Privacy

1. Controller

For privacy enquiries and to exercise your rights, please use the contact details above. No data protection officer has been appointed.

2. Website and hosting

The website is provided through OpenAI's ChatGPT Sites. Visits involve processing technical connection data, including your IP address, the pages and files requested, the time of access and device and browser information transmitted by your browser. This processing enables delivery of the website, troubleshooting and protection against attacks and misuse.

The legal basis for providing and securing the website at my request is Article 6(1)(f) GDPR. My legitimate interest is in maintaining a functional and secure website for my law practice.

Where OpenAI processes data on my behalf to provide the website, it acts as a processor. OpenAI uses further service providers, including Cloudflare for delivery and hosting. Details of the companies involved and processing locations are provided in OpenAI's subprocessor list.

Cookies, content and audience measurement

This law firm's website contains no analytics or advertising services integrated by me. Images and the logo are delivered with the website; there are no embedded external fonts, maps, videos, social media plugins or contact forms. The menu and navigation do not themselves store information on your device.

The hosting and sign-in platform's technical functions are separate. Where storing or accessing information on your device is strictly necessary to provide a service you have expressly requested, section 25(2), no. 2 TDDDG applies. Operations requiring consent need prior consent under section 25(1) TDDDG.

3. Access through ChatGPT

If access to this website is restricted, you must sign in through ChatGPT. The platform processes account and sign-in data for authentication and access control. The law firm's website has no separate user accounts, upload area or storage of user profiles.

Where OpenAI acts as a controller for its own platform and account purposes, the following also apply: OpenAI's European privacy policy and the legal bases, retention rules and data subject rights described there. OpenAI explains platform cookies in its cookie policy.

Technical cookies of the Sites platform

OpenAI lists the following technical cookies for ChatGPT Sites, among others. Whether a particular cookie is set depends on the sign-in and access process; the lifetimes shown are those published by the provider:

• __Host-oai-sib: platform functionality, up to 365 days.
• chatgpt_sites_siwc_login_<state>: sign-in, up to 10 minutes.
• chatgpt_sites_siwc_session and __Host-chatgpt_sites_session: session and sign-in, up to 400 days.
• sites_preview_token: access security, for the session.

4. Contact by email or telephone

When you contact me, I process the information you provide, particularly your name, contact details and details of your matter, to respond to your enquiry and, where appropriate, prepare or carry out an engagement.

For enquiries relating to an engagement, the legal basis is Article 6(1)(b) GDPR. I handle other enquiries under Article 6(1)(f) GDPR; the legitimate interest is in dealing with communications addressed to me. Article 6(1)(c) GDPR applies where processing is necessary to comply with legal obligations. Special categories of personal data are processed under Article 9(2)(f) GDPR where necessary for the establishment, exercise or defence of legal claims.

Getting in touch is voluntary. Without the information needed to reply or assess your matter, I may be unable to handle your enquiry, or able to do so only to a limited extent. Clicking the email link opens your email application; messages are not sent through a form on this website. If an engagement is established, you may receive additional privacy information.

5. Recipients and international transfers

Hosting, infrastructure and communication providers are used for technical operations and communications. They receive data to the extent necessary for their tasks. Additional recipients may be involved in an engagement, such as courts, authorities or parties to proceedings, where necessary for the engagement or legal obligations. Professional confidentiality must be observed.

Hosting and use of the platform may involve processing outside the European Economic Area, particularly in the USA. Under OpenAI's published data processing terms, such transfers rely on an applicable adequacy decision under Article 45 GDPR or appropriate safeguards, particularly standard contractual clauses under Article 46 GDPR. You can request information about these safeguards using the contact details above.

Further information: OpenAI's data processing terms and additional terms for ChatGPT Sites.

6. Retention periods

The processing period depends on the purpose. For technical operational data, the relevant purposes are providing the website, detecting faults and investigating security incidents. Longer retention may be appropriate, particularly when investigating specific incidents or complying with legal obligations.

Correspondence is retained for as long as necessary to handle your enquiry or an engagement. Subsequent retention is determined by statutory requirements and the need to establish, exercise or defend legal claims. Data is deleted when these grounds no longer apply. OpenAI's linked retention rules apply to account and platform processing for which it acts as controller.

7. Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR. Where processing relies on your consent, you may withdraw it at any time with effect for the future. Statutory restrictions, particularly those protecting professional confidentiality and the rights of others, remain unaffected.

Right to object

Under Article 21 GDPR, you may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. Processing will then cease unless overriding compelling legitimate grounds apply or it serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons.

Right to lodge a complaint

Under Article 77 GDPR, you may complain to a data protection supervisory authority, particularly in the place of your habitual residence, place of work or the alleged infringement. For the Munich law practice, the Bavarian State Office for Data Protection Supervision is one relevant authority:

Automated decisions

I do not use solely automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR, or corresponding profiling, to handle your enquiry or provide this law firm's content.

8. Security and updates

The website is delivered over encrypted HTTPS. This policy will be updated if the website's functions or the relevant processing change.