet address),
Tax data (e.g. marital status, employment, religious affiliation, occupation, employer, data from the wage tax statement or the most recent payslip, secondary residence, competent tax office, tax identification number, various expenses, income from capital assets and other sources, insurance, medical expenses, disabilities, personal data of persons living in the household, donations, church tax, household-related expenses or maintenance payments to third parties, as well as tax loss carryforwards. Such tax-relevant information can also include special “sensitive personal data”, such as data on your health, any care expenses, information about the denomination with regard to the church tax paid, or information about trade union membership.)
Advisory and activity data (e.g. contents of inquiries, advisory documentation, documents, file notes, legal and specifically tax-law assessments, proof of performance, statements of account, as well as further information necessary for asserting and defending your rights within the engagement),
Other engagement-related data (e.g. contracts, communication, booking receipts, evidence, invoices, service, remuneration and liability data, as well as data that you voluntarily provide to us within the engagement relationship).

3. Legal basis for the processing of personal data

Insofar as we obtain your consent for the processing of personal data, Art. 6(1)(a) GDPR serves as the legal basis.

For the processing of personal data that we require in order to perform a contract with you, Art. 6(1)(b) and Art. 9(2)(a) GDPR serve as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which we are subject, Art. 6(1)(c) GDPR serves as the legal basis.

In the unlikely event that your vital interests or those of another person make it necessary to process your data, Art. 6(1)(d) GDPR serves as the legal basis.

If the processing is necessary to safeguard our legitimate interests or those of a third party, and your interests, fundamental rights and freedoms do not override this interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

4. Deletion of data and storage period

The data we process is deleted in accordance with the statutory requirements as soon as the purpose of its processing has been achieved or ceases to apply, or you revoke the consent required for the processing. Insofar as the data is not deleted because it is required for other legally permissible purposes, its processing is restricted to those purposes. Storage beyond this point may also take place where this has been provided for by the European or national legislator in regulations, laws or other provisions to which we are subject. This is the case, for example, where the data must be retained for commercial-law or tax-law reasons, or where its storage is necessary for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Insofar as our privacy notices contain further information on the retention and deletion of data, that information takes precedence for the respective processing operations.

IV. How we process your data in detail

The following sections describe all processing operations that may occur in connection with the services offered via the platform. Which of these actually take place depends on the service selected by you in the individual case and agreed with the Firm, as well as on the range of services offered by the respective firm.

1. Identification and verification under the Anti-Money Laundering Act

As a professional practice company within the meaning of Section 2(1) no. 10 of the German Anti-Money Laundering Act (GwG), we are subject to the requirements of the Anti-Money Laundering Act (GwG). The preparation of the tax return requires, for legal reasons, in particular your unambiguous identification as a taxpayer. We are also obliged, among other things, to obtain information on your identity, on the beneficial owners, on the purpose and nature of the business relationship and the transactions carried out, and on the money laundering risk.

To verify reliability under anti-money laundering law, we check and store information on your identity (such as first names, surnames, place of birth, date of birth, addresses, nationality) and on your identity documents (e.g. identity card or passport with a registration certificate) for unambiguous identification and as proof of identity. To fulfil our obligations under the Anti-Money Laundering Act pursuant to Section 8(2) sentence 1 GwG, we store a copy of one of your official identity documents.

The identification pursuant to Sections 10 and 11 GwG and the subsequent screening for increased risks of money laundering or terrorist financing are carried out for us by Taxfix SE by way of contractual outsourcing pursuant to Section 17(5) GwG. We remain the party obliged under anti-money laundering law in this respect; the measures are attributed to us as our own. For this purpose, Taxfix uses the provider Veriff OÜ (“Veriff”), Niine 11, Tallinn 10414, Estonia, which acts as a processor of Taxfix in this respect. The data collected on your identity is retained for the statutorily prescribed period of at least five years (Section 8 GwG). The legal basis is Art. 6(1)(c) GDPR in conjunction with the provisions of the GwG.

The identity information is, moreover, used by Taxfix to check you for increased risks of money laundering or terrorist financing (comparison of the data with relevant sanctions lists of the EU, the USA and Interpol, lists of “politically exposed persons”, and official publications on regulatory measures or criminal sanctions against a person).

2. Retrieval of your tax data (tax data retrieval)

You have the option of pre-filling your tax return with certain information that is electronically reported to the tax authorities by your employer and the competent social security office and stored by the tax authorities (“Pre-Fill Data”). You can transfer this data into your tax return automatically.

In order for us to carry out the retrieval of records via our tax data retrieval for you, you must expressly authorise us.

