How we handle your data when you visit our online shop and your rights
Data protection information under Art. 13 f. of the EU General Data Protection Regulation
Thank you for visiting the Grant Thornton Germany [1] ("GT" or "we") merchandise shop. The security and protection of data when using our website are important to us. We would therefore like to let you know what personal data we collect when you visit our online shop, for what purposes we use them and what data protection rights you have.
[1] This includes: Grant Thornton AG Wirtschaftsprüfungsgesellschaft and Grant Thornton Rechtsanwaltsgesellschaft mbH.
Name and contact information of the controller and the data protection officer
The controller within the meaning of the EU General Data Protection Regulation ("GDPR") and of other national data protection legislation of the Member States (in Germany, the Federal Data Protection Act [Bundesdatenschutzgesetz], "BDSG") and of other data protection regulations is:
Grant Thornton AG
Wirtschaftsprüfungsgesellschaft
Johannstraße 39
40476 Düsseldorf
Tel.: +49 211 9524 0
Email: datenschutz@de.gt.com
You can find more information on data protection at Grant Thornton AG Wirtschaftsprüfungsgesellschaft and Grant Thornton Rechtsanwaltsgesellschaft mbH in the Privacy Policy for staff at: Datenschutz - Grant Thornton Purple Lounge.
Data protection officer contact information
CONCEPTEC GmbH
Thorsten Werning (certified DPO)
Bleichstraße 5
45468 Mülheim an der Ruhr
Tel.: (0208) 69609-0
Fax: (0208) 69609-190
Email: datenschutzbeauftragter@de.gt.com
General principles and rights of data subjects
This Privacy Policy applies to data processing when visiting the merchandise shop and making purchases.
Extent of the processing of personal data
We process your personal data only to the extent described below if this is necessary to provide our service, web and online offerings ("Offerings"), including functional webpages:
use of our website by staff and interested parties
purchase and shipping of articles.
Legal basis
Where personal data are processed based on consent by the data subject, the legal basis for the processing is Article 6(1)(a) GDPR.
When personal data are processed for the performance of a contract to which the data subject is party, the legal basis is Article 6(1)(b) GDPR; this also applies to processing required to take steps necessary prior to entering into a contract.
If processing is necessary for compliance with a legal obligation to which we are subject, the legal basis is Article 6(1)(c) GDPR.
If the vital interests of the data subject or of another natural person make processing necessary, the legal basis is Article 6(1)(d) GDPR.
If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Grant Thornton, processing personal data is based on Article 6(1)(e) GDPR.
If processing is necessary for the purposes of our legitimate interests or those of a third party and such interests are overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) GDPR is the legal basis for the processing.
Potential recipients of personal data
To provide our Offerings and to provide our services generally we also use IT service providers, IT developers, external consultants and shipping providers, who may work on providing our services on our behalf and in accordance with our instructions ("Processors"). These service providers may receive personal data as part of their work or come into contact with personal data and are deemed third parties or recipients within the meaning of the GDPR.
Where this is the case, we ensure that our service providers take sufficient security measures, that appropriate technical and organisational measures are in place so that they meet the relevant data protection provisions and ensure the protection of the rights of data subjects (cf. Art. 28 GDPR).
In addition, we process your personal data within the various specialist departments of Grant Thornton that are involved in performing the process. We may also be required by law to make the data we have collected available to public bodies (e.g., tax authorities, state criminal investigation offices).
Processing of personal data in third countries
As a rule, your personal data are processed within the European Union ("EU") or the European Economic Area ("EEA"). Information may only be transmitted to third countries in exceptional cases (e.g. disclosing personal data within the Grant Thornton network). Third countries are countries outside the EU/EEA in which it cannot be automatically assumed that there is an adequate level of data protection in accordance with European requirements.
Where transferred information also includes personal data that is transferred without being pseudonymised or anonymised, we ensure before the transfer that an adequate level of data protection is guaranteed in the third country in question or with the recipient in the third country. This may result from a European Commission "adequacy decision", be ensured by using the "EU standard contractual clauses" or by concluding an intercompany agreement with strict rules within the Grant Thornton network.
Data erasure and storage duration
Personal data of data subjects will be erased when the data are no longer necessary for the purposes of processing or where there is no longer any legal basis for storage. Data may be stored, instead of being erased, subject to a restriction of processing, if this is provided for by European or national legislation in EU regulations, laws, or other regulations, particularly
To comply with statutory retention duties (e.g. section 147 of the German Fiscal Code [Abgabenordnung – AO] or section 257 of the German Commercial Code [Handelsgesetzbuch – HGB], currently 6 to 10 years), and/or
If legitimate interests to storage exist (e.g. while the statute of limitation is still running for the purposes of legal defence (section 195 f. of the German Civil Code [Bürgerliches Gesetzbuch – BGB], currently between 3 and 30 years).
