Privacy policy

Information about the processing of your data

In accordance with Art. 12 of the General Data Protection Regulation (hereinafter referred to as the GDPR), we are obliged to inform you about the processing of your data when you use our website. We take the protection of your personal data very seriously and this privacy policy informs you about the details of the processing of your data and about your legal rights in this regard.

We reserve the right to adapt the privacy policy with future effect, in particular in the event of further development of the website, the use of new technologies or changes to the legal bases or the corresponding case law.

We recommend that you read this privacy policy from time to time and take a printout or a copy for your documents.

Definitions

• In the following, website means all of the controller’s pages at https://www.spiritlegal.com/de/;
• personal data means any information relating to an identified or identifiable natural person. A person is identifiable if they can be identified, either directly or indirectly, in particular by means of assignment to an identifier such as a name, to an identification number, to location data, to an online identifier or to one or more special features that are an expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person. Personal data is therefore, for example, a person’s name, email address and telephone number, but may also include information about preferences, hobbies and memberships;
• processing means operations or sets of operations carried out with or without the aid of automated procedures in connection with personal data, such as the collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure or destruction;
• pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person;
• consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes in a particular case by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
• Google means Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; reachable in the European Union at: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001.

Scope

This privacy policy applies to all pages of https://www.spiritlegal.com/de/. It does not cover any linked websites of other providers.

Responsible provider

The following party is responsible for the processing of personal data within the scope of this privacy policy:

SPIRIT LEGAL Fuhrmann Hense Partnerschaft von Rechtsanwälten
Neumarkt 16-18
04109 Leipzig, Germany
Tel.: +49 (0) 341 - 39297890
Fax: +49 (0) 341 - 39297899 
E-Mail: info@spiritlegal.com

Questions about data protection

If you have any questions about data protection with regard to our company or our website, you can contact our data protection officer:

SPIRIT LEGAL Fuhrmann Hense Partnerschaft von Rechtsanwälten
Attorney-at-law and data protection officer
Peter Hense
Neumarkt 16-18
04109 Leipzig, Germany
Tel.: +49 (0) 341 - 39297890
Fax: +49 (0) 341 - 39297899 
E-Mail: info@spiritlegal.com

Data protection officer
Contact via encrypted online form:
Contact data protection officer

Security

We have taken comprehensive technical and organisational precautions to protect your personal data from unauthorised access, abuse, loss and other external disruption. To this end, we regularly review our security measures and adapt them to current standards.

Your rights

You have the following rights with regard to the personal data concerning you that you can assert against us:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to object to processing (Art. 21 GDPR),
• right to withdraw your consent (Art. 7(3) GDPR),
• right to receive the data in a structured, commonly used, machine-readable format (“data portability”) and the right to transfer the data to another controller, if the prerequisites of Art. 20(1) (a), (b) GDPR are fulfilled (Art. 20 GDPR).

You can assert your rights by informing us using the contact details specified above under ‘Responsible provider’ or by contacting the data protection officer designated by us.

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR).

Use of the website, access data

In principle, you can use our website for purely informational purposes without disclosing your identity. When you access the individual pages of the website in this sense, this only results in access data being transferred to our web hosting service so that the website can be displayed to you. This is the following data:

• browser type/browser version,
• operating system used,
• language and version of the browser software,
• hostname of the accessing device,
• IP address,
• website from which the request comes,
• content of the request (specific page),
• date and time of the server request,
• access status/HTTP status code,
• referrer URL (website visited before),
• volume of data transferred,
• time zone difference from Greenwich Mean Time (GMT).

Temporary processing of the IP address by the system is necessary to make it technically possible to deliver the website to your device. This requires processing of your IP address for the duration of the session. The legal basis of such processing is Art. 6(1) Sentence 1(f) GDPR.

The access data is not used to identify individual users and is not combined with other data sources. The access data is deleted when it is no longer required for achieving the purpose of its processing. In the case of recording the data to provide the website, this is the case when you end your visit to the website.

IP addresses are stored in log files to ensure the functionality of the website. In addition, the data serves us to optimise the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes takes place in this context either. In principle, data is deleted after seven days at the latest; further processing is possible in individual cases. In this case, the IP address is deleted or so transformed that an assignment of the retrieving client is no longer possible.

The recording of data for the provision of the website and the processing of data in log files is an absolute necessity for the operation of the website. You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation, unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend against legal claims (Art. 21(1) GDPR). You can send us your objection to the contact data provided under ‘Responsible provider’. In the event that your objection is justified, we will examine the situation and either stop or adjust the data processing or point out to you the compelling legitimate reasons on the basis of which we will continue processing.

