Privacy Policy
I Name and address of the controller
The controller within the meaning of the General Data Protection Regulation (GDPR), the other national data protection laws of the Member States and other data protection provisions is:
MS Concept Rechtsanwaltsgesellschaft mbH
Gewerbestraße 11
71332 Waiblingen
Germany
Telephone: +49 7151 209550
Email: info@ms-concept.de
II General information on data processing
1 Scope of processing
As a rule, we collect and use our users’ personal data only to the extent necessary to provide a functioning website and our content and services. Personal data relating to our users is generally collected and used only with the user’s consent. An exception applies where obtaining consent in advance is not possible for practical reasons and processing is permitted by law.
2 Legal basis for processing personal data
Where we obtain the data subject’s consent to the processing of personal data, Article 6(1)(a) GDPR provides the legal basis for that processing.
Where the processing of personal data is necessary to enter into or perform a contract to which the data subject is a party, Article 6(1)(b) GDPR provides the legal basis. This also applies to processing necessary to take steps prior to entering into a contract.
Where processing is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) GDPR provides the legal basis.
Where processing is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) GDPR provides the legal basis.
Where processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, and those interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) GDPR provides the legal basis.
3 Erasure of data and retention periods
The data subject’s personal data will be erased or its processing restricted as soon as the purpose for which it is stored ceases to apply. Data may also be retained where this is required by EU or national legislation, regulations or other provisions to which the controller is subject.
Processing will also be restricted or the data erased when a retention period prescribed by those provisions expires, unless further retention is necessary to enter into or perform a contract.
III Provision of the website and creation of log files
1 Description and scope of processing
Whenever our website is accessed, our system automatically collects data and information from the accessing computer’s system. The following data is collected:
(1) Information about the browser type and version used;
(2) The user’s operating system;
(3) The user’s IP address;
(4) The date and time of access;
(5) Websites from which the user’s system accesses our website;
(6) Websites accessed by the user’s system through our website.
The data is also stored in our system’s log files. It is not stored together with other personal data relating to the user.
2 Legal basis for processing
The legal basis for the temporary storage of the data and log files is Article 6(1)(f) GDPR.
3 Purpose of processing
The system needs to store the IP address temporarily in order to deliver the website to the user’s computer. The user’s IP address must therefore remain stored for the duration of the session.
Data is stored in log files to ensure that the website functions properly. We also use this data to optimise the website and ensure the security of our IT systems. The data is not analysed for marketing purposes in this context. These purposes also constitute our legitimate interest in processing under Article 6(1)(f) GDPR.
4 Retention period
The data is erased as soon as it is no longer necessary for the purpose for which it was collected. Where data is collected to provide the website, this occurs when the relevant session ends.
Where data is stored in log files, it is erased within seven days at the latest. Longer retention is possible. In that event, users’ IP addresses are erased or altered so that the accessing client can no longer be identified.
5 Options to object and obtain erasure
The collection of data to provide the website and the storage of data in log files are essential to operating the website. Users therefore have no option to object to this processing.
IV Use of cookies
a Description and scope of processing
Our website uses cookies. Cookies are text files stored in or by the internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. The cookie contains a distinctive string of characters that allows the browser to be uniquely identified when the website is accessed again.
This website uses session cookies, also known as transient cookies. Their scope and operation are explained below.
We use these cookies to make our website more user friendly. Some elements of our website require the accessing browser to remain identifiable after the user navigates to another page. The cookies store and transmit the language settings selected.
b Legal basis for processing
The legal basis for processing personal data using cookies is Article 6(1)(f) GDPR.
c Purpose of processing
The purpose of using technically necessary cookies is to make websites easier to use. Some website functions cannot be provided without cookies. These functions require the browser to be recognised after the user navigates to another page. User data collected through technically necessary cookies is not used to create user profiles.
These purposes also constitute our legitimate interest in processing personal data under Article 6(1)(f) GDPR.
d Retention period and options to object and obtain erasure
Transient cookies, in particular session cookies, are automatically deleted when you close your browser. They store a session ID that allows different requests from your browser to be assigned to the same session. This enables your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close your browser.
VIII Use of Google Maps
Our website uses Google Maps (API), provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Maps is a web service that displays interactive maps to present geographical information visually. It shows you our location and helps you plan your journey.
