Data protection

I. Privacy Policy Website

A. Basic Information

Thank you very much for your interest in our website. The protection of your privacy is very important to us. We are aware of the great importance to the protection of your personal data and your right to informational self-determination.

We´d like to inform about the collection and processing of personal data when using our website. Personal data are all data that can be related to you personally, e.g. name, address, e-mail address.

1. Controller

Responsible for data protection in accordance with Art. 4 No. 7 of the General Data Protection Regulation (GDPR):

CBH Rechtsanwälte
Cornelius Bartenbach Haesemann & Partner Partnerschaft von Rechtsanwälten mbB
Habsburgerring 24
50674 Cologne
Phone: 0221/95190-0
Fax: +49 221-95190-90
E-mail: datenschutz@cbh.de

Further information and contact details as well as additional legal notices can be found on www.cbh.de under “Imprint” and under “Contact”.

2. Data Protection Officer

You can contact our data protection officer at:

CBH Rechtsanwälte
Data Protection Officer
Habsburgerring 24
50674 Cologne
Phone: 0221/95190-0
E-mail: dsb@cbh.de

3. Data and system security

We protect our website and systems making use of technical and organizational measures against loss, destruction, access, modification or distribution of your data by unauthorized persons.

In connection with access to our website, data that may allow identification (e.g. IP address) is temporarily stored on our servers for data and system security purposes, but in principle for no longer than 30 days. The processing of possibly personal data for data and system security purposes is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR and our legitimate interest in securing our systems and preventing misuse.

4. Principles for the storage and deletion of personal data

Personal data will only be processed for the period required to achieve the respective storage purpose or if this is provided for in the laws or regulations applicable to us, e.g. commercial or tax storage obligations. If a storage purpose (e.g. in case of cancellation of our newsletter service) or a legally prescribed storage period expires, affected personal data will be deleted routinely and according to the legal regulations or their processing is restricted, e.g. limited processing within the scope of commercial or fiscal storage obligations.

The processing of personal data on the basis of a legal obligation, namely the fulfilment of legal storage obligations, is based on Art. 6 para. 1 sentence 1 lit. c GDPR. If and to the extent that personal data pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR is processed for the purpose of preserving evidence, these processing purposes shall cease after expiry of the statutory limitation periods; the statutory regular limitation period shall be three years.

For further details on specific storage and deletion periods, we also refer to respective service descriptions or information in this data protection declaration.

B. Visiting our website

If you use our website for information purposes only, i.e. if you do not register for our newsletter or do not otherwise provide us with personal information, we may collect personal data that your browser transmits to our server. For the purposes of web analysis, we also use tracking technologies to the extent described below.

1. Technical provision

When you visit our website, we collect the following data, which is technically necessary for us to display our website to you and to guarantee the stability and security of our online offer:

IP address
date and time of the request
Time zone difference to Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
the amount of data transferred in each case
Website from which the request comes
Browser
Operating system and its interface
Language and version of the browser software.

The legal basis for this collection and processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest refers to the provision of a functional website and its system security. In addition, we use the aforementioned data in non-personal form for statistical purposes and to improve our online services.

2. Cookies

Our website uses cookies. Cookies are small text files that are stored on a computer system via an Internet browser.

Many websites and servers use cookies. Cookies often contain a so-called cookie ID. Such an ID is a unique identifier for the cookie and consists of a string of characters through which websites and servers can be assigned to a specific Internet browser in which the cookie was stored. Such cookies make it possible to distinguish your individual browser from other Internet browsers that contain other cookies. A particular Internet browser can therefore be recognized and identified by a unique cookie ID.

By using cookies, we can provide you with more user-friendly services that could not or only to a limited extent be implemented without cookies. We have limited the use of cookies to so-called essential cookies, which are necessary for the provision of a functional and comfortable online service; this concerns in particular a cookie for the language settingsa, a cookie for the realisation of a site-related lawyer search as well as a cookie for the realisation of an opt-out in the context of the web analysis tool used by us (cf. below under point 3 web analysis). Cookies are used on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. In this respect, we have a legitimate interest in the provision and optimisation of functional and convenient online services.

You can prevent the setting of cookies by setting your Internet browser and thus permanently object to the setting of cookies. In addition, cookies that have already been set can be deleted via an Internet browser or other software programs. However, please note that if you deactivate cookies in your Internet browser, you may not be able to use all the functions of our and other online services.