Cookies

In addition to the aforementioned access data, so-called cookies are stored in the internet browser of the device you use to access the website. These are small text files with a sequence of numbers that are stored locally in the cache of the browser used. Cookies do not become part of the device system and cannot execute programs. They serve to make our website user-friendly. The use of cookies may be technically necessary or may occur for other purposes (e.g. analysis/evaluation of website usage).

a) Technically necessary cookies

Some elements of our website require that the retrieving browser can be identified even after a page change. This involves processing the following data in the cookies:

• language settings.

The user data collected by technically necessary cookies is not processed to create user profiles. We also use session cookies, which store a session ID that can be used to assign various requests from your browser to the shared session. Session cookies are required for using the website. In particular, they enable us to recognise the device used when you return to the website. If you have an account with us, we use this cookie to recognise you on subsequent visits to the website; otherwise you would have to log in again each time you visited. The legal basis of this processing is Art. 6(1) Sentence 1(f) GDPR. We use session cookies to make using our website more attractive and effective. Session cookies are deleted as soon as you log out or close your browser.

Most browsers are preset to automatically accept cookies. You can object to the processing of your data by cookies. Your right of objection exists if you have reasons arising from your particular situation, unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend against legal claims (Art. 21(1) GDPR). In the event that your objection is justified, we will examine the situation and either stop or adjust the data processing or point out to you the compelling legitimate reasons on the basis of which we will continue processing.

You can disable or restrict the transfer of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use the full functionality of the website.

b) Technically non-essential cookies

In addition, we also use cookies on the website which enable an analysis of users’ surfing behaviour. For example, this involves processing the following data in the cookies:

• entered search terms,
• frequency of page views,
• use of website functions.

These cookies are used to make using the website more efficient and attractive. The legal basis of this processing is Art. 6(1) Sentence 1(f) GDPR. The technically non-essential cookies are automatically deleted after a specified period, which may vary depending on the cookie.

You can object to the processing of your data by cookies. Your right of objection exists if you have reasons arising from your particular situation, unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend against legal claims (Art. 21(1) GDPR). If you do not wish to use cookies, you have the option of changing your browser settings in order to generally or selectively block the placement of cookies or remove stored cookies. You can also have the corresponding information displayed before a cookie is placed. If you change the browser settings for the use of cookies or disable cookies, the functionality of this website may be restricted.

Where we integrate cookies from third-party providers into our website, we point this out to you separately below.

Contacting our company

When contacting our company, e.g. by email, we will process the personal data provided by you so that we can respond to your enquiry.

In order for us to process enquiries submitted via the contact form on the website, it is essential that you provide a name or pseudonym and a valid email address. At the moment when you submit the message to us, the following data will also be processed:

• IP address,
• date/time of registration,
• name,
• first name.

The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR and Art. 6(1) Sentence 1(b) GDPR, if the contact is made with the intention of concluding a contract. If it is necessary to enter your data in order to conclude a contract, it may be impossible to conclude or execute the contract or to process the request if the data is not made available.

Processing the personal data from the form allows us alone to process the contact you make with us. Where you contact us by email, this also constitutes the necessary legitimate interest in the processing of the data.

The data will not be transmitted to third parties in this context. The data is only processed in order to process the conversation. As soon as processing is no longer necessary, we delete the data generated in this context or, if statutory retention obligations apply, restrict processing of the data.

You have the possibility to object to the processing of your personal data for contact requests at any time. You can send us your objection to the contact data provided under ‘Responsible provider’. Your right of objection exists if you have reasons arising from your particular situation, unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend against legal claims (Art. 21(1) GDPR). In particular, you have a right of objection if processing is not necessary to fulfil a contract with you, which is described by us in the previous description of the functions. In such a case, it may not be possible to continue processing the request. In the event that your objection is justified, we will examine the situation and either stop or adjust the data processing or point out to you the compelling legitimate reasons on the basis of which we will continue processing.

Processing and transmission of personal data for contractual purposes

We process your personal data if and to the extent necessary for the initiation, creation, execution and/or termination of a legal transaction with our company. The legal basis from this results from Art. 6(1) Sentence 1(b) GDPR. If the data processing is necessary for the conclusion of a contract, the conclusion of the contract, the execution and/or the termination of a legal transaction with our company may be impossible if the data is not made available.

Once the purpose has been achieved (e.g. contract processing), the personal data will be blocked for further processing or erased, unless we are entitled to retain the data for a longer period and process it as required in the respective context on the basis of a consent granted by you (e.g. consent to the processing of your email address for sending promotional emails), a contractual agreement, a statutory authorisation (e.g. authorisation to send direct advertising) or on the basis of justified interests (e.g. retention for asserting claims).

