Data Policy

Controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union and other provisions relating to data protection is the law firm:

name: Bohardien Rechtsanwaltsgesellschaft mbH

address: Kaiserswerther Str. 215, 40474 Düsseldorf

phone: +49 (0) 211 2988 0300

email: kontakt@bohardien.de

website: www.bohardien.de

Collection, storage and use of personal data

When you visit our website www.bohardien.de (hereinafter referred to as the ‘website’), the browser used on your device automatically sends information to our website’s server. This information is temporarily stored in a so-called log file. It comprises the following information, which is collected without any action on your part and stored until it is automatically deleted:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the file accessed,
• the website from which the access originated (referrer URL),
• browser used and
• where applicable, your computer’s operating system and
• the name of your internet service provider.

In general, we process the personal data that you provide to us in the context of an enquiry, a pre-contractual client relationship or a contractual relationship. If you contact us in connection with an enquiry regarding a client relationship, we process your personal data to assess a potential client relationship, including any checks for conflicts of interest, and to communicate with you. In individual cases and insofar as this is necessary for the performance of the contract, we also process personal data that has been lawfully obtained from publicly accessible sources (e.g. commercial registers, the internet) or lawfully provided to us by third parties (e.g. credit reference agencies). This may include personal data (name, date of birth, legally authorised representatives), address details (address, email address, contact person), financial data (name of account holder, IBAN, BIC), contractual data (contract term, services purchased, cancellations), communication data (correspondence, email correspondence), advertising data (marketing letters) and other comparable categories of personal data.

Purposes and legal basis for the processing of personal data

We process the aforementioned data for the following purposes:

• to ensure the website connects smoothly,
• to ensure a user-friendly experience on our website,
• to evaluate system security and stability, as well as
• for other administrative purposes.

The legal basis for data processing is Article 6(1)(f) GDPR. Our legitimate interest arises from the purposes for data collection listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your identity.

In addition, we use cookies and analytics services when you visit our website. Further details on this can be found in sections 1.4 and 6 of this privacy policy.

We process your personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR), the new Federal Data Protection Act (BDSG) and all other relevant legislation for the following purposes and on the following legal bases:

• to process enquiries that you send to us by email – the legal basis for this is your consent in accordance with Article 6(1)(a) GDPR.
• to ensure IT security and the smooth operation of the website, and for statistical analysis with a view to optimising the website – the legal basis for this is Article 6(1)(f) GDPR.
• Should a client relationship be established with us, we will use personal data to the extent necessary for the performance of the contract or for the implementation of pre-contractual measures. The purposes of data processing are determined by the specific terms of the contract, which are agreed with you at the start of the client relationship (Article 6(1)(b) GDPR).

Cookies

We use cookies on our website. These are small files that your browser creates automatically and which are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your device and do not contain any viruses, Trojans or other malware.

Information relating to the specific device used is stored in the cookie. However, this does not mean that we thereby gain direct knowledge of your identity.

The use of cookies serves, on the one hand, to make your experience of our website more convenient. For example, we use so-called session cookies to recognise that you have already visited individual pages on our website. These are automatically deleted when you leave our site.

In addition, to optimise user-friendliness, we also use temporary cookies which are stored on your device for a specific, predetermined period. If you visit our site again to use our services, the system automatically recognises that you have previously visited us and recalls the entries and settings you have made, so that you do not have to re-enter them.

We also use cookies to collect statistical data on the use of our website and to analyse this data for the purpose of optimising our offering for you (see section 5). These cookies enable us to automatically recognise that you have previously visited our site when you return. These cookies are automatically deleted after a defined period of time.

Technically necessary cookies are used on the basis of Section 25(2) TDDDG. Where cookies or similar technologies are not necessary for the operation of the website, their use is based solely on your consent in accordance with Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR.

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or so that a notification always appears before a new cookie is created. Disabling cookies completely may, however, mean that you are unable to use all the features of our website.

Recipients and disclosure of personal data

Within Bohardien Rechtsanwaltsgesellschaft mbH, access to the personal data you provide to us is granted only to those persons or organisational units that require such access to the extent necessary to fulfil our contractual or statutory obligations.

We will only disclose your personal data to third parties if:

• you have given your explicit consent in accordance with Article 6(1)(a) GDPR,
• the disclosure is necessary, in accordance with Article 6(1)(f) GDPR, for the establishment, exercise or defence of legal claims, and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of your data,
• in the event that there is a legal obligation to disclose the data under Article 6(1)(c) GDPR, or
• where this is permitted by law and necessary under Article 6(1)(b) GDPR for the performance of contractual relationships with you.

