Preliminary remark

We, RPS Stahmer Rechtsanwälte PartG mbB (hereinafter also referred to as "we" or "us") appreciate your interest in our law firm specializing in employment law. With this privacy policy, we would like to inform you about how we process your personal data in accordance with the General Data Protection Regulation ("GDPR").

Our data protection information consists of several parts that build on each other: The general information for all processing of personal data and processing situations (1.) is followed by special information, each of which relates only to the processing situation specified there (2. ff.). To find the parts relevant to you, please refer to the following structure:

1. General information
2. Additional information for the website
3. Additional information for communication with us
4. Additional information for clients
5. Additional information for opposing parties
6. Supplementary information for other contractual partners
7. Additional information for applicants

1. General information

a) Controller under data protection law

The controller within the meaning of the GDPR and other data protection regulations is

RPS Stahmer Rechtsanwälte PartG mbB
Partners Rolf und Philipp Stahmer, Dr. Peter Deeg
Büschstraße 12
20354 Hamburg
Germany

Fon +49 40 323324-0
Fax +49 40 323324-11
E-Mail: kanzlei@rps-stahmer.de
Internet: https://www.rps-stahmer.de/
Further information can be found in our Imprint

Our primary contact person is Dr. Peter Deeg, attorney at law.

b) Legal basis for the processing of personal data

We process some of your personal data on the basis of the following legal bases:

(1) Consent of the data subject
Insofar as we obtain the consent of the data subject for certain purposes, Art. 6 para. 1 sentence 1 lit. a GDPR is the legal basis.

(2) Fulfillment of contractual obligations
Insofar as the processing is necessary for the performance of a contract to which you are a party, Art. 6 para. 1 sentence 1 lit. b GDPR is the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

(3) Legal requirements and obligations
Insofar as the processing is necessary to fulfill a legal obligation to which we are subject, Art. 6 para. 1 sentence 1 lit. c GDPR is the legal basis.

(4) Safeguarding legitimate interests
Insofar as the processing is necessary to safeguard our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not outweigh the former interest, Art. 6 para. 1 sentence 1 lit. f GDPR is the legal basis.

c) Storage period and deletion of personal data

The personal data will be deleted or blocked as soon as there is no longer a legal basis for the processing.

d) Recipients of personal data

Internally, only those departments process personal data that need it to fulfill their processing purposes. This also applies to the processors, service providers and vicarious agents we use. All departments and persons who work with personal data are obliged to maintain data secrecy and are made aware of the sensitive handling of such data.

Personal data will only be passed on to third parties if this is in accordance with data protection regulations. In particular, persons employed to carry out our business operations (e.g. banks, tax consultants, service providers for EDP and IT services) as well as government agencies/authorities may receive your personal data if this is necessary to fulfill a legal obligation.

e) Data processing in third countries

If we work with documents in Adobe format (in particular so-called "pdf files") in our activities, personal data may be processed in countries outside the EU/EEA ("third countries") by Adobe Systems Software Ireland Limited. Adobe's Privacy Center (https://www.adobe.com/de/privacy.html?promoid=JM4FW6J2&mv=other) states that Adobe and its group companies rely on standard contractual clauses, the European Commission's adequacy decisions for certain countries and/or the consent of individual users for the transfer of personal information from the European Economic Area (EEA), the UK or Switzerland to non-EEA countries. For further information, please refer to https://www.adobe.com/de/privacy/eudatatransfers.html.

f) Rights of data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us as the controller:

(1) Right to information

In accordance with Art. 15 GDPR, you have the right to request information about the personal data processed by us. In particular, you can

• Information about the purposes of processing,
• the category of the data,
• the categories of recipients to whom your data has been or will be disclosed and information as to whether the personal data will be transferred to a third country or to an international organization (in this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR),
• the planned storage period,
• the existence of a right to rectification, erasure, restriction of processing or objection,
• the existence of a right to lodge a complaint, the origin of your data if it was not collected by us,
• and the existence of automated decision-making including profiling in accordance with Art. 22 (1) and (4) GDPR and - at least in these cases - meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.

(2) Right to rectification

In accordance with Art. 16 GDPR, you have the right to rectification and/or completion of your personal data if it is incorrect or incomplete. We must make the correction without delay.

(3) Right to restriction of processing

In accordance with Art. 18 GDPR, you have the right to demand the restriction of the processing of your data if the accuracy of the data is disputed by you or the processing is unlawful.

If the restriction of processing has been restricted, you will be informed by us before the restriction is lifted.

(4) Right to erasure

In accordance with Art. 17 GDPR, you have the right to erasure of your personal data, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims.

(5) Right to information

If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data have been disclosed of the rectification, erasure of the personal data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

(6) Right to data portability

In accordance with Art. 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller.

(7) Right of objection

In accordance with Art. 21 GDPR, you have the right to object to the processing if the processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. e or lit. f GDPR.

(8) Right to revoke the declaration of consent under data protection law

In accordance with Art. 7 (3) GDPR, you have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

(9) Right to lodge a complaint with a supervisory authority

In accordance with Art. 77 GDPR, you have the right to complain to a data protection supervisory authority about our processing of your personal data.