When you access a page containing an embedded Google map, information about your use of our website, such as your IP address, is transmitted to and stored on Google servers in the USA. This happens regardless of whether you are logged into a Google account or do not have an account. If you are logged into Google, your data is associated directly with your account.
If you do not want this information associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles, even if you are not logged in, and analyses those profiles. In particular, this analysis is carried out under Article 6(1)(f) GDPR on the basis of Google’s legitimate interests in displaying personalised advertising, conducting market research and/or designing its website to meet users’ needs.
You have the right to object to the creation of these user profiles. To exercise this right, you must contact Google.
Google LLC, which is based in the USA, is certified under the EU–US Privacy Shield arrangement, which ensures compliance with the level of data protection applicable in the EU.
If you do not agree to your data being transmitted to Google when you use Google Maps in future, you can disable Google Maps completely by switching off JavaScript in your browser. Google Maps and the map display on this website will then be unavailable.
Google’s terms of service are available at http://www.google.de/intl/de/policies/terms/regional.html. The additional terms for Google Maps are available at:
https://www.google.com/intl/de_US/help/terms_maps.html
Detailed information about data protection in connection with Google Maps is available in Google’s privacy policy:
http://www.google.de/intl/de/policies/privacy/
IX YouTube videos
Our website embeds videos from the YouTube platform in privacy-enhanced mode. YouTube is a video platform on which users can upload videos and make them publicly accessible. These videos are not stored on our servers. YouTube is operated by Google Ireland Ltd., Google Building Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland.
When an embedded YouTube video is accessed, a connection to YouTube servers in the USA is established and certain data is sent to those servers. This happens regardless of whether you are logged into YouTube. We do not know the nature or scope of the data YouTube collects and have no influence over its use.
Please refer to Google’s privacy policy for this information:
https://policies.google.com/privacy?hl=en
Embedded YouTube videos can be played only after you have given prior consent to the transfer of your data to YouTube in the USA under Article 49(1)(a) GDPR. The level of data protection in the USA is not adequate. Associated risks include the inability to enforce data subject rights and possible access by public authorities. You may withdraw your consent at any time with effect for the future.
X Google reCAPTCHA
We use Google reCAPTCHA (“reCAPTCHA”) on this website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
reCAPTCHA checks whether data entered on this website, for example in a contact form, is entered by a human or an automated program. To do so, reCAPTCHA analyses the website visitor’s behaviour using various characteristics. This analysis begins automatically as soon as the visitor enters the website. reCAPTCHA evaluates information such as the IP address, time spent on the website and mouse movements. The data collected during the analysis is forwarded to Google.
The reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is taking place.
The data is stored and analysed on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in protecting its online services against abusive automated data extraction and spam. Where the relevant consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR; consent may be withdrawn at any time.
Further information about Google reCAPTCHA is available in Google’s privacy policy and terms of service:
https://policies.google.com/privacy?hl=en
https://policies.google.com/terms?hl=en
XI Advertising on Facebook and Instagram
(1) This website also uses advertising services provided by Meta Inc. (“Facebook”). By integrating the Facebook Pixel into our website, we can display our advertising (“Facebook and Instagram ads”) to users of our website and the Facebook and Instagram social networks and measure and evaluate its success (“conversion tracking”). The technical connection between Facebook and our website is established through the Facebook Pixel.
The legal basis for processing your data is Article 6(1)(a) GDPR, meaning that the integration takes place only with your consent.
(2) The marketing tools used cause your browser to establish a direct connection to Facebook’s server automatically when you visit our website. We have no influence over the scope or further use of the data Facebook collects through this tool. We therefore describe the processes known to us: integrating the Facebook Pixel informs Facebook that you have accessed the relevant page of our website or clicked on one of our advertisements. If you are registered with a Facebook service, Facebook can associate the visit with your account. Even if you are not registered with Facebook or are not logged in, the provider may obtain your IP address and other identifying information and use it to create profiles.
(3) The information collected is stored on Facebook servers, including servers in the USA. For these cases, the provider states that it has adopted a standard corresponding to the former EU–US Privacy Shield and undertaken to comply with applicable data protection laws when transferring data internationally. We have also agreed standard contractual clauses with Facebook, intended to ensure an adequate level of data protection in the third country.
