Privacy.

1. Controller

Rechtsanwaltskanzlei Philip Gafron
Kurfürstendamm 214
10719 Berlin, Germany
Email: office@gafron.law
Phone: +49 (30) 4036 72 110

2. Hosting

This website is hosted by Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany, on servers located in Germany. The hosting provider processes access data (IP address, time of access, page requested) in server log files. The processing is based on Art. 6(1)(f) GDPR to ensure the operation of the website. Log files are deleted after 14 days. We have concluded a data processing agreement with Contabo under Art. 28 GDPR.

3. Web analytics (Plausible Analytics)

We use Plausible Analytics for statistical analysis of website usage. Plausible runs on our own server (self-hosted). No cookies are set and no personal data is stored. The IP address is used only to compute anonymous visitor counts and is discarded immediately after processing. No data is transferred to third parties. The processing is based on Art. 6(1)(f) GDPR (legitimate interest in analysing website usage). Our installation neither stores information on your device nor reads information from it; consent under Section 25 TDDDG is therefore not required for this configuration.

4. Contact form

If you contact us via the contact form, the details you provide (name, email address, optionally company and phone number, subject and message) are processed to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Your enquiry is stored in a database on our server (hosted by Contabo, see section 2) so that we can process and allocate it; in addition, a notification is sent to us by email via Microsoft 365 (Microsoft Corporation as processor). This form data is deleted after six months at the latest, unless statutory or professional retention obligations apply or your enquiry leads to further contact. Providing your data is neither required by law nor by contract. Without your contact details, however, we cannot process your enquiry.

5. Contact by email

If you contact us by email, your details including the contact data you provide are stored to process the enquiry and for any follow-up questions. The legal basis is Art. 6(1)(b) or (f) GDPR. Emails are processed via Microsoft 365. Data is deleted once processing is complete, unless statutory or professional retention obligations apply.

6. No analytics or marketing cookies of our own

This website itself does not set cookies for analytics or advertising purposes. Plausible Analytics runs without cookies. Where external services are loaded only after an active click, in particular YouTube videos, we provide information in the relevant sections of this privacy policy.

7. Local storage during the browser session (sessionStorage)

Our calculator tools may store your inputs locally in your browser during the current browser session (sessionStorage) so that inputs are not lost immediately when the page is reloaded. Data held in sessionStorage is not read by us and is not transmitted to us automatically; it is normally deleted when you close the browser tab. Data is transmitted to our server only if you trigger this yourself, namely via the share-link function (section 8) or by requesting a report (section 9). You can also delete the stored data at any time directly in the tool via the "Reset" button or via your browser settings.

8. Share links / stored calculator states

If you use the share-link function in one of our calculator tools, the calculator state is stored in encrypted form on our server so that you can reopen and share it via the generated link. Encryption takes place client-side in your browser. We have no access to the content in plain text. The key required for decryption is contained only in the fragment of the link and is not transmitted to our server on a normal server request.

Stored calculator states are deleted automatically after 30 days. The legal basis is Art. 6(1)(b) GDPR insofar as storage is necessary to provide the share function you use, and Art. 6(1)(f) GDPR based on our legitimate interest in providing this function in a user-friendly and secure manner.

Where a shared calculator state contains personal data in an individual case, you have the statutory data-subject rights, in particular to access, rectification, erasure, restriction of processing and objection, under Art. 15 et seq. GDPR. Please note that anyone who has the complete share link can decrypt and view the stored calculator state. Treat the link confidentially and pass it on only to persons you want to grant access.

9. Report delivery by email

If you request a PDF report via one of our calculator tools, we process the following data: your email address to deliver the report, the simulation parameters you entered to produce the analysis, and technical metadata (IP address, timestamp) to prevent abuse.

The simulation parameters are held in memory only for the duration of report generation and are then deleted. Your email address is stored together with the time of the request, the type of calculator used and a keyed hash of your IP address. This data is deleted after six months. If your request leads to further contact, for example an enquiry by email, section 5 applies to that communication.

The legal basis is Art. 6(1)(b) GDPR insofar as processing is necessary to deliver the report you requested, and Art. 6(1)(f) GDPR for statistical analysis and abuse prevention based on our legitimate interest in providing the service securely and reliably. You may object at any time to processing based on legitimate interests.

