1. Name and contact information of the controller
This privacy notice provides information about the processing of personal data on the website of the law firm Walch Rittberg Nagel Partnerschaftsgesellschaft von Rechtsanwälten und Steuerberatern mbB, Campus Tower HafenCity, Versmannstraße 2, 20457 Hamburg.
2. Scope and purpose of the processing of personal data
2.1 Accessing the website
When this website walchrittbergnagel.com is accessed, the visitor’s Internet browser automatically sends data to this website’s server, and these data are temporarily saved in a log file. The following data are stored without any additional entry of data by the visitor until they are automatically deleted:
– IP address of the visitor’s terminal,
– Date and time of the access by the visitor,
– Name and URL of the page accessed by the visitor,
– Website from which the visitor was referred to the firm’s website (so-called referrer URL),
– Browser and operating system of the visitor’s terminal as well as the name of the access provider used by the visitor.
The processing of these personal data is lawful pursuant to Art. 6(1) clause 1 point (f) GDPR. The firm has a legitimate interest in the processing of data to
– quickly establish the connection to the firm’s website,
– allow for a user-friendly website experience,
– detect and ensure the security and stability of the systems, and
– facilitate and improve the administration of the website.
Data are expressly not processed to gain knowledge about the person of the website visitor.
3. Data Transfer
Personal data are transferred to third parties, if
– the data subject specifically agreed to it pursuant to Art. 6(1) point (a) GDPR,
– if disclosure is necessary pursuant to Art. 6 (1) clause 1 f GDPR to enforce, exercise or defend legal claims and there is no reason to assume that the data subject has an overriding interest worthy of protection in not disclosing its data,
– there is a legal obligation to do so pursuant to Art. 6(1) clause 1 point (c) GDPR, and/or
– this is required pursuant to Art. 6(1) clause 1 point (b) GDPR for the fulfillment of a contractual relationship with the data subject.
Personal data are not transferred to third parties in any other case.
4. Cookies
The website uses so-called cookies. These cookies are data packets that are exchanged between the server of the firm’s website and the visitor’s browser. These are stored during each visit to the website by the devices that are used (PC, Notebook, Tablet, Smartphone etc.). Cookies cannot cause any damage to the devices that are used. In particular, they do not contain any viruses or other malware. The cookies store information arising in connection with the specific terminal used for a particular visit to the site. The firm cannot possibly gain any direct knowledge regarding a website visitor’s identity on the basis of the data in the cookies.
For the most part, browsers’ basic settings accept cookies. It is possible to change the browser settings so that cookies are not accepted on the devices that are used or so that the user is notified before a new cookie is set. It should be noted, however, that as a result of deactivating cookies website visitors may not have optimal use of all functions of the website.
Cookies are used to make the firm’s website easier to use. For example, with session cookies it is possible to determine whether a visitor has already visited any pages of the website before. Once a visitor leaves the website, these session cookies are automatically deleted.
Temporary cookies are used to improve user-friendliness. They are temporarily stored on the visitor’s terminal. If the website is visited again, it is possible to automatically detect that this visitor had accessed the website previously and which inputs and settings were entered so that these do not have to be repeated.
Cookies are also used to analyze website visits for statistical purposes and to improve the offers on the website. These cookies make it possible in the event of a return visit to automatically detect that the visitor had accessed the website previously. After a predetermined period of time, these cookies are automatically deleted.
The data processed by the cookies are lawful for the protection of the firm’s aforementioned legitimate interests pursuant to Art. 6(1) clause 1 point (f) GDPR.
5. Your Rights as a Data Subject
If your personal information is processed when you visit our website, you as the “data subject” as defined by the DGPR have the following rights:
5.1 Information
You may ask us for information on whether your personal data are processed by us. There is no right to information if providing the requested information would violate the duty to confidentiality pursuant to Section 57(1) StBerG or if the information must be kept confidential for other reasons, in particular due to a overriding legitimate interest of a third party. In derogation from this, there may be a duty to provide information if your interests override the interest in maintaining confidentiality, in particular in consideration of imminent damages. Furthermore, the right to information is also excluded if the data are stored only because due to legal or statutory retention periods they must not be deleted or if they only serve purposes of data backup or privacy monitoring, to the extent that providing the information would require a disproportionate amount of effort or time and the processing of the data for other purposes is prevented by suitable technical and organizational measures. If, in your case, the right to information is not excluded and we are processing your personal data, you may request from us disclosure of the following information:
– the purposes of the processing;
– categories of your personal data that are processed;
– the recipients or categories of recipients to whom your personal data will be disclosed, in particular recipients in third countries;
– where possible, the envisaged period for which your personal data will be stored, or, if not possible, the criteria used to determine that storage period;
– the existence of the right to request rectification or erasure or restriction of processing of personal data concerning the data subject or to object to such processing;
– the right to lodge a complaint with a supervisory authority for data protection;
– where the personal data are not collected from you as the data subject, any available information as to their source;
– if applicable, the existence of automated decision-making, including profiling and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such automated decision-making;
– if applicable, in the case information is transferred to recipients in third countries, if no decision has been made by the EU Commission regarding the adequacy of the level of protection pursuant to Art. 45(3) GDPR, you are entitled to information regarding which appropriate safeguards pursuant to Art. 46(2) GDPR are in place to protect the personal data.