Your personal data will be passed on if

• it is necessary for the creation, execution or termination of legal transactions with our company (e.g. when transmitting data to a payment service provider/a shipping company to process a contract with you) (Art.6(1) Sentence 1(b) GDPR), or
• a subcontractor or party we use to perform our obligations, which we use exclusively within the framework of providing the offers or services requested by you, needs this data (unless you are expressly informed otherwise, such auxiliary parties are only entitled to process the data insofar as this is necessary for the provision of the offer or service), or
• there is an enforceable official order (Art. 6(1) Sentence 1(c) GDPR), or
• there is an enforceable court order (Art. 6(1) Sentence 1(c) GDPR), or
• we are legally obliged to do so (Art. 6(1) Sentence 1(c) GDPR), or
• the processing is necessary in order to protect the vital interests of the data subject or another natural person (Art. 6(1) Sentence 1(d) GDPR), or
• we are authorised or even obliged to pursue overriding legitimate interests (Art. 6(1) Sentence 1(f) GDPR).

Your personal data will not be transmitted to other persons, companies or bodies unless you have effectively consented to such transmission. The legal basis of the processing is then Art. 6(1) Sentence 1(a) GDPR.

Newsletter

You have the possibility to subscribe on the website to our email newsletter or website push notifications, which we use to inform you regularly about current developments in data protection, labour law, IT law, copyright and press law.

In order to receive the newsletter, you need to give your valid email address and optional your name.

To subscribe to our email newsletter, please use the double opt-in process. Once you have entered the data marked as mandatory, we will send you an email to the email address you have provided, in which we ask you to expressly confirm your subscription to the newsletter (by clicking on a confirmation link). This is how we ensure that you really want to receive our email newsletter. If no confirmation takes place within 24 hours, we block the information transferred to us and delete it automatically after one month at the latest.

If you wish to register for website push notifications, you first need to agree to receive push notifications from the website in your web browser and confirm your registration.

Furthermore, the following data is processed at the time of subscription:

• IP address,
• date/time of registration for the newsletter,
• time when you click on the confirmation link.

We process your IP address, the time of registration for the newsletter and for receiving website push notifications as well as the time of your confirmation in order to document your newsletter registration and to prevent abuse of your personal data. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPRWe process this data until two years after termination of the contract. If registration for the newsletter takes place and it is unrelated to the conclusion of a contract, we process this data until two years after termination of the usage. We delete this data when the newsletter subscription ends.

After your confirmation, we will process the email address and name/pseudonym of the recipient concerned for the purpose of sending our email newsletter and the website push notifications. The legal basis of the processing is Art. 6(1) Sentence 1(a) GDPR. We delete this data when you unsubscribe from the newsletter.

You can withdraw your consent to the processing of your email address for receiving the newsletter at any time, either by sending us a message (see the contact details under ‘Responsible provider’) or by clicking directly on the unsubscribe link in the newsletter. This does not affect the lawfulness of processing that has occurred based on the consent up until the point of your withdrawal (Art. 13(2)(c) GDPR).

We would like to point out that we analyse your user behaviour in relation to the sending of our newsletter. For this analysis, the emails sent out contain so-called web beacons or tracking pixels, which display single-pixel image files that are embedded in our website. For analysis purposes, we link the data mentioned under ‘Access data’ and the web beacons with your email address and an individual ID. Links received in the newsletter also contain this ID.

We use the data collected in this way to create a user profile in order to tailor the newsletter to your individual interests. Here we record when you read our newsletters, which links you click on in them and draw conclusions about your personal interests. We link this data to actions you perform on our website. The information is processed for as long as you have subscribed to the newsletter. Once you unsubscribe, we process the data for purely statistical purposes and anonymously.
Our intention here is to analyse the use of and to optimise the email advertising we send you. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR.

You can object to this tracking at any time by clicking on the separate unsubscribe link provided in each newsletter or by informing us using the contact details provided under ‘Responsible provider’.As regards objecting to data processing for direct marketing purposes, you have a general right of objection without giving reasons (Art. 21(2)GDPR). You can also prevent tracking by disabling the display of images in your email client by default. This will mean that the newsletter will not be displayed completely and you may not be able to use all functions. If you choose to display the images manually, the above tracking will take place.

MailChimp email marketing service

We use the email marketing service MailChimp, provided by Rocket Science Group, LLC (675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA, web: https://mailchimp.com/; hereinafter referred to as “MailChimp”).

If you have registered for the newsletter, the data provided during registration will be stored and processed on MailChimp’s servers in the USA. MailChimp processes this information for sending and analysing the newsletters on our behalf. MailChimp newsletters contain what are known as web beacons, which are pixel-sized files that are retrieved from the MailChimp server when the newsletter is opened. In the context of the retrieval, technical information, such as the browser used, time of the page retrieval and IP address, is collected. This information is processed to analyse and technically improve the services. Furthermore, it is analysed whether newsletters are opened, when they are opened and which links are clicked on by the reader. This information can theoretically be assigned to individual newsletter recipients. However, neither we nor MailChimp have any intention of monitoring individual recipients; the analysis of the information mentioned serves rather to recognise the reading habits of the recipients so as to better adapt and distribute our newsletter content accordingly. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. We have no knowledge of how long MailChimp stores data and have no way of influencing this.

