Privacy policy

The following information provides an overview of which personal data is processed when our websites are used and in the course of our business activities. Personal data is any information relating to an identified or identifiable natural person (Art. 4(1) GDPR). Detailed information is set out in the following sections of this privacy policy.

This privacy policy applies to the websites justreporting.eu, including the readers provided under /rechtsakte/, zfge.justreporting.eu, meet.justreporting.eu and sign.justreporting.eu, and to further websites under justreporting.eu unless they refer to their own privacy information. It also applies to our presences on social networks and to the processing of data in the course of our business communication.

The controller is justReporting GmbH Wirt­schafts­prüfungs­gesellschaft. The contact details are set out in the section "Controller" in chapter 3.

Data is collected, on the one hand, when it is communicated to us, for example through entries in a form, when booking an appointment or by sending a message. Other data is recorded technically by our IT systems when the websites are accessed, in particular information on browser, operating system and time of access. In addition, data may originate from generally accessible sources; details are set out in chapter 5.

Part of the data is collected to ensure that the websites are provided without errors. Other data is used to handle enquiries, to arrange and hold appointments, to maintain business relationships and to evaluate the reach of our content.

Data subjects have the right at any time to obtain information free of charge about the origin, recipients and purpose of their stored personal data, and to request the rectification, erasure or restriction of processing of that data. Consent given may be withdrawn at any time with effect for the future. There is a right to object under Art. 21 GDPR to processing based on legitimate interests and to direct marketing (chapter 3, "Right to object"). There is also a right to lodge a complaint with the competent supervisory authority. For this and any other questions on data protection, you may contact us at any time.

Our websites, including the booking calendar and the signing service, are operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner Online GmbH processes the data exclusively on our behalf and in accordance with our instructions; a data processing agreement under Art. 28 GDPR is in place. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure, fast and reliable provision of our websites.

When our websites are accessed, the server automatically records the following information and stores it in log files: IP address, date and time of the request, requested address, status code, amount of data transferred, referring address and browser and operating system identifier. This data is not merged with other data sources. The recording serves to deliver the content and to ensure the security and stability of operation and is based on Art. 6(1)(f) GDPR. The log files are deleted after 14 days; entries required to investigate a security incident are retained until it has been resolved.

For the delivery of justreporting.eu and to defend against attacks, we use the services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. All requests to justreporting.eu are routed through Cloudflare’s infrastructure; in particular, IP address, time, requested address and browser identifier are processed. For our other websites, Cloudflare provides name resolution (DNS) only. A data processing agreement under Art. 28 GDPR is in place. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and reliable availability of our websites. For the transfer to the USA, see chapter 3.

For security reasons and to protect the transmission of confidential content, our websites use TLS encryption. An encrypted connection can be recognised by the string "https://" in the browser’s address bar. When encryption is active, the data transmitted cannot be read by third parties.

The controller within the meaning of Art. 4(7) GDPR is:

justReporting GmbH Wirt­schafts­prüfungs­gesellschaft
Rheinpromenade 2
40789 Monheim am Rhein
Germany
Represented by the managing director Jannik Hassel, Wirt­schafts­prüfer
Telephone: +49 211 7407 7093
E-mail: hello@justreporting.eu

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

No data protection officer has been appointed, as the requirements of Art. 37(1) GDPR and § 38(1) BDSG are not met. Enquiries on data protection should be sent to the contact details above.

As a public audit firm (Wirt­schafts­prüfungs­gesellschaft), we are subject to professional secrecy under § 43(1) WPO and § 203(1) no. 3 StGB. This applies alongside data protection law. Under § 29(1) sentence 2 BDSG, the right of access does not apply where providing the information would disclose information that must be kept secret by law or by its nature, in particular because of the overriding legitimate interests of a third party.

Unless a more specific retention period is stated in this privacy policy, personal data remains with us until the purpose of the processing no longer applies. If a justified request for erasure is made or consent is withdrawn, the data will be erased unless there are other legally permissible grounds for retaining it, such as retention periods under tax or commercial law (in particular § 257 HGB, § 147 AO) or professional retention duties (§ 51b WPO); in these cases the data is erased once those grounds cease to apply.

Where consent has been given, processing is based on Art. 6(1)(a) GDPR; where the consent covers the storage of information on, or access to, terminal equipment, additionally on § 25(1) TDDDG. Where the data is required for the performance of a contract or to take pre-contractual steps, processing is based on Art. 6(1)(b) GDPR. Data required to comply with a legal obligation is processed on the basis of Art. 6(1)(c) GDPR. Processing may also be based on a legitimate interest under Art. 6(1)(f) GDPR. The legal basis relevant in each case is stated in the following sections.

