Privacy policy
1. legal basis
In accordance with Article 12 of the General Data Protection Regulation (GDPR), the law firm Bernrieder hereby provides all information in accordance with Article 13 GDPR and Article 14 GDPR as well as all notifications in accordance with Articles 15 to 22 and Article 34 GDPR.
2. controller for the collection of personal data
The controller pursuant to Article 13(1)(a) GDPR is
Bernrieder Law Firm
Andreas Bernrieder
Mitterfeldstraße 8
83071 Stephanskirchen
A data protection officer is not required due to the current size of the law firm in accordance with Section 38 (1) sentence 1 of the Federal Data Protection Act (BDSG) and has therefore not been appointed.
3. Legal basis for the processing of data
The law firm collects and processes personal data in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and all other applicable laws.
In particular, the law firm collects and processes the following data
- Name-related data: Salutation, title, first name, surname
- Contact details: Address, telephone number(s), e-mail address, other contact details
- Client-related data: All information that is expedient and necessary for the optimal processing of a mandate.
4. Purposes for the processing of personal data
4.1. Purpose of the fulfilment of a contract or pre-contractual measures
The legal basis for this is Article 6(1)(b) GDPR. This is done in particular
- to be able to clearly identify the client in order to reliably rule out confusion of any kind
- to ensure the optimal processing of the mandate
- to ensure prompt communication with the client
- to send invoices and reminders
- to enforce and defend against mutual claims arising from the client relationship
4.2 Purpose within the scope of the consent given
The legal basis for this is Article 6(1)(a) GDPR. This includes, in particular, contacting you for our newsletter and for special technical information that is sent to you without your express request. You can revoke your consent to this at any time by telephone or in text form. Data processing until the revocation is not affected by this and remains lawful.
4.3 Purpose of safeguarding the legitimate interests of the law firm or a third party
The legal basis for this is Article 6(1)(f) GDPR. This includes in particular the processing of personal data for the purpose of
- Market research and analysis
- Optimisation and further development of processes within the law firm
- Evaluation of the internal success of the law firm
- Determination of further legal services offered by the law firm
- Compliance with anti-money laundering laws
- Compliance with the laws against terrorism
- Ensuring the prevention of criminal offences
- Credit assessment
4.4 Purpose of the fulfilment of all legal obligations to which the law firm is subject
The legal basis for this is Article 6(1)(c) GDPR. The law firm discloses all data that it is obliged to disclose by law or on the basis of a law. This includes, in particular, requests from authorities in tax and criminal law matters, for the fulfilment of reporting and control obligations and any judicial request. The law firm is not obliged to check the lawfulness of the request by the authorities unless the unlawfulness of the request is evident.
5. Categories and purposes of data not collected directly from the client within the scope of the client relationship
The law firm collects and processes all personal data necessary for the optimal fulfilment of the mandate. This includes, in particular, data from generally accessible public sources, in particular commercial, registration and association registers, land registers, the Internet, press of any media. The law firm may also collect data from other companies, including detective agencies and address publishers.
The categories of data collected in this context include in particular
- personal data
- contact details
- Financial data, in particular data that enables an assessment of the creditworthiness of the client or third parties whose creditworthiness is important to the client
- Video data
- Audio data
6. Recipients or categories of recipients of client data
Personal data of clients will only be transmitted to third parties outside the law firm if
- clients have consented to the transfer of their data to third parties
- a transfer is necessary within the scope of the mandate, in particular to opposing parties and their legal or contractual representatives as well as authorities.
- the law firm is obliged to do so by law or on the basis of a law.
Any further transmission of your data to third parties will not take place.
7. Duration of storage of personal data
The personal data of clients will be stored for at least 6 years, beginning with the end of the calendar year in which the mandate was concluded, in accordance with Section 50 (1) sentences 2, 3 BRAO, this follows from Article 6 (1) lit. c) GDPR.
If tax and commercial law regulations provide for longer retention obligations, these can also be up to 10 years, in particular in accordance with Section 257 HGB and Section 147 AO, this follows from Article 6 (1) lit. c) GDPR.
In the event that a limitation period pursuant to Sections 194 et seq. BGB, the data will be stored until the end of a claim for or against the client. This can amount to a storage period of 30 years, Section 197 BGB, this follows from Article 6 para. 1 lit. b) GDPR.
Any further storage will only take place if the client has consented to this; this follows from Article 6(1)(a) GDPR.
