Source: https://www.brp.de/en/footer/data-protection/
Timestamp: 2019-04-19 07:14:55+00:00

Document:
On the one hand, your personal data will be collected when you communicate them to us. This could e.g. be data that can be entered on our website, e.g. when registering for a newsletter or data that you transmit to us in the course of a request. As far as certain input fields are designated as “required information”, we use these fields to collect the data necessary for contractual performance or to perform the action requested. Of course, you may provide us with additional data if you desire. On the other hand, our IT systems automatically collect data when you are visiting the website (for more information, please see clause 5 onwards).
Your personal data will be processed and stored to satisfy the existing contract with you or to carry out the actions that you request, e.g. preparing a quote, answering a contact request (Art. 6 para. 1 sentence 1 lit. b GDPR and for advertising purposes (Art. 6 para. 1 sentence 1 lit. f GDPR; please also read clause 2 for more information). Your personal data will be deleted once it is no longer necessary to satisfy a specific purpose. If statutory retention periods exist, the data will be locked until the retention periods expire and will then be deleted. A retention that goes beyond the statutory retention periods is possible, if you have given consent hereto (Art. 6 para. 1 sentence 1 lit. a GDPR) or if the retention purpose has not yet ceased.
You may object to the use of your personal data for advertising purposes respectively withdraw your consent at any time – in each case with effect for the future – in writing, by fax, email, phone without incurring any costs other than the transmission costs according to the basic tariffs.
This applies in particular to email newsletters, for example with information concerning our services. We will only send you an email newsletter if you have consented to the use of your data for this purpose or if we have a legitimate interest (particularly in direct advertising) pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
The delivery of our e-mail newsletter is partly carried out by CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede ("CleverReach"). CleverReach is a service provider bound by instructions who is obliged to comply with data protection regulations and may not use the data for any other purpose.
You can unsubscribe from an email newsletter at any time with effect for the future, either by clicking the link provided for this in every email newsletter or by contacting us directly at newsletter-cancel(at)brp.de.
If you make use of your right of objection, we save the address data mentioned in order to implement your objection in a "blocking list". If you wish your data to be completely deleted, we would like to point out that in the event of a new collection of your data, your objection may not be known and your data may again be processed for advertising purposes.
In principle, your personal data is known only to those persons who handle processing your inquiry and sending the newsletter. Your personal data will only be transferred to third parties to the extent that this is necessary for the purpose of contractual performance, if you have expressly agreed to the transfer or the data protection law permits such transfer. However, only the data necessary will be transferred.
Categories of recipients of personal data are providers of web analytics services, the sender of email newsletters and the Internet and Typo3 agency for the website. In these cases, our data processing is done with a service provider who is governed by instructions, who is obligated pursuant to the data protection law provisions and who may not use the data for another purpose.
Subject to certain conditions, you have the right to receive information free of charge concerning the personal data stored by us, to have incorrect data rectified and to demand the erasure, restriction of processing and portability of your personal data.
You can object to the use of your data for direct marketing purposes at any time with effect for the future; you may also object to the use of the data based on Art. 6 para. 1 lit. e or f GDPR for reasons relating to your particular situation at any time with effect for the future, without incurring any costs other than the transmission costs according to the basic tariffs.
However, in some cases we are not allowed to delete user data completely due to statutory retention requirements.
We also wish to refer you to your right lodge a complaint with a supervisory authority. The competent supervisory authority for us is the State Commissioner for Data Protection and Freedom of Information (Landesdatenschutzbeauftragter) in Baden-Württemberg, Königstraße 10a, 70173 Stuttgart.
Cookies are small text files that are stored on your computer. Most of the cookies that we use are deleted from your hard drive again after the browser session ends (referred to as session cookies). Other cookies remain on your computer and enable us to recognise your computer at your next visit (referred to as permanent cookies). Of course, you also have the option to view our website without cookies. Most browsers accept cookies automatically.
You can object to the data processing at any time with effect for the future. This is done most easily if you prevent cookies from being stored on your hard drive by selecting “do not accept cookies” in your browser settings. However, it is possible in this case that you will not be able to use all of the functions on our website to their full extent.
When you visit our site, the access data is stored on the server. This data includes e. g. browser type and version, operating system used, the website visited prior to ours, the date of access and time of the server request as well as the client’s file request (file name and URL). We use this data in anonymised form for statistical analyses, whereby an attribution cannot be made to the respective user.
