Privacy Policy

Last updated: 19 October 2026

This privacy policy explains which personal data we process when you visit our website or contact us, why we process it, and which rights you have.

1. Data controller

MA-Tax Consulting GmbH
Im Köller 3/1
70794 Filderstadt
Germany

Phone: +49 7158 94332-0
Email: customs@ma-tax.de

2. Hosting and technical access data

We host this website on the platform of Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel delivers the website through a distributed network and runs the technical processing of the contact form.

Website requests involve the processing of necessary connection data, particularly the IP address, requested address, time, HTTP status and information sent by the browser, such as browser type, operating system and, where supplied, the referring page. This data is processed to deliver the website, diagnose errors and protect its operation.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are reliable website delivery, resolving technical faults and preventing misuse.

Vercel privacy notice · Vercel data processing terms

3. Contact form, email and telephone

When you contact us, we process your contact details and the contents of your enquiry to handle your request and respond. The form transmits your first name, surname, company, email address, selected topics, message and any telephone number you choose to provide.

Where processing is necessary for a contract with you personally or for steps taken at your request before entering into a contract, the legal basis is Article 6(1)(b) GDPR. For enquiries from representatives of a company and other business enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is handling enquiries and communicating with prospective customers and business partners.

Required fields are marked with *. You cannot submit the form without the information required to identify and handle your enquiry. Your telephone number is optional. You can also contact us directly by email or telephone.

Email delivery through Mailjet

We use Mailjet, an email service of the Sinch group, to deliver form enquiries to our responsible mailbox. This involves sending the form details, including the message content, to Mailjet. Your email address and name are used as the reply-to contact. The email providers involved also process data required to transport, deliver and secure the message.

Submitting an enquiry does not subscribe you to a newsletter. Your enquiry is not automatically forwarded to the partner companies named in the topic selection.

Mailjet privacy notice · Mailjet / Sinch data processing terms

4. Retention

We retain enquiries and related correspondence for as long as required to handle the request, answer follow-up questions or manage a resulting business relationship. Once this purpose ends, the data must be deleted unless a legal obligation or a legitimate reason requires further retention.

Retention of technical logs and delivery data depends on the relevant operational and security purpose. The deciding factor is how long the data is needed to detect and resolve errors, establish delivery or investigate a specific security incident. Rate-limit data stored by our contact endpoint is handled separately under the rules below.

Where correspondence is subject to statutory commercial or tax retention obligations, Article 6(1)(c) GDPR is the basis for that further retention. Retention needed to establish, exercise or defend legal claims is based on Article 6(1)(f) GDPR and ends when the relevant claim can no longer be pursued or the matter has been resolved. You can ask about retention of your specific enquiry using the contact details above.

5. Preventing abusive form submissions

Our contact endpoint limits repeated submissions. It temporarily stores the IP address determined by the server, a request counter and the end of the rate-limit window in memory. The message content is not stored in this counter.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the contact form and email delivery against spam and overload.

The rate-limit window lasts 15 minutes. Once it expires, the entry is deleted when the application next executes; expired entries are not used to limit submissions. While the server instance is running, the cleanup runs at least once a minute. Entries are lost when the instance terminates. Separate technical logs kept by the hosting provider follow the retention criteria described above.

6. Language and cookie settings

• “ma-tax-language” in your browser’s local storage remembers the language you select (German or English). The application does not set an automatic expiry. The setting remains until you or your browser delete it.
• “cc_cookie” remembers the necessary cookie setting for 182 days. Choosing a language also saves this necessary setting. It does not activate any optional analytics or advertising features.

This storage provides and remembers the settings you expressly choose. Device access for these necessary settings is based on section 25(2), no. 2 TDDDG. Where personal data is processed, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is providing the settings you request.

You can delete both entries in your browser settings. “Cookie settings” in the footer lets you reopen the local-storage information at any time. Deleting the language setting may cause the language selection to appear again.

7. Analytics, fonts and external links

We currently use neither Google Analytics nor any other analytics service. We do not set analytics cookies, and your usage is not tracked by analytics.

Fonts and images are delivered through our website host. No fonts are loaded from Google Fonts. This website does not embed YouTube videos, Google Maps or reCAPTCHA services.

Links to other websites take you to the external website only when you follow them. Its provider is responsible for personal data processing there. Please read the relevant provider’s privacy notice.

8. Recipients and processing in third countries

Access is limited to the people at MA-TAX handling your enquiry and the service providers needed to operate the website, deliver email and operate our mailbox. Disclosure to further recipients requires an appropriate purpose and legal basis, such as necessary assistance with your request or a legal obligation.

Hosting with Vercel and the use of international email providers may involve processing outside the European Economic Area, particularly in the USA. Different data protection rules and government access powers may apply there.

Vercel’s and Sinch’s published data processing terms contain provisions for international transfers, including EU Standard Contractual Clauses for the transfers they cover. The documents are linked above. You can request further information and a copy of the safeguards applicable to your data using our contact details.

9. Your data protection rights

Subject to the applicable statutory conditions, you have the following rights:

• Access to your personal data and information about its processing (Article 15 GDPR).
• Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).
• Erasure of your data (Article 17 GDPR).
• Restriction of processing (Article 18 GDPR).
• Data portability for automated processing based on consent or a contract (Article 20 GDPR).

Right to object under Article 21 GDPR

Where we process data on the basis of Article 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation. We will then stop processing the data unless there are overriding compelling legitimate grounds or processing is needed to establish, exercise or defend legal claims. You may object to processing for direct marketing at any time.

Where processing is based on your consent, you may withdraw it at any time with future effect. This does not affect the lawfulness of processing before withdrawal.

To exercise your rights or ask a data protection question, email customs@ma-tax.de.

Complaints to a supervisory authority

Under Article 77 GDPR, you may complain to a data protection supervisory authority, particularly in the place of your habitual residence, your workplace or the alleged infringement. The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg is a relevant authority for our registered office.

Submit a complaint to the LfDI Baden-Württemberg

We do not make decisions about your enquiry based solely on automated processing that have legal or similarly significant effects within the meaning of Article 22 GDPR.

10. Protecting data in transit

When you access the website using HTTPS, TLS protects transmission between your browser and our website host. Subsequent email delivery is a separate transmission path. Complete protection against every risk of electronic communication cannot be guaranteed.