If all legal and contractual obligations have been fulfilled and no consent has been given for further storage, the data will be deleted immediately.
​
8. Processing of personal data in a third country or by an international organisation
Personal data will only be transferred to and processed by a third country or an international organisation if the law firm is legally obliged to do so or if the client has consented to this.
9 Rights of clients and other data subjects
​
9.1 Revocation of a given consent
Consent to the processing of personal data given in accordance with Article 6(1)(a) GDPR may be withdrawn by the client or other data subjects at any time, either verbally or in text form. Any processing of personal data carried out until the revocation remains lawful.
9.2 Right to information of clients and other data subjects
Pursuant to Article 15 GDPR, every client and data subject has the right to obtain confirmation from the law firm as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information
- the purposes of the processing
- the category of personal data being processed
- the recipients or categories of recipients to whom the personal data have been or will be disclosed
- if possible, either the planned duration of storage or, if not possible, the criteria for determining the duration of storage
- the existence of the right to request from the law firm rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing
- the existence of a right to lodge a complaint with a supervisory authority
- if the personal data have not been collected from the data subject, all available information about the origin of the data
- the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject
9.3 Right to rectification of clients and other data subjects
Clients and other data subjects have the right to obtain from the law firm without undue delay the rectification of inaccurate personal data concerning them and the completion of incomplete personal data.
9.4 Right to erasure of personal data of clients and other persons
Clients and other data subjects have the right to obtain from the law firm the erasure of personal data concerning them without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
- consent granted pursuant to Article 6(1)(a) GDPR has been withdrawn
- an objection has been lodged against the processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or an objection has been lodged against the processing pursuant to Article 21 (2) GDPR
- the personal data have been processed unlawfully
- the deletion of personal data is necessary to fulfil a legal obligation under Union law or the law of the Federal Republic of Germany
- the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
This does not apply if the processing is necessary
- to fulfil legal obligations, in particular retention and documentation obligations
- for the establishment, exercise or defence of legal claims
9.5 Right to restriction of the processing of personal data of clients and other persons
Clients and other data subjects have the right to request the law firm to restrict the processing of their personal data if one of the following conditions is met:
- if the accuracy of the personal data is contested, for the duration of the verification of accuracy
- if the processing of the personal data is unlawful, instead of the deletion of the data by the law firm
- the law firm no longer needs the personal data for processing, but the client or the data subject needs this data for the establishment, exercise or defence of legal claims
- the client or other data subject has objected to the processing of personal data pursuant to Article 21 GDPR pending the verification whether the legitimate grounds of the law firm override those of the client or the data subject.
9.6 Right to data portability
The client or other data subjects have the right to receive the personal data concerning them, which they have provided to the law firm, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the law firm to which the personal data have been provided, where
- the processing is based on consent pursuant to Article 6(1)(a) or on a contract pursuant to Article 6(1)(b) GDPR and
- the processing is carried out by automated means.
The client or other data subject may request that the personal data be transmitted directly to another controller if this is technically feasible. This only applies if the rights or freedoms of other persons are not affected by this.
9.7 Right to object
Pursuant to Art. 21 GDPR, the client and any other data subject have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on Article 6(1)(e) GDPR, processing for the performance of a task carried out in the public interest, or Article 6(1)(f) GDPR, processing for the purposes of the legitimate interests pursued by the law firm. The law firm will then no longer process the personal data of the client or other data subject unless the law firm can demonstrate legitimate grounds for the processing that outweigh the interests, rights and freedoms of the data subject, or the processing serves the assertion, exercise or defence of legal claims.
9.8 Right to lodge a complaint with a supervisory authority
The client or other data subject has the right to lodge a complaint with a supervisory authority in accordance with Article 77 GDPR. For Bavaria, the supervisory authority is the State Office for Data Protection Supervision in accordance with Article 51 GDPR, Section 40 BDSG, Article 18 BayDSG.
​
10. Obligation of the client and other data subjects to provide their personal data to the law firm within the scope of the mandate
Clients and other data subjects must only provide the law firm with the data required for the processing of the mandate, both in the pre-contractual and contractual area. Clients and other data subjects are advised that failure to provide the necessary data, as well as their subsequent withdrawal or restriction of processing, will have repercussions on the firm's ability to process the client appropriately, up to and including the loss of the ability to optimally process the mandate.
11. Changes to the privacy policy
The law firm endeavours to keep the data protection declaration up to date, which is why changes to the data protection declaration are possible at any time.