In the course of our business activities, we work with various external bodies. In some cases, this requires the transfer of personal data to these bodies. Data is passed on only where this is necessary for the performance of a contract, where there is a legal obligation, where there is a legitimate interest or where another legal basis permits it. Where processors are used, personal data is passed on only on the basis of a data processing agreement; in the case of joint controllership, an arrangement under Art. 26 GDPR applies where the provider makes one available (chapter 6). The individual recipients or categories of recipients are named in the respective sections. Data is not sold or passed on for advertising purposes.

In some cases, services of companies based in third countries, in particular the USA, are used. When these services are active, personal data may be transferred to and processed in these third countries. For the USA, there is an adequacy decision of the European Commission on the EU-US Data Privacy Framework of 10 July 2023 (Art. 45 GDPR); transfers to companies certified under it are based on this decision. Otherwise, transfers are based on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). Transfers to Switzerland are based on an adequacy decision of the European Commission under Art. 45 GDPR. A copy of the safeguards can be requested at hello@justreporting.eu.

Many data processing operations are only possible with express consent. Consent already given may be withdrawn at any time (Art. 7(3) GDPR). The lawfulness of the processing carried out until the withdrawal remains unaffected.

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, without prejudice to any other administrative or judicial remedy, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Data processed automatically on the basis of consent or in performance of a contract shall be provided, at the request of the data subject, to them or to a third party in a commonly used, machine-readable format (Art. 20 GDPR). Where direct transmission to another controller is requested, this is done only where technically feasible.

Within the applicable statutory provisions, there is the right at any time to obtain information free of charge about the stored personal data, its origin and recipients and the purpose of the processing (Art. 15 GDPR) and, where applicable, a right to rectification (Art. 16 GDPR) or erasure of this data (Art. 17 GDPR), subject to the restrictions under § 29 BDSG.

There is the right to request the restriction of processing of personal data (Art. 18 GDPR), in particular where the accuracy of the data is contested, the processing is unlawful, the data is needed for the establishment, exercise or defence of legal claims, or an objection under Art. 21(1) GDPR has been lodged and it has not yet been established whose interests prevail.

The provision of personal data is neither required by law nor by contract for the use of our websites. Before accepting an engagement, we are required by law to identify our contractual partners (§§ 10 et seq. GwG); without this information no engagement can be concluded. Where information is marked as mandatory in an individual case, its provision is necessary to handle the matter concerned; without it, the matter cannot be handled (Art. 13(2)(e) GDPR).

No automated decision-making within the meaning of Art. 22 GDPR takes place.

Our websites store information on users' terminal equipment or access information stored there where this is strictly necessary to provide a service expressly requested (§ 25(2) no. 2 TDDDG). This includes storing the consent status, on justreporting.eu with a randomly generated identifier, settings made by users themselves in the ESRS and VSME readers, such as the view, expanded outline items and saved passages, and session and language settings on sign-in pages, such as those of the signing service and of our internally used tools. The reader settings remain in the browser and are not transmitted to us; on the consent decision, which is also stored as proof, see the following section. Any further storage and access takes place only on the basis of consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which may be withdrawn at any time with effect for the future via the link "Cookie settings" (on zfge.justreporting.eu: "Manage cookies") in the footer. If JavaScript is disabled, the decision stored in the browser on zfge.justreporting.eu can be withdrawn by deleting the site data for that address in the browser.

On justreporting.eu we use the consent management tool CCM19 of Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany. When the website is accessed, a connection to the provider’s servers is established to obtain and store consent and to enable its withdrawal; in the process, the IP address, a randomly generated identifier, the selection made and the time and language are processed; even before a selection is made, CCM19 records the status "only technically necessary services". The legal basis for obtaining consent is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and § 25(1) TDDDG. The consent decision is stored as proof under Art. 7(1) GDPR at CCM19 (Art. 6(1)(c) GDPR) and erased there after one year; it also remains stored in the browser for one year, after which consent is requested again. A data processing agreement under Art. 28 GDPR is in place; processing takes place in Germany. On zfge.justreporting.eu, consent is obtained without an external provider; the decision is stored in the browser only.

On justreporting.eu we evaluate the reach of our content with the software Umami, which is operated on our own servers. Page views, including moves between our pages, and the successful sending of the contact form, without its content, are recorded server-side (requested address, referring address, for a move within the website the path of the page viewed before, browser identifier, language), without transmission of the IP address and solely from the information the browser sends to our server with the request anyway; no information is stored on or additionally read from the terminal equipment for this. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in determining which content is used. Only with consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) does a script additionally record clicks and further page views including screen size; in doing so, our Umami instance derives country and location and a monthly changing visit identifier from the IP address, without storing the IP address. The data is not passed on to third parties. It is erased after 24 months.

