Privacy Policy

With the following information, we would like to give you as the "data subject" an overview of the processing of your personal data by us and your rights under data protection laws. Use of our internet pages is generally possible without entering personal data. However, if you would like to use special services of our company via our website, processing of personal data may become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain your consent.

The processing of personal data, such as your name, address or email address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection regulations applicable to "CUCO Lohnsteuerhilfeverein e.V.". By means of this data protection declaration, we would like to inform you about the scope and purpose of the personal data collected, used and processed by us.

As the controller, we have implemented numerous technical and organizational measures to ensure the most complete possible protection of personal data processed through this website. Nevertheless, internet-based data transmissions can fundamentally have security gaps, so that absolute protection cannot be guaranteed. For this reason, you are free to transmit personal data to us via alternative means, such as by phone or post.

You can also take simple and easily implemented measures to protect yourself against unauthorized access by third parties to your data. Therefore, we would like to give you some tips on how to safely handle your data at this point:

• Protect your account (login, user or customer account) and your IT system (computer, laptop, tablet or mobile device) with secure passwords.
• Only you should have access to the passwords.
• Ensure that you only ever use your passwords for one account (login, user or customer account).
• Do not use one password for different websites, applications or online services.
• Particularly when using publicly accessible IT systems or those shared with other people: You should always log out after each registration on a website, application or online service.

Passwords should consist of at least 12 characters and be chosen so that they cannot be easily guessed. Therefore, they should not contain common words from everyday life, your own name or names of relatives, but upper and lower case letters, numbers and special characters.

The controller within the meaning of the GDPR is:

CUCO Lohnsteuerhilfeverein e.V.
Auf der Marienhöhe 49, 64297 Darmstadt, Germany
Phone: +49 (0) 6151 60 60 48 0
Fax: +49 (0) 6151 60 60 48 9
Email: info@cuco-lhv.de

Representatives of the controller: Mathias Dehe, Adrian Weiß

We have appointed a contact person for data protection.
The contact person for data protection: Mathias Dehe
Phone: +49 (0) 6151 60 60 48 0
Fax: +49 (0) 6151 60 60 48 9
Email: datenschutz@cuco-lhv.de

You can contact him directly at any time with all questions and suggestions regarding data protection.

This privacy policy is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our privacy policy should be easily readable and understandable for the public as well as for our customers and business partners. To ensure this, we would first like to explain the terminology used.

We use the following terms in this privacy policy, among others:

1. Personal Data
   Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
2. Data Subject
   Data subject is any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing (our company).
3. Processing
   Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
4. Restriction of processing
   Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.
5. Profiling
   Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
6. Pseudonymization
   Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
7. Processor
   Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
8. Recipient
   Recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
9. Third party
   Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
10. Consent
    Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Art. 6(1) lit. a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Article 6(1) lit. b GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services.

If our company is subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1) lit. c GDPR.

In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured in our company and his name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6(1) lit. d GDPR.

Finally, processing operations could be based on Article 6(1) lit. f GDPR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Such processing operations are particularly permissible because they have been specifically mentioned by the European legislator. He considered that a legitimate interest could be assumed if the data subject is a client of the controller (Recital 47 Sentence 2 GDPR).

Our offer is generally aimed at adults. Persons under 16 years of age may not transmit personal data to us without the consent of their parents or legal guardians. We do not request personal data from children and young people, do not collect them and do not pass them on to third parties.

6.1 SSL/TLS Encryption

This site uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login data or contact inquiries that you send to us as the operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

We use this technology to protect the data you transmit.

7.1 Contacting us / Contact Form

Personal data is collected when contacting us (e.g. via contact form or email). Which data is collected in the case of using a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of answering your request or for establishing contact and the associated technical administration. The legal basis for processing the data is our legitimate interest in answering your request in accordance with Art. 6(1) lit. f GDPR. If your contact is aimed at concluding a contract, then additional legal basis for the processing is Art. 6(1) lit. b GDPR. Your data will be deleted after final processing of your request, this is the case if it can be inferred from the circumstances that the matter in question has been finally clarified and provided that there are no statutory retention requirements to the contrary.

7.2 Applicant Management / Job Board

We collect and process the personal data of applicants for the purpose of processing the application procedure. The processing can also take place electronically. This is particularly the case if an applicant submits corresponding application documents electronically, for example by email or via a web form found on the website. If we conclude an employment contract with an applicant, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with statutory provisions. If no employment contract is concluded with the applicant by the controller, the application documents shall be automatically erased six months after notification of the refusal decision, provided that no other legitimate interests of the controller oppose the erasure. Other legitimate interest in this relation is, e.g. a burden of proof in a procedure under the General Equal Treatment Act (AGG).

