Privacy

Controller

The controller responsible for processing your personal data is the firm:

German lawyers Dr. Schwöbbermeyer and Blase
Civil-law partnership under German law (Gesellschaft bürgerlichen Rechts – GbR)
Partners: Rechtsanwalt Dr. Friedrich-Wilhelm Schwöbbermeyer and Rechtsanwalt Michael Blase
Kaiserstraße 23
33790 Halle (Westfalen), Germany

Telephone: 05201 818870
Email: info@dr-schwoebbermeyer.de

You can contact both lawyers using these details for data protection questions and to exercise your rights. The firm has not appointed a data protection officer. The competent supervisory authority is identified below under “Right to lodge a complaint”.

Website access and hosting

Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When you access it, data processed includes your IP address, date and time, the requested page or file, response status, and browser and operating system information. Depending on your browser settings, the previously visited page may also be transmitted. This data is used to deliver the website, maintain technical stability, and detect and prevent abuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of our website. IONOS processes hosting data as a technical service provider.

IONOS states that technical hosting logs are retained for no more than seven days. For access logs made available on the webspace under the existing hosting contract, however, IONOS describes availability for up to eight weeks and anonymised IP addresses. These different types of logs must be distinguished from the transmission records described below. The IP address is nevertheless technically processed during the connection. We do not combine hosting logs with form data for advertising purposes. Further information is available in the IONOS information about log files.

Collection and use of data when you contact us or enquire about representation

If you contact us by telephone, email or the online form, we process the contact details and information about your matter that you provide. In particular, the form collects your name, email address or telephone number, selected practice area, description and, where applicable, details of other parties, correspondence, deadlines, appointments and the documents you attach.

Processing serves to answer your enquiry, assess whether instructions may be accepted, including checks for professional conflicts of interest, and contact you. For the advice or representation you request, Article 6(1)(b) GDPR provides the legal basis for necessary pre-contractual processing. Checks required by law are based on Article 6(1)(c) GDPR together with the applicable statutory duty. Other correspondence and necessary information about other parties are processed under Article 6(1)(f) GDPR insofar as our interests in handling the enquiry and assessing and protecting legal claims prevail.

We process health data and other special categories of personal data to assess and handle legal claims insofar as necessary under Article 9(2)(f) GDPR. Data about criminal convictions and offences is additionally subject to Article 10 GDPR; it is processed only within legally permitted legal practice and with respect for lawyers' professional confidentiality. Please limit the information and documents you provide to those necessary for your matter.

Providing your information is voluntary. Without a means of contact and sufficient information, we may be unable to deal with your enquiry. The form does not require consent to advertising or visitor analytics. The acknowledgement checkbox confirms only that your attention has been drawn to this privacy notice.

Submitting an enquiry does not establish a lawyer–client relationship or mean that we have assumed responsibility for meeting any deadline. If a deadline is approaching, please also contact us by telephone.

Where we receive personal data about other parties, this generally comes from your account and the documents you submit, and later, where applicable, from correspondence with courts, authorities or other parties to the proceedings. We use it only insofar as necessary to handle the matter, check conflicts or protect legal claims. Information and access duties are fulfilled taking account of lawyers' professional confidentiality and statutory exceptions, particularly Article 14(5) GDPR and section 29 of the German Federal Data Protection Act (BDSG).

Encryption of the online form

Your details and selected files are processed in the memory of the open form page. The website does not save this content in the browser's local storage. On submission, your browser encrypts the form details, file names and file contents using the public key of the enquiry mailbox. The library used for this purpose is loaded from our own webspace.

The encrypted message is transmitted over HTTPS to the hosting server and stored in a dispatch queue that is not publicly accessible. Automatic dispatch runs every five minutes and forwards the message via Proton to our separate enquiry mailbox. The firm decrypts it for handling. The private decryption key is not stored on the webspace for this process.

IP addresses and other connection data, the recipient address, enquiry reference and dispatch status are technical metadata; content encryption does not conceal them. To limit abuse, our application generates a cryptographic verification value from the IP address and the hour. The original IP address is not stored in the application's own dispatch files. The verification value remains until the relevant dispatch record is deleted. The legal bases are Article 6(1)(b) GDPR for transmitting your enquiry and Article 6(1)(f) GDPR for security and protection against abuse.

The website confirms receipt once the server has accepted the enquiry. Forwarding it to the mailbox and the lawyers' assessment are subsequent steps. An ordinary email to the firm is not automatically end-to-end encrypted by the form's encryption system.

Disclosure to third parties, service providers and international transfers

Access to enquiry documents is restricted to the lawyers handling the matter and authorised firm employees. Technical service providers may process data to the extent necessary for hosting, communications and backups.

For email and additional backups using Proton Drive we use Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. Switzerland is covered by a European Commission adequacy decision under Article 45 GDPR. Contractual requirements concerning subprocessors and further international transfers are described in the Proton Data Processing Agreement . For transfers outside countries providing an adequate level of protection, it specifies standard contractual clauses or other legally permitted transfer mechanisms. Information about the service providers involved is also provided in the Proton Mail privacy policy and Proton Drive. You may request copies of the relevant safeguards from us.

Documents may be stored on the firm's server for internal assessment and handling. Local backups are made to protect against data loss; one local backup is additionally synchronised with Proton Drive. The online form does not upload files directly to Proton Drive.

If instructions are accepted, data necessary for advice and representation may be transmitted, in particular, to courts, authorities, the other party and their representatives, and other bodies required for handling the matter. The legal basis and extent depend on the specific instructions and statutory duties. Lawyers' professional confidentiality remains applicable.

