I. Data protection at a glance

At Weissenberg Rechtsanwälte PartmbB ("WSB"), we are committed to protecting your personal data.

This Privacy Notice sets out how your personal data es processed by WSB when

you visit our website,
we process your data in connection with working on a client matter or within the framework of a business relationship independet of a client matter,
you participate via Microsoft Teams, an application by Microsoft Deutschland GmbH (Walter-Gropius-Straße 5, 80807 München, Germany – "Microsoft") in an audio- or video conference, a chat and/or a desktop sharing session with us, or
you have given us your consent to send you information on current legal developments and events.

Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to the following privacy notice.

Data processing is based on the Federal Data Protection Act ("BDSG") of 30 June 2017, as amended, and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; "GDPR").

II. General information and mandatory information

1. Data protection

The operator of this website takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy notice.
When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy notice explains what data we collect and what we use it for. It also explains how and for what purpose this is done.
We would like to point out that data transmission over the Internet (e.g. when communicating by e-mail) may be prone to security gaps. It is not possible to completely protect data against third-party access.

2. Information about the responsible body

The responsible body (according to the GDPR: "controller") for data processing within the meaning of Art. 4 No. 7 GDPR is:

Weissenberg Rechtsanwälte PartmbB
Stafflenbergstraße 24
70184 Stuttgart
T: +49 711 8826 4150
info@weissenberg-partner.de

The responsible body is WSB as a legal entity that decides alone or jointly with others on the purposes and means of processing personal data (e.g. names, email addresses).

3. Storage period

Unless a more specific storage period is specified in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. The personal data collected by us for the purpose of mandating will be stored until the expiry of the statutory retention period for lawyers (6 years after the end of the calendar year in which the mandate ended, Section 50 (1) sentence 2 of the Federal Lawyers' Act) and then deleted, unless we are obliged to store it for a longer period in accordance with Art. 6 (1) (c) GDPR due to tax and commercial law storage and documentation obligations (from the German Commercial Code, Criminal Code or Fiscal Code) or you have consented to further storage in accordance with Art. 6 (1) (a) GDPR. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the personal data will be deleted when these other legal reasons no longer apply. Data of users is regularly stored for a period of 30 days. Cookies remain stored for the periods specified below (Section IV.2). You can also delete the cookies yourself earlier as described there. We store data for the transmission of current information about legal developments and events until you revoke your consent.

4. Disclosure of data to third parties

Where necessary, WSB works with companies and other bodies that have particular expertise in specific areas, e.g. tax advisors, other lawyers, consulting firms, translation agencies and logistics service providers. These bodies are either subject to professional confidentiality obligations or have been bound to confidentiality by WSB. If it is necessary to pass on personal data to these bodies, the legal basis for this is Art. 6 (1) (b) or (f) GDPR, depending on the content of the respective cooperation. Otherwise, we will only pass on your personal data to third parties without your express consent if WSB is obliged to do so by law or by official/court order.

III. General information on the legal basis for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, if special categories of data are processed in accordance with Art. 9(1) GDPR. In the event of explicit consent to the transfer of personal data to third countries, your personal data will also be processed on the basis of Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your end device (e.g. via device fingerprinting), data processing will also be carried out on the basis of Section 25(1) of the Act on Data Protection and Privacy in Telecommunications and Digital Services of 23 June 2021 (Telecommunications Digital Services Data Protection Act; "TDDDG"). Consent can be revoked at any time. If your data is necessary for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 (1) lit. b GDPR. Furthermore, we process your data if it is necessary to fulfil a legal obligation on the basis of Art. 6 (1) lit. c GDPR.

Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

The relevant legal basis in each individual case is explained in the following paragraphs of this privacy notice.

1. Recipients of personal data

As part of our business activities, we work with various external parties. This sometimes requires the transfer of personal data to these external parties.

