Controller
HFP Steuerberatungs GmbH, Beatrixgasse 32, 1030 Vienna, Austria, phone +43 (0)1 716 05-0, email [email protected] (“we”).
This policy explains how we process personal data – when working for our clients and when you visit this website.
Client data
This information is for current and former clients and prospective clients, as well as their shareholders, officers and employees.
Purposes
- establishing, managing and carrying out the business relationship
- providing the services commissioned under sections 2 and 3 WTBG 2017, in particular tax advice and representation before authorities, bookkeeping, payroll, annual financial statements, restructuring and business advice, expert opinions, trustee services and mediation
- information on current legal developments and our services
- internal organisation, quality assurance and claims management of the firm
Where we collect data from you directly, providing it is voluntary. Without the data, however, we cannot carry out our engagement, or not in full.
Legal bases
- performance of a contract (Art. 6(1)(b) GDPR)
- legal obligations, e.g. retention and due diligence duties under WTBG 2017, BAO and UGB (Art. 6(1)(c) GDPR)
- overriding legitimate interests, e.g. organising the firm and informing existing clients (Art. 6(1)(f) GDPR)
- consent, e.g. for marketing by email or phone to prospective clients (Art. 6(1)(a) GDPR)
- for special categories of data, e.g. in payroll: Art. 9(2)(b) and (g) GDPR in conjunction with WTBG 2017
Recipients
Where necessary for the purposes above, we transfer data to: tax offices, social security institutions, courts and other authorities; banks, insurers and employee pension funds; IT service providers we use; auditors, cooperation partners and legal representatives; and recipients designated by our clients. In payroll, also to employees’ creditors, employee representative bodies, company doctors and pension funds.
If data is transferred to countries outside the EEA without an adequacy decision by the European Commission, we ensure an adequate level of data protection through the EU standard contractual clauses (Implementing Decision (EU) 2021/914). You can request a copy.
Retention
We keep your data until the end of the business relationship and beyond that until the statutory retention and limitation periods have expired (generally seven years, longer in individual cases), and until any legal disputes are concluded. We keep data used for marketing until you object or withdraw your consent.
Visiting this website
Hosting and server log files
When you visit the website, the web server processes technically necessary data: IP address, date and time, requested address, browser and operating system. This is needed to provide the website securely and reliably (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest unless they are needed to investigate a security incident. The website is run by a hosting provider in the EU under a data processing agreement.
Cookies and local storage
We do not use analytics, tracking or advertising cookies. We only store:
- hfp_consent – your choice on external content (cookie, 12 months)
- hfpA11y – your accessibility settings such as text size or contrast (stored locally in your browser until you reset them)
Both are required for the function you requested (section 165(3) TKG 2021) and are not transmitted to us or to third parties.
External content: videos, calculators and maps
Videos (Vimeo, Vimeo.com Inc., USA), embedded calculators (Haude GmbH, Austria) and maps (Google Maps) are only loaded once you consent (Art. 6(1)(a) GDPR). Your IP address is then transmitted to the provider. Vimeo is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time via “Cookies” at the bottom right of every page.
Google Maps
On our contact page we embed a Google Maps map to make it easier to find us. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded when you click “Load map” or allow external content in general (Art. 6(1)(a) GDPR).
When the map loads, your IP address, the page you are visiting and technical details about your browser and device are transmitted to Google. Google may set cookies or read existing ones; if you are signed in to a Google account, Google can link the visit to your account. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. We have no influence on the nature and scope of this processing.
For details, see Google’s privacy policy: policies.google.com/privacy. Without your consent, no connection to Google is made; the link “Beatrixgasse 32, 1030 Wien” only opens Google Maps when you click it.
Contact forms and email
If you contact us through a form or by email, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR). You will receive a confirmation at the email address you provide. Form submissions are deleted automatically after six months unless they lead to an engagement. We use Microsoft 365 (Microsoft Ireland Operations Ltd.) to send emails.
To protect our forms against spam, we use Cloudflare Turnstile (Cloudflare, Inc., USA; certified under the EU-US Data Privacy Framework). Technical characteristics of your browser and your IP address are transmitted to Cloudflare to detect automated submissions. No advertising cookies are set. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
Applications
We use application documents only for the selection process (Art. 6(1)(b) GDPR). Uploaded files are sent by email to our recruiting team and stored in a protected area of our website that is not publicly accessible and that only authorised staff can access. If no employment results, we delete your data automatically after seven months – unless you agree to us keeping it longer for future vacancies.
Events
When you register for an event such as our client information evening, we process the details you provide to organise the event. We only publish photos from events with your consent.
Client portal
The client portal is operated by an external provider (klientenportal.at). When you log in, your login details are transmitted directly to that provider; its privacy policy applies.
Social media
We refer to our LinkedIn and Instagram profiles with simple links only. No data is transferred until you click a link.
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. You can withdraw your consent at any time with effect for the future. To do so, please contact [email protected].
If you believe that the processing of your data breaches data protection law, you can lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, www.dsb.gv.at.
Last updated: 18. October 2026