Here is a quick overview of what happens to your personal data when you visit our website. Personal data is any information that makes you directly or indirectly identifiable. Detailed information on how we handle your data can be found in the full privacy policy further down on this page.
The data on this website is processed by the website operator. You can find the contact details of the controller in the "Information on the controller" section of this privacy policy.
Some data is collected to ensure the website functions properly. Other data is used to analyze your user behavior and optimize the website.
You have the right to receive information about the origin, recipients, and purpose of your stored personal data at any time, free of charge. You also have the right to request the correction or deletion of this data. If you have given us consent to process your data, you can revoke this consent for the future at any time. Furthermore, you have the right to request the restriction of the processing of your personal data under certain circumstances. You also have the right to lodge a complaint with the competent data protection authority.
You can contact us at any time with these or any other questions regarding data protection.
When you visit our website, your browsing behavior may be statistically analyzed. This is primarily done using so-called analysis tools.
Detailed information on the analysis tools used can be found further down in this privacy policy.
Protecting your personal data is a top priority for us. We process your personal data exclusively on the basis of legal provisions (GDPR, DSG, TKG 2021).
We place great importance on protecting your personal data. We therefore handle your personal data with care and in accordance with applicable data protection regulations and this privacy policy.
When you visit our website, various personal data are collected. This is information that allows you to be personally identified. This privacy policy explains what data we collect and how we use it. It also explains why and for what purpose the data is collected.
Please note that data transmission over the internet, such as communication via email, can have security vulnerabilities. Complete protection of data against access by unauthorized third parties is unfortunately not possible.
Unless a more specific storage period is mentioned in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for erasure or withdraw your consent to data processing, your data will be deleted, provided we have no other legally permissible reasons for storing your personal data (e.g., tax or commercial retention periods); in the latter case, deletion will occur once these reasons no longer apply.
Stelzhammer, Heller & Partner Steuerberatungs GmbH
Ungargasse 59-61 / Top 3.4
A-1030 Vienna
T: +43 1 2080 548
Email: office@shp-steuerberatung.com
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).
If you have consented to data processing, we process your personal data based on Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, provided special categories of data under Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your device (e.g., via device fingerprinting), data processing is based on Section 165 of the 2021 Telecommunications Act (TKG) and the ePrivacy Directive. Consent can be withdrawn at any time. If your data is required for the performance of a contract or for pre-contractual measures, we process your data based on Art. 6(1)(b) GDPR. Furthermore, we process your data if necessary to fulfill a legal obligation based on Art. 6(1)(c) GDPR. Data processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. Information regarding the relevant legal basis in each individual case is provided in the following sections of this privacy policy.
We use tools from companies based in third countries that do not provide an adequate level of data protection, as well as US tools whose providers are not certified under the EU-US Data Privacy Framework (DPF). When these tools are active, your personal data may be transferred to and processed in these countries. Please note that in countries without adequate data protection, a level of protection comparable to that of the EU cannot be guaranteed.
Please note that the USA, as a secure third country, generally provides a level of data protection comparable to that of the EU. Data transfer to the USA is permitted if the recipient is certified under the "EU-US Data Privacy Framework" (DPF) or has appropriate additional safeguards in place. Information regarding transfers to third countries, including data recipients, can be found in this privacy policy.
This website uses SSL/TLS encryption to protect sensitive data and ensure secure transmission. This protects confidential information, such as inquiries or orders, that you send to us. You can identify an encrypted connection by the fact that the URL in your browser's address bar changes from "http://" to "https://" and a lock icon is displayed in the browser bar.
Thanks to enabled SSL/TLS encryption, third parties are unable to read the data you transmit.
The use of contact details published as part of our legal notice requirements for the purpose of sending unsolicited advertising and information materials is hereby prohibited. The site operators expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, such as spam emails.
We work with various external service providers as part of our business operations. In some cases, this requires the transfer of personal data to these external parties. We only share personal data with external parties when necessary for the performance of a contract, when we are legally obligated to do so (e.g., providing data to tax authorities), when we have a legitimate interest in the transfer under Art. 6(1)(f) GDPR, or when another legal basis permits the transfer. When using data processors, we only share our customers' personal data based on a valid data processing agreement. In the case of joint processing, a joint controller agreement is concluded.
You have the right to request confirmation as to whether we are processing your personal data. If this is the case, you have the right to access this personal data as well as further information related to the processing.
In the event that the personal data we process about you is (no longer) accurate or is incomplete, you may request the rectification and, if applicable, the completion of this data.
Provided the legal requirements are met, you may request the erasure of your personal data.
Provided the legal requirements are met, you may request the restriction of the processing of your data.
Provided the legal requirements are met, you may request the transfer of your data in a structured, commonly used, and machine-readable format.
WHERE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING IS FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).
If processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
If you believe that our processing of your personal data violates applicable data protection law or that your data protection rights have been infringed in any other way, you have the right to lodge a complaint with the competent supervisory authority (Austrian Data Protection Authority).
The address is:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Our website uses "cookies." These are small text files stored on your device that do not cause any damage. Cookies can be stored on your device either for the duration of a session (session cookies) or long-term (persistent cookies). Session cookies are automatically deleted when you leave the website, while persistent cookies remain stored until you delete them manually or your browser does so automatically.
Different types of cookies and their use:
Cookies serve various functions. Some are technically necessary to ensure basic website features (e.g., shopping carts or video playback). Others are used to analyze user behavior or support marketing purposes.
Cookies that are necessary for the operation of the website, the provision of requested functions (e.g., shopping cart), or for the optimization of the website are based on Art. 6(1)(f) GDPR, as the website operator has a legitimate interest in the error-free and optimized provision of its services. If consent for the use of cookies is obtained, processing is based on this consent in accordance with Art. 6(1)(a) GDPR and Section 165 of the Telecommunications Act (TKG 2021). Consent can be revoked at any time.
You have the option to configure your browser to inform you about the setting of cookies, to allow cookies only in individual cases, to block the acceptance of cookies generally, or to activate the automatic deletion of cookies when closing the browser. Please note that disabling cookies may limit the functionality of our website.
Detailed information on the cookies and services used on this website can be found in this privacy policy.
If you contact us by email, telephone, or fax, your request, including all resulting personal data (name, inquiry), will be stored and processed by us for the purpose of handling your request. We do not share this data without your consent.
This data is processed on the basis of Art. 6(1)(b) GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of requests addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if requested; consent can be revoked at any time.
The data you send us via contact requests will remain with us until you ask us to delete it, revoke your consent for storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory legal provisions—especially statutory retention periods—remain unaffected.
For communication with customers and business partners, we also use the instant messaging service WhatsApp, operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Messages are transmitted using end-to-end encryption, which ensures that content cannot be viewed by third parties, including WhatsApp. However, metadata such as sender, recipient, and time of communication is stored by WhatsApp. Please note that WhatsApp may share its users' personal data with its parent company, Meta, in the USA. Further information can be found in WhatsApp's privacy policy at: https://www.whatsapp.com/legal/#privacy-policy.
The use of WhatsApp is based on our legitimate interest in enabling fast and effective communication with customers and partners (Art. 6(1)(f) GDPR). If explicit consent is required, we process data exclusively on that basis; consent can be revoked at any time with future effect.
Messages exchanged via WhatsApp remain stored until you request their deletion, revoke your consent, or the purpose for storage no longer applies (e.g., after your request has been processed). Mandatory statutory retention periods remain unaffected.
WhatsApp is certified under the EU-U.S. Data Privacy Framework (DPF), which is intended to ensure that European data protection standards are maintained even when data is transferred to the USA. Further information on this data protection standard can be found here: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt00000011sfnAAA&status=Active.
We use the "WhatsApp Business" version and have implemented measures to enhance data protection. Our WhatsApp accounts are configured to prevent automatic synchronization with the address book on the devices used.
To use WhatsApp for communication, we have entered into a Data Processing Agreement (DPA) with the provider to ensure that data processing complies with applicable data protection standards. Data transfers to the USA are based on the Standard Contractual Clauses approved by the EU Commission. Further information can be found here: https://www.whatsapp.com/legal/business-data-transfer-addendum.
Provider: iubenda s.r.l., Via San Raffaele 1, 20121 Milan, Italy.
We use iubenda on this website as a consent management platform to obtain, manage, and legally document consent for the use of cookies and similar technologies. Through the cookie banner, you can decide which categories of cookies you wish to allow and can revoke or adjust your choices at any time.
To document your consent, iubenda processes data including your IP address (typically truncated), information about your browser and device, the time of consent, and your specific selections. This data is stored to provide evidence that consent was granted.
The legal basis for this is our legal obligation to provide proof of consent (Art. 6(1)(c) GDPR) and our legitimate interest in the legally compliant management of such consent (Art. 6(1)(f) GDPR).
Processing takes place within the European Union; no data is transferred to a third country.
Further information: https://www.iubenda.com/privacy-policy/
Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.
We use the service Cloudflare on this website, a Content Delivery Network (CDN) with security features. Cloudflare optimizes the delivery of our content, speeds up page loading, and protects the website from attacks and malicious traffic.
For this purpose, all traffic between your browser and our website is routed through Cloudflare's servers. In doing so, Cloudflare may process your IP address, information about your browser and device, access times, and technical connection data, and may use cookies or similar technologies for this purpose.
The legal basis is our legitimate interest in providing our website in a secure, stable, and efficient manner (Art. 6(1)(f) GDPR). Where consent is obtained via the cookie banner, processing is based on Art. 6(1)(a) GDPR.