We only pass on personal data to external parties if this is necessary for the fulfilment of a contract, if we are legally obliged to do so (e.g. passing on data to tax authorities), if we have a legitimate interest in passing on the data in accordance with Art. 6 (1) lit. f GDPR, or if another legal basis permits the transfer of data. When using processors, we only pass on our customers' personal data on the basis of a valid contract for data processing.

In the case of joint processing, a joint processing agreement shall be concluded.

2. Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may revoke any consent you have already given at any time. The legality of the data processing carried out until revocation remains unaffected by the revocation.

3. Right to object

Insofar as the processing of your personal data is based on a balancing of interests within the meaning of Art. 6(1)(f) GDPR, you have the right to object to this processing under the conditions described in Art. 21 GDPR.

4. Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged violation. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.

5. Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. We will only transfer data to another controller at your express request and only to the extent that this is technically feasible.

6. Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right at any time to obtain information free of charge about the categories of personal data stored about you, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to correction, deletion, restriction of processing or objection, the existence of a right of appeal, the origin of your data if it was not collected by us, and the existence of automated decision-making, including profiling and, if applicable, meaningful information about its details. You can contact us at any time with any questions you may have on this subject or on the subject of personal data.

In accordance with Article 16 of the GDPR, you have the right to request that we immediately correct and, taking into account the purposes of the processing, complete any personal data concerning you.

Under the conditions of Art. 17(1) GDPR and subject to the restrictions of Art. 17(3) GDPR, you have the right to request the erasure of your personal data stored by us.

7. Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time to do so. The right to restriction of processing applies in the following cases:

If you dispute the accuracy of your personal data stored by us, we will usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data was/is unlawful, you may request the restriction of data processing instead of erasure.
If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of its deletion.
If you have lodged an objection pursuant to Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, this data may – apart from its storage – only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

8. Exercising data subject rights

The easiest way to exercise your rights as a data subject is to contact info@weissenberg-partner.de.

IV. Data collection on this website and via other communication channels

1. Automatically collected data

When you visit our website, our systems automatically collect and store various data about the accessing system. This includes the browser type and version used, the operating system used, the website from which the WSB website is accessed, the subpages of the WSB website visited, the date and time of access, the Internet Protocol (IP) address, the Internet service provider and other data comparable to this.

We use the collected data to ensure error-free provision of the website, to identify and rectify any technical problems that may arise, and to prevent and, if necessary, prosecute misuse of WSB's services. We also use collected data in anonymised form, i.e. without the possibility of identifying the user, for statistical purposes and to improve our website.

We do not intend to use personal data for automated decision-making (including profiling).

2. Cookies

Our website uses cookies and similar technologies ("cookies"). Cookies are small data packets that exchange certain settings and data with the WSB system via the browser. Cookies do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your device. Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until they are automatically deleted by your web browser. You can also delete such cookies yourself via your web browser.

Cookies may originate from us (first-party cookies) or from third-party companies (third-party cookies). Third-party cookies enable the integration of certain services from third-party companies within websites (e.g. cookies for navigation via map service providers to help you find us more easily (for more details, see section VI).

Cookies have various functions. Numerous cookies are technically necessary, as certain website functions would not work without them. Other cookies may be used by WSB to evaluate user behaviour. The information stored in the cookies is not used to identify the user and is not merged with other personal data stored about the user.

Cookies that are necessary for optimising the website (e.g. for measuring the web audience) (necessary cookies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified.

The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimised provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, data will be processed exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG); consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If you deactivate cookies, the functionality of this website may be restricted.

3. Enquiry by e-mail, telephone or fax

If you contact us by e-mail, telephone or fax, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us in order to process your request. We will not pass on this data without your consent.

We process this data on the basis of Art. 6 (1) (b) GDPR, provided that your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively processing enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), if this has been requested; consent can be revoked at any time.

The data you send us via contact requests will remain with us until you request us to delete it, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g. after your request has been processed).

Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

4. Consent to the transmission of current information on legal developments

If you give us your consent to send you relevant, up-to-date information about legal developments and our services at irregular intervals, we will collect your first and last name, your title (if applicable), your email address and, if applicable, your position in the company.

This data will be used exclusively for sending information and will not be passed on to third parties. The legal basis for processing the data is Art. 6(1)(a) GDPR. The user has the right to withdraw their consent at any time without this rendering the data processing operations already carried out on the basis of the consent prior to receipt of the withdrawal retroactively unlawful.

In this case, the user will no longer receive the information.

5. Data processing when handling mandates

WSB processes personal data to the extent necessary to establish client relationships or handle mandates.

5.1. Data subjects

When handling mandates, WSB processes personal data from

Clients and their employees and board members (e.g. management board members, managing directors),
Third parties whose personal data is required to establish a client relationship or to process a mandate; this includes, among others, direct and indirect shareholders of the client, business and contractual partners and advisors of the client, (potential) opponents in a legal dispute and their legal advisors, as well as the employees and board members of the aforementioned persons and entities.
Employees of public authorities and courts, and
Witnesses and experts.

5.2. Data collected and processed

To the extent necessary to establish a client relationship or process a mandate, WSB collects and processes the following personal data:

Contact information, in particular first and last name, salutation and title if applicable, address, telephone number, email address,
Information on professional activity,
Information on income and financial circumstances, and
Other personal data that is necessary in the context of handling the mandate for the determination and legal assessment of the facts and the appropriate legal advice and representation of the client.

In individual cases, the processed data may also include special categories of personal data within the meaning of Article 9 GDPR (e.g. health data) and data relating to criminal convictions and offences within the meaning of Article 10 GDPR, in accordance with the provisions specified therein.

Insofar as WSB does not obtain personal data directly from the data subjects (e.g. in the course of correspondence with contact persons at clients and/or opposing parties), the data originates from

Clients,
Courts and authorities (e.g. in the context of file inspections and/or information requests),
other third parties (e.g. parties to proceedings, witnesses, etc.), or
publicly accessible sources (public registers, internet searches).

5.3. Purposes of data processing

WSB processes data, where necessary, to establish a client relationship or to handle a mandate, for the following purposes:

Review of potential conflicts of interest prior to accepting a client,
Compliance with legal requirements (e.g. under the Money Laundering Act) for identifying the client and the beneficial owner associated with the client. The legal basis for this processing is Art. 6(1)(c) GDPR.
Correspondence with clients, authorities, courts and other parties involved,
Advising and representing clients,
Determination and legal assessment of the facts,
Settlement of fees and charges, and
Settlement and assertion of other claims arising from the client relationship.

The legal basis for data collection and processing in these areas is as follows:

insofar as the client's personal data is processed, Art. 6(1)(b) GDPR,
insofar as special categories of personal data are concerned, Article 9(2)(f) GDPR and
furthermore, Art. 6(1)(f) GDPR.

5.4. Transmission of data

Where necessary to establish a client relationship or process a mandate, WSB transfers personal data to the following recipients:

Clients and companies associated with clients,
authorities and courts,
Other third parties. These include, among others, direct and indirect shareholders of the client, business and contractual partners, other advisors to the client, (potential) opponents in a legal dispute and their legal advisors.

In individual cases, it is necessary to transfer data to recipients in third countries outside the European Union or the European Economic Area for which the European Commission has not formally determined the existence of an adequate level of data protection in accordance with Art. 46 GDPR. In such cases, we only transfer personal data if this is necessary for the establishment, exercise or defence of legal claims (Article 49(1)(e) GDPR) or if there is another reason for the transfer in accordance with Article 49(1) GDPR.

6. Data processing within the scope of other business relationships

WSB processes personal data of business partners and their employees to the extent necessary within the scope of other business relationships. This applies, where necessary, to establishing or conducting the business relationship:

Contact information, in particular first and last name, title (if applicable), address, telephone number, email address,
Information on professional activity and
Bank data.

