Privacy policy

§ 1 Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR; German: DSGVO) is:

Deutsch Rechtsanwaltsgesellschaft mbH – hereinafter also “DEUTSCH.LEGAL”
Rittnertstr. 40 A, 76227 Karlsruhe, Germany
Telephone: +49-(0)721-27663355
Email: office@deutsch.legal
Website: www.deutsch.legal
Register court: Amtsgericht Mannheim (Mannheim Local Court); register number: HRB 755946
Legally represented by: Séverine Deutsch, managing director, Dr. Oliver Melber, managing director

This privacy policy provides information about the processing of personal data when you use our website, when you contact us and in connection with initiating an engagement or communicating about an engagement. It does not apply to external websites to which we merely link. “We” (or “us”) above and below refers to Deutsch Rechtsanwaltsgesellschaft mbH, which operates in legal dealings under the firm name DEUTSCH.LEGAL.

§ 2 Principles, legal bases and categories

We process personal data only insofar as this is necessary and there is a legal basis for it. Depending on the processing, we rely in particular on Art. 6(1)(a) GDPR (consent), (b) (contract or pre-contractual measures), (c) (legal obligation) or (f) GDPR (legitimate interests). Insofar as special categories of personal data are concerned, processing only takes place if an additional condition under Art. 9 GDPR is met.

Depending on the occasion, the categories processed may include in particular master and contact data, communication and content data, contract and engagement data, usage and connection data and technical log data. We observe the professional and confidentiality obligations that apply to us as lawyers. Please do not transmit particularly confidential content carelessly via unsecured communication channels.

§ 3 Provision of the website, hosting and server log files

For the technical provision of our website, we use the following processor on the basis of a data processing agreement pursuant to Art. 28 GDPR:

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (hosting and delivery via the “Cloudflare Pages” service and Cloudflare's content delivery network).

For this purpose, Cloudflare operates a worldwide server network. Processing of your data outside the European Union or the European Economic Area, in particular in the USA, can therefore not be ruled out (see § 10).

Each time the website is accessed, Cloudflare may process – only insofar as actually processed – in particular the IP address, the date and time of access, the page or file accessed, the referrer URL, information on the browser and operating system and HTTP status codes in server log files.

The processing serves the technical delivery of the website, ensuring stability and IT security, error analysis and the detection and prevention of attacks and misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, functional and economical operation of our website.

The server log files are processed by Cloudflare and stored only for as long as is necessary for the purposes stated. Details can be found in Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.

§ 4 Technically necessary cookies and similar technologies

Only technically necessary cookies or similar technologies are intended for the website described here. They are used only insofar as they are strictly necessary for the transmission of a message over a public telecommunications network or for the provision of a digital service that you have expressly requested.

The storage of information in your terminal equipment or access to information already stored there is governed by Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act). Insofar as an exception under Section 25(2) TDDDG applies, no consent is required for this. Insofar as personal data are processed in the course of a technically necessary use, this is generally based on Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and technically proper provision of the website.

Analytics, marketing and social media technologies are not used on this website.

§ 5 Technologies requiring consent

Technologies requiring consent within the meaning of this privacy policy are functions of a website that store information on the visitor's device or read information already stored there without being strictly necessary for the service expressly requested. Consent must in principle be given before the storing or reading takes place. It must be given freely, on an informed basis, unambiguously and for a specific purpose.

Insofar as the storage of information in your terminal equipment or access to it is not exceptionally permitted under Section 25(2) TDDDG, we obtain your clear and fully informed consent in advance pursuant to Section 25(1) TDDDG. Insofar as personal data are processed in this context, a legal basis under Art. 6 GDPR is additionally required, generally your consent under Art. 6(1)(a) GDPR. On this website, this concerns only the embedding of Google Maps; the purpose, provider and how to withdraw consent are described below.

Plugins and tools

Google Fonts (local hosting)

To display fonts consistently, this site uses so-called Google Fonts, which are provided by Google. The font files are stored locally and delivered together with this website (see § 3). No connection to Google's servers takes place.

Further information on Google Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy:

https://policies.google.com/privacy?hl=en.

Google Maps

This site uses the Google Maps map service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. With the help of this service, we can embed map material on our website.

The map is not loaded automatically. Only when you click the “Load map” button is a connection to Google's servers established. In the process, your IP address in particular is processed. A transfer of personal data to companies of the Google group in the USA cannot be ruled out. The provider of this site has no influence on the further data processing by Google.

By clicking “Load map”, you consent to this processing. The processing is based on Art. 6(1)(a) GDPR and, insofar as information is stored on or read from your device, on Section 25(1) TDDDG. Your choice is not stored; each time the page is opened again, the map is only loaded after another click. You can withdraw your consent at any time with effect for the future; to do so, it is sufficient to reload or leave the page.

Google LLC is certified under the “EU-US Data Privacy Framework” (DPF). The transfer to the USA is based on the European Commission's adequacy decision for the DPF. Further information is available at:
https://www.dataprivacyframework.gov/participant/5780

More information on how Google handles user data can be found in Google's privacy policy:
https://policies.google.com/privacy?hl=en

§ 6 Contacting us by email and telephone

If you contact us by email, telephone, post or in any other way, we process the data you provide, in particular your name, contact details, the content of your communication and the reason for your enquiry. The processing serves to handle your enquiry, to initiate or carry out an engagement, to fulfil legal obligations and to communicate appropriately. Depending on the individual case, the legal bases are Art. 6(1)(b), (c) or (f) GDPR. Our legitimate interest under Art. 6(1)(f) GDPR lies in the efficient handling of legitimate concerns and the documentation of communication.

For technical reasons, emails may be transmitted unencrypted. Unencrypted email should not be used for particularly confidential content or information requiring special protection.

