PRIVACY POLICY

This privacy policy is intended to satisfy the information obligations under Articles 13 and 14 of the General Data Protection Regulation (GDPR) for the law firm's website. It informs you about the data processing that takes place when you visit our website or contact us by email or telephone. It also informs you about our presence on social media and about your rights regarding the processing of your data. The term “data processing” always refers to the processing of personal data.

1. Name and contact details of the controller within the meaning of Art. 4 GDPR

Claudia Schanz Russell

Schützenstraße 2 88212 Ravensburg Germany Email: mail@schanzrussell.com Phone: +49 751 359 1877

2. Collection and storage of personal data, and the nature and purpose of its use

2.1 When visiting the website

When you access our website schanzrussell.com, the browser on your device automatically sends information to our website's server. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and is stored until it is automatically deleted:

  • IP address of the requesting computer,
  • date and time of access,
  • name and URL of the file retrieved,
  • website from which access was made (referrer URL),
  • browser used and, where applicable, the operating system of your computer as well as the name of your access provider.

The above data is processed by us for the following purposes:

  • ensuring a smooth connection to the website,
  • ensuring convenient use of our website,
  • evaluating system security and stability, and
  • other administrative purposes, where applicable.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes listed above. Under no circumstances do we use the data collected to draw conclusions about your identity.

Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany (“IONOS”). IONOS processes the above-mentioned log file data as our processor within the meaning of Art. 28 GDPR, on the basis of a corresponding agreement.

Under our hosting agreement, we use the tool IONOS WebAnalytics to statistically evaluate visitor behaviour on our website. According to IONOS, this tool operates without cookies and anonymises IP addresses immediately upon collection, so that no link to an individual can be established. Processing therefore takes place on the basis of our legitimate interest in evaluating the use of our website (Art. 6(1)(f) GDPR). Consent under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is not required for this purpose, as no cookies or comparable storage or access technologies are used on your device. Independently of this, our website provides a cookie consent tool through which you can grant or withdraw consent for services that do require consent (e.g. Google Maps, see Section 6).

2.2 Contact by email or telephone

For any questions, we offer you the option of contacting us using the contact details provided on the website. When contacting us by email, a valid email address is required so that we know who is making the enquiry and are able to respond to it. Further information may be provided voluntarily.

When you contact us by telephone, we process personal data that you voluntarily provide to us. This generally includes your name and your email address or telephone number, so that we can respond to your enquiry.

Processing your data for the purpose of contacting us is based on our legitimate interest in responding to your enquiry or, where the contact serves to prepare a potential engagement, on the basis of pre-contractual measures (Art. 6(1)(f) or (b) GDPR, respectively).

We use Microsoft 365 (Business Standard) to manage our email mailbox. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, acting as our processor within the meaning of Art. 28 GDPR. The use of Microsoft 365 may involve processing of your data outside the European Union. Microsoft provides appropriate safeguards for this, in particular under the EU Data Boundary and the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Personal data collected through contact by email or telephone is deleted once your enquiry has been dealt with. See Section 8 for further detail.

3. Disclosure of data

We only disclose your personal data to third parties if:

  • disclosure is necessary under Art. 6(1)(f) GDPR to assert, exercise or defend legal claims, and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
  • there is a legal obligation to disclose the data under Art. 6(1)(c) GDPR,
  • you have given your explicit consent to do so under Art. 6(1)(a) GDPR.

3.1 Credit check on a case-by-case basis

In individual cases where there is a legitimate interest, including for existing clients, our firm checks and monitors information on your previous payment history when entering into contracts. For this purpose, we work on a case-by-case basis with Creditreform Ulm/Neu-Ulm Müller & Schott GmbH & Co. KG, Geschäftsstelle Ravensburg, Karlstr. 10, 88212 Ravensburg, Germany, from whom we receive the data required for this purpose. Where the information relates to a private individual, Creditreform Ulm/Neu-Ulm Müller & Schott GmbH & Co. KG additionally draws on the database of infoscore Consumer Data GmbH, Rheinstraße 99, 76532 Baden-Baden, Germany, a company of the Experian Group. For this purpose, we transmit your name, address and date of birth to Creditreform Ulm/Neu-Ulm Müller & Schott GmbH & Co. KG. Information pursuant to Art. 14 GDPR on the processing carried out by infoscore Consumer Data GmbH is available at: https://www.experian.de/icd-infoblatt.

3.2 International data transfers

In connection with the use of services provided by Google LLC and Meta Platforms, Inc., as well as in connection with our use of Microsoft 365 (see Section 2.2), your personal data may be transferred to the United States. Google and Meta state that they are certified under the EU-U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795 of the European Commission of 10 July 2023).

We would like to point out that the practical robustness of this adequacy decision is currently the subject of legal disputes in the United States and of an appeal pending before the Court of Justice of the European Union. To the best of our knowledge, the decision nevertheless remains formally in force. Independently of this, we additionally base the relevant data transfers on the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR, as made available by the respective providers. We monitor further developments and will amend this policy where necessary.

4. Cookies and comparable storage technologies

We use cookies on our website, as well as a comparable storage technology (local storage). Cookies are small files that your browser automatically creates and that are stored on your device when you visit our site. They do not cause any damage to your device and do not contain viruses, trojans or other malicious software.