5.2 Rectification and Completion
If you find that we have inaccurate personal data of you on file, you may request that we rectify the inaccurate data without undue delay. In the event of incomplete personal data pertaining to you, you may demand that it be completed.
5.3 Erasure
You have a right to erasure (“right to be forgotten”) unless the processing is required for exercising the right of freedom of expression and information or for compliance with a legal obligation or for the performance of a task that is in the public interest and one of the reasons below applies:
– the personal data are no longer necessary in relation to the purposes for which they were processed.
– the only legal basis for the processing was your consent, which you have withdrawn.
– You have objected to the processing of your personal data that we made public.
– You have objected to the processing of data we did not make public, and there are no overriding legitimate grounds for the processing.
– your personal data have been unlawfully processed.
– The erasure of the personal data is required for compliance with a legal obligation to which we are subject.
There is no right to erasure if the erasure in the case of legitimate, non-automated data processing is not possible or is possible only with a disproportionately great effort due to the special type of storage and your interest in the erasure is low. In this case, the data are not erased, but their processing is restricted.
5.4 Restriction of Processing
You may demand the restriction of processing if one of the following reasons applies:
– You contest the accuracy of the personal data. In this case, restriction may be requested for the time that allows us to verify the accuracy of the personal data.
– The processing is unlawful, and you request the restriction of the use of your personal data instead of their erasure.
– We no longer need your personal data for the purposes of processing, but they are required by you for the establishment, exercise, or defense of legal claims.
– You objected pursuant to Art. 21(1) GDPR. The restriction of processing may be requested for as long as it has not been verified whether our legitimate grounds override your grounds.
Restriction of processing means that such personal data shall only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. We are required to inform you before we lift the restriction.
5.5 Data Portability
You have a right to data portability if processing is based on your consent (Art. 6(1) clause 1 point (a) or on Art. 9(2) point (a) GDPR) or on a contract to which you are a party and where the processing is carried out by automated processes. The right to data portability includes in this case the following rights unless this adversely affects the rights and freedoms of other persons: You have the right to receive from us the personal data you have provided in a structured, commonly used, and machine-readable format. You have the right to transmit those data to another controller without hindrance from us. Where technically feasible, you have the right to ask us to transmit your personal data directly to another controller.
5.6 Objection
To the extent the processing is based on Art. 6(1) clause 1 point (e) GDPR (performance of a task carried out in the public interest or in the exercise of official authority) or on Art. 6(1) clause 1 point (f) GDPR (vital interests of the controller or a third party), you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. This applies as well to profiling based on Art. 6(1) clause 1 point (e) or point (f) GDPR. After exercising the right to object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise, or defense of legal claims.
You may object at any time against the processing of your personal data for purposes of direct marketing. This includes profiling to the extent it is related to such direct marketing. After you have exercised this right to object, we will no longer use the respective personal data for direct marketing purposes.
You may object informally by phone, by email, or by sending a letter to our firm to the mailing address provided at the top of this privacy notice.
5.7 Withdrawal of Consent
You have the right to withdraw consent at any time with future effect. The withdrawal may be made informally by phone, email, or in a letter sent to our mailing address. The withdrawal does not affect the lawfulness of the data processing based on consent prior to receipt of its withdrawal. Upon receipt of the withdrawal, any data processing that was based only on your consent will cease.
5.8 Complaint
If you believe that the processing of your personal data is unlawful, you may lodge a complaint with a data protection supervisory authority that is competent for the place of your residence, place of work, or place of the suspected infringement.
6. Status and Updates of this Privacy Notice
This Privacy Notice took effect on 25 May 2018. We reserve the right to update this privacy notice at any time to improve data protection and/or to adapt it to the changed practices of authorities or to case law.