Privacy Notice
pursuant to Art. 13, 14 EU General Data Protection Regulation (GDPR)
Data Controller
The data controller within the meaning of Art. 4 No. 7 GDPR for the processing of your personal data is:
PricewaterhouseCoopers GmbH Wirtschaftsprüfungsgesellschaft
Friedrich-Ebert-Anlage 35-37
60327 Frankfurt am Main
Email: DE_Kontakt@pwc.com
Telephone: +49 69 9585-0
Fax: +49 69 9585-1000
Data Protection Officer
PwC WPG has appointed a data protection officer pursuant to Art. 37 GDPR. You can reach the data protection officer of PwC WPG, Dr. Tobias Gräber, at the following contact details:
Email: DE_Datenschutz@pwc.com
Telephone: +49 69 9585-0
Postal address:
PricewaterhouseCoopers GmbH WPG
Dr. Tobias Gräber, Data Protection Officer
Friedrich-Ebert-Anlage 35-37
60327 Frankfurt am Main
Your rights as a data subject
You have the following rights vis-à-vis PwC under the applicable data protection law with regard to the personal data concerning you:
Right of access
You can request information from PwC at any time as to whether and which personal data PwC has stored about you. The provision of information by PwC is of course free of charge for you. However, the right of access is not unrestricted. For example, the right of access does not exist or exists only to a limited extent if and insofar as the information would reveal information that requires confidentiality, e.g. information that is subject to professional secrecy.
Right to rectification
If your personal data stored by PwC is incorrect or incomplete, you have the right to request PwC to rectify this data at any time.
Right to erasure
You have the right to request PwC to erase your personal data if and insofar as the data is no longer required for the purposes for which it was collected, or if the processing is based on your consent and you have withdrawn your consent. In this case, PwC must cease processing your personal data and remove it from its IT systems and databases.
A right to erasure does not exist insofar as
- the data may not be deleted due to a legal obligation or must be processed due to a legal obligation;
- the data processing is necessary for the assertion, exercise or defence of legal claims.
Right to restriction of processing
You have the right to request PwC to restrict the processing of your personal data.
Right to data portability
You have the right to receive the data you have provided to PwC in a structured, commonly used and machine-readable format, as well as the right to have this data transferred to another controller. This right only exists if
- you have provided the data to PwC on the basis of consent or on the basis of a contract concluded with you, and
- the processing is carried out by automated means.
You can assert all of the above-described data subject rights vis-à-vis PwC by directing your specific request to the data protection officer at the contact details given above.
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR if you believe that the processing of your personal data by PwC violates data protection law.
If the processing of your data by PwC is based on Art. 6 para. 1 lit. f) GDPR (on the basis of a legitimate interest), you can object to the processing by PwC at any time.
Provision of data
Even though data is partially transmitted automatically when accessing the application, you are not legally or contractually obliged to provide data in connection with the use.
In connection with contacting us by email, you are also free to send us data via these channels; however, without contacting us accordingly we cannot process and answer any enquiries from you in this respect.
Description of the data processing and legal basis
Recipients of the data
In order to fulfil the processing purposes listed below, data is also transferred to third parties. This may also include the transfer of personal data to European and non-European countries and the storage of data outside the EU or the European Economic Area (EEA).
Recipients bound by instructions
We share your data with service providers bound by instructions, both within the PwC network and with other third parties, such as IT service providers, who support us in our activities, e.g. as part of the administration and maintenance of the application and the related systems and/or for other internal or administrative purposes.
PwC is a member of the global PwC network, which consists of the individual legally independent PwC firms. In the course of our activities, we use other German or foreign PwC network companies as network-internal IT service providers bound by instructions who provide services for the operation, maintenance and upkeep of the IT systems and applications used by the PwC network companies. This is in particular PwC IT Services Ltd. based in the United Kingdom (UK).
If we pass on data to service providers bound by instructions, we do not require a separate legal basis for this.
Further information on the cloud service providers used by PwC can be found at the following link: www.pwc.de/externe-dienstleister
Independent recipients
In addition, we share your data in individual cases both within the PwC network and with other third parties who use your data under their own responsibility. Other third parties are, for example, authorities, courts or other bodies, if we are required by law or by official or court order of an EU member state to disclose personal data to these bodies. These bodies also use the data under their own responsibility.
Insofar as you have explicitly consented, Art. 6 para. 1 lit. a) GDPR is the legal basis for the data transfer. If there is a legal obligation to disclose the data, the legal basis for the data transfer is Art. 6 para. 1 lit. c) GDPR. If the disclosure is necessary for the fulfilment of a contractual or pre-contractual measure with you as a natural person, Art. 6 para. 1 lit. b) GDPR is the legal basis. Otherwise, the transfer is based on our legitimate interests and the legal basis is Art. 6 para. 1 lit. f) GDPR; we and the other companies of the PwC network have an interest in designing our work processes efficiently and dividing business processes within the PwC network.
Data transfer to recipients in third countries outside the EU/EEA
Insofar as any of the above-mentioned data transfers are made to a recipient outside the European Economic Area, an appropriate level of data protection for the international transfer is ensured by means of suitable security measures.
For data transfers within the PwC network, the PwC network companies have, among other things, concluded an internal data protection agreement which provides for compliance with the EU standard contractual clauses of the EU Commission within the meaning of Art. 46 para. 2 lit. c) GDPR for the transfer of personal data from EU/EEA states to PwC network companies outside the EU/EEA.
If you have any questions about such data protection agreements based on the EU standard contractual clauses or if you would like more information about additional security mechanisms and measures for data transfers to third countries, please feel free to contact our data protection officer, e.g. at DE_Datenschutz@pwc.com.