The data will be erased when the storage period prescribed by the legal provisions referred to above ends at the latest, unless it is necessary for us to continue to store them and a legal basis exists for this.
Categories of data
We differentiate personal data into the following main categories:
Master data
Master data are data about your person and your relationship with Grant Thornton that you make available to us. These particularly include first name, last name, email address, and office.
Meta data
An example of metadata is session IDs.
Rights of data subjects
The GDPR conveys certain rights to data subjects whose data are processed ("rights of the data subject"). If you would like to exercise one or more of the following rights, you can contact us at any time. As a data subject you have the following rights in particular:
Right of access under Art. 15 GDPR
You can obtain from the controller information as to whether and for what purposes personal data concerning you was or is being processed.
Right to rectification under Art. 16 GDPR
You have a right with respect to the controller to rectification and/or to have incomplete personal data completed if the processed personal data concerning you is incorrect or incomplete.
Right to erasure under Art. 17 GDPR
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay unless one of the exceptions set out in the GDPR applies or other statutory document retention periods require the controller to keep the data in question.
Right to restriction of processing under Art. 18 GDPR
You may obtain from the controller restriction of processing of personal data concerning you under the conditions laid down by the GDPR.
Right to data portability under Art. 20 GDPR
You have the right to receive the personal data concerning you which you have provided to the controller and which is based on consent or on a contract with you in a structured, commonly used and machine-readable format. Furthermore, based on the conditions laid down by the GDPR, you have the right to transmit these data to another controller without hindrance from the controller to which the personal data have been provided. In exercising this right, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This may not adversely affect the rights and freedoms of others.
Right to object under Article 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on points (e) or (f) of Art. 6(1) GDPR, including profiling based on those provisions. Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data will no longer be processed for such purposes.
Right to withdrawal of consent under Art. 7(3) GDPR
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can withdraw your consent at any time at datenschutz@de.gt.com.
Right to lodge a complaint under Art. 77 GDPR
In the case of alleged or committed infringements of data protection regulations, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies.
The data protection supervision authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Bettina Gayk
Kavalleriestr. 2-4
40213 Düsseldorf
Telephone: 0211/38424-0
Fax: 0211/38424-999
Email: poststelle@ldi.nrw.de
You can also submit your complaint to all other supervisory authorities. You can find the contact information of other data protection supervisory authorities in Germany by following this link:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html
No obligation to provide personal data
We do not make the conclusion of contracts or the fulfilment of our Offerings contingent on your providing personal data beforehand. As a staff member and interested party, you are under no statutory or contractual obligation to provide us with any personal data; however, if you do not provide us with the necessary data, we may not be able to provide certain Offerings or only provide them to a limited extent.
Hosting
Our website is hosted by Moll KONZEPT GmbH, Marie-Curie-Straße 10
48308 Senden ("Moll KONZEPT"). When you visit our website, Moll KONZEPT collects various logfiles, including your IP address. Moll KONZEPT saves cookies or other recognition technology that are necessary to show the page, provide certain website functions and safeguard security (technically necessary cookies). You can find more information in the Moll KONZEPT privacy policy: Datenschutz - Moll KONZEPT GmbH.
Use of Moll KONZEPT is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the presentation of our website being as reliable as possible. If consent is requested, processing takes place solely based on Art. 6(1)(a) GDPR and section 25(1) of the TDDDG if consent includes the saving of cookies or access to information on the user’s device (e.g. device finger printing) within the meaning of the TDDDG. Consent can be withdrawn at any time.
Data collection through use of our website
Every time our website is accessed, our systems automatically collect data and information from the computer system of the accessing computer. The following data are processed in particular:
Date and time of the server request
IP addresses
In addition, the following master data are requested from the customer relationship management system (CRM) for user registration or to access the page so that the staff member can be identified and access the online shop. The online shop is only accessible to Grant Thornton staff.
Title, first name and last name
Position
Office
Email address
Language
Telephone number (if any)
Purpose and legal basis of the data processing
It is necessary for the systems to temporarily store the IP address and other log files as required every time our website is accessed in order to provide the website to your computer. This is required to use our Offerings. The legal basis for this data processing – i.e. for the duration of your website visit – is Art. 6(1)(b) or (f) GDPR.
Any processing and storing of the IP address and log files for purposes other than the communication process serves to ensure the functionality of our Offerings, to optimise these Offerings and to ensure the security of our information technology systems. The legal basis for storing the IP address for these purposes other than the communication process is Art. 6(1)(f) GDPR.
Storage duration
Data are stored for as long as they are needed to fulfil the above processing purposes. In the case of data collection for provision of the website, this is the case when the relevant session, i.e. the website visit, has ended. Any further storage of log files including the IP address for the purposes of system security and optimising our Offerings will be for the period of two days from the end of access by the user.
