Legal information
Privacy policy
GKM Global GmbH privacy policy for gkm-buchhaltung.de and the client portal: what data we process, why, for how long, and your rights.
This is a translation. The German version is authoritative.
1. Data controller
GKM Global GmbH, GKM Buchhaltung division
Gerhofstraße 1–3, c/o WeWork, 20354 Hamburg
Phone +49 40 2989 6395, Email info@gkm-buchhaltung.de
Represented by Managing Director Gagik Kreuz.
2. General
We process personal data only to the extent necessary for the operation of this website, the handling of your requests, pre-contractual measures, the fulfillment of contracts, or our legitimate interests. We do not sell data.
3. Hosting and server log files
The website and client portal run on a dedicated server of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, located in a data center in Spain, that is, within the EU. When you visit the site, your browser transmits technically necessary data: IP address, date and time, URL accessed, amount of data transferred, status code, referring page, as well as browser and operating system.
The purpose is to ensure the secure and stable operation of the website. The legal basis is Article 6(1)(f) of the GDPR. The log data is deleted after 14 days, unless a security incident needs to be investigated. The provider processes the data as a data processor in accordance with Article 28 of the GDPR.
5. Contact by email or phone
If you call or write to us, we process your information to respond to your request. The legal basis is Article 6(1)(b) of the GDPR if the matter concerns a contract with you; otherwise, it is Article 6(1)(f) of the GDPR. Regular emails are not end-to-end encrypted. Please send confidential documents via the client portal or as otherwise agreed.
6. Callback form and “Become a client” and “Find a tax advisor” requests
In the callback form on the contact page, we process your name, phone number, your email address if you provide it, your preferred time slot, the language of the call, the subject, and your message. In the “Become a client” request, we process your name, company name, location, email address, and phone number if you provide it, as well as your legal form, industry, desired services, approximate number of entries and employees, choice of tax advisor, and desired start date. Required fields are marked.
The information is sent to us via email and is used to respond to your request and prepare a quote. The legal basis is Article 6(1)(b) of the GDPR; for information provided on behalf of a company, the legal basis is Article 6(1)(f) of the GDPR. For emails, we use Microsoft 365 provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor pursuant to Article 28 of the GDPR.
“Find a tax advisor” request
If you use our service to find a tax advisor, we also process information about your company, your situation, and your needs: legal form, industry, location, number of employees, and revenue range; your previous tax advisor and reasons for switching; desired services; backlogs; urgency and deadlines; way of working; language; systems used; and your contact information. The purpose is the initial consultation, which is a needs assessment without tax advice, and the recommendation of a tax advisor we work with. The legal basis is Article 6(1)(b) of the GDPR.
We will only share with the recommended tax advisor the information they need to prepare a quote, and only with your explicit consent pursuant to Article 6(1)(a) of the GDPR. We store the wording, version, and date of your consent. You may revoke your consent at any time with future effect by sending an email to info@gkm-buchhaltung.de. The tax advisor will then process the data as an independent data controller.
Storage of requests and origin
We also store requests submitted via all forms in our client portal in order to process and evaluate them. The legal basis for this is Article 6(1)(f) of the GDPR, our legitimate interest in orderly processing and in evaluating our advertising. Only if you agree in the notice at the bottom of the page will your browser store, in session storage for the duration of your visit, the page or campaign through which you reached us, without a cookie; when you submit a request, we store this information with it. The legal basis for this is your consent under § 25(1) TDDDG and Article 6(1)(a) of the GDPR. Your browser keeps your decision for six months; after that, we ask again. You can withdraw your consent at any time via “Change consent” at the bottom of the page; the website works the same without your consent. Section 12 specifies how long we store requests. After submitting, you will receive a confirmation by email; for a callback request, only if you provide an email address.
When you fill in “Become a client” or “Find a tax advisor”, your browser saves your progress in session storage, for this tab only. That way, nothing is lost if you go back or reload the page. Your progress stays on your device and is not transmitted to us; we only receive your information when you submit the form. After that, the form deletes your progress; otherwise, it ends when you close the tab. No consent is required for this, because the storage only serves the form you started yourself (§ 25(2) no. 2 TDDDG).
7. Client portal
In the client portal, we process the data we need for access and collaboration: name, email address, your password only as a hash, the key for two-factor authentication once it is set up, uploaded and provided documents, and electronic signatures with the time, IP address, and checksum of the document. Our server checks every uploaded file for malware before saving it; no third parties are involved.