Data may be transferred to the USA. Cloudflare bases this transfer on the EU Commission's standard contractual clauses and is certified under the EU-US Data Privacy Framework.
Further information: https://www.cloudflare.com/privacypolicy/
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA).
We use Google reCAPTCHA on this website to protect our forms from spam and automated abuse by bots. reCAPTCHA checks whether an input is made by a human or an automated program.
To do this, the service analyzes the behavior of website visitors based on various characteristics. Data processed may include your IP address, time spent on the website, mouse and keyboard movements, information about your browser and device, and other technical data. reCAPTCHA may use cookies or similar technologies for this purpose.
The legal basis is our legitimate interest in protecting our website from spam and abuse (Art. 6(1)(f) GDPR). Where consent is obtained via the cookie banner, processing is based on Art. 6(1)(a) GDPR.
Data may be transferred to the USA. Google bases this transfer on the EU Commission's standard contractual clauses and is certified under the EU-US Data Privacy Framework.
Further information: https://policies.google.com/privacy
Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This service helps us analyze visitor behavior and optimize our content.
Google Analytics uses cookies and similar technologies to collect data about how you use our website. This includes information such as page views, time spent on the site, the operating system used, and the user's geographic origin. This data helps us better understand interactions and improve our website.
The "Google Analytics 4" feature allows data, sessions, and interactions across multiple devices to be linked to a unique User ID. Additionally, Google uses machine learning and device fingerprinting to refine its analytics.
Data transfer and security measures
Information collected via cookies is generally transmitted to and stored on Google servers in the USA. Google acts as a data processor for us and may only use the transmitted data according to our instructions. Furthermore, Google is contractually obligated to comply with data protection requirements.
Since Google is headquartered in the USA, data may be transferred to third countries. This transfer is based on the EU Commission's Standard Contractual Clauses. Additionally, Google is certified under the EU-U.S. Data Privacy Framework (DPF) to ensure an adequate level of data protection. You can find more information here:
https://www.dataprivacyframework.gov
IP anonymization: IP anonymization is enabled for Google Analytics on this website. This means your IP address is truncated within the EU or the EEA before being transmitted to Google servers. Only in exceptional cases is the full IP address sent to a Google server in the USA and truncated there.
Google processes this anonymized data on our behalf to perform usage analysis, generate reports on website activity, and provide other services related to web analytics. The IP address transmitted as part of Google Analytics will not be merged with other Google data.
Legal basis and withdrawal: Google Analytics is only used if you have provided your consent when entering our website (Art. 6(1)(a) GDPR and § 165(3) TKG 2021). This consent can be withdrawn at any time with effect for the future.
Deactivating Google Analytics: If you do not want your data to be collected by Google Analytics, you have the following options:
Further information: Detailed information on data processing by Google Analytics can be found here:
Data processing agreement: We have entered into a data processing agreement with Google. This ensures that the use of Google Analytics complies with European data protection requirements.
Google Tag Manager is a tool that allows us to manage various website tags centrally via a user interface, enabling us to integrate other services into our online offerings. Google Tag Manager itself does not store cookies or create user profiles. It is used solely to execute the integrated tags. In this process, Google only receives the user's IP address, which is required to activate Google Tag Manager.
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Website: https://marketingplatform.google.com
Privacy Policy: https://policies.google.com/privacy
Further information on the services used can be found in this privacy policy.
Google Ads (formerly Google AdWords) is an online advertising program from Google that allows companies and website operators to place ads in search results and on other Google platforms. These ads are used to attract visitors to the advertised website and to reach potential customers. Google Ads also allows users to select target groups and specific keywords to reach potential customers in a targeted manner and increase conversion rates. Using Google Ads can increase a website's traffic volume and help boost a company's online visibility and revenue.
We use the online marketing tool "Google Ads" to place our ads within the Google advertising network. This includes placing ads in Google search results, on websites, in videos, and in other locations to reach potential users who may be interested in our offerings. Additionally, we use conversion tracking to measure the success of our ads. In this process, we only receive the anonymous total number of users who clicked on one of our ads and were subsequently redirected to a page with a "conversion tracking tag." No information is transmitted that would allow for the personal identification of users.
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Website: https://marketingplatform.google.com
Privacy policy: https://policies.google.com/privacy
Further information on how user data is handled can be found in Google's privacy policy.
Our website uses the features of Google Ads Remarketing, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
With Google Ads Remarketing, we can assign visitors to our website to specific target groups in order to show them interest-based advertising within the Google advertising network at a later time (known as remarketing or retargeting).
Furthermore, the advertising target groups created by Google Ads Remarketing can be combined with Google's cross-device functions. This makes it possible to display interest-based and personalized advertising messages that were shown on one device (e.g., a smartphone) on other devices used by the same user (e.g., a tablet or PC).