Option to object
The recording of log files, including storage within the limits described above, is absolutely necessary for the operation of the website and the individual functions stored on it. Users of the website therefore have no right to object.
Email contact and contact form
Description and extent of data processing
To contact us, you can use the email addresses provided on our website or our contact forms. If you make use of these options, personal data will be processed and stored with us to reply to your inquiry. In this context, we process first name, last name, office and email address in particular. We do not disclose these data to third parties without your consent.
Purpose and legal basis of the data processing
The legal basis for processing data transferred as part of an inquiry using the contact form on the website is Article 6(1)(a) of the GDPR. You can withdraw your consent at any time at datenschutz@de.gt.com. If you contact us directly by email, Art. 6(1)(b) and/or Art. 6(1)(f) GDPR is the legal basis for the data processing.
Storage duration
The data will generally be erased as soon as they are no longer required for the purpose for which they were collected.
Where data are no longer necessary to comply with contractual or statutory obligations, including document retention duties under commercial and tax law, or to pursue legitimate interests, i.e. to preserve evidence related to the statute of limitations, they will be erased.
Purchase of merchandise
To purchase merchandise you can select the merchandise on our webpage and place it in the basket. Before the product goes into the basket, a target group must be selected: clients/business contacts, staff or students/job applicants/trade fair contacts. If you wish to acquire products for clients/business contacts, contact details and a reason need to be given. For the target group of staff, information on staff number, first and last name, reason and office are required. When the target group is selected, the responsible cost centre is required and a different delivery address can be given if needed. On ordering, the costs will be charged to the cost centre you have given.
If you make use of the option to purchase merchandise, personal data will be processed and stored with us for billing and shipping. In this context, we process the first name, last name, office and email address in particular. These data are shared with Moll KONZEPT GmbH to process the billing and shipping. Moll KONZEPT GmbH will process your data according to Grant Thornton’s instructions.
The legal basis for processing data transferred to us when making a purchase in our merchandise shop is Article 6(1)(b) of the GDPR.
Storage duration
The data will generally be erased as soon as they are no longer required for the purpose for which they were collected. Data on shop sessions are stored for the period of one year.
Where data are no longer necessary to comply with contractual or statutory obligations, including document retention duties under commercial and tax law, or to pursue legitimate interests, i.e. to preserve evidence related to the statute of limitations, they will be erased.
Cookies
Description and extent of data processing
We use cookies on our website. Cookies are small text files which your internet browser sets and stores on your computer by which certain information is collected by the party that set them. They serve to optimise our website and Offerings.
Most of them are "session cookies" which are deleted at the end of your visit. Sometimes, however, such cookies provide information to re-identify you automatically. This recognition is based on the IP address stored in the cookies; however, they are not able to directly identify a user.
Web analytics tools ("performance cookies") may also be used to analyse the online platform. By using cookies the online platform use data may be processed and in this way knowledge obtained about the use of our online platform (e.g. number of views, number of users).
Advertising cookies or targeting cookies serve to offer website users need-based advertising on the website or services from third parties and to measure the effectiveness of these services. Sharing cookies serve to improve the interactivity of our website with other services (e.g. social networks).
All use of cookies that is not technically necessary constitutes data processing that is only permitted with your explicit and active consent in accordance with Art. 6(1)(a) GDPR. This particularly applies to the use of advertising, targeting or sharing cookies. Furthermore, we only disclose your personal data that has been processed by cookies to third parties if you have given your explicit consent to this under Art. 6(1)(a) GDPR.
You can prevent cookies from being set by selecting the appropriate setting in your browser; however, please note that in this case you may not be able to use all the functions of our website to their full extent.
Purpose and legal basis of the data processing
Grant Thornton only uses technically necessary cookies. The legal basis for processing data processed when using cookies is Article 6(1)(f) GDPR. Grant Thornton has a legitimate interest in processing your personal data to provide a functioning, service-based and secure platform.
Storage duration
Transient cookies are automatically deleted when you close your browser. This particularly includes session cookies. These store a session ID, with which your browser’s various requests can be assigned to the same session. In this way, your computer can be recognised again when you return to our website. The session cookies are deleted when you log out or close the browser.
However, persistent cookies will be deleted automatically after a prescribed duration which may differ depending on the cookie. You can delete cookies at any time in your browser’s security settings.
Further information
We value the trust you place in us. We therefore intend to be available to you at all times to answer your questions about the processing of your personal data. If you have any questions that this Privacy Policy has not been able to answer or if you would like in-depth information on any point, please contact us at any time at the following email address: datenschutz@de.gt.com.
We reserve the right to amend this Privacy Policy from time to time upon further development of data protection legislation or technological or organisational changes and will notify you of all major changes that will have an effect on the use of your personal data. This data protection information is updated as of July 2025.