We use a technically necessary session cookie for signing in. It expires when you sign out, or after twelve hours at the latest. If you select “Trust this device for 30 days” when signing in, another cookie remembers this device for that period so that your password alone is sufficient on that device; you can revoke this at any time in the portal. If you select a language before signing in, a cookie stores only this selection for one year. We set all three cookies only at your request; they do not require consent (§ 25(2) no. 2 TDDDG). We log sign-ins, signatures, and document retrievals as evidence and to protect against misuse. The legal basis is Article 6(1)(b) of the GDPR; for the log, it is Article 6(1)(f) of the GDPR. Details are provided in the privacy notice for clients, which you receive in the portal.
Ordering Rekana Rechnung
If you order Rekana Rechnung online, we process the information provided in the order: company name, legal form, name of the person placing the order, address, email address, phone number if you provide it, tax number or VAT ID, for newly founded businesses without a number the date of business registration or notification to the tax office, the selected invoice template, the language of the website and the language of your invoices, and, for payment by SEPA direct debit, the account holder, IBAN, and BIC if you provide it. We store your confirmation as a business, your consent to the general terms and conditions and the data processing agreement, and the SEPA direct debit mandate with the wording, version, time, IP address, and browser identifier as evidence.
The purpose is to conclude and perform the contract, activate your access, and carry out the monthly billing. The legal basis is Article 6(1)(b) of the GDPR. To ensure that the free trial period is granted only once per business and tool, we compare the email address, tax number or VAT ID, and IBAN with previous orders; the legal basis for this is Article 6(1)(f) of the GDPR. We retain invoices and contract data under § 147 AO and § 257 HGB; the legal basis for this is Article 6(1)(c) of the GDPR.
If you pay by SEPA direct debit, we submit the direct debit with the mandate reference, account holder, IBAN, and amount to the bank of GKM Global GmbH; the bank processes this data for the collection. If you do not confirm an order within 14 days via the link in our email, or if you do not set up two-factor authentication within a further 14 days after that, we delete the order along with its details.
We process the data you enter in the software yourself, such as customers, invoices, account transactions, and receipts, on behalf of your company under the data processing agreement in Annex 2 of the terms and conditions.
Bank statements and receipts
If you upload bank statements for a business account in the portal as files in CAMT, MT940, CSV, or Excel format, we process the account transactions with counterparty, IBAN, payment reference, amount, and date, as well as the account balances from the statements, the uploaded receipts, and your categories. There is no connection to your bank through which transactions are retrieved. Our server reads the amount, date, invoice number, and name from PDF receipts to match them with transactions; no third parties are involved in this process. The server generates exports as Excel, CSV, or PDF files only at your request.
Invoicing with Rekana Rechnung
When you create invoices in the portal, we store the documents containing your customers’ information and, at your request, send them on behalf of your company: e-invoices via Microsoft 365 from our address e-rechnung@gkm-buchhaltung.de, as described in Section 8, or via your own email account. Each transmission is logged with the recipient, time, and checksum of the files.
Access for employees of our clients
If we handle payroll for a company, it can give its employees their own access to the client portal. For this purpose, we process the following on behalf of the employer as processor under Article 28 of the GDPR: name, email address and, if desired, the personnel number entered by the employer, the leaving date, the password only as a hash, if desired the key for the second factor, the chosen language, and sign-ins and downloads with time and IP address. In this access, we provide the employee’s payslips and, if the employer links it, their personnel questionnaire. We announce new payslips by email, without an attachment and without any details from the payslip.
The employer is the controller. The legal basis is the performance of the employment relationship, including the employer’s obligation to provide payslips under § 108 GewO, Article 6(1)(b) of the GDPR and Article 6(1)(c) of the GDPR. The employer decides for each employee whether they receive the payslip online or on paper. If the employer locks the access or switches to paper, sign-in ends immediately. Access ends one year after the leaving date: we then delete the password, second factor, backup codes and sessions; the payslips remain with the employer for its retention obligations. Employees exercise their rights under Section 14 against their employer; we forward requests addressed to us to the employer.
Rekana Zeit time tracking
If we handle payroll for a company, it can use the Rekana Zeit time tracking for its employees. We operate it on behalf of the employer as processor under Article 28 of the GDPR; the employer is the controller. We store the entries with the time, adjustments with the reason, the review by the employer, the confirmation of the month, the device used to clock in and out, and the IP address when clocking in or out. The time tracking does not ask for a location. The legal basis is Article 6(1)(c) of the GDPR in conjunction with the employer’s recording obligations under § 3(2) no. 1 ArbSchG, § 16(2) ArbZG, and § 17 MiLoG.