The purpose of this data processing is to enable the website to be viewed and displayed correctly on your device and to optimise our website. We have a legitimate interest in this respect. The processing is based on Art. 6 para. 1 sentence 1 lit. f GDPR and §15 TMG.
We operate a so-called fan page (hereinafter "Facebook page") on the social media network Facebook of Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland, on which we inform about news from our law firm, events or other law firm activities.
So-called "page insights" are collected solely through your visit to our Facebook page. These page insights are data collected in connection with a visit to our Facebook Page or an interaction on or with our Page that tells us how users interact with our Facebook Page.
This includes, for example, information about the end devices that visit our site (such as operating system, hardware and software versions, browser type) as well as information for example about how long a user views certain posts on our Facebook page. Page insights may be based on personal data. If you are also logged into your Facebook Account, Facebook may add the processed information to your account and treat it as personally identifiable information, depending on your account settings. For more information about the data processing through Facebook, please also have a look at de-de.facebook.com/about/privacy.
As the operator of the Facebook page, Facebook makes these page insights available to us in anonymous form. These page insights enable us to statistically evaluate the use of our Facebook page and thus enable us to control the marketing of our activities in a targeted manner. This represents a legitimate interest within the meaning of the relevant legal basis of Art. 6 para. 1 sentence 1 lit. f GDPR.
If you write to us via the contact-function on the Facebook page, we also process this data. This opportunity to interact with our (potential) clients and applicants also represents a legitimate interest within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR.
In 2018, the Court of Justice of the European Union (CJEU) ruled out that Facebook and the respective owner of the fan page are Joint Controller within the meaning of Art. 4 No. 7 GDPR. We therefore have concluded a Joint Controller Agreement with Facebook pursuant to Art. 26 GDPR (Page Controller Addendum ) in which the data protection obligations arising from the operation of the fan page are divided between us as the fan page operator and Facebook. In this agreement Facebook has taken over a large part of the data protection obligations, such as the fulfillment of the rights of the data subject according to Art. 12 ff. GDPR, the obligation to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk and the communication and notification obligations in the event of a personal data breach.
We do not pass on any personal data that we collect via the Facebook page to third parties. However, we can neither influence nor exclude that Facebook transmits the collected data to Facebook Inc. based in 1601 Willow Road, Menlo Park, California, 94025, USA. Facebook Inc. is certified under the "EU US Privacy Shield" (can be found at www.privacyshield.gov/list). Privacy Shield is an agreement between the European Union (EU) and the US to ensure compliance with European privacy standards in the United States.
You can assert your data subject rights (see also section 4) with regard to data processing through our Facebook page directly against Facebook. However, you are also welcome to contact us. In this case, according to the Page Controller Addendum we are obliged to immediately forward your request to Facebook using a form available for this purpose.
We use Matomo (www.matomo.org) on our website, a web analytics service of InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, (“Matomo”), which collects and stores data for optimisation and marketing purposes. In accordance with Art. 45 GDPR, the Commission has adopted a decision stating that New Zealand ensures an adequate level of protection.
Pseudonymised user profiles can be created and evaluated from this data for the same purpose. Cookies can be used for this (see clause 5, above), which are stored locally in the web browser cache of the page visitor’s device. The cookies allow, inter alia, recognition of the web browser. The data collected using the Matomo technology (including the pseudonymised IP address of the page visitor’s device) is processed on our servers.
The information generated by the cookie in the pseudonymous user profile is not used to personally identify the visitor of this website and is not merged with the personal data of the bearer of the pseudonym. The statistical analysis of the use of the website of optimisation and marketing purposes constitutes a legitimate interest within the meaning of the applicable legal basis of Art. 6 para. 1 sentence 1 lit. f GDPR.
You can prevent cookies from being stored on your hard drive by selecting "Do not accept cookies" in the browser settings. In this case, however, you may not be able to use all the features of this website to their full extent. If you do not agree to the storage and evaluation of this data from your visit, you can object to the storage and use at any time by clicking below. In this case, what is referred to as an opt-out cookie will be filed in the browser that you use, meaning that Matomo does not collect any session data. Please note that deleting all cookies means that the opt-out cookie will also be deleted, and you may have to reactivate it.

References: Art. 6
 Art. 6
 Art. 6
 §15
 Art. 6
 Art. 6
 Art. 4
 Art. 26
 Art. 12
 Art. 45
 Art. 6