The table below shows which cookies or storage entries are in use as of the date of this policy:

Name Provider Purpose Retention Consent
Contao HTTPS CSRF token our own website (hosting: IONOS) Protection against cross-site request forgery attacks End of session No – strictly necessary, Sec. 25(2) No. 2 TDDDG
PHP session ID our own website (hosting: IONOS) Managing the user session End of session No – strictly necessary
ccb_contao_token (local storage) our own website (cookie consent tool) Storing your cookie banner selection Until changed/deleted by you No – strictly necessary
Google Maps (category in consent tool) Google Ireland Limited Activating the map display, see Section 6 Until withdrawn Yes – consent required

The use of the strictly necessary cookies and of local storage is based on our legitimate interest in the functional and secure operation of the website (Art. 6(1)(f) GDPR). Consent is not required for this under Sec. 25(2) No. 2 TDDDG. Activating Google Maps requires your consent under Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG, which you can grant or withdraw at any time via our cookie consent tool.

Most browsers accept cookies automatically. You can, however, configure your browser so that no cookies are stored on your computer, or so that a notice always appears before a new cookie is created. Disabling cookies entirely may, however, mean that you are unable to use all the functions of our website.

5. Google Web Fonts

This site uses so-called web fonts provided by Google for the uniform display of typefaces. Google Fonts is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The fonts are stored locally on our own servers and delivered from there. No connection to Google's servers is established in this process, and your IP address is not transmitted to Google. Accordingly, no personal data is passed on to Google when you access pages of our website on which Google Fonts is used. The use of Google Web Fonts serves our interest in a consistent and visually appealing presentation of our online offering and constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

6. Google Maps

We use Google Maps, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (“Google”), to show you our location on a map and make it easier for you to find us. Before the map is displayed, we ask for your consent via our cookie consent tool. Only after you have confirmed your consent is information about your use of our website (e.g. your IP address) transmitted to Google's servers, which may include servers operated by Google LLC in the United States.

The processing of data in connection with the use of Google Maps is based on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG. You have the right to withdraw your consent at any time with effect for the future via the cookie settings (Art. 7(3) GDPR). For further information, please see Google's privacy policy at: https://policies.google.com/privacy.

7. Use of data in connection with social networks and their social media plug-ins

On the basis of Art. 6(1)(f) GDPR, we use social media plug-ins from the social networks Instagram and LinkedIn on our website to raise awareness of our firm. These plug-ins are embedded using the so-called two-click method in order to provide the best possible protection for visitors to our website.

Joint controllership under Art. 26 GDPR

In connection with the integration of the social media plug-ins of Meta Platforms Ireland Ltd. (Instagram) and LinkedIn Ireland Unlimited Company, we are joint controllers together with the respective providers for the collection of data when the plug-ins are accessed. The key content of the relevant agreements is available at: Meta: https://www.facebook.com/legal/controller_addendum; LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum. The primary point of contact for the exercise of data subject rights is the relevant platform provider. You may also contact us in addition.

7.1 Instagram

Our website uses social media plug-ins from Instagram. In doing so, we rely on the technical platform and services of Meta Platforms Technologies Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you access a page of our website that contains such a plug-in, your browser establishes a direct connection to Instagram's servers. Instagram thereby receives the information that your browser has accessed the relevant page, even if you do not have an Instagram profile of your own. Further information on Meta's use of data is available at: https://help.instagram.com/519522125107875.

7.2 LinkedIn

Our website uses social media plug-ins from LinkedIn. In doing so, we rely on the technical platform and services of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. If you access a page of our website that contains such a plug-in, your browser establishes a direct connection to LinkedIn's servers. Further information on LinkedIn's use of data is available at: https://de.linkedin.com/legal/privacy-policy.

8. Retention period

We only store your personal data for as long as is necessary for the purposes stated in this policy:

  • server log files (Section 2.1): deleted after 7 days at the latest, unless there are security-relevant irregularities, in which case the data is stored until the matter has been clarified;
  • enquiries by email or telephone (Section 2.2): deleted once your enquiry has been dealt with, and at the latest after the statutory limitation period of three years (Sec. 195 of the German Civil Code, BGB), to the extent that we have a legitimate interest in being able to demonstrate the communication that took place.

9. Data subject rights

You have the right:

  • under Art. 15 GDPR, to request information about the personal data we process concerning you, in particular the purposes of processing, the categories of personal data, the categories of recipients, the envisaged storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected from you, and the existence of automated decision-making, including profiling;
  • under Art. 16 GDPR, to request the immediate rectification of inaccurate data or the completion of personal data stored with us;
  • under Art. 17 GDPR, to request the erasure of your personal data stored with us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
  • under Art. 18 GDPR, to request the restriction of the processing of your personal data;
  • under Art. 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller;
  • under Art. 7(3) GDPR, to withdraw any consent you have given to us at any time; and
  • under Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority of your habitual residence or place of work. The authority with jurisdiction over our firm's registered office is: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI), Heilbronner Straße 35, 70191 Stuttgart, Germany, telephone: +49 711 615541-0, email: poststelle@lfdi.bwl.de.

10. Right to object

Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right, under Art. 21 GDPR, to object to the processing of your personal data on grounds relating to your particular situation, or where the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to state a particular situation.

11. Data security

When you visit our website, we use the widely adopted TLS (Transport Layer Security) protocol together with the highest level of encryption supported by your browser. Whether an individual page of our website is transmitted in encrypted form can be seen from the closed padlock symbol in your browser's address bar.

We otherwise employ appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or total loss, destruction, or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

12. Currency and amendment of this privacy policy

As we develop our website and our services further, or as a result of changes to legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version of this privacy policy can be accessed and printed at any time at www.schanzrussell.com/datenschutz.html.

If you have any questions about the collection, processing, archiving or transmission of your personal data, about requests for information, rectification, restriction or erasure of data, or about the withdrawal of consent given or an objection to a particular use of your data, please contact our firm directly. An email to mail@schanzrussell.com is sufficient.

As of: August 2026