Information obligations pursuant to Art. 13 and 14 of the General Data Protection Regulation (GDPR)
1. Information obligations regarding our activities in the law firm
Here you will find information on data protection regarding data processing in the context of our activities.
– Information obligations for clients and business partners (more)
– Information obligations for applicants (more)
2. Information obligations of the website
You can reach the person responsible for the online presence in accordance with Art. 4 para. 7 GDPR at the following address
LUDWIG WÖHREN SCHEWTSCHENKO (LWS Rechtsanwälte) Rechtsanwälte Partnerschaft mbB
Neuer Wall 43
20354 Hamburg, Germany
Email: hamburg@lws-rechtsanwaelte.de
Telephone: +49 40 226 33 33 – 0
Fax: +49 40 226 33 33 – 33
Further information can be found in our imprint.
You can contact our data protection officer (Niehoff-Systemberatung) at the above address, keyword “Data Protection Officer” or at the e-mail address datenschutz@lws-rechtsanwaelte.de.
3 Processing of personal data
3.1 General overview
We offer various services on our website and use the data processing processes listed below:
- Operation of the website and storage of log files: We process your personal data when you use our website.
- Use of cookies: We use cookies to control the language of the website and marketing measures as well as to store your data protection settings
- Contacting us: We provide you with a quick way to contact us using our form and our published e-mail addresses.
- Marketing and web analysis with Google Analytics: We use Google Analytics for web analysis of our visitors and the continuous improvement of our website and services Google Ads
- Conversion Tracking and the Conversion Linker service to measure and optimise advertising measures on the Internet for our website.
- Map display with Google Maps: We use Google Maps to help you find your way to our offices.
- Use of Usercentrics: We use a tool to manage your consent for the above-mentioned processing activities.
In order to be able to offer our services and continuously optimise our website, your personal data may also be passed on to other service providers and processed by them. We have carefully selected our service providers in accordance with Art. 28 GDPR and monitor them regularly. If these providers process your data outside the European Union or the European Economic Area, we ensure that the service providers we use have an appropriate level of data protection.
4 Operation of the website and storage of log files
4.1 Type and data of the processing
When you access the website, your Internet browser automatically sends the following data to our server and stores it in a log file for a limited period of time:
- Name and URL of the retrieved file
- Date and time of access
- Amount of data transferred
- Notification of successful retrieval
- Browser type and version
- operating system
- previously visited website
- Websites accessed by your system via our website
- Internet service provider of the user
- IP address and the requesting provider
4.2 Purposes and legal basis of processing
Your data is processed for the following purposes on the basis of our legitimate interest pursuant to Art. 6 (1) (1) (f) GDPR to
- Enabling the use of our website,
- Presentation of our service portfolio,
- simple contact by existing customers and interested parties
- Ensuring the proper operation of our website and
- fulfilment of legal obligations, i.e. for defence against and investigation of cyberattacks.
4.3 Recipients and categories of recipients
Our website is operated by the service provider Host Europe GmbH, Hansestrasse 111, 51149 Cologne, Germany. We have concluded an order processing contract with the service provider in accordance with Art. 28 GDPR. Further information can be found in the service provider’s privacy policy.
Personal data will only be passed on to third parties if this is necessary for the defence or investigation of criminal offences and/or if we are otherwise legally obliged to do so.
4.4 Storage period and, if applicable, criteria for determining the storage criteria
The personal data is automatically deleted 30 days after the end of the connection, provided there are no legal retention periods to the contrary.
4.5 Miscellaneous
The collection of data for the provision of our website and the storage of data in log files is necessary for the operation of the website.
5 Usage of cookies
A cookie is a piece of information that is temporarily stored on your end device (computer, smartphone, tablet, etc.), e.g. in the form of a text file or in a database, depending on the browser you are using. This information can be read again by servers when you visit our website again. In addition to the technologies listed in the Consent Manager, we use the following cookies to improve the use of our website:
Name: qtrans_front_language
Function: Saves the language you have selected for your next visit.
Storage period: 1 year after the last visit to our website
Name: _ga
Function: Collects statistics on the use of the website (reach measurement).
Storage period: 13 months after the last visit to our website
Name: _gcl_au
Function: The cookie is used by Google Tag Manager to track and save conversions.
Storage period: 3 months after the last visit to our website
Most browsers accept cookies automatically. However, you can also view our website without cookies. You can prevent cookies from being stored on your end device by selecting the “Do not accept cookies” function in your browser settings. You can delete cookies already stored on your device at any time. Please refer to the instructions of your browser or device manufacturer to find out how this works in detail. If you do not accept cookies, you may not be able to use the full functionality of the website.
You can call up information on other processing activities in the Usercentrics tool at the bottom of the screen and adjust your settings accordingly.