There is no disclosure to further recipients or categories of recipients as defined in Article 4(9) GDPR.

Duration of storage of personal data and criteria for determining the retention period

We process and store your personal data for as long as is necessary to fulfil our contractual and legal obligations. Once the data is no longer required for the fulfilment of contractual obligations, it is regularly deleted, unless its continued processing for a limited period is required due to professional regulations or other statutory or professional retention obligations.

Your rights as a data subject

You have the right:

• pursuant to Article 15 of the GDPR, to request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the intended storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data, provided that it was not collected by us, as well as information on the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details;
• to request, in accordance with Article 16 GDPR, the rectification of inaccurate personal data or the completion of your personal data stored by us without undue delay;
• in accordance with Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
• in accordance with Article 18 GDPR, to request the restriction of the processing of your personal data, provided that you contest the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer require the data, but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing in accordance with Article 21 GDPR;
• in accordance with Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transferred to another controller;
• in accordance with Article 7(3) GDPR, to withdraw your consent at any time. As a result, we may no longer continue the data processing that was based on this consent in future;
• pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority for your usual place of residence or work, or for the location of our firm’s registered office; and
• in accordance with Article 21 GDPR, to object to the processing of your personal data, provided there are grounds arising from your particular situation or the objection relates to direct marketing. In the latter case, you have a general right to object, which we will honour without you needing to specify a particular situation. You may inform us of your objection informally by telephone, email, fax or by post to our firm’s address listed at the beginning of this privacy policy.

Obligations regarding the provision of data

When using our website, you are not obliged to provide personal data. If you wish us to contact you, we require at least (i) your name and (ii) your telephone number or email address.

Data security

This website uses state-of-the-art TLS encryption to protect the transmission of confidential content.

We also employ appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

Automated decision-making and profiling

When establishing and carrying out our contractual relationship, you will not be subject to any decision based solely on automated processing – including profiling – in accordance with Article 22 GDPR, which produces legal effects concerning you or similarly significantly affects you.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You may withdraw any consent you have already given at any time. The lawfulness of the data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Objection under Article 21 GDPR

Where the processing of your personal data is based on Article 6(1)(e) or (f) GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation. This also applies to profiling based on these provisions. You can find the specific legal basis on which processing is based in this privacy policy.

If you object, we will no longer process the personal data in question, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

If your personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing. This also applies to profiling insofar as it is related to such direct marketing. In the event of an objection, your personal data will no longer be processed for the purposes of direct marketing.

Validity and amendments to this privacy policy

This privacy policy is currently valid and is dated 1 August 2026.

Supplementary data protection information regarding the use of Microsoft 365, including ‘Teams’

We use Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, for electronic communication and collaboration, as well as for managing emails and calendars, conducting online meetings, and storing and jointly editing documents and other files. In particular, we use Microsoft Outlook, Microsoft Teams, Microsoft OneDrive, Microsoft SharePoint and Microsoft Bookings for this purpose.

In the course of this use, the following data may be processed in particular: master data and contact details, user and login details, communication and content data, email and calendar data, files and documents, and – when using Microsoft Teams – audio, video and chat data.

The processing is carried out for the purposes of communicating with clients and other business partners, as well as for internal organisation and collaboration. Unless a more specific legal basis applies, the legal basis is Article 6(1)(b) or (f) GDPR.

Microsoft generally processes personal data in connection with the provision of Microsoft 365 as a data processor on our behalf. The processing is carried out on the basis of the Data Protection Addendum (DPA) in force between us and Microsoft.

Where personal data is transferred to third countries in the course of using Microsoft 365, this is carried out in accordance with the requirements of Articles 44 et seq. of the GDPR. Where no adequacy decision has been issued by the European Commission, the transfer is based on appropriate safeguards in accordance with Article 46 of the GDPR, in particular the standard contractual clauses provided by Microsoft.

Supplementary data protection information regarding the use of our contact form (Microsoft Bookings)

If you have any enquiries, we offer you the option of contacting us via a form provided on the website. You must provide a valid email address so that we know who the enquiry is from and can respond to it. Further details may be provided on a voluntary basis.

Data processing for the purpose of contacting us is carried out in accordance with Article 6(1)(a) GDPR on the basis of your voluntary consent.