The legal basis for processing your data is Art. 6(1) lit. b), 88 GDPR in conjunction with Section 26(1) BDSG.

So that we can also communicate with you on social networks and inform you about our services, we are represented there with our own pages. If you visit one of our social media pages, we, together with the provider of the respective social media platform, are jointly responsible for the processing operations triggered by this in the sense of Art. 26 GDPR.

We are not the original provider of these pages, but only use them within the scope of the possibilities offered to us by the respective providers.
Therefore, we point out as a precaution that your data may also be processed outside the European Union or the European Economic Area. Use may therefore be associated with data protection risks for you, as the safeguarding of your rights e.g. to information, deletion, objection, etc. could be made more difficult and the processing in the social networks is often carried out directly for advertising purposes or to analyze user behavior by the providers, without this being influenced by us. If the provider creates user profiles, cookies are often used or user behavior is assigned to your own member profile created in the social networks.

The described processing operations of personal data take place in accordance with Art. 6(1) lit. f GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider to be able to communicate with you in a contemporary manner or to inform you about our services. If you must give consent to data processing as a user to the respective providers, the legal basis refers to Art. 6(1) lit. a GDPR in conjunction with Art. 7 GDPR.

Since we do not have access to the providers' datasets, we point out that you can best assert your rights (e.g. to information, correction, deletion, etc.) directly with the respective provider. We have listed further information on the processing of your data in social networks below for the respective social network provider we use:

8.1 Facebook

(Joint) Controller for data processing in Europe:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Meta (Facebook) can, if no objection is made, process the content of adult users from the EU, e.g. photos, posts or comments, to train its own AI models. The basis is a legitimate interest according to Art. 6(1) lit. f GDPR. As a company, we have no influence on this specific data processing by Meta. Users can object to this via an online form on the Meta platforms.

Privacy Policy (Data Policy):
https://www.facebook.com/about/privacy

8.2 LinkedIn

(Joint) Controller for data processing in Europe:
LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland

Privacy Policy:
https://www.linkedin.com/legal/privacy-policy

8.3 XING (New Work SE)

(Joint) Controller for data processing in Germany:
New Work SE, Am Strandkai 1, 20457 Hamburg, Germany

Privacy Policy:
https://privacy.xing.com/en/privacy-policy

Information requests for XING members:
https://www.xing.com/settings/privacy/data/disclosure

9.1 LinkedIn Pixel (Insight Tag)

This website uses LinkedIn Insights from LinkedIn Corporation, 1000 W Maude Ave Sunnyvale, CA 94085, USA (LinkedIn). In the event of express consent, the behavior of users can be tracked via this.

The procedure is used to evaluate the effectiveness of advertisements for statistical and market research purposes and can help optimize future advertising measures. Through the LinkedIn Pixel, we receive advanced information about prospects for our products, including job title, employer or the industry in which they work.

When you visit the website, the following data, among other things, may be processed by the LinkedIn Pixel:

• IP address
• Interactions on our website (e.g. page views, clicks, conversions)
• Browser type/version
• Operating system used
• Referrer URL (previously visited page)
• Time of server request

Direct identifiers are automatically removed from the dataset within seven days by LinkedIn, and the data is deleted after 180 days. The storage period of the cookie can be found in our consent solution used. The data is stored and processed by LinkedIn so that a connection to the respective user profile is possible.

These processing operations take place exclusively in the event of express consent in accordance with Art. 6(1) lit. a GDPR.

LinkedIn is certified under the EU-US Data Privacy Framework. There is an adequacy decision pursuant to Art. 45 GDPR, meaning a transfer of personal data may also take place without further guarantees or additional measures.

Further information and privacy provisions of LinkedIn Pixel can be viewed at: https://de.linkedin.com/legal/privacy-policy.

9.2 Meta Pixel (formerly Facebook Pixel)

This website uses the "Facebook Pixel" of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA ("Meta"). In the event of express consent, the behavior of users can be tracked after they have seen or clicked on a Facebook ad. This process is designed to evaluate the effectiveness of Facebook ads for statistical and market research purposes and can help optimize future advertising measures.

When you visit the website, the following data to be processed by the Meta Pixel include:

• IP address,
• Device information,
• Browser history
• Interactions on our website (e.g. page views, clicks, conversions).

The data is stored and processed by Meta so that a connection to the respective user profile is possible and Meta can use the data for its own advertising purposes, in accordance with the Meta (Facebook) Data Usage Policy (https://www.facebook.com/about/privacy/). This allows Meta and its partners to serve ads on and off Facebook. A cookie may also be stored on your computer for these purposes.

The collected data is stored by Meta for a period of 180 days and is then removed if the user does not visit the website again.

These processing operations take place exclusively in the event of express consent in accordance with Art. 6(1) lit. a GDPR.