Retention and deletion

We retain personal data only for as long as necessary for the relevant purpose, to comply with statutory duties, or for the establishment, exercise or defence of legal claims. The following periods and criteria apply to the individual processing activities:

• Website enquiry mailbox: Our separate enquiry mailbox is used to receive and technically dispatch website enquiries. Automatic purging of all messages after 30 days is configured for the corresponding user. This does not depend on whether instructions are accepted. Necessary documents are transferred to the firm's general or client records before purging so that the matter can be handled. Further personal correspondence takes place through our general firm mailbox.
• Transmission via the webspace: Once acceptance by the mail server has been confirmed, the encrypted message copy is removed from the dispatch file. Successfully completed dispatch records are deleted after seven days during the next automatic run. Pending, failed or uncertain dispatch processes are retained to investigate errors. The application contains no automatic deletion period for these records; retention must be limited to necessary error investigation and any required evidence.
• Other enquiry documents and correspondence: The 30-day mailbox period does not automatically apply to copies held in the firm's records or to subsequent correspondence. After the enquiry has been dealt with, these are deleted once they are no longer needed for handling the matter, specific legal claims or statutory duties. The retention period for client files does not apply indiscriminately to enquiries where no instructions were accepted. For the firm's other mailboxes, a separate technical rule purges already deleted messages after ten years. This technical rule does not establish a general duty or entitlement to retain every message for ten years; necessary deletions must be assessed independently.
• Client files: Where instructions have been accepted, client files are generally retained for six years from the end of the calendar year in which the instruction ended (section 50 BRAO). Other statutory retention periods and further retention necessary to protect legal claims remain applicable.
• Backups: Purging an active mailbox does not simultaneously delete every backup and working copy. Proton describes encrypted offline backups retained for up to 30 days. Local backups, synchronised copies, recycle bins and older file versions must be considered separately. Their retention depends on the need for recovery and the legal requirements applicable to the backed-up data. Restoring data that is no longer needed must not cause it to be retained permanently in the active records again.

Retention periods for hosting logs, cookie settings and Analytics are described in the relevant sections. You may contact the firm at any time to request erasure; statutory exceptions are assessed individually.

Cookies and local storage

We store your privacy choice, its timestamp and the settings version for 180 days in your browser's local storage under kanzlei-cookie-settings-v5. This entry contains no form data. Once it expires, we ask you to make a new choice when you visit again. If browser storage is blocked, your choice applies only to the open page. Storing your requested choice is based on section 25(2), no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6(1)(f) GDPR; our legitimate interest is to respect your privacy choice reliably.

Statistics are optional and initially switched off. You can change your choice and withdraw consent to statistics with effect for the future at any time using “Cookie settings”. On withdrawal, ongoing measurement stops, the page reloads and the Analytics cookies used by our integration are deleted on this device. Previous processing remains unaffected. The enquiry form works independently of consent to statistics. Google Ads, remarketing, external font files, embedded maps and review widgets are not loaded.

Open cookie settings

Google Analytics – optional visitor analytics

If you consent to statistics, we use Google Analytics 4 (measurement ID G-C45WKEWMT5) to analyse visits to general information pages. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing includes selected page views, timestamps, pseudonymous cookie identifiers, technical browser and device information, and usage data. The IP address is technically processed during the connection; Google states that individual IP addresses are not logged or stored in GA4. Visitor analytics therefore does not equate to completely anonymous browsing.

The legal bases are your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Without consent, no Google tags are loaded and no analytics signals are sent to Google (Basic Consent Mode). We measure only selected general pages using predefined labels. The enquiry form page, form entries, documents, enquiry references and details of individual matters are not sent to Analytics. Our integration does not transmit URL query parameters or referring pages as page information. Additional automatic interaction measurement, Google Signals and advertising personalisation are not used.

Analytics may set the cookies _ga and _ga_… to recognise a browser on measured pages. Our integration limits their duration to 180 days and does not extend it on every visit. The privacy choice also applies for 180 days. Renewed consent may start a new storage period. We have set retention of personal user and event data to two months in each case. Resetting that retention period upon new user activity is disabled. This setting does not limit retention of aggregated standard reports. Deleting a cookie does not automatically erase data already sent to Google retrospectively; please contact us to exercise your data protection rights.

Google may also process data in the United States, particularly through Google LLC. For transfers to appropriately certified US companies, the EU–US Data Privacy Framework provides an adequacy decision under Article 45 GDPR. Google describes additional contractual safeguards, including standard contractual clauses, in its data processing terms. Information and safeguards are available in the Google data processing terms, the Google privacy policy and the information about privacy in GA4. You may request copies of the relevant safeguards from us.

External links

Links to Google, OpenStreetMap or other external websites connect to their providers only when you follow those links. No maps or Google review widgets are embedded here. Processing on the websites you visit is governed by their own privacy notices. Telephone and email links open the application configured for that purpose on your device.

Your data protection rights

Subject to the statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future; processing before withdrawal remains lawful (Article 7(3)).

For requests concerning your data, please contact info@dr-schwoebbermeyer.de. Statutory restrictions, particularly those protecting the rights of others and lawyers' professional confidentiality, remain applicable.

Right to object

Where we process data under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation (Article 21(1)). We then cease processing that data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving particular grounds.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, place of work or the alleged infringement (Article 77 GDPR). In North Rhine-Westphalia, you can contact the State Commissioner for Data Protection and Freedom of Information, Postfach 20 04 44, 40102 Düsseldorf, through the LDI NRW contact page.

No automated decision on accepting instructions

The firm assesses your enquiry and decides whether to accept instructions. No decision based solely on automated processing with legal or similarly significant effects within Article 22 GDPR, and no corresponding profiling, takes place.

Privacy notice last updated: 4 October 2026.