Processing of personal data when accessing the application
When you access our application, we collect the data that is technically necessary to display it to you. This involves the following personal data which is automatically transmitted to our server by your browser:
- IP address
- Date and time of your request/call to the application
- Time zone difference from Greenwich Mean Time (GMT)
- Content of the request (which specific page you have visited)
- Access status/http status code
- Transferred data volume
- Website requesting the access
- Browser (type and version)
- Operating system and its interface
- Language and version of the browser software
The processing of this personal data is based on Art. 6 para. 1 lit. f) GDPR. The application cannot be accessed and offered to users without using such data; there is a legitimate interest in making the call-up and use technically possible. The aforementioned data will be stored for 7 days and then deleted.
Web analytics with Piwik PRO
To analyse and improve this application, we use the web analytics platform Piwik PRO. Piwik PRO helps us understand how the application is used in order to identify technical errors, improve usability and prioritise further development according to need.
Provided that you have given your consent via our consent banner, we process the following data for this purpose:
- Page views and page titles
- Referrer information
- Interaction and event data
- Browser type and browser version
- Operating system
- Screen resolution
- Session timestamp
- IP address (anonymised before storage)
- Pseudonymised user ID (SHA-256 hash of SSO identifier)
- Custom dimensions: grade, business unit, office location, platform (session-scoped)
- Click and interaction events on UI elements
To recognise sessions and visitors, Piwik PRO sets the cookies listed under “Analytics cookies” in the cookie table below. As part of the data evaluation, the collected data is aggregated (groups of fewer than 10 users cannot be segmented). Identification of individual persons is not intended.
The legal basis for storing information on your terminal device (cookies) and for the subsequent processing is your consent pursuant to Section 25 (1) TDDDG in conjunction with Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future by adjusting your cookie settings at [link to cookie settings]. Your withdrawal does not affect the lawfulness of the processing carried out until withdrawal. The data is deleted once there is no longer any reason for storing it.
Use of cookies
In order to make visiting our application attractive and to enable the use of certain functions, we and certain third parties use cookies. These are small text files that are stored on your terminal device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your terminal device and enable us or our partner companies to recognise your browser the next time you visit (so-called persistent cookies).
The following cookie categories are used:
Cookies strictly necessary for the operation of our application
These cookies are required for the operation and functionality of the application. They make it technically accessible, secure and usable and provide essential and basic functionalities, such as navigation, correct display in the browser or consent management.
Provider | Name | Purpose | Duration |
|---|---|---|---|
| Piwik PRO | ppms_privacy_36b5145a-f55a-4f20-8556-46cde3e54cc8 | Stores the visitor's consent decision regarding data collection and use. | 12 months |
| Microsoft Azure | ARRAffinity / ARRAffinitySameSite | Ensures that requests within a session are routed to the same application server (session affinity). | Session end |
| Softwarebescheinigung (NextAuth) | __Secure-authjs.session-token / NEXT_LOCALE | Authentication token for the user session or language preference. | Session end / 1 year |
Note: Add the technically necessary cookies actually set by your application here (e.g. load balancer, session, SSO/Entra ID).
Analytics cookies (only with your consent)
These cookies enable us to recognise you as a visitor to our application, to collect information on user behaviour and to analyse it statistically. They are set only after your prior consent.
Provider | Name | Purpose | Duration |
|---|---|---|---|
| Piwik PRO | _pk_id.36b5145a-f55a-4f20-8556-46cde3e54cc8 | Used to recognise visitors and record their various characteristics. | 13 months |
| Piwik PRO | _pk_ses.36b5145a-f55a-4f20-8556-46cde3e54cc8 | Indicates an active session of the visitor. | 30 minutes |
| Piwik PRO | stg_traffic_source_priority | Stores the type of traffic source that explains how the visitor arrived at the application. | 30 minutes |
| Piwik PRO | stg_last_interaction | Determines whether the last session is still running or a new session has started. | 365 days |
| Piwik PRO | stg_returning_visitor | Determines whether the visitor has been on the application before (returning visitor). | 365 days |
| Piwik PRO | stg_externalReferrer | Stores the URL of the web page that referred the visitor to the application. | End of session |
| Piwik PRO | _stg_optout | Only set when the user explicitly rejects data collection via the opt-out mechanism. Disables all tracking tags. | 365 days |
| Piwik PRO | ppms_webstorage | Local storage object holding information about created cookies (protects against data loss, e.g. Safari ITP). | Not removed automatically |
Note: The stg_* cookies are set by the Piwik PRO Tag Manager container as part of session management and visitor recognition once consent for analytics cookies has been granted.
Marketing cookies
This application does not use marketing cookies.
Legal basis and withdrawal
The legal basis for the use of technically necessary cookies is Section 25 (2) No. 2 TDDDG or Art. 6 para. 1 lit. f) GDPR to protect our legitimate interests. Our legitimate interests lie in particular in being able to provide you with a technically optimised, user-friendly application designed to meet your needs, and to ensure the security of our systems. Furthermore, we use cookies on the basis of your consent pursuant to Section 25 (1) TDDDG in conjunction with Art. 6 para. 1 lit. a) GDPR. Insofar as we use cookies on the basis of your consent, you can revoke your consent at any time with effect for the future, e.g. by adjusting your cookie settings here: [link to cookie settings]. Your revocation does not affect the lawfulness of the processing carried out until revocation.
Disabling the cookie settings
Most browsers are pre-set to accept cookies automatically. You can object to the creation of cookies by disabling cookies in your browser's system settings. Please note, however, that some cookies are technically necessary for the functionality of our application. We will only use cookies that are not technically necessary if you have provided your prior express consent. In addition, you can control the installation of cookies yourself at any time by changing your browser settings and/or deleting all cookies.
Date: July 15, 2026