2. Additional information for the website

We are responsible for our website www.rps-stahmer.de and its subpages ("website"). Personal data is processed through the use of our website. Below we provide detailed information about the data processing that takes place.

a) Provision of the website and creation of log files

When our website is accessed, we automatically collect data and information from the user's end device (so-called log files).

Processor

To provide our website, we use a processor with whom we have concluded an order processing contract and who processes the personal data exclusively on our behalf.

Processed information & duration of processing

The following information is processed:

- Information about the browser type and version used
- The operating system of the end device
- The Internet service provider of the user
- The IP address of the end device
- Date and time of access
- The IP addresses are anonymized after seven days at the latest.

Purpose of processing & legal basis

The data is required to display the website on the user's device, to ensure its functionality and to analyze any malfunctions. We also use the data to optimize the website and to ensure the security of our information technology systems.

The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. The collection of log files is absolutely necessary for the operation of the website. Consequently, the user has no option to object.

b) Use of mandatory cookies

We use cookies on our website. These are text files that are stored in or by the internet browser on the system of the user's end device when visiting a website.

Processed information & duration of processing

Each cookie contains a characteristic character string that makes it possible to uniquely identify the browser the next time the website is accessed and thus the respective user device.

The necessary cookies are deleted in the following time intervals:

Purpose & legal basis

Some functions of our website cannot be used without the use of cookies. For example, it may be necessary to use so-called counting cookies to prevent the website from being overloaded. Session cookies may also be required to retain the selected language setting of the website for future visits. In addition, mandatory cookies also serve to enable our system to recognize whether the user has consented to the placement of cookies in their browser or has restricted them (so-called opt-out cookies). These technically necessary cookies are not used to determine the identity of the user or to create user profiles.

The legal basis for the storage of mandatory cookies is Section 25 (2) No. 2 TTDSG.

The legal basis for the processing of the resulting personal data is Art. 6 para. 1 sentence 1 lit. f GDPR.

The use of these cookies is absolutely necessary for the operation of the website. Consequently, the user has no option to object.

3. Additional information for communication with us

The following information applies to all communication with us.

If the communication takes place within a client relationship or another contractual relationship, the data processing is also governed by the supplementary information under No. 4. or No. 5.

If the communication is aimed at an application to us, the data processing is also based on the supplementary information under 7.

a) Telephone

You can contact us by telephone.

Processed information & duration of processing

In addition to your telephone number, we process the personal data that you provide to us during the conversation.

The data will be deleted - unless there is another reason for processing - as soon as the matter has been clarified with you.

Purpose of processing & legal basis

The personal data will be processed by us exclusively for the purpose of processing the request and in the event of follow-up questions.

If the communication is aimed at the conclusion of a contract, the legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

In all other cases, Art. 6 para. 1 sentence 1 lit. f GDPR is the legal basis. Your interest does not outweigh our interest in responding to your request; since you are contacting us by telephone, it is also in your interest to receive a response and you are aware that we must process your personal data in order to respond to your request.

b) E-mail

You can contact us by e-mail. We would like to point out that it is possible for third parties to gain insight into e-mail communication. If it is important to you that the information you provide is not exposed to the risk of illegal access by third parties, we therefore recommend that you use a different method of communication. However, if you contact us by e-mail, we assume that further communication via this channel is also in your interest.

Processed information & duration of processing

In addition to your e-mail address, we process the personal data that you provide to us in the course of e-mail communication.

The data will be deleted - unless there is another reason for processing - as soon as the matter with you has been clarified or after the statutory retention periods have expired.

Purpose of processing & legal basis

The personal data will be processed by us exclusively for the purpose of processing the request and in the event of follow-up questions.

If the communication is aimed at the conclusion of a contract, the legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

In all other cases, Art. 6 para. 1 sentence 1 lit. f GDPR is the legal basis. Your interest does not outweigh our interest in responding to your request; since you are writing to us, responding is also in your interest and you are aware that we must process your personal data in order to respond to your request.

c) Video telephony

We also use video telephony for communication.

Processor

We use Microsoft Teams from Microsoft Ireland Operations Ltd, South County Business Park, One Microsoft Place, Carmanhall And Leopardstown, Dublin, D18 P521, Ireland as a processor to carry out video calls. We have concluded a data processing agreement with the processor. The Microsoft Ireland Operations Ltd processor processes personal data in Germany or the EU and therefore not in a third country.

Processed information & duration of processing

The following communication data is processed during video telephony:

- Personal master data (if you provide this of your own accord)
- Content of the online meeting (if you make a personal appearance with verbal and/or written contributions)
- Authentication data
- Log files, protocol data
- Metadata (e.g. IP address, time of participation, etc.)
- Profile data (e.g. your user name, if you provide this of your own accord)
- The personal data will be deleted as soon as the matter has been clarified with you and provided that there is no other reason for the processing.

Purpose of processing & legal basis

The personal data will be processed by us exclusively for the purpose of processing the request and in the event of follow-up questions.  If the communication is aimed at the conclusion of a contract, the legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

In all other cases, Art. 6 para. 1 sentence 1 lit. f GDPR is the legal basis. Your interest does not outweigh our interest in responding to your request; since you are contacting us by video call, responding is also in your interest and you are aware that we must process your personal data in order to respond to your request.

4. Additional information for clients

If you have a client relationship with us, the following additional information applies to you.

Processed information & duration of processing

Which of your data is processed in detail depends on the tasks within the client relationship. We use the personal data exclusively for the purpose for which it was provided to us. This includes, for example, personal data (name, address and other contact details, date and place of birth). In addition, this may also include order data (e.g. payment order), data from the fulfillment of our contractual obligations (e.g. turnover data in payment transactions), information about your financial situation (e.g. creditworthiness data), as well as other data comparable to the categories mentioned.

Purpose of processing & legal basis

The processing is mainly carried out for the purpose of establishing and implementing the client relationship; the legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR. In the case of a client relationship, this may also mean that personal data is stored in your interest until the expiry of the limitation periods.

In addition, we also process your data in part on the basis of our legitimate interest, namely for the purpose of contact and communication management, profitability checks, contract and project management and to ensure the operation of information and telecommunications systems. The legal basis in this case is Art. 6 para. 1 sentence 1 lit. f GDPR.

In addition, as a company we are bound by various legal obligations that must be complied with under applicable laws and regulations. The legal basis for processing to fulfill legal requirements and obligations is Art. 6 para. 1 sentence 1 lit. c GDPR. These include, on the one hand, retention obligations under tax law and, in client relationships, in particular the professional retention ob-ligations of hand files for six years pursuant to Section 50 (1) sentence 2 BRAO and the retention of personal data for the conflict of interest check pursuant to Section 43a (4) BRAO.

If you have given us your consent to process personal data for specific purposes, the legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR.

Disclosure of data to third parties

Insofar as it is necessary for the fulfillment of the obligations arising from the client relationship with you, personal data will be passed on to third parties. This includes in particular the disclosure to opposing parties and their representatives (in particular their lawyers) as well as courts and other public authorities for the purpose of correspondence and for the assertion and defense of your rights. The data passed on may be used by the third party exclusively for the stated purposes. The attorney-client privilege remains unaffected. Insofar as data is concerned that is subject to attorney-client privilege, it will only be passed on to third parties in consultation with you.

We use the special electronic mailbox for lawyers ("beA") to communicate with government agencies. The processing of personal data via beA is carried out on the basis of Art. 6 para. 1 sentence 1 lit. e, para. 3 GDPR, Section 3 BDSG in conjunction with Sections 31a, 31c BRAO. §§ Sections 31a, 31c BRAO so that no data processing agreement with the Federal Bar Association is required.

5. Additional information for opposing parties

If we receive personal data from opposing parties in the context of a client relationship, we are not obliged to inform you about our processing of the personal data due to the lawyer's duty of confidentiality pursuant to Section 43a para. 2 BRAO (Art. 14 para. 5 lit. d GDPR). If we receive personal data from opposing parties, the "Supplementary information for communication with us" (see no. 3 above) applies.

6. Supplementary information for other contractual partners

In addition, the following information applies to you if we have a contractual relationship with each other.

Processed information & duration of processing

Which of your data is processed in detail depends on the tasks within the contractual relationship. We use the personal information exclusively for the purpose for which it was provided to us. This includes, for example, personal data (name, address and other contact details, date and place of birth). In addition, this may also include order data (e.g. payment order), data from the fulfill-ment of our contractual obligations (e.g. turnover data in payment transactions), information about your financial situation (e.g. creditworthiness data), advertising and sales data and other data comparable to the categories mentioned.

The personal data will be deleted as soon as the contractual relationship with you has ended and provided there is no other reason for the processing.

Purpose of processing & legal basis

The processing is mainly carried out for the purpose of establishing and implementing the contractual relationship; the legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

In addition, we also process your data in part on the basis of our legitimate interest, namely for the purpose of contact and communication management, profitability checks, contract and project management and to ensure the operation of information and telecommunications systems. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

In addition, as a company we are bound by various legal obligations that must be complied with due to applicable laws and regulations. The legal basis for processing to fulfill legal requirements and obligations is Art. 6 para. 1 sentence 1 lit. c GDPR. This includes, in particular, retention obli-gations under tax law.

7. Additional information for applicants

If you apply to us, the following information also applies to you.

Processed information & duration of processing

We process the personal data that we receive from you through your application.

The personal data will be deleted after six months if no employment relationship is established. If an employment relationship is established, the data will continue to be processed for this purpose. Purpose of processing & legal basis

We collect and process the personal data of applicants for the purpose of handling the application process.

The legal basis for the processing of personal data is Section 26 BDSG. If we conclude an employment contract with you, the transmitted data will be further processed for the purpose of handling the employment relationship; in this case, the legal basis remains in particular § 26 BDSG.

If no employment contract is concluded, the application documents will be deleted, provided that deletion does not conflict with any other legitimate interests of the controller. Other legitimate interest in this sense is, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).