This US company is certified under the EU-US Data Privacy Framework. An adequacy decision under Art. 45 GDPR therefore applies, so that personal data can be transferred without further guarantees or additional measures.

9.3 Google Analytics 4 (GA4)

We use Google Analytics 4 (GA4), a web analysis service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google") on our websites.

In this context, pseudonymised usage profiles are created and cookies (see the "Cookies" point) are used. The information generated by the cookie regarding your use of this website may include:

• short-term recording of the IP address without permanent storage
• Location data
• Browser type/version
• Operating system used
• Referrer URL (previously visited page)
• Time of server request

The pseudonymized data may be transferred by Google to a server in the USA and stored there.

The information is used to evaluate the use of the website, to compile reports on website activities, and to provide further services associated with website use and internet use for the purposes of market research and tailored design of these internet pages. This information may also be passed on to third parties if this is legally required or if third parties process this data on behalf of us.

These processing operations take place exclusively in the event of express consent in accordance with Art. 6(1) lit. a GDPR.

The standard storage period set by Google is 14 months. For the rest, personal data is retained as long as it is necessary to fulfill the processing purpose. The data is deleted as soon as it is no longer required to achieve the purpose.

The parent company Google LLC is certified as a US company under the EU-US Data Privacy Framework. Thus an adequacy decision according to Art. 45 GDPR exists, meaning a transmission of personal data may take place without further guarantees or extra measures.

Further privacy information concerning GA4 can be found here: https://support.google.com/analytics/answer/12017362?hl=en.

9.4 Google Analytics 4 (GA4) - Additional Information on Google Signals

Google Signals is a feature in Google Analytics that collects session data from websites and apps when users are signed into their Google account and have turned on personalized ads. It enables enhanced analysis by linking user behavior across devices and providing additional information such as demographics and interests. Your consent to use Google Analytics (see above) also includes consent to the Google Signals add-on.

9.5 Google Analytics 4 (GA4) - Additional Information on Consent Mode, Basic Implementation

Under the Digital Markets Act, Google is obliged to obtain the user's consent before user data is processed by Google for personalized advertising. Google complies with this requirement with the "Consent Mode". Users are obliged to implement this to prove they obtained consent from website visitors.

Google offers two implementation modes, basic and advanced implementation.

We use the basic implementation method of Google Consent Mode. A connection to Google is only established, a Google code is executed, and the processing described above is only carried out if you give your consent to the use of Google Analytics (see above). If you refuse consent, Google only receives information that consent has not been given. The Google code is not executed and no Google Analytics cookies are set.

10.1 Right of Confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

10.2 Right to Information (Art. 15 GDPR)

You have the right to receive free information from us at any time about the personal data stored about you and a copy of this data in accordance with statutory provisions.

10.3 Right to Rectification (Art. 16 GDPR)

You have the right to request the immediate correction of inaccurate personal data concerning you. Furthermore, you have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.

10.4 Right to Erasure (Art. 17 GDPR)

You have the right to demand that the personal data concerning you be deleted immediately, provided that one of the legal reasons applies and as long as processing or storage is not required.

10.5 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to demand that we restrict processing if one of the legal requirements is met.

10.6 Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which was provided to us by you, in a structured, common and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent pursuant to Art. 6(1) lit. a GDPR or Art. 9(2) lit. a GDPR or on a contract pursuant to Art. 6(1) lit. b GDPR and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Art. 20(1) GDPR, you have the right to have the personal data transmitted directly from one controller to another, insofar as this is technically feasible and provided that this does not adversely affect the rights and freedoms of others.

10.7 Right to Object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1) lit. e (data processing in the public interest) or f (data processing on the basis of a balancing of interests) GDPR.

This also applies to profiling based on these provisions within the meaning of Art. 4 No. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.

In individual cases, we process personal data for direct marketing purposes. You can object to the processing of personal data for the purpose of such advertising at any time. This also applies to profiling insofar as it is connected with such direct advertising. If you object to processing by us for direct marketing purposes, we will no longer process your personal data for these purposes.

In addition, you have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you by us for scientific or historical research purposes or for statistical purposes pursuant to Art. 89(1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.

You are free to exercise your right to object in connection with the use of information society services by automated means using technical specifications, notwithstanding Directive 2002/58/EC.

10.8 Revocation of a Data Protection Consent

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

10.9 Right to lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority responsible for data protection regarding our processing of personal data.

This privacy policy is currently valid and has the status: March 2026.

Due to the further development of our internet pages and offers or due to changed legal or regulatory requirements, it may be necessary to change this privacy policy. You can access and print out the current privacy policy at any time on the website at "https://cuco-lhv.de/datenschutz/".