Optional consent to a follow-up email: When requesting a report, you may optionally consent to receiving a one-time follow-up email from us with additional information. If you tick the corresponding box, we first send you a confirmation email (double opt-in). Only after you confirm on the linked page do we record your consent and send you a single follow-up email a few days later. The confirmation is given by clicking a button on the linked page; merely opening the link, for example by security software of your email provider, does not constitute confirmation. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) UWG). You may withdraw this consent at any time with effect for the future (Art. 7(3) GDPR), for example by emailing office@gafron.law; after withdrawal we no longer send the follow-up email. To evidence your consent we store your email address, the wording and version of the consent declaration and the times of request, confirmation, dispatch and withdrawal; six months after the request we remove the remaining details (report link, IP hash), and three years after confirmation we delete the record completely (Art. 6(1)(f) GDPR, evidence under Art. 7(1) GDPR for the regular limitation period). If you do not give consent, you receive only the requested report; the delivery email contains no promotional content.

Report generation and email dispatch take place on our server-side infrastructure. Insofar as our hosting provider is involved as a processor, we refer to the relevant information in this privacy policy. No data is passed on to other third parties.

10. Fonts

The fonts used on this website are served locally from our own server. No connection to external font services is established.

11. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the lock symbol in your browser's address bar and by the address changing from "http://" to "https://".

12. YouTube videos (two-click solution)

On some pages we provide YouTube videos via a so-called two-click solution. When the page is opened, only a preview image stored locally on our server is displayed. In this state, no connection to YouTube or Google is established and no YouTube player is loaded.

Only when you actively click on the video is the YouTube player loaded and a connection to Google servers established. We use YouTube's privacy-enhanced mode for this (domain: youtube-nocookie.com). After loading, you can disconnect again in the player via the "End YouTube connection" button; the preview image is then shown again. According to Google, no cookies are set for tracking purposes in this mode as long as you do not play the video. When the video is loaded or played, however, cookies may be set or read and personal data, in particular your IP address, device and browser information and the page visited, may be transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and, where applicable, to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

The legal basis for loading the YouTube player is your consent given by actively clicking on the video (Art. 6(1)(a) GDPR). Insofar as information is stored on or read from your device, this is also based on your consent (Section 25(1) TDDDG). You can refuse consent by not clicking on the preview image; in that case no YouTube player is loaded. Insofar as Google transfers data to the USA, the transfer relies on Google LLC's certification under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), supplemented by the European Commission's standard contractual clauses.

Further information: Google privacy policy

13. Social networks

We maintain company profiles on LinkedIn and YouTube. When you visit these profiles, the respective platform operators process your data under their own privacy policies. For the page statistics of our LinkedIn profile, we are jointly responsible with LinkedIn (Art. 26 GDPR) on the basis of the joint controller agreement (Page Insights Joint Controller Addendum).

• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland – privacy policy
• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – privacy policy

For our YouTube channel, Google does not provide a joint controller agreement. We decide on the content of the channel and evaluate the channel statistics provided by YouTube (views, watch time, aggregated demographic data) to assess reach and topic selection; we have no access to personal raw data. To the extent that this makes us party to the processing of your data for the purpose of creating these statistics, we are jointly responsible with Google for that processing (Art. 26 GDPR); whether and to what extent this is the case has not been conclusively settled in law. The basis for our evaluation is our interest in informing about our work and legal topics (Art. 6(1)(f) GDPR). Google is responsible for the other processing operations when you visit the channel, in particular cookies, user accounts and advertising. You can assert your rights against us and against Google Ireland Limited. Beyond page statistics, we have no influence on the data processing by the platform operators. Further information on your rights can be found in the privacy policies of the respective providers.

14. Data transfers to third countries

We use Microsoft 365 for email communication. Microsoft may transfer data to the USA. The transfer is based on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). Data may also be transferred to third countries when YouTube videos are played; Google LLC is likewise certified under the EU-US Data Privacy Framework, see section 12.

15. External links

This website contains links to external websites. When you click on these links, data is transmitted to the respective provider. This happens only after an active click, not automatically when the page loads.

16. Your rights

Under the GDPR you have the following rights:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please contact office@gafron.law.

17. Right to object (Art. 21 GDPR)

Insofar as we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to the processing. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin – datenschutz-berlin.de.