Privacy policy

Data protection at a glance

Overview

This section gives you a brief overview of what happens to your personal data when you visit this website. Personal data is any information that can be used to identify you. You will find more detailed information in the privacy policy below.

How we collect data on this website

Who is responsible for collecting data on this website?

Data is processed by the website operator or, in connection with legal services or advice, by the relevant law firm. Their contact details appear under “Who is responsible for your data?” in this privacy policy.

How do we collect your data?

Some data is collected when you provide it to us, for example by entering information in a contact form.

Other data is collected by our IT systems automatically, or with your consent, when you visit the website. This is mainly technical information, such as your browser, operating system and the time you access a page. It is collected automatically when you enter the website.

What do we use your data for?

Some data is collected to keep the website running properly. Other data may be used to analyse how you use it. Where the website can be used to enter into or prepare contracts, the information you submit is also processed for quotations, orders or other requests for services.

What rights do you have over your data?

You have the right at any time to obtain information free of charge about the source, recipients and purpose of your stored personal data. You may also request that it be rectified or erased. If you have consented to processing, you can withdraw that consent at any time with effect for the future. In certain circumstances, you may request that processing be restricted. You also have the right to complain to the competent supervisory authority.

You can contact us at any time about these rights or any other data protection questions.

Analytics and third-party tools

Your browsing activity may be analysed statistically when you visit this website, primarily through analytics tools.

The privacy policy below explains these tools in detail.

Hosting

Our website is hosted by the following provider:

Amazon Web Services (AWS)

The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg (“AWS”).

When you visit our website, your personal data is processed on AWS servers. Personal data may also be transferred to AWS’s parent company in the United States. Transfers to the US rely on the EU Standard Contractual Clauses. Details: https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/.

For further information, see the AWS privacy notice: https://aws.amazon.com/de/privacy/?nc1=f_pr.

We use AWS on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in providing our website as reliably as possible. Where we ask for consent, processing is based solely on Article 6(1)(a) GDPR and section 25(1) TDDDG, to the extent that the consent covers storing cookies or accessing information on your device, for example through device fingerprinting, within the meaning of the TDDDG. You can withdraw your consent at any time.

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States intended to ensure that European data protection standards are met when data is processed in the US. Every DPF-certified company undertakes to comply with these standards. Further information is available from the provider at: https://www.dataprivacyframework.gov/participant/5776.

Data processing agreement

We have entered into a data processing agreement for the service described above. This agreement is required by data protection law and ensures that the provider processes our website visitors’ personal data only on our instructions and in accordance with the GDPR.

General information and mandatory disclosures

Data protection

The operators of this website take the protection of your personal data seriously. We treat your personal data confidentially and in accordance with data protection law and this privacy policy.

Various types of personal data are collected when you use this website. Personal data is information that can be used to identify you. This privacy policy explains what we collect, how we collect it and why we use it.

Please be aware that transmitting data over the internet, for example by email, can involve security vulnerabilities. Complete protection against third-party access is not possible.

Who is responsible for your data?

The controller for the website operator’s and advokio UG’s own processing purposes, particularly its platform services and the assessment, provision and settlement of cost coverage, is:

advokio UG (haftungsbeschränkt)
Im Kammereck 12e
63329 Egelsbach
Telephone: +49-6103-3018552
Email: info@advokio.com

The controller for legal advice, enquiries about legal representation, the handling of client matters and the associated legal billing is:

advokio Rechtsanwaltsgesellschaft mbH
Im Kammereck 12e
63329 Egelsbach
Telephone: +49-6103-3018552
Email: info@advokio-legal.com

A controller is the individual or organisation that decides, alone or jointly with others, why and how personal data, such as names or email addresses, is processed.

Technical storage and the companies’ respective roles

Both companies’ data is stored on the technical systems of advokio UG (haftungsbeschränkt). Where data is stored does not determine who is responsible under data protection law: each company decides how data is processed for its own purposes.

Where advokio UG processes data solely on the instructions of advokio Rechtsanwaltsgesellschaft mbH for legal advice and client matters, it acts as the law firm’s processor. The UG is a controller in its own right when deciding how to use data for its own purposes, particularly to assess, provide and settle cost coverage. Technical access to client data does not automatically entitle the UG to use it for its own purposes.