§ 7 Initiating an engagement and communication about engagements

When initiating an engagement or in the course of an engagement, we process the necessary personal data to examine, establish, carry out and terminate the client relationship, to communicate and to fulfil statutory and professional obligations. The legal basis is generally Art. 6(1)(b) GDPR; where necessary, Art. 6(1)(c) GDPR or Art. 6(1)(f) GDPR also apply.

The specific categories of data depend on the subject matter and course of the respective engagement. Insofar as special categories of personal data are processed, this only takes place if the necessary conditions are met. Confidential content is handled in compliance with the confidentiality obligations of lawyers.

§ 8 Online meetings with Microsoft Teams

We use Microsoft Teams as a video conferencing and communication service for preparing, holding and following up meetings, for initiating engagements and communicating about engagements and, where necessary, for collaboration (hereinafter: “online meetings”). Microsoft Teams is a service of Microsoft Corporation, 1 Microsoft Way, Redmond, WA 98052, which has its registered office in the USA. Its representative and data protection officer for the European Economic Area is Microsoft Ireland Operations Limited (One Microsoft Place South County Business Park Leopardstown Dublin 18, D18 P521, Ireland). Further information on data protection and data security when using Microsoft Teams can be found at:

https://privacy.microsoft.com/en-gb/privacystatement#mainenterpriseservicesmodule

Depending on use and configuration, in particular master and contact data, meeting metadata (e.g. date, participants, dial-in and connection data), image and sound data when the camera or microphone is activated, chat, file and screen-sharing content and, where applicable, technical usage and diagnostic data may be processed. The specific processing depends on the functions activated and the participants' settings.

Where there is a pre-contractual, contractual or engagement-related reason, the processing is based on Art. 6(1)(b) GDPR. Insofar as the organisation, technical provision or security of meetings is concerned, Art. 6(1)(f) GDPR may apply. Our legitimate interest lies in conducting professional communication securely, efficiently and independently of location. Consent under Art. 6(1)(a) GDPR is obtained where required in the individual case, in particular for recordings.

Meetings are generally not recorded. A recording or transcription only takes place after prior clear information and only on a sound legal basis. Where consent is the legal basis, it can be withdrawn at any time with effect for the future.

Insofar as Microsoft Teams processes personal data on our behalf, this is done on the basis of the relevant Microsoft contract documents and a data processing arrangement pursuant to Art. 28 GDPR. Current sub-processors and processing locations are determined by the relevant documentation and contractual agreements.

§ 9 Recipients, processors and confidentiality

Where necessary, recipients of personal data may be the competent internal departments and carefully selected service providers. These include in particular hosting and IT service providers such as Cloudflare (see § 3), providers of communication and collaboration services such as Microsoft Teams, where applicable law firm or file management systems, and authorities, courts, banks, insurers, tax advisers or other bodies if there is a legal obligation or this is necessary to handle an engagement or an enquiry or to protect our rights.

Service providers who process data on our behalf and in accordance with our instructions are generally engaged as processors pursuant to Art. 28 GDPR. Recipients only receive data insofar as this is legally permissible and necessary for the respective purpose. The confidentiality obligations of lawyers remain unaffected.

§ 10 Transfers to third countries

Personal data are only transferred to countries outside the European Union or the European Economic Area if the conditions of Chapter V GDPR are met. In the case of Microsoft Teams, a transfer to a third country or the possibility of access from a third country may arise depending on the specific configuration, contract documents, sub-processors and processing locations.

With hosting by Cloudflare (see § 3), processing may take place in the USA. Cloudflare, Inc. is certified under the “EU-US Data Privacy Framework” (DPF) (https://www.dataprivacyframework.gov/participant/5666); insofar as a transfer is not covered by the DPF, the European Commission's standard contractual clauses agreed in Cloudflare's data processing agreement apply. For the transfer to Google when the map is loaded, see § 5 “Google Maps”.

You can request information about the relevant safeguards, or a copy of them, from us using the contact details given in § 1, unless statutory or contractual confidentiality interests prevent this.

§ 11 Storage period

We delete or anonymise personal data as soon as they are no longer required for the respective purposes and no statutory, contractual, tax, professional or other retention obligations prevent this. Longer storage may also be necessary insofar as data are needed to establish, exercise or defend legal claims.

The relevant professional and tax retention obligations apply to engagement data.

§ 12 Rights of data subjects

Subject to the statutory requirements, you have in particular the following rights:

• access to the data processed about you pursuant to Art. 15 GDPR;
• rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR;
• erasure of your data pursuant to Art. 17 GDPR;
• restriction of processing pursuant to Art. 18 GDPR;
• data portability pursuant to Art. 20 GDPR, insofar as its conditions are met;
• objection to processing based on Art. 6(1)(e) or (f) GDPR pursuant to Art. 21 GDPR; in the case of direct marketing, there is a right to object at any time, insofar as direct marketing takes place;
• withdrawal of consent given, with effect for the future, pursuant to Art. 7(3) GDPR.

To exercise your rights, you can use the contact details given in § 1.

§ 13 Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

§ 14 Obligation to provide data, automated decisions

The provision of personal data is generally neither required by law nor by contract for merely visiting this website. However, the website cannot be provided without technically necessary data, in particular the processing of the IP address. If you wish to contact us or initiate or carry out an engagement, certain information may be required to handle your enquiry or to provide the service requested. We will inform you separately, where applicable, of the consequences of not providing data in the individual case.

No decision based solely on automated processing, including profiling within the meaning of Art. 22 GDPR, takes place.

§ 15 Currency of this privacy policy

We update this privacy policy when changes to our data processing, legal developments or other reasons make this necessary. The version published on this website at the time applies.