Technical implementation & data processing: Google Ads Remarketing uses cookies and similar technologies to track usage behavior on our website and display personalized advertisements to you. This data processing only occurs with your consent.
If you have a Google account, you can disable personalized advertising directly via Google: https://www.google.com/settings/ads/onweb/
Legal basis and withdrawal: The use of Google Ads Remarketing is based exclusively on your consent in accordance with Art. 6(1)(a) GDPR and Section 165(3) of the TKG 2021. You may withdraw your consent at any time with future effect.
Data transfer to third countries (USA): Since Google is headquartered in the USA, data may be transferred to the USA and other third countries. This transfer is based on the European Commission's standard contractual clauses.
Google is also certified under the EU-U.S. Data Privacy Framework (DPF) to ensure an adequate level of data protection. Further information on this can be found at: https://www.dataprivacyframework.gov
Further information: Detailed information on data processing by Google and your configuration options can be found in Google's privacy policy: https://policies.google.com/technologies/ads?hl=en
For our social media activities, we use the following social media services:
We use social media plugins. These allow us to display interactive elements or content (e.g., text posts, graphics, images, and videos) from social media services. Through these plugins, data—including personal data—may be transmitted to the social media service providers and potentially used by them.
We currently use social media plugins from the following services:
We host our website with Webflow. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter: Webflow). When you visit our website, Webflow collects various log files, including your IP address, which is anonymized.
Webflow is a tool for building and hosting websites. It uses cookies and other recognition technologies that are necessary for displaying the page, providing certain features, and ensuring security (necessary cookies).
Further details can be found in Webflow's privacy policy: https://webflow.com/legal/eu-privacy-policy.
The use of Webflow is based on Art. 6(1)(f) GDPR, as we have a legitimate interest in the reliable presentation of our website. If consent for the use of cookies is required, data processing is carried out based on your consent in accordance with Art. 6(1)(a) GDPR and Section 165 of the Telecommunications Act (TKG 2021), insofar as the consent relates to the storage of cookies or access to information on the user's device. This consent can be revoked at any time.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision by the European Commission.
Data processing agreement: We have entered into a data processing agreement (DPA) with Webflow. This contract ensures that Webflow processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
This site uses Google Fonts for consistent typography, which are provided by Google. These Google Fonts are installed locally. No connection to Google servers is established. For more information on Google Fonts, please visit https://developers.google.com/fonts/faq and Google's privacy policy: https://policies.google.com/privacy?hl=en.
Last updated: 07/2026
Our website uses Cookiebot's consent technology to obtain your consent for the storage of certain cookies on your device or for the use of certain technologies and to document this in a data-protection-compliant manner. The provider of this technology is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter "Cookiebot").
When you enter our website, a connection is established with Cookiebot's servers to obtain your consent and other declarations regarding cookie usage. Cookiebot then stores a cookie in your browser to assign the given consent or its revocation to you. The data collected in this way is stored until you ask us to delete it, delete the Cookiebot cookie yourself, or the purpose for data storage no longer applies. Mandatory statutory retention obligations remain unaffected.
Cookiebot is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6(1)(c) GDPR.
You can easily schedule appointments with us through our website. For this, we use the service "Calendly," provided by Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA (hereinafter "Calendly").
To book an appointment, please enter your details and your preferred time into the provided form. This information is used exclusively for scheduling, managing, and, if necessary, following up on your appointment. Appointment data is stored on Calendly's servers. For more information on how Calendly processes data, please see their privacy policy: https://calendly.com/privacy.
The data you enter will be stored by us until you request its deletion, withdraw your consent for storage, or the purpose for data storage no longer applies. Mandatory statutory retention periods remain unaffected.
The legal basis for data processing is Art. 6(1)(f) GDPR, as we have a legitimate interest in simple and efficient appointment scheduling. If consent for the use of cookies or similar technologies is required, data processing is based on Art. 6(1)(a) GDPR and § 165 TKG 2021. This consent can be withdrawn at any time.
Data transfer to the USA is based on the Standard Contractual Clauses approved by the EU Commission. Detailed information can be found here: https://calendly.com/pages/dpa.
Data processing agreement: We have entered into a data processing agreement (DPA) with Calendly. This contract ensures that Calendly processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.
We use Jotform on our website to create online forms. The service provider is the American company Jotform Inc., 4 Embarcadero Center, Suite 780, San Francisco CA 94111, USA.
Although Jotform is an American company, it states that it processes and stores data from European customers exclusively on European servers. You can find more information on this in their blog post, "EU Safe Forms: Our Solution to the EU Safe Harbor Invalidation."
You can learn more about the data processed through the use of Jotform in their privacy policy at https://www.jotform.com/privacy/.