(4) You may withdraw your consent at any time without affecting the lawfulness of processing before withdrawal. The easiest way to withdraw consent is through our consent manager. Users who are logged in may also object through the provider’s settings at:
https://www.facebook.com/settings/?tab=ads#_
(5) Further information about Facebook’s processing is available from Meta Inc., 1601 S California Ave, Palo Alto, California 94304, USA. Privacy policy:
https://www.facebook.com/privacy/policy
(6) We also use the “Custom Audiences” remarketing function, which likewise uses the Facebook Pixel to display interest-based advertisements when you visit our website or other websites that have integrated the Facebook Pixel. This allows us to show you advertising that interests you, make our website more relevant to you and market our services.
XII Contact form and email contact
1 Description and scope of processing
You can contact us using the email address provided on our website. In that case, the personal data transmitted with your email is stored. No data is disclosed to third parties in this connection. The data is used exclusively to handle the correspondence.
2 Legal basis for processing
The legal basis for processing data transmitted by email is Article 6(1)(f) GDPR. If the email contact is intended to lead to a contract or an engagement of our firm, Article 6(1)(b) GDPR provides an additional legal basis.
3 Purpose of processing
We process personal data from the input form solely to handle your enquiry. Where you contact us by email, this also constitutes the necessary legitimate interest in processing the data. Other personal data processed when the form is submitted is used to prevent misuse of the contact form and ensure the security of our IT systems.
4 Retention period
The data is erased as soon as it is no longer necessary for the purpose for which it was collected. Personal data sent by email is erased when the relevant correspondence with the user has ended. Correspondence is considered to have ended when the circumstances show that the matter concerned has been conclusively resolved.
Additional personal data collected during submission is erased within seven days at the latest.
5 Options to object and obtain erasure
If you contact us by email, you may object to the storage of your personal data at any time. In that case, the correspondence cannot continue. All personal data stored in the course of the contact will then be erased.
XIII Newsletter
If you subscribe to our company’s newsletter, the data entered in the relevant form is transmitted to other controllers. We use a double opt-in procedure for newsletter subscriptions: after registering, you receive an email asking you to confirm your subscription. This confirmation is necessary to prevent anyone from subscribing using someone else’s email address.
We use Mailchimp, provided by The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA (“Mailchimp”), to send our newsletter. This allows us to contact subscribers directly. We also analyse your usage behaviour to optimise our services.
For this purpose, we disclose your email address to Mailchimp.
Mailchimp receives your personal data and acts as our processor in relation to sending our newsletter. The processing described in this section is neither legally nor contractually required. Without your consent and the transmission of your personal data, we cannot send you a newsletter.
Mailchimp also collects personal data through cookies and other tracking methods: information about your device, including its IP address, device information, operating system, browser ID, the application used to read emails and other hardware and internet connection information. It also collects usage data, such as the date and time you opened an email or campaign and browser activity, for example which emails or websites were opened.
Mailchimp needs this data to ensure the security and reliability of its systems, compliance with its terms of use and the prevention of abuse. This corresponds to Mailchimp’s legitimate interest under Article 6(1)(f) GDPR and serves the performance of a contract under Article 6(1)(b) GDPR. Mailchimp also analyses performance data, such as email delivery statistics and other communication data. This information is used to generate usage and performance statistics for its services.
Mailchimp also collects information about you from other sources. Personal data is collected through social media and other third-party data providers over an unspecified period and to an unspecified extent. We have no influence over this process.
The legal basis for this processing is your consent under Article 6(1)(a) GDPR. You may withdraw your consent to the processing of your personal data at any time. Each mailing contains a corresponding link. You can also withdraw consent using the contact details provided. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Further information about options to object and obtain erasure from Mailchimp is available at:
https://mailchimp.com/legal/privacy/#3._Privacy_for_Contacts
Your data is processed for as long as the relevant consent remains in place. Apart from this, it is erased after the contract between us and Mailchimp ends, unless statutory requirements require further retention.
Mailchimp has implemented compliance measures for international data transfers. These apply to all global activities in which Mailchimp processes personal data relating to individuals in the EU. The measures are based on the EU Standard Contractual Clauses (SCCs). Further information is available at:
https://mailchimp.com/legal/data-processing-addendum/
XIV Rights of the data subject
If personal data relating to you is processed, you are a data subject within the meaning of the GDPR and have the following rights against the controller.