From the time of our engagement, we retrieve the pre-fill data concerning you from the servers of the tax administration via a secure internet connection (SSL/HTTPS). Further information on the security and encryption methods of ELSTER can be found here. Once we have received your pre-fill data via ELSTER, we store it on our servers so that this data can be transferred directly into your tax return. In doing so, we use the technical support of Taxfix SE, Köpenicker Str. 122, 10179 Berlin (hereinafter “Taxfix”).

In accordance with your instructions, we also make the data available in your Taxfix user account so that it can be used there as the basis for your tax return.

The legal bases for the processing of your pre-fill data are Art. 6(1)(b) GDPR (performance of the contract) as well as Art. 6(1)(a) and Art. 9(2)(a) GDPR (consent) for the processing of your sensitive personal data (e.g. relating to religious beliefs) that may be contained in your pre-fill data.

3. Preparation of your tax return

Within your Taxfix account, you have the option of confirming, by clicking accordingly, that you are interested in having your tax return prepared by us. If you confirm your interest in this way, we will ask you questions about your personal situation via the Taxfix app, on the basis of which you will receive a list of documents that we need in order to prepare your tax return. With the help of the questions and documents, the tax data described above is collected, among other things. The legal basis for the processing of this information is Art. 6(1)(b) GDPR (performance of pre-contractual measures). Insofar as your information includes sensitive personal data, the relevant legal basis is your consent, which we obtain separately in this case (Art. 6(1)(a), Art. 9(2)(a) GDPR).

Insofar as an engagement is established between us, you instruct us to use all of your tax data available in the Taxfix app to prepare your tax return and to transmit the final draft of the tax return to Taxfix in order to make the tax return available directly in your Taxfix user account. The legal basis for the processing of this information is Art. 6(1)(b), Art. 6(1)(a) and Art. 9(2)(a) GDPR (performance of the contract; consent).

Once you have approved the tax return, Taxfix files the tax return with the tax authority competent for you via an interface to the ELSTER software. You can find details on this in Taxfix’s privacy policy https://taxfix.de/datenschutz/. You can send any related inquiries to privacy@taxfix.de. The legal basis for the processing of your tax data described in this section is Art. 6(1)(b), Art. 6(1)(a) and Art. 9(2)(a) GDPR (performance of the contract; consent).

Further information on data processing via the tax authorities’ ELSTER software can be found in the brochure they provide here.

We also store your tax data in order to further optimise and simplify your tax return for the following year. Taking into account the statutory deadlines for filing your tax return (Section 46(2) no. 8 EStG, Section 169(2) no. 2 AO), we also store your tax data, after transmission to the tax office, in fully encrypted form in our database for a period of 10 years. The data is then fully anonymised.

4. Consultation by video call

Within your Taxfix account, you have the option of confirming, by clicking accordingly, that you are interested in a consultation by video call with us. If you confirm your interest in this way, we will give you the opportunity via the Taxfix app to provide information and ask questions in advance so that we can prepare for the telephone consultation. These questions and information may contain the tax data described above. The legal basis for the processing of this information is Art. 6(1)(b) GDPR (performance of pre-contractual measures). Insofar as your information includes sensitive personal data, the relevant legal basis is your consent, which we obtain separately in this case (Art. 6(1)(a), Art. 9(2)(a) GDPR).

Insofar as an engagement is established between us, you instruct us to use all of your tax data, if any, available in the Taxfix app for the telephone consultation. The legal basis for the processing of this information is Art. 6(1)(b), Art. 6(1)(a) and Art. 9(2)(a) GDPR (performance of the contract; consent).

If a final report is prepared after the video-call consultation, it is transmitted to Taxfix so that you have the option of accessing the final report in the Taxfix app (alternatively, the report is transmitted to you by e-mail). Insofar as we are to answer further questions following the consultation, we will make these available to you via the Taxfix app (alternatively, the report is transmitted to you by e-mail) or by telephone. The legal basis for the processing of your tax data described in this section is Art. 6(1)(b), Art. 6(1)(a) and Art. 9(2)(a) GDPR (performance of the contract; consent).

Further information on data processing within the Taxfix app can be found in Taxfix’s privacy policy https://taxfix.de/datenschutz/. You can send any related inquiries to privacy@taxfix.de.

5. Expert Subscription (ongoing tax support)

Under the Expert Subscription, we support you on an ongoing basis within the framework of a continuing mandate. We process your tax data in order to prepare and produce income tax returns and to answer your tax questions on an ongoing basis via the Expert Chat of the Taxfix platform. In doing so, we process in particular your master and tax data, the documents you provide, your chat entries, the chat history and the answers and advisory content we produce. Chat logs constitute advisory documentation and are subject to the professional retention obligations. The legal basis is Art. 6(1)(b) GDPR (performance of the contract); for sensitive personal data, Art. 6(1)(a) and Art. 9(2)(a) GDPR (consent).