Types of data processed in client matters

Depending on the matter, we process:

clients’ identity and contact details and, for minors, those of their legal representatives;
communications and documents;
information about personal, family, professional, legal and financial circumstances needed for the matter.

This may include information about third parties involved. Health data may also be processed where necessary for the matter and legally permitted.

How long we retain data

Lawyers’ case files: Under section 50 BRAO, advokio Rechtsanwaltsgesellschaft mbH generally retains lawyers’ case files for six years from the end of the calendar year in which the engagement ended. Different statutory requirements may apply to individual documents.

Documents subject to statutory retention: The company responsible observes the statutory retention period for each document type. Under section 257 HGB and section 147 AO, where applicable, this is generally six years for commercial and business correspondence, eight years for accounting vouchers and ten years for accounting records and annual financial statements. The starting date is determined by the applicable legislation, generally by reference to the end of the relevant calendar year. Special statutory rules and legally required extensions remain unaffected.

Data not subject to statutory retention: Where there is no statutory retention requirement, we delete data once the matter is finally concluded, unless it is still needed to complete its administration or to establish, exercise or defend legal claims. Any further retention is limited to the data and period necessary for that purpose.

Storage on behalf of the law firm: Where the UG stores data on the law firm’s behalf, it follows the firm’s lawful deletion instructions. Technical storage does not create an additional retention period for the UG. Storage for the UG’s own purposes requires an appropriate legal basis and compliance with the relevant retention periods.

Legal bases for processing data on this website

If you consent to processing, we rely on Article 6(1)(a) GDPR or, where special categories of data under Article 9(1) GDPR are involved, Article 9(2)(a) GDPR. If you explicitly consent to the transfer of personal data to third countries, Article 49(1)(a) GDPR also applies. If you consent to cookies being stored or information on your device being accessed, for example through device fingerprinting, section 25(1) TDDDG provides an additional legal basis. You can withdraw consent at any time. Where data is needed to perform a contract or take steps before entering into one, we rely on Article 6(1)(b) GDPR. Where processing is needed to comply with a legal obligation, we rely on Article 6(1)(c) GDPR. We may also process data for our legitimate interests under Article 6(1)(f) GDPR. The following sections explain which legal basis applies in each case.

Data protection officer

advokio UG (haftungsbeschränkt) and advokio Rechtsanwaltsgesellschaft mbH have appointed the following data protection officer:

Michael Homberger
Im Kammereck 12e
63329 Egelsbach
Email: michael.homberger@advokio.com

Recipients of personal data

We work with various external organisations in the course of our business. This sometimes requires us to transfer personal data to them. We do so only where necessary to perform a contract, where required by law, for example to provide data to tax authorities, where we have a legitimate interest under Article 6(1)(f) GDPR or where another legal basis permits it. When using processors, we share clients’ personal data only under a valid data processing agreement. Where processing is carried out jointly, we enter into a joint controllership agreement.

Depending on what is necessary and legally permitted for the purpose concerned, recipients may include the categories already described: hosting, IT and communications providers, payment providers, other lawyers, experts and other advisers, certification bodies, professional indemnity insurers, tax authorities and other competent public bodies. Processors engaged by the law firm act on its instructions. Sharing client information for the UG’s own purposes requires separate authority. The sections on individual services explain their use and any transfers to third countries.

Withdrawing your consent

Many processing activities require your express consent. You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Your right to object in particular circumstances and to direct marketing (Article 21 GDPR)

WHERE PROCESSING IS BASED ON ARTICLE 6(1)(e) OR (f) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. THIS INCLUDES PROFILING BASED ON THOSE PROVISIONS. THIS PRIVACY POLICY STATES THE LEGAL BASIS FOR EACH PROCESSING ACTIVITY. IF YOU OBJECT, WE WILL STOP PROCESSING THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR PROCESSING IS NEEDED TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS (ARTICLE 21(1) GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO PROCESSING FOR THAT PURPOSE, INCLUDING PROFILING RELATED TO DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING (ARTICLE 21(2) GDPR).

Your right to complain to a supervisory authority

If the GDPR is breached, you have the right to complain to a supervisory authority, particularly in the Member State where you normally live or work, or where the alleged breach occurred. This right is without prejudice to other administrative or judicial remedies.

