Privacy notice

1. Controller

Email: info@kanzlei-hajjo.de
Telephone: 030 644 62 694

You may also use these contact details to exercise your data protection rights.

2. Website, hosting and email

The website and office email are provided through ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf. The provider processes technical access data and emails transmitted and stored through its systems.

Website requests transmit, in particular, your IP address, time of access, requested file, access status and technical browser details. Depending on the request, this includes the referring page. Processing serves website delivery, troubleshooting and protection against misuse. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is the secure and functional operation of the website.

The hosting provider receives data needed for hosting and email in its capacity as a processor. The legal basis for processing email contents depends on the matter, as explained below.

3. Contact and contact form

When you contact me by form, email, telephone or fax, I process your contact details and information to respond, assess whether I can accept the matter and check conflicts of interest, and where appropriate prepare an engagement. Processing necessary for steps requested before a contract or for an engagement is based on Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR; the legitimate interest is appropriate communication.

Legal duties, particularly professional obligations, are fulfilled under Article 6(1)(c) GDPR. If special categories of personal data, such as health data, are needed to establish, exercise or defend legal claims, Article 9(2)(f) GDPR additionally applies.

The form requires your name, email address and a brief description of your matter. Telephone number, topic and deadline are optional. I use a provided telephone number for questions about your enquiry. Providing data is not a statutory requirement; however, the form cannot be submitted without the required fields. You may instead contact me by telephone or email. Please send detailed documents and particularly sensitive information only after agreeing on a suitable transmission method.

Form details are transmitted to the web server and then emailed to the office. No separate form database is maintained. Your enquiry is not automatically forwarded to network partners; this happens only after agreement with you. An enquiry alone does not create an engagement or acceptance of responsibility for deadlines.

Form security

Submitting the form creates a necessary session cookie called “hajjo_contact”. It contains a random session identifier and protects against cross-site form requests. It is intended to last for the browser session; session restoration features may retain it longer. Its security token is valid for at most one hour and is invalidated after successful acceptance for sending.

Access to your device is necessary for the expressly requested form function (section 25(2), no. 2 TDDDG). Processing for form security is based on Article 6(1)(f) GDPR. No external CAPTCHA is used.

To limit automated enquiries, the server also stores a pseudonymous check value calculated from the IP address and the times of sending attempts, without message content. Up to five attempts per hour are allowed. Expired check files are cleared on the next valid sending attempt; without another request, deletion at a fixed time is not guaranteed. This value is not used for visitor profiling.

4. Retention periods

Retention depends on the purpose and type of data:

• Technical access data: Data is processed for as long as needed to deliver and securely operate the website. Security incidents may require retention for investigation and legal action. The hosting provider manages storage and clearing of server logs.
• Enquiries not followed by an engagement: After final handling, data is deleted once no longer needed for the enquiry, legal duties, or pursuing or defending claims. Applicable limitation periods are particularly relevant to the latter.
• Engagement-related documents: Lawyer case files are generally retained for six years under section 50 BRAO, starting at the end of the calendar year in which the engagement ended. Statutory exceptions and other duties for particular documents, especially tax retention duties, must also be considered. Legally required retention is based on Article 6(1)(c) GDPR.
• Form security: The session cookie, security token and check files have the lifetimes and clearing arrangements described above.

5. External map and links

The map loads only when you select “Load external map”. This gives consent to connection with the map provider under Article 6(1)(a) GDPR. Any non-essential access to your device is based on section 25(1) TDDDG. You can use the website and directions fully without this consent.

The provider is the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. Map tiles load directly from tile.openstreetmap.org. The provider receives, in particular, your IP address, technical connection data and potentially a referrer to this website. The map does not request your device location.

Transfers to the United Kingdom are covered by a European Commission adequacy decision under Article 45 GDPR. OpenStreetMap also uses a worldwide network of cache servers; exclusively European processing is therefore not assured. Further details about the provider’s processing, service providers and retention periods are in the OpenStreetMap Foundation privacy policy. Information about the adequacy decision is published by the European Commission.

Your choice is not stored permanently. “Hide map” withdraws consent for the future and ends the embedded display, without affecting the lawfulness of earlier processing. The map will again be disabled on the next page load.

“Directions to the office” opens Apple Maps. Other external links lead to transport operators, courts, professional bodies and the cooperating law firm, among others. External pages are contacted only when you open their links. Their providers’ privacy notices then apply.

6. Cookies, fonts and analytics

The website has no advertising or analytics trackers. The firm sets no cookies apart from the necessary session cookie when the contact form is used. These functions do not require general cookie consent. The external map requires separate consent as explained above.

Fonts, photographs, logos and map display software load from our own web server. No external fonts or embedded social media elements are used. This website and form do not carry out automated decision-making, including profiling, within Article 22 GDPR.

7. Your rights

Subject to statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). In particular, statutory retention and lawyers’ confidentiality obligations may limit individual rights.

Objection: For processing based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation.

Withdrawal: You may withdraw consent at any time for the future, without affecting earlier lawful processing. For the map, use “Hide map”; otherwise use the contact details above.

Complaint: You may complain to a data protection authority, in particular where you usually live or work or where the alleged infringement took place. The authority responsible for this firm is the Berlin Commissioner for Data Protection and Freedom of Information.