6 Contact form
6.1 Type and data of the processing
Our website allows you to use our contact form. The following data is transmitted to us when you use the contact form:
- Name, e-mail address (mandatory fields)
- Telephone number, message (optional fields)
- Date and time of the contact request sent
6.2 Purposes and legal basis of processing
The processing of your data serves to answer the contact enquiry satisfactorily and, if desired, to be able to contact you directly. If the contact is aimed at the initiation or execution of a contract, the processing is carried out in accordance with Art. 6 para. 1 subpara. 1 letter b) GDPR. In all other cases, your data will be processed for the purpose of contacting and responding to you in accordance with a balancing of interests pursuant to Art. 6 para. 1 subpara. 1 letter f) GDPR. Our legitimate interest lies in being able to contact us efficiently and at any time.
6.3 Recipients and categories of recipients
Your data will be transmitted to authorised employees within our company. In addition, processors, such as IT service providers, are used who are responsible for operation, support and maintenance. Your data will not be transferred to a third country or international organisations.
6.4 Storage period and, if applicable, criteria for determining the storage criteria
The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For the personal data from the input screen of the contact form, this is the case when the respective conversation with the user has ended, i.e. when it can be inferred from the circumstances that the matter in question has been conclusively clarified. The additional personal data collected during the sending process will be deleted after a period of one year at the latest.
6.5 Miscellaneous
You have the option to object to the processing of your personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of contacting us will be deleted in this case.
7 WEB ANALYSIS WITH GOOGLE PRODUCTS USING THE GOOGLE TAG MANAGER
7.1 Type and data of the processing
Google Tag Manager is a system that is used to integrate tracking and analysis tools. We use the web analysis service Google Analytics to collect, collate and analyse data about the behaviour of visitors to our website. Among other things, the service collects data about which website you came to our website from, which subpages you accessed or how often and for how long you viewed a subpage. The IP address of your device is shortened and anonymised by Google if you access our website from a member state of the European Union or from another state party to the Agreement on the European Economic Area.
We also use the Google Ads Conversion Tracking and Conversion Linker tools to measure and optimise the success of our advertising measures on the Internet.
The following data is processed by the individual services
Google Analytics
- IP address
- Usage data
- Click path
- App updates
- Browser information
- Device information
- JavaScript support
- Visited pages
- Referrer URL
- downloads
- Flash version
- Location information
- Purchase activity
- Widget interactions
- Date and time of visit
Google Ads Conversion Tracking:
- Display clicked
- IP address
- Web request
- Usage data
- Cookie ID
- Date and time of the visit
- Cookie information
- Error URL
- Browser language
- Browser type
Google Conversion Link:
- IP address
- Browser information
- Device information
- Referrer URL
- Usage data
- Clicks on adverts
- Clickstream
- Date and time of the visit
- Pages viewed
7.2 Purposes and legal basis of processing
The processing of personal data enables us to analyse the surfing behaviour of our users and our advertising measures. By evaluating the data obtained, we are able to compile and optimise information about the use of the individual components of our website. Before using this, we obtain your consent in accordance with Art. 6 para. 1 subpara. 1 letter a) GDPR in conjunction with Art. 7 GDPR. Art. 7 GDPR.
7.3 Recipients and categories of recipients
The provider of Google Analytics is Google Ireland, Gordon House, Barrow Street, Dublin 4, Ireland.
7.4 Transfers to a third country and existence of the adequacy decision
Your personal data will be transferred to a third country to the parent organisation Google LLC, 1600 Amphitheatre Pkwy, Mountain View, California 94043. The transfer takes place on the basis of an adequacy decision pursuant to Art. 45 GDPR. Due to legal requirements to which Google LLC is subject, it cannot be ruled out that government authorities may access your personal data.
7.5 Storage period and, if applicable, criteria for determining the storage criteria
The data is deleted as soon as it is no longer required for our recording purposes. In order to be able to track improvements to our website, the data is stored for 26 months and then automatically deleted.
7.6 Miscellaneous
You can revoke your consent at any time by calling up the Usercentrics tool at the bottom of the screen and adjusting your settings accordingly. Further information and the applicable data protection provisions of Google can be found under the following links:
Privacy policy of Google
Terms of use for Google Analytics
8 Map display with Google Maps
Our website uses Google Maps in various places. This allows us to show you interactive maps directly on the website and enables you to conveniently use the map function to find our offices.
8.1 Type and data of the processing
When this website or the directions page is accessed, personal data is automatically transmitted to the service provider in accordance with point 4.1.
8.2 Purposes and legal basis of processing
Your personal data is processed for the visualisation of road maps. In order to be able to display the map, you must first authorise the data processing, i.e. give your consent in accordance with Art. 6 para. 1 subpara. 1 letter a) GDPR in conjunction with Art. 7 GDPR. Art. 7 GDPR.
8.3 Recipients and categories of recipients
Google (Google Ireland, Gordon House, Barrow Street, Dublin 4, Ireland) may transfer the information obtained through Google Maps to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. It cannot be ruled out that Google will associate your IP address with other Google data. It is technically possible that Google could identify at least individual users on the basis of the data received. We have no influence on whether your personal data and personality profiles are processed by Google for other purposes.
8.4 Storage period and, if applicable, criteria for determining the storage criteria
We are not aware of the criteria used to determine whether and, if so, for how long Google stores the above-mentioned data.
8.5 Transfers to a third country and existence of the adequacy decision
Your personal data will be transferred to a third country to the parent organisation Google LLC, 1600 Amphitheatre Pkwy, Mountain View, California 94043. This is done on the basis of an adequacy decision pursuant to Art. 45 GDPR. Due to legal requirements to which Google LLC is subject, it cannot be ruled out that government authorities may access your personal data.
8.6 Miscellaneous
You can revoke your consent by revoking your consent in the Usercentrics tool. For more information, please refer to the Google Maps Terms of Use and Google’s Privacy Policy.
9 Consent to data processing with Usercentrics
9.1 Type and data of the processing
We use the Usercentrics Consent Management Platform as a consent management tool as part of the analytics activities on our website. The Usercentrics Consent Management Platform collects log file and consent data using JavaScript. This JavaScript makes it possible to inform users about their consent to certain tags on our website and to obtain, manage and document this consent.
We process the following data:
- Consent data or consent data
- anonymised logbook data (Consent ID, Processor ID, Controller ID, Consent Status, Timestamp)
- Device data or data of the devices used, such as truncated IP addresses (IP v4, IP v6), device information, date, time
- User data (e.g. email, ID, browser information, SettingIDs, changelog)
No user information is stored for the statistics on the use of consent given or not given. Only the frequency and locations of clicks are stored.
9.2 Purposes and legal basis of processing
The purpose of data processing is to analyse and manage the consents given in order to fulfil the legal requirements of the GDPR and the Telecommunications Digital Services Data Protection Act (TDDDG). The use of Usercentrics serves the following purposes
- Obtaining and providing consent
- Proof of which device you used to provide consent and at what time
- Legitimisation of access to the settings and documentation of changes.
The legal basis for the management of your consent to the processing of your personal data is Art. 6 para. 1 subpara. 1 letter f) GDPR.
Our legitimate interest lies in the legally compliant documentation and verifiability of consent, the management of marketing measures based on the consent given and the optimisation of consent rates.
We have concluded an order processing contract with the service provider. This is a contract prescribed by data protection law, which ensures that Usercentrics processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
The legal basis for the storage of your settings is in accordance with § 25 para. 2 sentence 2 TDDDG, as this is absolutely necessary for the function of Usercentrics and the fulfilment of legal requirements. If the settings of your end device prevent the storage of cookies, no settings can be saved by you on your end device and no additional functions can be used.
9.3 Recipients and categories of recipients
We use the Usercentrics Consent Management Platform (Usercentrics) from Usercentrics GmbH, Rosental 4, 80331 Munich. According to the service provider, this data is processed in the European Union. The data is transmitted to Google Cloud EMEA Ltd, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.
9.4 Transfers to a third country and existence of the adequacy decision
Your personal data will be transferred to a third country to the parent organisation Google LLC, 1600 Amphitheatre Pkwy, Mountain View, California 94043. The European Commission has recognised the level of data protection for certain companies from the USA in an adequacy decision (so-called EU-U.S. Data Privacy Framework). The company has self-certified under this framework and has thus committed to compliance. Self-certification means that the transfer of personal data to the USA is permitted on the basis of the EU-U.S. Data Privacy Framework.
9.5 Storage period and, if applicable, criteria for determining the storage criteria
The data is deleted as soon as it is no longer required. The associated cookie has a duration of 60 days. The revocation document of a previously granted consent is stored for a period of three years. The retention is based, on the one hand, on our accountability pursuant to Art. 5 para. 2 GDPR in conjunction with Section 31 of the German Administrative Offences Act (Ordnungswidrigkeitengesetz).
9.6 Miscellaneous
You can permanently prevent the execution of JavaScript at any time by making the appropriate settings in your browser, which would also prevent Usercentrics from executing the JavaScript. The data protection settings can be switched on and off for each category by ticking the checkbox. Further information on data protection can be found at the manufacturer Usercentrics.
10 Your rights as a data subject
Insofar as your personal data is processed when you visit our website and use our services, you have the following rights if the legal requirements within the meaning of the GDPR are met, which you can assert with the bodies named in point 2:
Art. 15 GDPR: Right to information of the data subject
You have the right to obtain information from us about which personal data we process about you.
Art. 16 GDPR: Right to rectification
If your personal data is incorrect or incomplete, you can request the correction of incorrect data or the completion of incomplete data.
Art. 17 GDPR: Right to erasure
Under the conditions of Art. 17 GDPR, you can request the erasure of your personal data. Your right to erasure depends, among other things, on whether your personal data is still required by us to fulfil our legal tasks or whether we or third parties can prove an overriding legitimate interest, such as the defence or assertion of legal claims.
Art. 18 GDPR: Right to restriction of processing
You can request the restriction of the processing of your personal data.
Art. 21 GDPR: Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR (data processing based on a balancing of interests); this also applies to profiling based on this provision within the meaning of Article 4(4) GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Art. 7 para. 3 GDPR: Right to withdraw consent
You have the right to withdraw your consent to the processing of your personal data at any time with effect for the future. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Art. 77 GDPR: Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the applicable data protection laws. The data protection supervisory authority responsible for us is: The Hamburg Commissioner for Data Protection and Freedom of Information
Hamburg, July 2024