Data portability

You have the right to receive data that we process automatically on the basis of your consent or a contract, or have it provided to a third party, in a commonly used, machine-readable format. If you ask us to transfer it directly to another controller, we will do so where technically feasible.

Access, rectification and erasure

Subject to the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its source and recipients and the purpose of processing. You may also have the right to have it rectified or erased. You can contact us at any time about these rights or other questions concerning personal data.

Restriction of processing

You have the right to request that processing of your personal data be restricted. You can contact us at any time to do so. This right applies in the following circumstances:

If you dispute the accuracy of the personal data we hold, we usually need time to check it. You may request restriction while we do so.
If your data has been or is being processed unlawfully, you may request restriction instead of erasure.
If we no longer need your data, but you need it to establish, exercise or defend legal claims, you may request restriction instead of erasure.
If you have objected under Article 21(1) GDPR, your interests must be weighed against ours. You may request restriction until it has been determined whose interests prevail.

Once processing is restricted, your data may, apart from being stored, be processed only with your consent, to establish, exercise or defend legal claims, to protect the rights of another individual or organisation, or for reasons of important public interest of the European Union or a Member State.

SSL and TLS encryption

This website uses SSL or TLS encryption for security and to protect confidential content, such as orders or enquiries you send to us as the website operator. You can recognise an encrypted connection by the change from “http://” to “https://” in the browser’s address bar and the padlock symbol.

When SSL or TLS encryption is active, third parties cannot read the data you send us in transit.

Encrypted payments on this website

If, after entering into a paid contract, you are required to provide payment details, such as your account number for a direct debit, we need these details to process the payment.

Payments using common methods, such as Visa, MasterCard and direct debit, are made exclusively over an encrypted SSL or TLS connection. You can recognise this by the change from “http://” to “https://” and the padlock symbol in your browser’s address bar.

With encrypted communication, third parties cannot read the payment details you send us in transit.

Unsolicited advertising emails

We object to the use of contact details published as part of the legally required legal notice to send unsolicited advertising and information. The website operators expressly reserve the right to take legal action against unsolicited advertising, including spam emails.

Data collection on this website

Cookies

Our website uses cookies: small data files that do not harm your device. They are stored either temporarily for a single visit (session cookies) or for a longer period (persistent cookies). Session cookies are deleted automatically when your visit ends. Persistent cookies remain until you delete them or your browser removes them automatically.

Cookies may be set by us (first-party cookies) or by other companies (third-party cookies). Third-party cookies allow services from other providers to be integrated into a website, for example payment processing.

Cookies serve different purposes. Many are technically necessary because certain website functions, such as a shopping basket or video playback, would not work without them. Others may be used to analyse user behaviour or for advertising.

Cookies needed for electronic communications, to provide functions you request, such as a shopping basket, or to optimise the website, such as audience measurement cookies (“necessary cookies”), are stored on the basis of Article 6(1)(f) GDPR unless another legal basis is stated. The website operator has a legitimate interest in storing necessary cookies to deliver technically reliable, optimised services. Where we ask for consent to cookies or similar recognition technologies, processing is based solely on that consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw consent at any time.

You can configure your browser to notify you when cookies are set, allow them individually, reject some or all cookies, or delete them automatically when the browser closes. Disabling cookies may limit this website’s functionality.

This privacy policy explains which cookies and services the website uses.

Consent management with Usercentrics

This website uses Usercentrics’ consent technology to obtain your consent to certain cookies being stored on your device or certain technologies being used, and to document that consent in accordance with data protection law. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, website: https://usercentrics.com/de/ (“Usercentrics”).

When you enter our website, the following personal data is transferred to Usercentrics:

Your consent choices and any withdrawals of consent
Your IP address
Information about your browser
Information about your device
The time of your visit
Geolocation

Usercentrics also stores a cookie in your browser so it can associate your consent choices or withdrawals with you. The data collected is retained until you ask us to delete it, delete the Usercentrics cookie yourself or the purpose of storage no longer applies. Mandatory statutory retention obligations remain unaffected.

The Usercentrics banner on this website was configured with eRecht24’s assistance, as indicated by the eRecht24 logo in the banner. Displaying the logo establishes a connection to eRecht24’s image server. Your IP address is transmitted but is stored in the server logs only in anonymised form. The image server is hosted in Germany by a German provider. The banner itself is provided exclusively by Usercentrics.

We use Usercentrics to obtain the legally required consent for certain technologies. The legal basis is Article 6(1)(c) GDPR.

Data processing agreement

Server log files

The hosting provider automatically collects and stores information in server log files, which your browser sends to us automatically. This includes:

Browser type and version
Operating system
Referrer URL
Hostname of the computer accessing the website
Time of the server request
IP address

This information is not combined with other data sources.

It is collected on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring that the website works properly and is optimised; this requires server log files.

Contact form

If you send an enquiry through our contact form, we store the information you enter, including your contact details, to deal with your enquiry and any follow-up questions. We do not share this data without your consent.

Where your enquiry relates to performing a contract or taking steps before entering into one, we rely on Article 6(1)(b) GDPR. In all other cases, processing is based on our legitimate interest in dealing effectively with enquiries (Article 6(1)(f) GDPR), or on your consent where requested (Article 6(1)(a) GDPR). You can withdraw consent at any time.

We retain the data you enter in the contact form until you ask us to delete it, withdraw your consent to storage or the purpose no longer applies, for example once we have finished dealing with your enquiry. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, we store and process your enquiry and any personal data it contains, such as your name and the details of your enquiry, so we can deal with it. We do not share this data without your consent.

Where your enquiry relates to performing a contract or taking steps before entering into one, processing is based on Article 6(1)(b) GDPR. In all other cases, we rely on our legitimate interest in dealing effectively with enquiries (Article 6(1)(f) GDPR), or on your consent where requested (Article 6(1)(a) GDPR). You can withdraw consent at any time.

We retain the data you send us with an enquiry until you ask us to delete it, withdraw your consent to storage or the purpose no longer applies, for example once your enquiry has been resolved. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Communicating via WhatsApp

We use WhatsApp, among other services, to communicate with clients and other third parties. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Communications use end-to-end encryption (peer-to-peer), which prevents WhatsApp and other third parties from accessing their content. However, WhatsApp can access metadata generated during communication, such as the sender, recipient and time. WhatsApp also states that it shares users’ personal data with its US-based parent company, Meta. For more information, see WhatsApp’s privacy policy: https://www.whatsapp.com/legal/#privacy-policy.

We use WhatsApp on the basis of our legitimate interest in communicating quickly and effectively with clients, prospective clients and other business and contractual partners (Article 6(1)(f) GDPR). Where we ask for consent, processing is based solely on that consent, which you can withdraw at any time with effect for the future.

We retain the content of our WhatsApp communications with you until you ask us to delete it, withdraw your consent to storage or the purpose no longer applies, for example once your enquiry has been resolved. Mandatory statutory provisions, particularly retention periods, remain unaffected.

We use WhatsApp Business.

Transfers to the US rely on the European Commission’s Standard Contractual Clauses. Details: https://www.whatsapp.com/legal/business-data-transfer-addendum.

Our WhatsApp accounts are configured not to synchronise automatically with the address books on the smartphones we use.

We have entered into a data processing agreement with the provider named above.

Using legal services and advice: the client questionnaire

If you seek legal advice through advokio.com, you can provide information about your matter in a questionnaire or enquiry. Information intended for a legal enquiry and the handling of a client matter is stored on the UG’s systems and made available to the relevant law firm. This also applies to additional information and documents provided to the firm orally, in writing or by email. The companies’ respective roles are explained under “Technical storage and the companies’ respective roles”.

An enquiry, questionnaire or submission of data does not, by itself, establish a lawyer–client relationship. This is established only when the law firm is instructed and accepts the engagement. Contracts for legal representation and cost coverage are currently concluded by email or telephone. The law firm is bound by professional duties of confidentiality. Data is stored on the UG’s systems using the infrastructure described under “Hosting”.

The rules under “How long we retain data”, which distinguish between processing purposes and document types, govern storage and deletion. Technical storage by the UG does not extend the permitted retention period.

Processing to prepare or perform a legal engagement or a company’s own contract is based on Article 6(1)(b) GDPR where it concerns the relevant contracting party and is necessary for that purpose. Necessary processing of data about third parties involved, and processing to protect legitimate interests, particularly to pursue or defend legal claims, may rely on Article 6(1)(f) GDPR following the required balancing of interests. Statutory obligations are covered by Article 6(1)(c) GDPR. Where consent is required, it is obtained separately and can be withdrawn at any time with effect for the future. Health data also requires a condition under Article 9(2) GDPR, particularly Article 9(2)(f) where processing is necessary to establish, exercise or defend legal claims. Access to devices, whether technically necessary or subject to consent, must also meet the requirements of section 25 TDDDG.

Registering on this website

You can register on this website to use additional functions. We use the data you enter only to provide the offer or service for which you registered. All mandatory registration details must be provided; otherwise we will reject the registration.

We use the email address provided at registration to notify you of important changes, such as changes to the services available or necessary technical changes.

Registration data is processed to perform the user agreement established by registration and, where applicable, to prepare further contracts (Article 6(1)(b) GDPR).

We retain registration data for as long as you remain registered on this website and delete it afterwards. Statutory retention periods remain unaffected.

Analytics and advertising

Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager allows us to integrate tracking tools, statistics tools and other technologies into our website. It does not itself create user profiles, store cookies or carry out its own analyses. It simply manages and deploys the tools integrated through it. However, it does collect your IP address, which may be transferred to Google’s parent company in the United States.

We use Google Tag Manager on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in integrating and managing website tools quickly and easily. Where we ask for consent, processing is based solely on Article 6(1)(a) GDPR and section 25(1) TDDDG, to the extent that consent covers storing cookies or accessing information on your device, for example through device fingerprinting, within the meaning of the TDDDG. You can withdraw consent at any time.

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse visitor behaviour. It provides usage data such as page views, time spent on the website, operating systems used and where visitors come from. This information is combined under a user ID and associated with the visitor’s device.

Google Analytics also allows us to record mouse movements, scrolling and clicks. It uses various modelling methods to supplement the data collected and applies machine learning to analyse it.

Google Analytics uses technologies, such as cookies or device fingerprinting, that recognise users so their behaviour can be analysed. Information collected by Google about your use of this website is generally transferred to a Google server in the US and stored there.

We use this service on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw your consent at any time.

Transfers to the US rely on the European Commission’s Standard Contractual Clauses. Details: https://business.safety.google/adscontrollerterms/sccs/.

IP anonymisation

Google Analytics IP anonymisation is enabled. Google therefore truncates your IP address within EU Member States or other states party to the Agreement on the European Economic Area before transferring it to the US. Only in exceptional cases is the full IP address sent to a Google server in the US and truncated there. On behalf of the website operator, Google uses this information to assess your use of the website, compile reports on website activity and provide other services relating to website and internet use. The IP address sent by your browser through Google Analytics is not combined with other Google data.

Browser add-on

You can prevent Google from collecting and processing your data by downloading and installing the browser add-on available at: https://tools.google.com/dlpage/gaoptout?hl=de.

Further information about Google Analytics’ handling of user data is available in Google’s privacy information: https://support.google.com/analytics/answer/6004245?hl=de.

Google signals

We use Google signals. When you visit our website, Google Analytics collects information including your location, search history, YouTube history and demographic data (“visitor data”). Google signals can use this information for personalised advertising. If you have a Google account, Google signals links visitor data to that account and uses it to personalise advertising. The data is also used to create anonymised statistics on our users’ behaviour.

Data processing agreement

We have entered into a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Analytics ecommerce measurement

This website uses Google Analytics’ ecommerce measurement function. It allows the website operator to analyse visitors’ purchasing behaviour to improve online marketing campaigns. It records information such as orders placed, average order value, shipping costs and the time between viewing and buying a product. Google may combine this information under a transaction ID associated with the user or their device.

Google Ads

The website operator uses Google Ads, an online advertising service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads allows us to display adverts in Google search results or on third-party websites when a user enters particular search terms (keyword targeting). Adverts can also be targeted using data held by Google, such as location and interests (audience targeting). As the website operator, we can evaluate this information quantitatively, for example by analysing which search terms triggered our adverts and how often the adverts were clicked.

We use this service on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw your consent at any time.

Transfers to the US rely on the European Commission’s Standard Contractual Clauses. Details: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.

Google conversion tracking

This website uses Google conversion tracking, provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google conversion tracking allows Google and us to identify whether users have taken particular actions. For example, we can see how often buttons are clicked and which products are viewed or purchased most frequently. This information is used to compile conversion statistics. We learn the total number of users who clicked our adverts and the actions they took. We receive no information that allows us to identify users personally. Google itself uses cookies or similar recognition technologies to identify users.

We use this service on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw your consent at any time.

Further information about Google conversion tracking is available in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Meta Pixel (formerly Facebook Pixel)

This website uses Meta’s visitor action pixel to measure conversions. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Meta states that the data collected is also transferred to the US and other third countries.

The pixel tracks visitors’ behaviour after they click a Meta advert and are redirected to the advertiser’s website. This allows the effectiveness of Meta advertising to be evaluated for statistical and market research purposes and future advertising to be improved.

The data collected is anonymous to us as the website operator; we cannot identify individual users from it. However, Meta stores and processes the data, allowing it to be linked to a user’s Facebook or Instagram profile and used for Meta’s own advertising purposes under its data policy (https://de-de.facebook.com/about/privacy/). This allows Meta to display adverts on Facebook, Instagram and other advertising channels. We have no control over this use of the data.

We use this service on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw your consent at any time.

Where the tool described here collects personal data on our website and sends it to Meta, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are joint controllers for that processing (Article 26 GDPR). Joint responsibility is limited to collecting the data and passing it to Meta. Meta’s subsequent processing is not covered by it. Our respective obligations are set out in a joint controllership agreement, available at: https://www.facebook.com/legal/controller_addendum. Under that agreement, we are responsible for providing data protection information about the Meta tool and implementing it on our website in a way that complies with data protection law. Meta is responsible for the security of its products. You can exercise your rights, such as the right of access, directly with Meta in relation to data processed on Facebook or Instagram. If you exercise those rights through us, we are required to forward your request to Meta.

Transfers to the US rely on the European Commission’s Standard Contractual Clauses. Details: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Meta’s privacy policy contains further information about protecting your privacy: https://de-de.facebook.com/about/privacy/.

You can also disable the “Custom Audiences” remarketing function in your advertising settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged in to Facebook to do so.

If you do not have a Facebook or Instagram account, you can disable Meta’s interest-based advertising through the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.

Meta Conversions API

We have integrated the Meta Conversions API into this website. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Meta states that the data collected is also transferred to the US and other third countries.

The Meta Conversions API allows us to record visitors’ interactions with our website and send them to Meta to improve advertising performance on Facebook and Instagram.

The data collected includes, in particular, the time of access, the page accessed, your IP address and user agent and, where applicable, other specific information such as products purchased, basket value and currency. A full overview of the data that can be collected is available at: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters.

We use this service on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw your consent at any time.

Meta’s privacy policy contains further information about protecting your privacy: https://de-de.facebook.com/about/privacy/.

Data processing agreement

Meta Custom Audiences

We use Meta Custom Audiences, provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

We collect personal data when you visit or use our websites and apps, use our free or paid services, provide data to us or interact with our company’s Facebook or Instagram content. If you consent to our use of Meta Custom Audiences, we send this data to Meta so it can show you relevant advertising. Your data can also be used to define audiences with similar characteristics (lookalike audiences).

Meta processes this data as our processor. Details are set out in Meta’s terms: https://www.facebook.com/legal/terms/customaudience.

We use this service on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw your consent at any time.

Transfers to the US rely on the European Commission’s Standard Contractual Clauses. Details: https://www.facebook.com/legal/terms/customaudience and https://www.facebook.com/legal/terms/dataprocessing.

Newsletter data

To subscribe to the newsletter offered on this website, you must provide an email address and information allowing us to verify that it belongs to you and that you agree to receive the newsletter. No other data is collected unless you provide it voluntarily. We use this information only to send the information you request and do not share it with third parties.