We receive personal data either from the data subjects themselves or from our business partners. Insofar as we process personal data from business partners, we do so on the basis of Article 6(1)(b) GDPR and, in all other cases, on the basis of Article 6(1)(f) GDPR.

7. Data processing in connection with communication or collaboration via Microsoft Teams

When you communicate with us via Microsoft Teams, e.g. by participating in a Teams conference, we process the personal data required for this purpose from the persons who communicate or collaborate with us via Microsoft Teams and other persons who are the subject of such communication or collaboration.

This applies to the following data, where necessary in individual cases:

Information that you have made part of your own account with Microsoft Teams,
Technical data required to provide a Microsoft Teams function, in particular IP address, time and duration of use, log and other usage data,
Audio and/or video data from participants in audio or video conferences,
Contact information, in particular first and last name, title (if applicable), address, telephone number, email address,
Details of business or professional activities and
Other information related to communication or cooperation.

The purpose of data processing depends on the content of the communication: the fulfilment of contracts or pre-contractual obligations in accordance with Art. 6(1)(b) GDPR, or otherwise the legitimate interest of you and WSB in being able to communicate via Microsoft Teams in accordance with Art. 6(1)(f) GDPR.

We transfer the above-mentioned data to Microsoft for the technical provision of Microsoft Teams functions. Microsoft is obliged to maintain strict confidentiality and only processes data on behalf of and in accordance with the instructions of WSB. The above-mentioned data may also be transferred to countries outside the EU/EEA, in particular to the USA. To ensure that data protection is adequately guaranteed there as well, we have concluded the standard contractual clauses approved by the European Commission with Microsoft. With the adequacy decision of the EU Commission on the EU-U. S. Data Privacy Framework (DPF), the European Commission has decided that the USA now also guarantees an adequate level of protection for personal data transferred from the EU to companies in the USA, provided that these companies are certified under the DPF and listed in the DPF list (https://www. dataprivacyframework.gov/s/participant-search). Data transfers from the EU to the US can now take place to certified organisations without the need for additional transfer instruments under Art. 46 GDPR or additional measures. Microsoft Corporation is included in this list.

Audio and video data generated during an audio or video conference or a screen sharing session will only be processed for the duration of the conference or session and deleted immediately afterwards. Recordings that are stored beyond this period will not be created without your separate, explicit consent.

V. Hosting

We host the content of our website with the following provider:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Germany

1. External hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the host/hosts. This may include IP addresses, meta and communication data, website accesses and other data generated via a website.

External hosting is carried out for the purpose of fulfilling our contractual obligations towards our potential and existing clients (Art. 6(1)(b) GDPR) and in the interests of providing our online services securely, quickly and efficiently through a professional provider (Art. 6(1)(f) GDPR).

If consent has been requested, processing will be carried out exclusively on the basis of Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG, insofar as consent includes the storage of cookies or access to information on the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Our host(s) will only process your data to the extent necessary to fulfil their service obligations and will follow our instructions regarding this data.
We use the following host(s):

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Germany

2. Order processing

We have concluded a contract with the host for order processing (AVV) for the use of the above-mentioned service. This is a contract required by data protection law, which ensures that the host processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

VI. Plugins und Tools

OpenStreetMap

We use the map service provided by OpenStreetMap (OSM). We integrate the map material from OpenStreetMap on the server of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The United Kingdom is considered a third country with adequate data protection. This means that the United Kingdom has a level of data protection that is equivalent to that in the European Union.

When using OpenStreetMap maps, a connection is established to the servers of the OpenStreetMap Foundation.

This may involve your IP address and other information about your behaviour on this website being forwarded to OSM. OpenStreetMap may store cookies in your browser or use similar recognition technologies for this purpose.

We use OpenStreetMap in the interest of an appealing presentation of our online offerings and to make it easy to find the locations we have indicated on the website. This is a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information on the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.