Your rights

You have a range of rights in connection with your personal data. In particular, you have the right:

• to request an update of your personal data held by us or, if you think these are inaccurate or incomplete, a correction of that data,
• to request the deletion of your personal data stored by us or a restriction on the way we process these data if this is not precluded by legal obligations,
• to revoke your consent to the processing of your personal data by us at any time free of charge without giving reasons, which can be done by contacting kontakt@deloitte.de (if such processing is based on consent),
• to obtain a copy of the personal information you have provided to us in a structured, common and machine-readable format and to transmit it to another party (if processed on the basis of consent or a contract),
• to object to the processing of your personal data by us.

If you wish to exercise your rights and use the website as a client of Deloitte, please send an e-mail to kontakt@deloitte.de or write to us at the following address:

Deloitte GmbH Wirtschaftsprüfungsgesellschaft 
Business Development
Kurfürstendamm 23
10719 Berlin

If you wish to exercise your rights and use this website as a start-up, please send an e-mail to startupatscale@deloitte.de.

Right of appeal

If you do not agree with the way your personal information is processed by us, or with a request or inquiry that you have addressed to us, please contact datenschutz@deloitte.de. You also have the right to contact the Deloitte Data Protection Officer. For an overview of relevant regulators, see the al company details.

Changes to this privacy policy
If necessary, we may amend or supplement this privacy policy.
To let you know when we make changes to this privacy policy, we will adjust the revision date at the top of this page. The newly amended or expanded privacy policy will be effective as of this revision date. Therefore, we encourage you to periodically review this policy to learn how we process and protect your information.

Please note that the Deloitte website, including this Privacy policy, has been made available to provide general information and guidance on certain topics, but not to delve into individual topics. The Deloitte website is not designed to provide binding advice (including on accounting, tax, legal affairs, investments), any other service or work output, or any response to any related matter, for example. Accordingly, you cannot rely on the content of Deloitte website with regard to taking a decision or action, and should therefore always consult with a professionally qualified advisor on matters relating to your personal finances and business dealings.

Questions about the protection of privacy

If you have any questions about this Privacy policy or feel that you have specific concerns about it that should be addressed, feel free to contact us directly via kontakt@deloitte.de or startupatscale@deloitte.de.

2. Information about the processing of personal data in accordance with Art. 13, 14 GDPR

Please ensure that, in addition to the information below, you are also familiar with Deloitte’s Privacy Policy and Agorize Privacy policy. For questions of understanding or other queries, please contact us at datenschutz@deloitte.de.

Deloitte Digital GmbH  is a subsidiary of Deloitte GmbH Wirtschaftsprüfungsgesellschaft, a company providing services in the areas of auditing, risk advisory, tax consultancy, financial advisory and consulting for companies and institutions from all economic sectors  including, but not limited to, the management of innovation related projects including open innovation challenges and innovation awards (legal advice is provided in Germany by Deloitte Legal Rechtsanwaltsgesellschaft mbH) (collectively “Deloitte” / “we”). As part of the commission to provide the above services, Deloitte processes personal data according to the individual order. This information complements the Privacy Policy above and provides a more concrete description of how Deloitte processes your personal information as part of the provision of the commissioned service.

Please note that this information refers exclusively to personal data within the meaning of Art. 4 No. 1 GDPR, i.e. not all data and information that Deloitte receives in relation to an underlying client relationship and/or in connection with any services of Deloitte, but essentially only information that relates to an identified or identifiable natural person. Notwithstanding this, applicable secrecy and confidentiality obligations to which Deloitte and Deloitte employees are subject shall apply in full to all data and information we receive under a client relationship, regardless of whether this is personal data within the meaning of the GDPR.

The controller within the meaning of the GDPR

The controller within the meaning of Art. 4 (7) EU General Data Protection Regulation (GDPR), which is responsible for processing your personal data in connection with all services not provided by Deloitte Legal, is:

Deloitte Digital GmbH 
Rosenheimer Platz 4
81669 München

If the contractor of a contract for the performance of our services is another German Deloitte company, then it acts as the responsible body in the case concerned. An overview of the German Deloitte companies can be found here.

Data protection officer & data protection supervisor

All German Deloitte companies have appointed data protection officers. You can contact the respective data protection officer at datenschutz@deloitte.de. The relevant supervisory authorities can be found here.