After a page on justreporting.eu has loaded, the browser asks our server whether a hint to the other language version should be shown. For this, the browser’s preferred language and the country derived by Cloudflare from the IP address (as a country code only), which the browser and Cloudflare transmit with the request anyway, are evaluated; in the browser, the referring page is also read so that the hint does not appear right after a language switch. Beyond the server log files, nothing is stored in the process, neither on our server nor on the terminal equipment. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in offering the suitable language version.

On zfge.justreporting.eu we use, with consent, the service Plausible Analytics of Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. The requested address, referring address, browser, operating system, device type and the country derived from the IP address are processed; the IP address itself is not stored. The legal basis is consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which may be withdrawn at any time via "Manage cookies" in the footer of zfge.justreporting.eu. A data processing agreement under Art. 28 GDPR is in place. The data is stored for as long as it is required to compare reach over time.

In the case of an enquiry via the contact form, the feedback function of the ESRS and VSME readers, by e-mail or by telephone, the information transmitted, including the contact details, is stored and processed to handle the enquiry and for any follow-up questions. With the feedback function, in addition to a comment and, if desired, an e-mail address, the passage concerned, the interface language, the window width and an optionally attached screenshot of the reading area may be transmitted. The legal basis is Art. 6(1)(b) GDPR where the enquiry is related to the performance of a contract or is necessary to take pre-contractual steps; in all other cases Art. 6(1)(f) GDPR, the legitimate interest lying in handling enquiries and improving the readers. To prevent automated submissions, we check technical characteristics of the submission, such as the time taken to fill it in and the page it was sent from, and limit the number of submissions per IP address; for this, the IP address is held only in the server’s memory and is no longer used after one hour (Art. 6(1)(f) GDPR; the legitimate interest is protection against abusive submissions). Messages are sent via Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, France, as processor; our mailboxes are operated by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, and our telephone system by fonial GmbH, Cologne, Germany. The data remains with us until the enquiry has been finally handled, unless statutory retention duties apply.

To arrange appointments, we operate a booking calendar on our own servers (meet.justreporting.eu); the software used is Cal.com. Name, e-mail address, the selected appointment and the information provided in the booking form are processed in order to arrange, confirm, remind of and prepare the appointment; the legal basis is Art. 6(1)(b) GDPR. Where the booking is started on justreporting.eu, the path of the page it was started from is also stored with it. Our server takes it from the referring address the browser sends with the request anyway, or inserts it when delivering the page; no information is stored on or additionally read from the terminal equipment for this (Art. 6(1)(f) GDPR; the legitimate interest is finding out which content leads to appointment requests). The calendar is embedded on our websites only with consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), as the embedded calendar stores information on the terminal equipment. On zfge.justreporting.eu, the text of a navigator result can be carried into the notes field when the booking is opened; name, e-mail address and company are not part of it, and the text can be changed or deleted before booking. After an introductory call for the ZF green electricity audit has been booked, the calendar sends the browser to a confirmation page on zfge.justreporting.eu and appends the booking details to the address, among them the booking reference, name, e-mail address, time and, where given, phone number, notes and the e-mail addresses of further guests; this does not happen for our other appointments. The details thereby reach only our server, on which the calendar and the website run; no third party receives them. The page reads only the start of the appointment, removes the details from the address after loading if JavaScript is enabled, and does not store them; the access log records the address without them, and the page sends no referrer and loads neither third-party services nor analytics. The browser may keep the full address in its history and cache, where it can be deleted. The legal basis is Art. 6(1)(b) GDPR and, for booking details transmitted for technical reasons that the page does not read, Art. 6(1)(f) GDPR (legitimate interest in running the confirmation page with our calendar software’s standard redirect). For the preparation e-mail on this introductory call, the calendar passes name, e-mail address, time, time zone and language of the booking to zfge.justreporting.eu within our server; there the details are used only for sending and are not stored (Art. 6(1)(b) GDPR). Confirmation, reminder and preparation e-mails are sent via Scaleway SAS; the appointment is transferred to our Microsoft 365 calendar. In the booking calendar, booking data is erased 60 days after the appointment; otherwise the section "Retention period" applies.

For meetings we use Microsoft Teams of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Connection data such as IP address and device information, as well as the audio and video data transmitted during the conference, are processed. The legal basis is Art. 6(1)(b) GDPR. A data processing agreement under Art. 28 GDPR is in place; Microsoft Corporation, USA, may be involved as a sub-processor.