The income tax return prepared under the subscription is transmitted to the tax administration via Taxfix after your approval (see above). Taking into account the statutory retention obligations (Section 66 StBerG, Section 46(2) no. 8 EStG, Section 169(2) no. 2 AO), we store the subscription-related data for ten years after the end of the engagement in fully encrypted form in our database.

Insofar as we use AI-supported functions in the Expert Chat or in assistance features to prepare or support our answers, this serves exclusively to provide the engaged service; no training of AI models with your personal data takes place. This does not involve any solely automated decision within the meaning of Art. 22 GDPR; the tax support and responsibility always remain with the Firm.

6. Tax Office Assistance

Within your Taxfix account, you have the option of using the Tax Office Assistance service. Within the Tax Office Assistance service, we process your personal data as follows:

To carry out the assessment notice review, we receive your tax assessment notice and the associated tax data via the Taxfix platform. We compare the notice with the tax return submitted and, where applicable, prepare a draft objection. For this purpose, we process in particular: your master data (name, address, tax identification number), your tax data, your tax assessment notice (including ancillary provisions and explanations) and letters from your tax office. The legal basis is Art. 6(1)(b) GDPR (performance of the contract). For sensitive personal data, the legal basis is Art. 6(1)(a) and Art. 9(2)(a) GDPR (consent).

Within the Expert Chat, we answer your tax questions via the chat function of the Taxfix platform. In doing so, we process the data you enter in the chat (including any tax information), the chat history and the answers and advisory content we produce. Chat logs constitute advisory documentation and are subject to the professional retention obligations. The legal basis is Art. 6(1)(b) GDPR (performance of the contract). For sensitive personal data, Art. 6(1)(a) and Art. 9(2)(a) GDPR applies (consent).

In accordance with your instructions and on the basis of your release from the duty of confidentiality, we transmit the results of the assessment notice review, draft objections, explanations of official letters and Expert Chat content to Taxfix so that these are made available to you in the Taxfix app. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) in conjunction with your release from the duty of confidentiality pursuant to Section 203 of the German Criminal Code (StGB).

Taking into account the statutory retention obligations (Section 66 StBerG, Section 46(2) no. 8 EStG, Section 169(2) no. 2 AO), we store your Tax Office Assistance-related data for a period of 10 years after the end of the engagement in fully encrypted form in our database.

V. Disclosure of your data

The transmission of your data to third parties only takes place on your instructions or with your consent. Within the engagement, we disclose your data, for example, to tax authorities and courts. If you instruct us to do so, we also disclose your data to Taxfix so that you can complete your tax return in the Taxfix app or transmit it to the tax authorities.

Taxfix acts partly as our processor (e.g. technical support and storage of the data exchanged via the platform on our behalf and in the name of the client), and partly as a controller in its own right (operation of the platform). Taxfix’s privacy notices apply to processing carried out under Taxfix’s own responsibility.

We also use processors (e.g. data centres, IT service providers, customer support providers, printing service providers), whose services we use only insofar as they are obliged, as contributing persons, to safeguard our professional secrets pursuant to Section 203(3) of the German Criminal Code, and the professional requirements to which we are subject remain safeguarded.

Data may also be disclosed to the competent authority on the basis of statutory provisions, for example to report suspected cases under the Anti-Money Laundering Act. In this respect, the legal basis for disclosure is Art. 6(1) sentence 1(c) GDPR in conjunction with Section 43 GwG.

A transfer of data to third countries (countries outside the European Economic Area – EEA) only takes place insofar as this is necessary to carry out the engagement, you have given us your consent, or this is otherwise permitted by law. In such a case, we take measures to ensure the protection of your data, for example through contractual arrangements with the data recipient (so-called standard data protection clauses). We transmit your data exclusively to recipients that ensure the protection of your data in accordance with the GDPR provisions for transfers to third countries (Art. 44 to 49 GDPR).

VI. Your data protection rights

As a data subject, you have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR) of your personal data, as well as the right to data portability (Art. 20 GDPR). You also have the right to revoke consent you have given at any time with effect for the future. Depending on the scope of our engagement, however, a revocation may result in you no longer being able to use all of our services or in us being prevented from completing your tax return.

You have the right to object to the processing of your personal data if the processing is based on our legitimate interests.

To exercise your rights, please contact info@Lapis-Kanzlei.de

You have the option of lodging a complaint about the processing of your personal data with the competent supervisory authority. You can find a list of the competent authorities here.

VII. Updating this Privacy Policy

We ask you to inform yourself regularly about the content of our Privacy Policy. We reserve the right to amend this Privacy Policy as soon as changes to the data processing we carry out or other circumstances make this necessary. Should the changes require an action on your part, we will inform you separately (e.g. consent).

Insofar as we refer in this Privacy Policy to addresses and contact details of other companies or organisations, please note that these addresses may change over time, and we ask you to check the details before making contact.

Version: Version 5.0 / August 2026