The personal data we collect when you use the contact form will be automatically deleted once your enquiry has been dealt with.

Additional data protection information regarding the use of CloudFlare

On our website, we use services provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to secure and optimise our website, as well as to improve its availability and performance. Among other things, Cloudflare provides a Content Delivery Network (CDN) and protective mechanisms against unauthorised access and cyber-attacks.

When using Cloudflare, the following data in particular may be processed: IP addresses, information about content and URLs accessed, timestamps, technical information about the device and browser used, and information about accesses and security incidents. This data is processed, in particular, to deliver the website, to ensure the security and stability of the website, and to detect and prevent unauthorised access.

Cloudflare processes the personal data generated in this context, insofar as it acts as a data processor, on the basis of the data processing agreement (Data Processing Addendum) concluded with us.

The processing is carried out to safeguard our legitimate interest in the secure, stable and efficient provision of our website in accordance with Article 6(1)(f) GDPR.

When using Cloudflare, personal data may be processed in third countries, in particular in the USA. Cloudflare states that, for international transfers, it relies, amongst other things, on the Standard Contractual Clauses approved by the European Commission and – for transfers to the USA – on its participation in the EU-US Data Privacy Framework.

Further information on data processing by Cloudflare can be found in Cloudflare Privacy Policy.

Supplementary privacy notice regarding hosting and Content Delivery Networks (CDN)

This website is hosted by Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany. Raidboxes provides the technical infrastructure for the operation and delivery of our website.

When you visit the website, the hosting provider processes, in particular, technical connection data. This may include, in particular, the IP address, the date and time of access, the content requested, the volume of data transferred, information about the browser and operating system used, and other technical data. The processing of this data is necessary to technically provide the website, to ensure its stability and security, and to detect and prevent unauthorised access.

The processing is carried out based on our legitimate interest in the secure and reliable provision of our website in accordance with Article 6(1)(f) GDPR.

Raidboxes processes personal data in connection with hosting services as our data processor. We have entered into a data processing agreement with Raidboxes in accordance with Article 28 of the GDPR.

According to Raidboxes, the servers for Raidboxes’ Managed WordPress Hosting are located in Germany.

Further information on data processing by Raidboxes can be found in Raidboxes’ privacy policy.

Supplementary privacy notice on analytics tools

The tracking measures listed below and used by us are carried out based on Article 6(1)(f) GDPR. We use these tracking measures to ensure that our website is designed to meet your needs and is continuously optimised. Furthermore, we use these tracking measures to statistically record the use of our website and to analyse this data for the purpose of optimising our service for you. These interests are to be regarded as legitimate within the meaning of the aforementioned provision.

The respective data processing purposes and data categories can be found in the relevant tracking tools.

Google Analytics

For the purpose of designing our pages to meet your needs and continuously optimising them, we use Google Analytics, a web analytics service provided by Google Inc. (https://www.google.de/intl/de/about/) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter ‘Google’). In this context, pseudonymised usage profiles are created and cookies (see section 4) are used. The information generated by the cookie regarding your use of this website, such as

• browser type/version,
• operating system used,
• referrer URL (the previously visited page),
• hostname of the accessing computer (IP address),
• time of the server request,

are transmitted to a Google server in the USA and stored there. The information is used to analyse the use of the website, to compile reports on website activity and to provide other services relating to website and internet usage for the purposes of market research and the needs-based design of these web pages. This information may also be transferred to third parties where required by law or where third parties process this data on Google’s behalf. Under no circumstances will your IP address be linked to other data held by Google. IP addresses are anonymised so that they cannot be linked to you (IP masking).

Google Analytics is only used with your explicit consent. You may withdraw your consent at any time with future effect.

You can prevent the installation of cookies by adjusting your browser settings accordingly; however, please note that in this case, you may not be able to make full use of all the functions of this website.

You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address), as well as the processing of this data by Google, by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de).

As an alternative to the browser add-on, particularly for browsers on mobile devices, you can also prevent data collection by Google Analytics by clicking on this link. An opt-out cookie will be set, which prevents the future collection of your data when you visit this website. The opt-out cookie applies only to this browser and only to our website, and is stored on your device. If you delete the cookies in this browser, you will need to set the opt-out cookie again.

Further information on data protection in connection with Google Analytics can be found, for example, in the Google Analytics Help Centre (https://support.google.com/analytics/answer/6004245?hl=de).

