Privacy notice

This is a translation for information purposes. The German version is legally binding.

As of 6 November 2026

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

HGF Tax GmbH

Donau-City-Straße 11
1220 Vienna
Austria

Phone: +43 1 388 00 88
Email: office@hgf.at

In accordance with Art 13 GDPR, we inform you of the legal bases for our data processing. Unless the legal basis is specifically stated in this notice, the following applies: the legal basis for obtaining consent is Art 6(1)(a) in conjunction with Art 7 GDPR. The legal basis for processing in order to provide our services, to carry out contractual measures and to respond to enquiries is Art 6(1)(b) GDPR. The legal basis for processing in order to comply with our legal obligations is Art 6(1)(c) GDPR. Where processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art 6(1)(f) GDPR is the legal basis. Where processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Art 6(1)(d) GDPR is the legal basis.

We adhere to the principles of data minimisation under Art 5(1)(c) GDPR and storage limitation under Art 5(1)(e) GDPR. We store your personal data only for as long as necessary to achieve the purposes stated here or as required by statutory retention periods. Once the respective purpose no longer applies or these retention periods expire, the data concerned will be erased as soon as possible.

This website may contain links to third-party websites or to other websites for which we are responsible. If you follow a link to a website outside our responsibility, please note that these websites have their own privacy policies. We accept no responsibility or liability for these third-party websites and their privacy policies. Please check whether you agree with their privacy policies before using these websites. You can recognise external links either because they are displayed in a different colour from the rest of the text or underlined. Your cursor indicates external links when you move it over such a link. Your personal data is only transferred to the link target when you click on an external link. The operator of the other website receives, in particular, your IP address, the time at which you clicked the link, the page on which you clicked it and other information set out in that provider’s privacy policy. Please also note that some links may lead to data being transferred outside the European Economic Area. This could give foreign authorities access to your data, and you may have no legal remedies against such access. If you do not want your personal data to be transferred to the link target or exposed to access by foreign authorities, please do not click on any links.

As a data subject within the meaning of the GDPR, you have various rights. The rights arising from the GDPR are the right of access (Art 15), the right to rectification (Art 16), the right to erasure (Art 17), the right to restriction of processing (Art 18), the right to object (Art 21), the right to lodge a complaint with a supervisory authority and the right to data portability (Art 20).

Right to withdraw consent:

Some processing can only take place with your express consent. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to object:

Where processing is based on Art 6(1)(e) or (f) GDPR, you may object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you. This also applies to profiling based on these provisions within the meaning of Art 4(4) GDPR. Unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims, we will cease processing your data after you object. Where personal data is processed for direct marketing purposes, you have the right to object at any time. The same applies to profiling related to direct marketing. Here, too, we will no longer process your personal data once you object.

Right to lodge a complaint with a supervisory authority:

If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, email dsb@dsb.gv.at, website www.dsb.gv.at.

Right to data portability:

Where your data is processed automatically on the basis of consent or for the performance of a contract, you have the right to receive this data in a structured, commonly used and machine-readable format and to request its transfer to another controller, where technically feasible.

Right of access, rectification and erasure:

You have the right to obtain information about your processed personal data, including the purpose of processing, the categories, the recipients and the storage period. If you have any questions on this or any other topic relating to personal data, please contact us using the details given in the legal notice.

Right to restriction of processing:

You may request the restriction of the processing of your personal data at any time if one of the following conditions is met:

• You contest the accuracy of the personal data, for the period needed to verify its accuracy.
• If processing is unlawful, you may request restriction of use instead of erasure.
• If we no longer need your personal data for the purposes of processing but you need it for the establishment, exercise or defence of legal claims, you may request restriction instead of erasure.
• If you object to processing under Art 21(1) GDPR, your interests and ours will be weighed. Until this has been done, you have the right to request restriction of processing.

Restriction of processing means that, apart from storage, personal data may only be processed with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Our website is hosted by:

Zayo Infrastructure France SA
19-21 Rue Poissonnière, 75002 Paris
France

The server is located in Austria.

When you visit our website, we automatically collect and store information in server log files, which your browser transmits automatically to our server or the server of our hosting provider. This includes: the IP address of the visitor’s device, the device used, the host name of the accessing computer, the visitor’s operating system, browser type and version, name of the file accessed, time of the server request, amount of data and whether the request was successful. This data is not combined with other data sources.

Instead of operating this website on our own server, we may have it operated on the server of an external service provider (hosting provider), named above in that case. The personal data collected by this website is then stored on the hosting provider’s servers. In addition to the data mentioned above, the web host also stores, for example, contact requests, contact details, names, website access data, meta and communication data, contract data and other data generated via a website on our behalf. The legal basis for this processing is Art 6(1)(f) GDPR. Our legitimate interest is the technically error-free presentation and optimisation of this website. Where the website is accessed in order to enter into contract negotiations or conclude a contract with us, Art 6(1)(b) GDPR serves as an additional legal basis. Where we have engaged a hosting provider, a data processing agreement is in place with this provider.