1 Right of access
You may obtain confirmation from the controller as to whether we process personal data relating to you. Where such processing takes place, you may request access to the following information:
(1) The purposes for which the personal data is processed;
(2) The categories of personal data processed;
(3) The recipients or categories of recipients to whom your personal data has been or will be disclosed;
(4) The envisaged retention period for your personal data or, where specific information cannot be provided, the criteria used to determine that period;
(5) The existence of the right to rectification or erasure of your personal data, restriction of processing by the controller, or objection to that processing;
(6) The existence of the right to lodge a complaint with a supervisory authority;
(7) Any available information about the source of the data where it was not collected from the data subject;
(8) The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of that processing for the data subject.
You may request information on whether your personal data is transferred to a third country or an international organisation. In that connection, you may request information about the appropriate safeguards under Article 46 GDPR relating to the transfer.
2 Right to rectification
You have the right to obtain rectification and/or completion from the controller where your personal data is inaccurate or incomplete. The controller must rectify it without undue delay.
3 Right to restriction of processing
You may obtain restriction of the processing of your personal data where:
(1) You contest the accuracy of the data, for a period enabling the controller to verify its accuracy;
(2) Processing is unlawful and you oppose erasure and request restriction of use instead;
(3) The controller no longer needs the data for processing purposes, but you require it for the establishment, exercise or defence of legal claims; or
(4) You have objected to processing under Article 21(1) GDPR and verification of whether the controller’s legitimate grounds override yours is pending.
Where processing has been restricted, the data may, apart from storage, be processed only with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.
Where processing has been restricted under the conditions above, the controller will inform you before the restriction is lifted.
4 Right to erasure
a Obligation to erase data
You may obtain erasure of your personal data from the controller without undue delay, and the controller must erase it without undue delay, where one of the following grounds applies:
(1) The data is no longer necessary for the purposes for which it was collected or otherwise processed;
(2) You withdraw the consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR and there is no other legal ground for processing;
(3) You object to processing under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object under Article 21(2) GDPR;
(4) Your personal data has been unlawfully processed;
(5) Erasure is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject;
(6) Your personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
b Informing third parties
Where the controller has made your personal data public and is obliged to erase it under Article 17(1) GDPR, the controller will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing that data that you have requested the erasure of any links to, or copies or replications of, the personal data.
c Exceptions
The right to erasure does not apply to the extent that processing is necessary:
(1) For exercising the right of freedom of expression and information;
(2) For compliance with a legal obligation requiring processing under Union or Member State law to which the controller is subject, or for performing a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) For reasons of public interest in public health under Article 9(2)(h) and (i) and Article 9(3) GDPR;
(4) For archiving purposes in the public interest, scientific or historical research, or statistical purposes under Article 89(1) GDPR, insofar as the right referred to in subsection (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) For the establishment, exercise or defence of legal claims.
5 Right to be informed
If you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller must communicate that rectification, erasure or restriction to each recipient to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort.
You have the right to be informed by the controller about those recipients.
6 Right to data portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit that data to another controller without hindrance from the controller to which you provided it, where:
(1) Processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or a contract under Article 6(1)(b) GDPR; and
(2) Processing is carried out by automated means.
When exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.
The right to data portability does not apply to processing necessary for performing a task carried out in the public interest or in the exercise of official authority vested in the controller.
7 Right to object
You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.
The controller will no longer process your personal data unless it demonstrates compelling legitimate grounds for processing that override your interests, rights and freedoms, or unless processing serves the establishment, exercise or defence of legal claims.
Where your personal data is processed for direct marketing, you have the right to object at any time to processing for that purpose, including profiling insofar as it relates to direct marketing.
If you object to processing for direct marketing, your personal data will no longer be processed for those purposes.
In the context of using information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
8 Right to withdraw consent
You have the right to withdraw your consent to data processing at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
9 Automated individual decision making including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. This does not apply where the decision:
(1) Is necessary for entering into or performing a contract between you and the controller;
(2) Is authorised by Union or Member State law to which the controller is subject and that law lays down suitable measures to safeguard your rights, freedoms and legitimate interests; or
(3) Is based on your explicit consent.
However, these decisions must not be based on special categories of personal data under Article 9(1) GDPR unless Article 9(2)(a) or (g) applies and suitable measures to safeguard your rights, freedoms and legitimate interests are in place.
In the cases referred to in (1) and (3), the controller will implement suitable measures to safeguard your rights, freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, express your point of view and contest the decision.
XV Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that processing of your personal data infringes the GDPR.
The supervisory authority with which the complaint has been lodged will inform the complainant of its progress and outcome, including the possibility of a judicial remedy under Article 78 GDPR.