• Identity data (e.g. name, date of birth, data contained in identity cards and other identification documents);
• Contact details (e.g. address, e-mail, telephone number) and
• Mandate data (e.g. information that
  • is typically in legal documents such as contracts or briefs and/or public registers, e.g. land register, commercial and association registers,
  • were the subject of correspondence with our clients, counterparties, parties to proceedings, courts, authorities or other business partners, or
  • Legal relationships with the client’s employer or third parties, e.g. personal data, file number or loan or account numbers at banks touch.
• If this is the subject of our advice, we also process special categories of personal data, e.g. health data (Art. 9 Para. 1 GDPR) or data relating to criminal convictions and offenses or related security measures (Art. 10 GDPR).
• Other communication data (e.g. data that is the subject of our correspondence and communication (oral/written, electronic (e-mail/chat))).

• to conclude or implement mandate agreements, contracts and other business relationships (including the processing of sales contracts, deliveries or payments) or to prepare or respond to requests for quotations and to determine the conditions of the contractual relationship, namely with our clients, business partners, service providers or cooperation partners, for which you may work as an agent or employee;
• for the office's internal administrative purposes (e.g. for bookkeeping, address management);
• if necessary, to carry out anti-terrorist and sanctions list screenings;
• to conduct court and administrative proceedings and/or for the purpose of asserting/exercising and defending against legal claims at home and abroad, including exercising professional privileges and ensuring other special confidentiality rights;
• for other communication purposes;
• to ensure the IT security and IT operations of our law firm;
• to use service providers (e.g. external IT service providers) who support our business processes;
• to prevent criminal offenses and, in individual cases, to accompany compliance investigations and the associated (including electronic) review of correspondence and documents.

 
3. Disclosure of Personal Data
We only transmit your personal data to third parties on the basis of legal regulations or if you have given your consent in individual cases.
Your personal data may be passed on to external service providers inside and outside the European Economic Area (EEA) to the extent necessary for the above purposes. In the course of our work, we also use cloud-based IT solutions from third-party providers (e.g. Microsoft Office365). In particular, we use (cloud-based) services for document management, collaboration and automation or analysis of documents, as well as external (cloud) providers of mail servers.
The service providers are carefully selected by us and commissioned in compliance with data protection and professional regulations.
In the normal business of the law firm and for the above-mentioned purposes, it may also happen that we pass on your data to other third parties inside and outside the EEA, such as business partners or law firms with whom we work within the framework of a mandate, translators, opponents and other third parties.
In addition, to the extent permitted by law, we can transmit your personal data to authorities (e.g. social insurance institutions, tax authorities or law enforcement authorities), public registers and courts in Germany and abroad in order to fulfill legal obligations or with your consent in individual cases. These can also be foreign authorities and courts.
 
4. Third country transfers
As a law firm that also deals with cross-border matters, we share the data we process with recipients (service providers or other third parties) who may be based in countries outside the EEA. If there is no legal level of protection comparable to European data protection law in these countries, we will take precautions if your personal data is transferred to these countries to ensure adequate protection of your personal data in these countries. In particular, the standard contractual clauses published by the European Commission are available to us for this purpose.
 
5. Protection of personal data
Each of our employees and all employees of external service providers who have access to personal data are obliged to treat this data confidentially and to protect it accordingly. We have also implemented various technical and organizational measures to process the data securely.
However, communication by e-mail in particular carries risks such as delay or non-delivery, transmission to persons other than the recipient, data loss or damage, interception, modification or other manipulation by third parties. In addition, viruses and similar malicious programs can be transmitted via e-mails despite the anti-virus software we use. Mobile means of telecommunication and other forms of communication via the Internet, such as video conferences, harbor comparable risks, particularly with regard to unauthorized access by third parties.
With regard to the use of cloud-based IT applications, it cannot be ruled out that third parties (in particular US authorities) will openly or covertly inspect data. Loss of data or damage to it cannot be ruled out with cloud-based services, despite exercising due care and observing the current technical standards.
 
6. Deletion of personal data
We delete the personal data at the end of the mandate or contractual relationship or our contact, if the storage is no longer necessary to fulfill our (post)contractual obligations or the legitimate interests mentioned in this data protection declaration and there are no statutory storage obligations. If there are statutory retention requirements, we restrict the processing of the data.
 
7. Data subject rights
Under the legal requirements, the existence of which must be checked in each individual case, you have the right to receive information about your personal data and to request the correction or deletion of your personal data or the restriction of processing, and to receive your personal data in a structured, current and machine-readable format (data portability). Under the legal requirements, the existence of which must be checked in each individual case, you also have the right to object to the processing of your personal data.
If we process your personal data in order to inform you about our consulting activities and current developments to the extent relevant to your business activity, you can object to the processing of your personal data at any time without giving reasons. Furthermore, with regard to the processing of your personal data, you have the right to lodge complaints with a supervisory authority. The supervisory authority of our office is the Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, 10969 Berlin.
 
8. Updating and changing this data protection declaration
This information letter is currently valid as of July 2022. Due to changes in our activities and/or our services or due to changed legal or official requirements, it may become necessary to change this information. You can access and print out the current data protection declaration at any time on the website at www.galen.de/datenschutz.