Purposes of processing and legal basis for processing

Deloitte processes your personal information for the purpose of fulfilling our (pre)contractual obligation to our customers. Furthermore, in the context of the open innovation platform services, we process your personal information for the purpose managing and offering new challenges as well as for the purpose of storing your data in local excel sheet in order to keep an overview of participating/ed startups and to contact them in case of new challenges.

In particular, we process your contact details such as name, address, and e-mail address in this context for the above mentioned purposes and in order to carry out pre-contractual measures (such as internal pre-contractual compliance checks or within the scope of a client / contract) and to carry out our respective contractual obligations, including administrative execution and settlement of the respective contract on the basis of Art. 6 para. 1 lit. b) GDPR. Deloitte uses IT systems to administer and store your personal information to manage and execute order requests/assignments, but with no automated decision-making or profiling.

Depending on the category of documents, Deloitte will store personal data for record keeping/documentation and archival purposes in accordance with relevant legislation for a varying period of time:

• Auditors’ reference files: 10 years from the end of the calendar year of completion of the order
• Lawyers’ reference files: 6 years from the end of the calendar year of the completion of the order
• Accounting documents: 10 years
• Received commercial or business letters and reproductions of the dispatched commercial or business letters as well as other tax-relevant documents: 6 years

As a rule, Deloitte receives the necessary personal data from the customers and startups. In this respect, Deloitte has, in accordance with Art. 6 para. 1. a), 7 GDPR, received an express consent in the processing of those personal data. Furthermore, Deloitte has, in accordicanc with Art. 6 para. 1 f ) GDPR a legitimate interest in the processing of this personal data, as Deloitte is obliged to carry out the contracted service on the basis of the underlying contract an/or the performance of the open innovation platform services. In this context, it is essential for Deloitte to process any personal data related to the contact persons of the startups and our clients (including at an early stage within the context of the offer preparation).

If you have commissioned Deloitte to perform certain services, such additional personal data relating to you will be processed in the context of order processing in addition to your contact details to the extent that they are necessary for the provision of the service agreed with you and that you have forwarded such information to us. In this respect, the processing of your personal data is justified to ensure the fulfillment of the contract between you and Deloitte and according to Art. 6 para. 1 b) GDPR.

Please note that Deloitte’s General Terms and Conditions generally require the client to be obliged to provide Deloitte with all the documents and information necessary to complete the contract. In this respect, the processing of the respective order and the associated fulfillment of the contractually agreed service by Deloitte is not possible or possible only to a limited extent if and insofar as the necessary information is not provided.

As Deloitte is required by law to ensure proper record keeping, extensive documentation of its clients and assignments (also beyond the conclusion of an order) as well as compliance with further retention and documentation obligations (including due to professional, accounting or commercial and corporate law requirements), Deloitte processes your personal data in the context of documents to be recorded, work results or related customer-related correspondence (also for the purpose of file management), documentation and archiving both in the form of paper files and in the context of IT systems used for this purpose on the basis of Art. 6 para. 1. c) GDPR for the fulfillment of our aforementioned legal obligations.

Notwithstanding the foregoing purposes, Deloitte will, to the extent permitted by applicable law, also process your contact information (including name, address, e-mail address) for marketing and advertising purposes, in other words, for example, to provide you with information about our further offers or events. This is done on the basis of consents and / or a legitimate economic interest of Deloitte as defined in Art. 6 para. 1. f) to inform their customers about further offers and events they provide and thus to establish and maintain a long-term customer relationship.

Finally, Deloitte also processes your contact information for the purpose of maintaining our business contacts when we receive them in the course of a business event, as part of a business appointment (e.g. by exchanging business cards) or as part of an order, and transfer these into the CRM system we use (Customer Relationship Management System).

Because Deloitte has a legitimate commercial interest in maintaining contacts in the context of business relations beyond the initial contact, to use them for establishing a business relationship and to remain in contact with the data subject for this purpose, the above processing of your personal data takes place on the basis of Art. 6 para. 1. f) GDPR.

Categories of data recipients and transfers to third countries

In connection with the implementation of our commissioned service, personal data, as specified below, may in exceptional cases, also be transmitted to third parties. In this respect, data can be transferred to both European and non-European countries and can be stored outside the EU:

To other Deloitte member companies1 for cooperation as part of our service provision

To the extent necessary to provide the commissioned service, i.e. in the case of a foreign relationship or if the expertise of a foreign counterpart is required, Deloitte cooperates with other companies in the global Deloitte network. Insofar as such a transfer is made to a network company outside the EU / European Economic Area, an appropriate level of data protection is ensured by the use of standard contractual clauses provided by the EU Commission within the meaning of Art. 46 para. 2. c) GDPR. The EU standard contractual clauses can be found at https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:EN:PDF.