3. Web analysis

On our website we use the open source software tool Matomo (formerly PIWIK) to analyse the surfing behaviour of our users. We use Matomo without the use of tracking cookies. We have deactivated the use of tracking cookies in the basic configuration of Matomo in order to ensure a particularly data protection-friendly procedure. If individual pages of our website are accessed, the following data is stored:

two bytes of the IP address of the user’s calling system
called up web page
website from which the user has accessed the accessed website (referrer)
subpages that are called up from the called up web page
time spent on the website
frequency with which the website is accessed

The software runs exclusively on the servers of our website. The data of a website visit is only stored there. Matomo is set so that the IP addresses are not completely stored, but 2 bytes of the IP address are masked (e.g.: 192.168.xxx.xxx ). In this way it is no longer possible to assign the shortened IP address to the calling computer.

The legal basis for the processing of users’ personal data is Art. 6 para. 1 sentence lit. f GDPR. The processing of users’ personal data enables us to analyse the surfing behaviour of our users. We are in a position to compile information about the use of the individual components of our website by evaluating the data obtained. This helps us to continuously improve our website and its user-friendliness. For these purposes, it is also in our legitimate interest to process the data in accordance with Art. 6 para. 1 lit. f GDPR. By anonymizing the IP address, users’ interest in protecting their personal data is sufficiently taken into account.

The data will be deleted as soon as they are no longer needed for our recording purposes. In our case, this is the case after 12 months.

You have the option to make use of a separate out-out on our website. In this case a cookie is placed on your system, which signals to our system not to store the user’s data:

Status/opt-out

C. Use of Services

Personal data is collected and processed when you provide it when you subscribe to our newsletter service or communicate with us using the contact options provided (e.g. for recruiting).

1. Communication

On our website we offer various ways to get in touch with us and to send us messages. In particular, you can also contact us by telephone or e-mail.

If you contact us accordingly, we will store and process the data you provide (e.g. your e-mail address, if applicable your name and your telephone number) in order to process your request. The legal basis in this respect is Art. 6 para. 1 sentence 1 lit. b and f GDPR. Our legitimate interests refer to an efficient and structured collection and processing of inquiries. We delete the accruing data after the storage is no longer necessary, or limit the processing, if legal storage obligations exist.

2. Online meetings

We use the tool “Jitsi” to conduct telephone conferences, online meetings, video con-ferences and/or webinars (hereinafter: “online meetings”). “Jitsi” is an open source software for online meetings, which we have installed and operate on our own server.

If you participate in a “Jitsi” meeting, you will be asked for your name at the beginning of the meeting. This name is processed for the duration of your participation in the respective online meeting and then deleted. Also, any audio, video or chat content will only be processed during that online meeting.

In order to be able to conduct the online meeting, the IP address used by your end device is processed. When setting up an online meeting, a name for the online meet-ing is selected by the organizer. In addition, a password can be provided for participa-tion in the online meeting. This data is only processed until the end of the respective online meeting and then deleted. Please note, however, that the name of “Online Meeting” as well as the date, time and duration of the “Online Meeting” can be stored locally in your browser. If you no longer wish to see these data, you should delete your browser cache.

You can optionally enter an e-mail address. This e-mail address will then be used to retrieve and display a profile photo from the “Gravatar” service. Gravatar profile pho-tos will only be displayed if a public Gravatar image can be retrieved for the e-mail address provided. If you have provided an email address in the “Online Meeting”, the Gravatar service of Automattic Inc. (USA) is called. The use of “Gravatar” does not constitute order processing for us. The provider himself determines the purpose and means of data processing. If you have created an account with “Gravatar”, these terms and conditions apply.

3. Newsletter

If you subscribe to our newsletter, we collect and process personal data for sending you advertising information, in particular information on the topics you may have selected when you subscribed to our newsletter as well as information on events and special offers or campaigns of our company.

Registration is based on consent. Only your e-mail address is mandatory. Optional information (surname, first name, preferred information) is voluntary and serves to address you personally and more individually. For the registration to our newsletter we use the so-called double opt-in procedure. This means that after your registration we will send you an e-mail to the e-mail address you provided, in which we ask you to confirm that you wish to receive our newsletter via the e-mail address you provided.

We use your data transmitted for the registration to the newsletter for the purpose of the delivery of our newsletter. In addition, the following data is collected upon registration: IP address of the calling computer, date and time of registration. This data is collected and stored in order to demonstrate that effective consent has actually been given by the respective user and that the double opt-in procedure has been properly carried out.

The legal basis for the processing of your data for the purpose of carrying out the newsletter service is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. Insofar as the registration for our newsletter is technically documented, the legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interests refers to the documentation of the proper collection and/or execution of the double opt-in procedure.