The employee links their phone with a code from their employer. For this, we set a technically necessary cookie that recognizes this device, for 90 days from the last use. Without a connection, the browser stores entries on the device and sends them as soon as a connection is available again. The cookie and the storage serve only the time tracking that the employee opens themselves; they do not require consent under § 25(2) no. 2 TDDDG.
If the employee turns on reminders on their phone, they are delivered by the notification service of their browser or operating system, from Apple, Google, Mozilla, or Microsoft depending on the device. Our server passes to this service the address at which the device can be reached there and the encrypted notification; only the device can read it. Processing in the U.S. is possible in this case; see Section 11. Reminders can be turned off at any time.
The records remain stored for at least two years, as part of the payroll records for up to six years, and are then deleted. Employees exercise their rights under Section 14 against their employer; we forward requests addressed to us to the employer.
8. Sending invoices
Companies that use Rekana Rechnung in the client portal can send their e-invoices via GKM Buchhaltung from the address e-rechnung@gkm-buchhaltung.de. The controller for processing the recipients’ data is the company that issues the invoice and is named in the email. GKM Global GmbH acts as a processor in accordance with Article 28 of the GDPR.
The data processed includes the name, address, and email address of the recipient and their contact persons; the details of the invoice and its attachments; and the transmission data: time, sender, recipient, subject line, message ID, file checksums, and the mail server’s response. The purpose is to send the invoice and to provide proof of transmission.
The emails are sent via Microsoft 365. Microsoft Ireland Operations Limited is a subprocessor of GKM Global GmbH; the location of processing and safeguards in the event of access from third countries are governed by the data processing agreement and Section 11 of this statement.
The transmission log and the sent message are part of the document and are stored along with it, at least for the duration of its retention period in accordance with § 147 AO and § 14b UStG. If the company’s contract with GKM Global GmbH ends, they remain stored for the company’s read access and are then deleted: for customers who ordered Rekana Rechnung online, at the end of the tenth calendar year after the contract ends; for clients, when the retention period for the last invoice expires.
Messages sent to e-rechnung@gkm-buchhaltung.de go to GKM Global GmbH; they are not read there, not forwarded, and deleted no later than 45 days after receipt. GKM Global GmbH is itself the controller for these messages; the legal basis is Article 6(1)(f) of the GDPR, and the legitimate interest is the operation of a sending address whose incoming messages are not processed. If you have any questions regarding the invoice, please contact the company that issued it.
You may exercise your rights to access, rectification, or erasure, restriction of processing, objection to processing, and data portability under Articles 15 through 21 of the GDPR with this company. You also have the right to lodge a complaint with a data protection supervisory authority; the Hamburg Commissioner for Data Protection and Freedom of Information is responsible for GKM Global GmbH.
The page gkm-buchhaltung.de/zertifikat containing information about the signature of these emails does not set cookies and does not track visits.
9. Bookkeeping in DATEV
If we handle bookkeeping or payroll for your company, we process the bookkeeping and payroll data on behalf of your company in accordance with Article 28 of the GDPR. Your company is the controller for this data; the details are governed by the data processing agreement we enter into with your company. The processing serves to fulfill your company’s bookkeeping, record-keeping, and reporting obligations (Article 6(1)(c) of the GDPR) and to perform its contracts (Article 6(1)(b) of the GDPR). For special categories of personal data pertaining to employees in payroll, the legal basis is Article 9(2)(b) of the GDPR in conjunction with the employer’s obligations under labor, tax, and social security law. We agree with your company on where the bookkeeping is kept. There are three options:
- In the DATEV records of our partner tax advisor. We post entries in records that a tax advisor we work with keeps in DATEV under their advisor number. They provide us with this environment as a subprocessor; the data processing agreement with your company names them. As the holder of the records, they have technical access. They are bound to professional secrecy (§ 57(1) StBerG). If your company engages them or grants them a power of attorney to represent it in tax matters, they process the data in the DATEV records for their tax tasks as an independent controller; for the bookkeeping we do, they remain a subprocessor. Your company can request at any time that we keep the books using one of the other options.
- In your own tax advisor’s DATEV records. We post entries there using access that your tax advisor sets up for us, or we deliver the bookkeeping to your tax advisor in DATEV format. Your tax advisor processes the data for their own tasks as an independent controller.
- In Lexware Office. Your company enters into a contract with the provider directly and sets up an account for us there. The data is then stored with the Lexware Office provider, who processes it on behalf of your company.
The DATEV records are kept in the data center of DATEV eG, Paumgartnerstraße 6–14, 90429 Nürnberg, Germany. Access from third countries is only possible in exceptional cases during maintenance by further processors of DATEV, on the basis of adequacy decisions or EU standard contractual clauses (Articles 45 and 46 of the GDPR). DATEV processes the data as a processor of the tax advisor under whose advisor number the records are kept. For our partner tax advisor’s records, it does so along the chain through us and them. DATEV also transmits the statutory filings to the tax authorities, social security agencies, and the Berufsgenossenschaft, the statutory accident insurer. Depending on the option, the recipients of the bookkeeping data are DATEV eG; our partner tax advisor as a subprocessor and, to the extent your company has engaged them, as an independent controller; your own tax advisor as an independent controller; or the provider of Lexware Office as your company’s processor. Further recipients are the bodies to which the law requires filings and the other subprocessors that the data processing agreement names for remote access, email, filing, and AI applications. When the contract ends, we transfer the records to your company or to a successor it designates; otherwise, Section 12 applies.
10. Recipients
Access is limited to GKM employees who process your request, as well as our service providers for hosting, email, and IT acting as processors. If you choose a tax advisor we work with, we share your contact information and details of the engagement with them, with your consent. They then process this information under their own responsibility. Section 9 specifies who receives the bookkeeping data. Authorities receive data only if required by law.
11. Transfer to third countries
The website itself does not transfer any data to countries outside the EU and the EEA. Microsoft generally processes our emails within the EU. Access by the parent company, Microsoft Corporation, in the U.S. cannot be ruled out. This is based on the adequacy decision for the EU-U.S. Data Privacy Framework, under which Microsoft is certified (Article 45 of the GDPR), and additionally on standard contractual clauses (Article 46 of the GDPR). If an employee turns on reminders in the Rekana Zeit time tracking, our server passes the encrypted notification to the notification service of their browser at Apple, Google, Mozilla, or Microsoft; processing in the U.S. is possible in this case. For DATEV, the maintenance exception described in Section 9 applies. Otherwise, the rules on transfers to third countries in the data processing agreement apply to the bookkeeping data.
12. Storage period
Server log files: 14 days. Client portal sign-in details: until access ends. We keep the log of sign-ins, signatures, and document retrievals as evidence for the duration of the contract and the statutory retention periods. We anonymize requests that do not lead to a contract with us six months after we last worked on them, even if we have introduced you to a tax advisor: name, company, location, contact information, the details from the form, our notes on them, and the IP address recorded when you gave your consent are deleted. For our analysis, only the type, origin, industry, legal form, and processing status of the request remain, without any reference to you. We delete the emails related to these requests from our mailbox at the same time. If a contract is concluded, the statutory retention periods apply: six years for business letters, eight years for accounting documents, and ten years for books and financial statements. Account transactions and uploaded receipts in the portal remain stored for the duration of the contract; after that, we hand them over or delete them in accordance with the data processing agreement. For customers who ordered Rekana Rechnung online, the software’s data remains stored in read access after the contract ends, until the end of the tenth calendar year after the contract ends, and is then deleted; on request, we delete it earlier. For clients, documents issued in Rekana Rechnung, with the sending log and sent message, remain stored for read access until the retention period for the last invoice has expired, and are then deleted. Deleted data disappears from the backups after 30 days at the latest. We delete messages sent to e-rechnung@gkm-buchhaltung.de no later than 45 days after receipt, see Section 8.
13. Data security
The connection to the website is encrypted using TLS, as indicated by “https://” in the address bar. We take appropriate technical and organizational measures to protect your data.
14. Your rights
You have the right to access, rectification, erasure, restriction of processing, and data portability (Articles 15 through 20 of the GDPR). If we process data based on legitimate interests, you may object on grounds relating to your particular situation (Article 21 of the GDPR). You may withdraw your consent at any time with future effect. Simply send a message to info@gkm-buchhaltung.de.
You may file a complaint with a data protection supervisory authority; the Hamburg Commissioner for Data Protection and Freedom of Information is the authority responsible for us.
15. Automated decisions
We do not make decisions based solely on automated processing, nor do we create profiles.
Last updated: November 2026