To authorities, courts or other bodies

In connection with the performance of our services, it may also be necessary to provide information, work results and documents to authorities, courts or other public or private entities (in the case of foreign relations, also abroad). The same applies to the cases in which Deloitte is required by law, government or court order to publish/disclose personal data. This only occurs if there are no professional confidentiality obligations to the contrary.

To Deloitte-internal service providers as well as external IT service providers

Within the scope of its activities, Deloitte uses other German or foreign Deloitte network companies in individual cases as network-internal IT service providers who provide services for the operation, maintenance and care of the IT systems and applications used by the Deloitte network companies. Deployment of these companies with access rights to personal data takes place only if this was agreed in the order agreements with our customers or is legally permissible without consent in individual cases.

Insofar as access is provided by a network company outside the European Economic Area, an appropriate level of data protection is ensured by the use of standard contractual clauses provided by the EU Commission within the meaning of Art. 46 para. 2. c) GDPR.

Specialized and client-related IT service providers, which are deployed when, for instance, processing clients, providing specialist applications for tax consultants, auditors and/or lawyers as well as cloud services, are only used in coordination with our clients where this is required by law.

Your rights in connection with data processing

The GDPR essentially grants data subjects the following rights, which you can assert at any time by contacting the data protection officer named in this information at datenschutz@deloitte.de.

In principle, you can request information from Deloitte at any time as to whether personal data about you are processed or stored at Deloitte and which personal data are affected. Please note that your right to information may be restricted to the extent that such information conflicts with professional secrecy and to the extent that information requiring secrecy would be disclosed.

In addition to your right to information, you can request the correction of your data at any time. In addition, you have the right to delete your data if and when the data are no longer needed for the purposes for which it was collected or, if the processing is based on your consent, you have revoked your consent. The aforementioned right to delete your data is waived if your data must not be deleted due to a legal obligation or must be processed due to a legal obligation or if data processing is required for the assertion, exercise or defense of legal rights.

In addition, you have the right to request that Deloitte restrict the processing of your personal information.

Added to this is a right to data portability, i.e. you may request that Deloitte retain the data you provide in a structured, common and machine-readable format and / or that such data be transmitted to another controller. Please note that this does not apply if you have made the data available to us on the basis of consent or on the basis of a contract concluded with you or if the processing is carried out using automated procedures.

If Deloitte processes your personal data on the basis of Art. 6 para. 1. f) GDPR (e.g. if your employer, as a Deloitte customer, has provided us with your personal information as a contact in your company, or if we use your contact information to send you information about offers and events provided by Deloitte), you can object to this processing at any time.

Right of appeal to a data protection supervisory authority

In addition to the data subject rights listed above, you also have the right to complain to a data protection supervisory authority in accordance with Art. 77 GDPR if you believe that the processing of your personal data violates data protection law. In each case, the supervisory authority of the federal state in which the controller has its seat is responsible.

Duration of data storage

Please note that Deloitte will store and process your personal information for as long as it is necessary for the fulfillment of the above-mentioned processing purposes. Insofar as personal data are subject to statutory retention obligations or are part of documents subject to statutory retention requirements, Deloitte will store this data for the duration of the statutory retention period.

Depending on the category of documents, Deloitte will generally store personal information for the following varying periods of time, based on applicable statutory retention requirements:

• Auditors’ reference files: 10 years from the end of the calendar year of completion of the order,
• Lawyers’ reference files: 6 years from the end of the calendar year of completion of the order,
• Accounting records as per legal requirement: 10 years,
• Received commercial or business letters and reproductions of the dispatched commercial or business letters as well as other tax-relevant documents: 6 years.

If the data are subject to different retention periods, the longest retention period applies, and the legally required retention period may be extended depending on the individual case, e.g. if the information is required to assert, exercise or defend legal rights even after expiration of the retention period.

1 Deloitte refers to Deloitte Touche Tohmatsu Limited (“DTTL”), a “private company limited by guarantee,” its network of member companies and their affiliates. DTTL and each of its member companies are legally autonomous and independent. DTTL (also called “Deloitte Global”) does not provide services to customers. A more detailed description of DTTL and its member companies can be found at www.deloitte.com/en/UeberUns.