If you contact us via the contact form, by email or by phone, we process the data you provide (name, email address, phone number where applicable and the content of your message) in order to respond to your enquiry. The legal basis is Art 6(1)(b) GDPR where your enquiry relates to an engagement or contract, and otherwise our legitimate interest in responding to enquiries (Art 6(1)(f) GDPR). Your name, email address and message are required so that we can respond. Form enquiries are transmitted to our email system in encrypted form. We store your data for as long as necessary to process your enquiry or as required by statutory retention obligations. As a firm of tax advisors and auditors, we are bound by professional secrecy.

If you apply via our career form or by email, we process your details and documents to carry out the application process (Art 6(1)(b) GDPR). After the process has been completed, we keep your data only for as long as necessary to defend against possible legal claims (Art 6(1)(f) GDPR). We only keep your data for longer for future vacancies with your separate consent (Art 6(1)(a) GDPR).

For our email communication, we use Microsoft 365 provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor (Art 28 GDPR). A transfer to Microsoft Corporation in the USA cannot be ruled out. Any such transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art 45 GDPR), to which Microsoft Corporation has signed up, and additionally on standard contractual clauses (Art 46(2)(c) GDPR).

Our website uses local storage items, session storage items and/or cookies. Local storage is a mechanism that allows data to be stored in the browser on your device. This data usually contains user preferences, such as a website’s day or night mode, and remains until you delete it manually. Session storage is very similar to local storage, but the data is only kept for the current session, ie until you close the current tab, and is then deleted from your device. Cookies are pieces of information that a web server stores on your device in order to identify it. They are either stored temporarily for the duration of a session (session cookies) and deleted at the end of your visit, or permanently (persistent cookies) until you delete them yourself or your browser deletes them automatically.

These objects may also be stored on your device by third parties when you visit our site (third-party requests). This allows us as operator and you as visitor to use certain third-party services installed on this website, such as payment services or the display of videos.

These mechanisms have many uses. They can improve the functionality of a website, control shopping cart functions, increase security and convenience and analyse visitor flows and behaviour. Depending on their function, they are classified differently under data protection law. We use technically essential cookies and storage entries without consent to the extent that they are necessary to provide a service you have expressly requested (section 165(3) TKG, Austrian Telecommunications Act). We base the associated processing on our legitimate interest in the technically error-free operation of the website (Art 6(1)(f) GDPR). We use all other cookies, storage entries and external services (eg for statistics or marketing) only with your consent (section 165(3) TKG, Art 6(1)(a) GDPR). You can withdraw your consent at any time via “Manage consent” at the bottom of the page. Where local storage items, session storage or cookies are used by third parties or for analysis purposes, we inform you about this separately in this privacy notice. Your consent will be requested where required and can be withdrawn at any time.

External services are used on our website. These are third-party services that are used on our website for various reasons, such as embedding videos or website security. When these services are used, personal data is also passed on to the respective providers. Where we have no legitimate interest in using these services, we obtain your consent, which you may withdraw at any time, before use (Art 6(1)(a) GDPR).

To comply with data protection requirements, we use a consent management tool on our website. We use this tool to obtain the necessary consent for setting cookies or using external services. The consents are stored. The processing is necessary to comply with a legal obligation to which the controller (website operator) is subject. The legal basis is therefore Art 6(1)(c) GDPR.

We use the Complianz GDPR/CCPA Cookie Consent service on our website, provided by Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, Netherlands. As this service is hosted locally on the web server, no data is transferred to third parties.

The service sets the following cookies on our website:

A content management system enables digital content to be created, edited, organised and displayed. We use a content management system to create content for our website, which allows us to design a more appealing website. We base this processing on a legitimate interest (Art 6(1)(f) GDPR), namely the technically error-free presentation and optimisation of the website.

We use WordPress on our website, provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. As this service is hosted locally on the web server, no data is transferred to third parties. The service stores the following data in the browser’s local or session storage:

We integrate online media on our website to facilitate the provision of content and the integration of information. This allows us to include additional information from other service providers and partners on the website. Processing only takes place if you consent to it via our consent banner. The legal basis is consent (Art 6(1)(a) GDPR). Without your consent, the data processing described above does not take place. If you withdraw your consent (eg via the consent banner or other options provided on this website), we will stop this processing. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We use Klienten-Info GmbH, Döblinger Hauptstraße 56/4, 1190 Vienna, as a processor (Art 28 GDPR) to send our newsletter. When you subscribe, we process your email address and any voluntary details (salutation, first and last name) on the basis of your consent (Art 6(1)(a) GDPR). The data is stored on our behalf on Klienten-Info GmbH’s servers and is not used for the provider’s own purposes. You can unsubscribe at any time via the link in every issue or via our website, and your data will then be removed from the mailing list. On the “Klienteninfo” page, we only load Klienten-Info GmbH’s articles once you have consented to the “Marketing” category (Art 6(1)(a) GDPR, section 165(3) TKG). In this case, your IP address is transmitted to Klienten-Info GmbH’s servers.