You can object to the processing in the future at any time by clicking on the unsubscribe link at the end of the newsletter or by informing us using the contact details provided under ‘Responsible provider’. As regards objecting to data processing for direct marketing purposes, you have a general right of objection without giving reasons (Art. 21(2) GDPR). This will simultaneously end the processing of data for you being sent the newsletter and for statistical analysis. It is not possible to object to the distribution via MailChimp or the statistical evaluation separately.

Furthermore, MailChimp has informed us that it may use the transferred data to optimise or improve its own services, e.g. to technically optimise the sending and presentation of newsletters. According to its own information, MailChimp neither processes the data in order to write to you with its own advertising nor transmits the data to third parties.

As the recipient of the newsletter, you may be redirected to the MailChimp website, for example if there are problems displaying the newsletter in your email program and you follow the link contained in the newsletter to retrieve the newsletter online. In this context, we would like to point out that further analysis services and cookies may be used on the MailChimp website, which may process your personal data on behalf of MailChimp. We have no influence on this processing.

MailChimp is certified under Privacy Shield, the US-EU data protection agreement, and is thus committed to complying with the European Union’s data protection regulations. You can view MailChimp's certification at https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG. Please refer to MailChimp’s privacy policy for more information: https://mailchimp.com/legal/privacy/.

Hosting

We use external hosting services for the provision of the following services: infrastructure and platform services, computing capacity, storage resources and database services, security and technical maintenance services. This involves processing all data necessary for the operation and use of our website.

We use external hosting services to run this website. By using external hosting services, we aim to make the provision of our website efficient and secure. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR.

The recording of data for the provision and use of the website and the processing of data using external web hosting services is an absolute necessity for the operation of the website. You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation, unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend against legal claims (Art. 21(1) GDPR). You can send us your objection to the contact data provided under ‘Responsible provider’. In the event that your objection is justified, we will examine the situation and either stop or adjust the data processing or point out to you the compelling legitimate reasons on the basis of which we will continue processing.

Integration of third-party content

The website integrates third-party content such as videos, maps, RSS feeds and graphics from other websites. This integration always requires that the providers of this content (“third-party providers”) perceive the IP addresses of users. This is because without the IP address they would not be able to send the content to the browser of the respective user. As such, the IP address is required to display this content.

We endeavour to only use content from third-party providers who process the IP address solely for delivering the content. We do however have no influence over whether the third-party providers process the IP addresses, e.g. for statistical purposes. If we are aware of such activity, we inform you of this in the following.

Some of the third parties may process data outside the European Union.

You can object by installing a JavaScript blocker such as the browser plug-in NoScript (www.noscript.net) or disabling JavaScript in your browser. Your right of objection exists if you have reasons arising from your particular situation, unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend against legal claims (Art. 21(1) GDPR). This may however result in functional restrictions on the website.

YouTube videos

Our website uses plug-ins from the video platform YouTube.de/YouTube.com, a service whose provider – represented by Google – is YouTube LLC (headquartered at 901 Cherry Avenue, San Bruno, CA 94066, USA; “YouTube”). The plug-ins allow us to embed visual content (“videos”) on this website that we have published on Youtube.de/Youtube.com.

The videos are all embedded in ‘extended privacy mode’, which means that no data about you as a user will be transferred to YouTube if you do not play the videos. Only when you play the videos is the following data transferred. We have no influence on this data transfer.

By visiting the website, YouTube receives the information that you have retrieved the corresponding subpage of our website. In addition, the data mentioned under ‘Access data’ is submitted. This occurs regardless of whether YouTube provides a user account that you are logged in with or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for this data to be associated with your YouTube profile, you must log out before activating the button.

YouTube stores your data as usage profiles and processes it for purposes of advertising, market research and/or the demand-oriented design of its website. Such analysis takes place in particular (even for users who are not logged in) to provide demand-oriented advertising and to inform other users of the social network about your activities on our website. YouTube, as part of Google, also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. You can view Google's certification at https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. The processing serves to make our website more attractive and to offer you additional services. We have no knowledge of how long YouTube stores data and have no way of influencing this. For more information about the purpose and scope of processing by YouTube, please refer to its privacy policy at https://www.google.de/intl/en/policies/privacy.

You have the right to object to the processing. You can send us your objection to the contact data provided under ‘Responsible provider’. Your right of objection exists if you have reasons arising from your particular situation, unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend against legal claims (Art. 21(1) GDPR). You can disable or restrict the transfer of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use the full functionality of the website.