The data collected when subscribing to the newsletter will only be stored as long as the subscription to the newsletter is active. The subscription to the newsletter can be cancelled by the user concerned at any time. For this purpose, there is a corresponding unsubscribe link in every newsletter. You are also welcome to contact us using your e-mail address registered for the newsletter; simply use the contact data provided in this data protection declaration.

4. Seminars and events

From time to time we offer visitors to our website the opportunity to register for seminars and other events (hereinafter referred to as seminars) of our firm via an online form. Any conditions of participation will be provided with the registration form.

We process personal data of interested parties who register for seminars (hereinafter: seminar participants) in accordance with Art. 6 para. 1 sentence 1 lit. b and f DS-GVO. Processing includes, among other things, the processing of personal data for correspondence purposes and for the purposes of organising and conducting seminars. Our legitimate interest lies in the optimised organisation and implementation of seminars of an individual nature. Data processing is also carried out in accordance with Art. 6 para. 1 sentence 1 lit. c DS-GVO for the purposes of fulfilling legal obligations, in particular the fulfilment of statutory storage obligations, as well as in accordance with Art. 6 para. 1 sentence 1 lit. f DS-GVO for documentation and preservation of evidence. In addition, CBH processes personal data of seminar participants pursuant to Art. 6 para. 1 sentence 1 lit. f DS-GVO for customer relations purposes. This data processing is based on legitimate interests of CBH in optimizing its consulting services in order to provide seminar participants with information tailored to their interests and needs and to refine CBH’s consulting and service offering. For the right of objection against data processing for direct marketing purposes see below under Part D clause 8.

As a matter of principle, we only process data of seminar participants which are collected by us directly in relation to the seminar participant (e.g. acceptance or registrations, etc.). Personal data of seminar participants will only be passed on to third parties within the scope of the seminar, as far as this is necessary for the execution of seminars (e.g. creation of personalized documents, name badges, etc.).

5. Career

Under section “Career” of our website we inform about our job offers and training opportunities. You can send us your application documents via the e-mail addresses provided in each case. When sending confidential information, please ensure that it is sent securely in your own interest or use the option of sending password-protected files.

The personal data transmitted within the scope of an application will be processed for the purpose of processing corresponding enquiries or applications. If an employment contract is concluded, the data transmitted will be stored and further processed for the purpose of processing the employment relationship in accordance with the statutory provisions. If no employment relationship is concluded, the application documents will be deleted as soon as further storage is no longer necessary to safeguard our legitimate interests, basically six month following to the end of application procedure. A legitimate interest in this sense exists in particular with regard to a burden of proof in a possible procedure according to the General Equal Treatment Act (AGG). The legal basis for processing is Art. 6 para. 1 sentence 1 lit. b and f GDPR.

D. Rights of the data subject

We would be happy to inform you about your rights under the GDPR as “data subject”. Thereafter, you have the following rights with respect to the personal data that concerns you:

right of access (Art. 15 para. 1, 2 GDPR)
right to rectification (Article 16 GDPR) and right to erasure (Article 17 GDPR)
the right to restriction of processing (Article 18 GDPR)
right to data portability (Art. 20 GDPR)
right to object (Article 21 GDPR)
Right to withdraw (Art. 7 para. 3 GDPR)
right
lodge a complaint with a supervisory authority (Art. 77 GDPR)

In addition, we summarise the key points of the rights of those affected under the GDPR. Please, be aware that this presentation is not exhaustive, but merely addresses basic information of the rights under the GDPR:

1. Right of access by the data subject

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
the right to lodge a complaint with a supervisory authority;
where the personal data are not collected from the data subject, any available information as to their source;
the existence of automated decision-making, including profiling, referred to in Art. 22 para. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

2. Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3. Right to restriction of processing

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
the data subject has objected to processing pursuant to Article 21 para. 1 GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

4. Right to erasure

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws consent on which the processing is based according to Art. 6 para. 1 sentence 1 lit. a GDPR or Art. 9 para 2 lit. a GDPR, and where there is no other legal ground for the processing;
the data subject objects to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 para. 2 GDPR;
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
the personal data have been collected in relation to the offer of information society services referred to in Art. 8 para. 1 GDPR.

5. Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: the processing is based on consent pursuant to Art. 6 pra. 1sentence 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR; and the processing is carried out by automated means.

In exercising his or her right to data portability pursuant to paragraph Art. 20 para. 1 GDPR, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

6. Right to withdraw

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.

7. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes GDPR.

The data protection supervisory authority responsible for us is: LDI – Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf.

8. Rights to object (Art. 21 (1), (2) GDPR

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

E. Contact

You can contact us at any time to exercise your rights as a data subject or if you have general questions about data protection: