Privacy Notice

2. Overview

This website does not use cookies, analytics tools, tracking technologies, or social media plugins. No personal data is collected by the website itself. The only personal data processed in connection with this website is (a) technical data recorded automatically by the hosting infrastructure when you visit the site, and (b) data you provide voluntarily by sending an e-mail.

3. Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (vercel.com). When you access the website, your browser automatically transmits certain technical data to Vercel's infrastructure, including:

• your IP address
• the date and time of the request
• the URL requested and the HTTP method
• the HTTP response code and the volume of data transferred
• the referring URL (if any)
• your browser type and operating system

This data is recorded in server access logs in the ordinary course of website operation. We do not use it to identify individual visitors. The legal basis is our legitimate interest in the stable and secure operation of the website (Art. 6(1)(f) GDPR). Access logs are retained in accordance with Vercel's current retention policy (see vercel.com/legal/dpa).

Vercel acts as a data processor pursuant to Art. 28 GDPR; a data processing agreement incorporating the Standard Contractual Clauses (Commission Decision 2021/914) is in place.

4. Contact by e-mail

If you contact us by e-mail — including by using the "Book a Call" link on this site — we will process the personal data contained in your message. This includes in particular your e-mail address and any other information you choose to include in your message.

The data is used solely for the purpose of responding to your enquiry and, where applicable, establishing and performing a client relationship. The legal basis is Art. 6(1)(b) GDPR (steps taken at the data subject's request prior to entering into a contract) or, where no client relationship follows, Art. 6(1)(f) GDPR (our legitimate interest in responding to correspondence addressed to us).

Data relating to completed mandates is retained for ten years after the conclusion of the matter in accordance with § 50 BRAO and applicable commercial and tax law retention obligations. Data relating to enquiries that do not lead to a mandate is deleted once it is no longer required for the purpose for which it was collected, unless a longer retention period is required by law.

5. Recipients of personal data

Personal data is not sold or transferred to third parties for their own commercial purposes. Data may be shared only where strictly necessary:

• with the hosting provider, acting as a data processor under Art. 28 GDPR, solely for the purpose of operating this website;
• with professional advisers (e.g., tax advisers) to the extent required for compliance with legal obligations applicable to this practice;
• with public authorities where disclosure is required by applicable law.

6. International transfers

The hosting provider, Vercel Inc., is based in the United States. When you access this website, your IP address and the other technical data described in section 3 above are transferred to and processed on Vercel's servers, which may be located outside the European Economic Area.

This transfer is carried out on the basis of the Standard Contractual Clauses approved by the European Commission in Decision 2021/914 (Art. 46(2)(c) GDPR), incorporated into the data processing agreement concluded with Vercel. A copy of the applicable clauses is available at vercel.com/legal/dpa.

No other transfers of personal data to countries outside the EEA take place in connection with the operation of this website.

7. Your rights as a data subject

Subject to the conditions and limitations set out in the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): You may request confirmation of whether we process personal data about you and, if so, access to that data and the information specified in Art. 15 GDPR.
• Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate personal data or the completion of incomplete personal data.
• Right to erasure (Art. 17 GDPR): You may request the deletion of personal data where the conditions of Art. 17 GDPR are met. This right may be limited by retention obligations under § 50 BRAO and applicable commercial and tax law.
• Right to restriction of processing (Art. 18 GDPR): You may request that processing be restricted in the circumstances specified in Art. 18 GDPR.
• Right to data portability (Art. 20 GDPR): Where processing is based on consent or a contract and is carried out by automated means, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR): Where processing is based on our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to the processing on grounds relating to your particular situation. We will then cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.

To exercise any of these rights, please contact us at mail@thegermandesk.com. We will respond within the time limits prescribed by the GDPR.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for our registered office in Bavaria is:

You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence or place of work.

9. Changes to this notice

We may update this privacy notice from time to time to reflect changes in our processing activities or applicable law. The current version is always available at www.thegermandesk.com/privacy.