Google AdWords Conversion Tracking

We also use Google Conversion Tracking to collect statistical data on the use of our website and to analyse this data with a view to optimising our website for you. In this process, Google AdWords sets a cookie (see section 4) on your computer if you have accessed our website via a Google advert.

These cookies expire after 30 days and are not used for personal identification. If the user visits certain pages on the AdWords client’s website and the cookie has not yet expired, Google and the client can recognise that the user clicked on the advert and was redirected to that page.

Each AdWords client is assigned a different cookie. Cookies cannot therefore be tracked across the websites of different AdWords clients. The information collected via the conversion cookie is used to compile conversion statistics for AdWords clients who have opted for conversion tracking. AdWords customers are informed of the total number of users who have clicked on their advert and been redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.

If you do not wish to take part in the tracking process, you can also refuse the setting of the cookie required for this – for example, via a browser setting that generally disables the automatic setting of cookies. You can also disable cookies for conversion tracking by configuring your browser to block cookies from the domain ‘www.googleadservices.com’. Google’s privacy policy on conversion tracking can be found here (https://services.google.com/sitestats/de.html).

Additional privacy information regarding the use of Google Maps

This website uses Google Maps to display our location and to make it easier for you to find us. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When using Google Maps, personal data – in particular your IP address and technical information about the device and browser you are using – may be transmitted to Google. Google may process the data collected in connection with the use of Google Maps in accordance with its privacy policy. Further information on data processing by Google can be found in Google’s privacy policy.

The integration of Google Maps is based on your consent in accordance with Article 6(1)(a) GDPR, provided that you consent to the use of Google Maps via our consent management system. Consent may be withdrawn at any time with future effect.

Where personal data is transferred to third countries, in particular the USA, in connection with the use of Google Maps, this is carried out in accordance with the requirements of Articles 44 et seq. of the GDPR. Where no adequacy decision has been issued by the European Commission, appropriate safeguards are put in place for the transfer.

Further information on data processing by Google can be found in Google’s privacy policy.

Supplementary privacy notice on the use of social media

We maintain a company page on LinkedIn. When you visit our website, no data is generally transferred to LinkedIn unless you click on the relevant link. A connection to LinkedIn’s servers is only established when you visit the LinkedIn page. LinkedIn Ireland Unlimited Company, Dublin, Ireland, is responsible for the processing of personal data on LinkedIn. Further information on the processing of personal data by LinkedIn can be found in LinkedIn’s privacy policy.

Additional data protection information regarding subscription to our newsletter

If you subscribe to our newsletter, we will use your email address to send you our newsletter. This processing is carried out on the basis of your consent in accordance with Article 6(1)(a) GDPR. You may withdraw your consent at any time with future effect. To do so, you can use the unsubscribe link included in every newsletter. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

We use the MailerLite service to manage newsletter subscriptions and send out the newsletter. The provider is MailerLite Limited, Ireland. In the context of sending out the newsletter, your email address and, where applicable, any other data you provided when signing up will be processed. MailerLite processes this data on our behalf as a data processor. We have entered into a data processing agreement with MailerLite in accordance with Article 28 of the GDPR.

MailerLite may process information regarding the use of the newsletter as part of the provision of its services. This may include, in particular, information on whether and when an email has been opened or a link contained therein has been clicked, provided that the relevant functions are activated in our MailerLite account.

MailerLite states that it processes and stores data relating to customers from the European Economic Area within the European Union. However, insofar as personal data is nevertheless transferred to third countries in the course of providing the services, this is carried out in accordance with the requirements of Articles 44 et seq. of the GDPR and on the basis of the appropriate safeguards provided for this purpose.

Further information on the processing of personal data by MailerLite can be found in MailerLite’s privacy policy.

Supplementary data protection information for job applicants

You have the option of applying to us in response to job vacancies or on your own initiative. When using the online application process, data such as your name, address, telephone number, email address and any other application documents you submit (cover letter, CV, certificates, etc.) will be collected and processed. This data is transmitted in encrypted form.

If your application is successful, the data provided will be used for administrative matters relating to your employment. Should we be unable to offer you a position, we will retain the data you have provided for up to six months for the purpose of answering any queries relating to your application and the decision not to offer you a role. However, if your application documents are of general interest to us but there are currently no suitable vacancies available, you may consent to your data being stored and considered for similar job vacancies or future employment opportunities.

The legal basis for the processing is Article 6(1)(f) or, in the case of consent, Article 6(1)(a) GDPR.