The fonts used on our websites are loaded from our own servers. No connection to third-party servers, such as Google Fonts, is established for this purpose.

In the course of maintaining existing and initiating future business relationships, professional contact and communication data of contact persons at companies and organisations, and information on interactions with our posts, profiles and messages, is processed. Where such data is not collected from the data subject, it originates from generally accessible professional sources such as company websites and professional networks (Art. 14(2)(f) GDPR). The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in maintaining and initiating business relationships. The data is processed in our own systems and within Microsoft 365; recipients may also include providers of software and AI services that support us in maintaining business contacts, including providers based in the USA (see chapter 3). It is erased as soon as cooperation is no longer a possibility; to this end the records are reviewed annually, and entries with no exchange within two years are erased. The right to object under Art. 21 GDPR remains unaffected.

Data processed in the course of an engagement is subject to professional secrecy and is processed in accordance with the engagement and the professional and statutory retention duties (Art. 6(1)(b) and (c) GDPR). For the electronic signing of contract and engagement documents, we operate the signing service sign.justreporting.eu on our own servers (software Documenso); name, e-mail address and signature are processed, together with times, IP address and browser identifier as proof of signing. The legal basis is Art. 6(1)(b) GDPR and, for the proof data, Art. 6(1)(f) GDPR (legitimate interest in proving the signature); signed documents and the proof are retained with the engagement files (§ 51b WPO). Notifications are sent via Scaleway SAS.

On our websites we show excerpts from public reviews of us posted on review platforms (KennstDuEinen, Google). We take over the text verbatim and mark any cuts; we do not name the author unless they have agreed to be named. We process the review text, the month or date of the review and, where needed to put it in context, the author’s relationship with us (for example as a cooperation partner). The information comes from the platform on which the review is publicly available (Art. 14(2)(f) GDPR). The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in giving prospective clients a verifiable picture of our work. We remove an excerpt as soon as the review is changed or deleted on the platform or the author objects (Art. 21 GDPR); an informal message to hello@justreporting.eu is enough.

We maintain presences on social networks to present our firm, to provide information on professional topics and to communicate with interested parties. On our websites, these networks are integrated exclusively by plain links; plugins, scripts or pixels of the networks are not used. Data is transmitted to the respective network only when a link is followed.

When our presences are visited, public interactions (such as reactions, comments, following) and messages addressed to us are processed. In doing so, we can see the public profile information of persons who follow or interact with our presences. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our firm and communicating with interested parties. For enquiries relating to an engagement or a job application, the legal basis is Art. 6(1)(b) GDPR. Posts and comments remain until they are deleted; messages are deleted once the matter has been dealt with, unless they serve to maintain a business relationship (see chapter 5, "Business contacts") or retention duties apply. The networks also process data under their own responsibility, in particular for advertising purposes; we have no influence on this. Confidential documents should not be sent via social networks.

Some networks provide us with aggregated statistics on the use of our presences. Where this is the case, joint controllership with the respective network within the meaning of Art. 26 GDPR may exist (CJEU, judgment of 5 June 2018, C-210/16). LinkedIn and Meta provide arrangements under Art. 26 GDPR for this, under which they assume the essential obligations towards data subjects. X, Google (YouTube) and XING offer no such arrangement, nor does LinkedIn for personal profiles; Bluesky provides no statistics. Data subjects can always exercise their rights against us as well (Art. 26(3) GDPR); we forward requests to the respective network where necessary. The aggregated statistics contain no data relating to individual persons; for personal profiles, however, LinkedIn and XING show, depending on the settings of the person viewing, who has viewed the profile.

The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. For the page statistics, there is an arrangement under Art. 26 GDPR: linkedin.com/legal/l/page-joint-controller-addendum. The provider’s privacy information: linkedin.com/legal/privacy-policy.

The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. For the statistics, the arrangement under Art. 26 GDPR at facebook.com/legal/terms/page_controller_addendum applies, to the extent the provider applies it to them. The provider’s privacy information: privacycenter.instagram.com/policy.

The provider is X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. The provider’s privacy information: x.com/en/privacy.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider’s privacy information: policies.google.com/privacy.

The provider is Bluesky Social, PBC, USA; its representative in the European Union under Art. 27 GDPR is Ametros Ltd, Cork, Ireland. The provider’s privacy information: bsky.social/about/support/privacy-policy.

The provider is XING SE & Co. KG, Germany. The provider’s privacy information: privacy.xing.com/en/privacy-policy.