Data entered in the newsletter subscription form is processed solely on the basis of your consent (Article 6(1)(a) GDPR). You can withdraw consent to the storage of your data and email address and their use for the newsletter at any time, for example through the unsubscribe link in a newsletter. Withdrawal does not affect the lawfulness of processing already carried out.

We or the newsletter provider retain the data you provide for your subscription until you unsubscribe. It is removed from the mailing list after you unsubscribe or once its purpose no longer applies. We reserve the right, at our discretion and in pursuit of our legitimate interest under Article 6(1)(f) GDPR, to delete or block email addresses on our mailing list.

This does not affect data we hold for other purposes.

After you unsubscribe, we or the newsletter provider may retain your email address on a suppression list where necessary to prevent further mailings. This data is used only for that purpose and is not combined with other data. This serves both your interest and our legitimate interest in complying with the legal requirements for newsletters (Article 6(1)(f) GDPR). There is no fixed time limit for retention on the suppression list. You may object to this storage if your interests outweigh our legitimate interest.

Newsletters for clients and existing customers

If you order goods or services from us and provide an email address, we may subsequently use it for newsletters, provided we inform you beforehand. Such newsletters contain only direct advertising for our own similar goods or services. You can unsubscribe at any time using the link provided in every newsletter. The legal basis is Article 6(1)(f) GDPR in conjunction with section 7(3) of the German Act Against Unfair Competition (UWG).

After you unsubscribe, we may retain your email address on a suppression list to prevent further mailings. The data is used only for that purpose and is not combined with other data. This serves both your interest and our legitimate interest in complying with the legal requirements for newsletters (Article 6(1)(f) GDPR). There is no fixed retention period. You may object to storage if your interests outweigh our legitimate interest.

Plugins and tools

YouTube in privacy-enhanced mode

This website embeds YouTube videos. YouTube is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit a page containing an embedded YouTube video, a connection is established to YouTube’s servers. YouTube is told which of our pages you have visited. If you are logged in to YouTube, it can associate your browsing activity directly with your personal profile. You can prevent this by logging out of YouTube.

We use YouTube’s privacy-enhanced mode. According to YouTube, videos played in this mode are not used to personalise browsing on YouTube. Adverts displayed in this mode are also not personalised. Privacy-enhanced mode does not set cookies. Instead, it stores local storage items in your browser which, like cookies, can contain personal data and be used to recognise you. Details: https://support.google.com/youtube/answer/171780.

Activating a YouTube video may trigger further processing over which we have no control.

We use YouTube to present our online services attractively. This is a legitimate interest under Article 6(1)(f) GDPR. Where we ask for consent, processing is based solely on Article 6(1)(a) GDPR and section 25(1) TDDDG, to the extent that the consent covers cookies or access to information on your device, for example through device fingerprinting, within the meaning of the TDDDG. You can withdraw consent at any time.

For further information about data protection at YouTube, see Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Font Awesome (hosted locally)

This website uses Font Awesome to display fonts consistently. Font Awesome is installed locally, so no connection is made to Fonticons, Inc. servers.

Further information is available in Font Awesome’s privacy policy: https://fontawesome.com/privacy.

Google Maps

This website uses Google Maps, provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. This service allows us to display maps on our website.

Using Google Maps requires your IP address to be stored. This information is generally transferred to a Google server in the US and stored there. The website provider has no control over this transfer. When Google Maps is enabled, Google may use Google Fonts to display fonts consistently. Your browser loads the necessary web fonts into its cache so text and fonts display correctly.

We use Google Maps to present our online services attractively, verify your address and carry out know-your-customer (KYC) checks. These are legitimate interests under Article 6(1)(f) GDPR. Where we ask for consent, processing is based solely on Article 6(1)(a) GDPR and section 25(1) TDDDG, to the extent that the consent covers cookies or access to information on your device, for example through device fingerprinting, within the meaning of the TDDDG. You can withdraw consent at any time.

Transfers to the US rely on the European Commission’s Standard Contractual Clauses. Details: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

Further information about the handling of user data is available in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Ecommerce and payment providers

Processing client and contract data

The law firm processes clients’ personal data and contract data to prepare, carry out and bill for legal engagements. The UG acts as a controller for personal contract data used for its platform services and agreed cost coverage. Where the UG handles the law firm’s data solely on the firm’s instructions for technical processing, it acts as a processor. The legal basis depends on the purpose and the conditions described under “Using legal services and advice: the client questionnaire”.

