Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is:

2. Data protection officer

We are not required to appoint a data protection officer (Article 37 GDPR, § 38 BDSG). For all data protection matters, please contact us using the details above.

3. Overview

We designed this website to collect as little personal data as possible:

• no cookies and no local storage of any kind;
• no analytics, advertising or tracking tools;
• no social media plugins, embedded maps or videos;
• no fonts, scripts or other resources loaded from third-party servers;
• no contact form — you decide whether to contact us by email or phone.

Personal data is therefore processed only in the cases described below.

4. Hosting & server log files

This website is hosted by:

When you visit the website, your browser automatically transmits information that the server records in log files:

• IP address of the requesting device;
• date and time of the request;
• requested page or file and the HTTP status code;
• referrer URL (the page from which you came), if transmitted;
• browser type and version and operating system (user agent).

Purpose: delivering the website, ensuring its stability and security, and detecting and defending against attacks.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and technically error-free provision of the website.

Retention: log files are deleted after 7 days, unless a specific security incident requires longer retention for the purpose of investigation; in that case, the data is deleted once the incident has been resolved.

We have concluded a data processing agreement with the hosting provider pursuant to Article 28 GDPR.

5. Cookies & tracking

This website does not set cookies and does not access information stored on your device beyond what is technically necessary to display the page. Consent under Article 5(3) of Directive 2002/58/EC (ePrivacy Directive) and § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) is therefore not required (§ 25(2) no. 2 TDDDG), and no cookie banner is shown.

6. Contacting us by email or phone

If you contact us, we process the data you provide — typically your name, contact details, the content of your message and, where relevant, information about other parties to the matter.

Purpose: responding to your enquiry, checking for conflicts of interest and, where applicable, preparing an engagement.

Legal basis: Article 6(1)(b) GDPR where your enquiry relates to the conclusion of a contract; otherwise Article 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries. The conflict check is also required by the professional rules that apply to us (Article 6(1)(c) GDPR).

Retention: if no engagement results, we delete your enquiry once it has been fully dealt with, at the latest after six months, unless statutory retention obligations apply. Data needed to document the conflict check may be retained for as long as professional rules require.

Third-party data: if you tell us about other persons (for example, the opposing party), we process their data on the same legal bases to check for conflicts and to handle your enquiry (Article 14 GDPR). Their right to information may be restricted where professional secrecy applies.

Email confidentiality: regular email is not end-to-end encrypted and may be read or altered in transit. Please do not send confidential information by email before we have agreed a secure channel with you.

7. Clients & engagements

If you instruct us, we process the data required to perform the engagement on the basis of Article 6(1)(b) GDPR and to comply with our legal obligations — in particular professional, tax and anti-money-laundering rules — on the basis of Article 6(1)(c) GDPR. Special categories of data are processed only where this is necessary to establish, exercise or defend legal claims (Article 9(2)(f) GDPR). Client files are retained for the periods prescribed by the applicable professional and tax law and are deleted thereafter. Clients receive further information when the engagement begins.

8. Recipients & international transfers

We disclose personal data to third parties only where this is necessary to perform an engagement (for example, to courts, authorities or opposing counsel), where we are legally obliged to do so, or where you have consented. Technical service providers — our hosting provider and email provider — act as processors bound by our instructions under Article 28 GDPR.

Email provider: Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands (EU data centres)

We do not intend to transfer personal data to countries outside the European Economic Area. Where a service provider exceptionally accesses data from outside the EEA (for example, for technical support), this takes place only on the basis of the EU Standard Contractual Clauses (Article 46(2)(c) GDPR).

9. Your rights

Subject to the statutory requirements, you have the right to:

• obtain access to your personal data (Article 15 GDPR);
• have inaccurate data rectified (Article 16 GDPR);
• have your data erased (Article 17 GDPR);
• restrict processing (Article 18 GDPR);
• receive your data in a portable format (Article 20 GDPR);
• withdraw any consent you have given, with effect for the future (Article 7(3) GDPR).

Right to object (Article 21 GDPR): where we process your data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

These rights may be limited where the data is subject to professional secrecy obligations under applicable law. To exercise your rights, contact us using the details in section 1.

Right to lodge a complaint (Article 77 GDPR): you may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority competent for us is:

You are not obliged to provide personal data. Without it, however, we cannot respond to your enquiry. We do not use automated decision-making or profiling within the meaning of Article 22 GDPR.

10. Security

This website is delivered exclusively over an encrypted connection (HTTPS/TLS). We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access (Article 32 GDPR).

11. Changes to this policy

We may update this Privacy Policy when our processing or the legal requirements change. The version published on this page applies.

Last updated: 13 September 2026