Retention and deletion periods are explained under “How long we retain data”. Statutory retention requirements are applied according to the document type and the company responsible.

Data transfers for contracts involving services and digital content

We or, in connection with legal services or advice, the relevant law firm, share personal data with third parties only where necessary to perform the contract, for example with the bank handling a payment.

No further transfers take place unless you have expressly consented. Your data is not shared with third parties without express consent for purposes such as advertising.

The legal basis is Article 6(1)(b) GDPR, which permits processing to perform a contract or take steps before entering into one.

Payment services

We or, in connection with legal services or advice, the relevant law firm, integrate third-party payment services into our website. If you make a purchase through advokio.com, the payment provider processes your payment details, such as your name, the amount, bank details and credit card number, to handle the payment. Each provider’s contractual terms and privacy provisions apply. We use payment providers on the basis of Article 6(1)(b) GDPR (performance of a contract) and our interest in making payments as smooth, convenient and secure as possible (Article 6(1)(f) GDPR). Where we ask for consent to particular activities, Article 6(1)(a) GDPR is the legal basis. You can withdraw consent at any time with effect for the future.

We or, in connection with legal services or advice, the relevant law firm, use the following payment services and providers on this website:

PayPal

The provider is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”).

Transfers to the US rely on the European Commission’s Standard Contractual Clauses. Details: https://www.paypal.com/de/webapps/mpp/ua/pocpsa-full.

For details, see PayPal’s privacy statement: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Mastercard

The provider is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium (“Mastercard”).

Mastercard may transfer data to its parent company in the US. These transfers rely on Mastercard’s Binding Corporate Rules. Details: https://www.mastercard.de/de-de/datenschutz.html and https://www.mastercard.us/content/dam/mccom/global/documents/mastercard-bcrs.pdf.

VISA

The provider is Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, United Kingdom (“VISA”).

The United Kingdom is considered a third country with an adequate level of data protection, meaning that its level of protection is equivalent to that of the European Union.

VISA may transfer data to its parent company in the US. These transfers rely on the European Commission’s Standard Contractual Clauses. Details: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zu-zustandigkeitsfragen-fur-den-ewr.html.

For further information, see VISA’s privacy notice: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

Audio and video conferences

Data processing

We use online conferencing tools, among other methods, to communicate with clients, their representatives and third parties. The tools we use are listed below. If you communicate with us by video or audio conference over the internet, we and the tool provider collect and process your personal data.

These tools collect all data you provide to use them, such as your email address or telephone number. They also process the duration of the conference, the times you join and leave, the number of participants and other contextual information about the communication (metadata).

The provider also processes technical data needed to deliver the communication. This includes IP and MAC addresses, device IDs, device type, operating system type and version, client software version, camera type, microphone or speakers and connection type.

Content exchanged, uploaded or otherwise provided through the tool is also stored on the provider’s servers. This includes cloud recordings, chat and instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared while using the service.

We do not have complete control over how these tools process data. Our influence depends largely on each provider’s policies. The privacy statements linked below provide further details about the tools’ processing activities.

Purposes and legal bases

We use conferencing tools to communicate with prospective or existing contractual partners and their representatives, or to provide certain services to clients, their representatives and others (Article 6(1)(b) GDPR). They also make communication with us or our company easier and faster, which is a legitimate interest under Article 6(1)(f) GDPR. Where we ask for consent, the relevant tool is used on that basis. Consent can be withdrawn at any time with effect for the future.

Retention periods

We delete the data we collect directly through video and conferencing tools from our systems when you ask us to delete it, withdraw consent to storage or the purpose no longer applies. Cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no control over how long conferencing providers retain your data for their own purposes. Please contact the providers directly for details.

Conferencing tools we use

We use the following conferencing tool:

Microsoft Teams

We use Microsoft Teams, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Details about data processing are available in Microsoft’s privacy statement: https://privacy.microsoft.com/de-de/privacystatement.

Data processing agreement

Last updated: 6 December 2025

German is the legally binding language

The German-language privacy policy is the legally binding version. Versions in other languages are informal translations only and are not legally binding. The German-language version prevails.