Legal

Privacy Policy

Placeholder — pending legal review. This English version is provided for convenience only and has not yet been reviewed by legal counsel. The legally binding version is the German Privacy Policy, which prevails in case of any discrepancy.

This website does without any tracking, third-party cookies, and external embeds. No user profiles are created, and — apart from processing your enquiry when you contact us (see section 3) or the technical provision of the site (see section 4) — no personal data is passed on to third parties.

1. Name and contact details of the controller

This privacy information applies to data processing by:

Rechtsanwaltskanzlei Feldhaus
Dr. Nadine Feldhaus
Rothenbaumchaussee 31
20148 Hamburg
Germany

E-mail: mail@kanzlei-feldhaus.de
Phone: +49 40 648 51 357
Fax: +49 40 655 84 310

2. Collection and storage of personal data, and the nature and purpose of its use

When you access my website www.kanzlei-feldhaus.de, no access data (log files) is stored on my servers. I only collect personal data when you actively provide it to me, for example via the contact form (see section 3).

3. Contact form

My website offers a contact form. If you use it, I process the data you enter (first and last name, e-mail address, subject, and message) solely to handle your enquiry.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR (performance of pre-contractual measures) and Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in responding to enquiries).

Processor – AWS SES: To send the contact enquiry by e-mail, I use Amazon Simple Email Service (SES) provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Processing takes place exclusively on servers in Frankfurt am Main (EU region eu-central-1). No transfer to third countries takes place. A data processing agreement pursuant to Art. 28 GDPR (AWS Data Processing Addendum) is in place with AWS. The data is used solely for the purpose of e-mail delivery and is not stored thereafter.

The data is deleted once the enquiry has been conclusively handled and no statutory retention obligations preclude deletion.

4. Hosting and content delivery network (AWS CloudFront)

To provide my website, I use the content delivery network (CDN) CloudFront. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (hereinafter “AWS”).

For technical reasons, your IP address must be transmitted to AWS in order to deliver the website content to your device. I have fully disabled logging in CloudFront. No connection data of yours is stored on the AWS servers.

The legal basis for using this service is my legitimate interest in the stable, secure, and fast provision of my website pursuant to Art. 6 (1) lit. f GDPR. Processing takes place on the basis of a data processing agreement with AWS.

5. Audio and video conferencing (Google Meet)

For communication with my clients, I use the online conferencing tool Google Meet by default. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The tool processes data that you provide in order to use it (e-mail address or phone number) as well as metadata (duration of the conference, time of participation, number of participants). Furthermore, technical data such as IP addresses, device IDs, and operating system versions is processed. Insofar as content is exchanged or made available within the tool, it is stored on the provider’s servers.

The legal basis is communication with existing or prospective clients (Art. 6 (1) lit. b GDPR) and my legitimate interest in efficient communication (Art. 6 (1) lit. f GDPR). Where consent has been requested, use takes place on that basis (Art. 6 (1) lit. a GDPR), which can be withdrawn at any time.

For details on the data processing, please refer to Google’s privacy policy at https://policies.google.com/privacy?hl=en and the specific information for Google Workspace at https://cloud.google.com/privacy/gdpr?hl=en. The data transfer to the USA is based on the European Commission’s standard contractual clauses and the provider’s certification under the EU-US Data Privacy Framework (DPF). I have concluded a data processing agreement (DPA) with Google.

6. Disclosure of data

Your personal data is not transferred to third parties for purposes other than those listed. I only disclose your personal data if:

  • you have given your express consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR,
  • disclosure is necessary pursuant to Art. 6 (1) sentence 1 lit. f GDPR to assert, exercise, or defend legal claims,
  • there is a legal obligation to disclose pursuant to Art. 6 (1) sentence 1 lit. c GDPR,
  • this is legally permissible and necessary pursuant to Art. 6 (1) sentence 1 lit. b GDPR for the performance of contractual relationships.

7. Cookies

My website uses a single, technically necessary cookie:

pref_lang – This cookie stores the language version (German or English) that you have manually selected via the language switcher. It is set only when you actively switch the language, and ensures that on a subsequent visit you remain in the selected language and are not automatically redirected based on your browser language. The cookie contains only the language code (de or en), does not allow you to be re-identified as a person, is not used for analytics, and is not passed on to third parties. Storage period: one year.

The legal basis is § 25 (2) no. 2 TDDDG, as the cookie is strictly necessary to provide the function you have expressly requested (language selection); no consent is required for this. You can delete the cookie at any time via your browser settings.

8. Analytics tools

I do not use any analytics or tracking tools. No evaluation of your usage behaviour takes place.

9. Data subject rights

You have the right:

  • pursuant to Art. 15 GDPR, to request information about your data processed by me,
  • pursuant to Art. 16 GDPR, to request the correction or completion of your data,
  • pursuant to Art. 17 GDPR, to request the erasure of your data,
  • pursuant to Art. 18 GDPR, to request the restriction of processing,
  • pursuant to Art. 20 GDPR, to receive your data in a structured and machine-readable format,
  • pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority.

10. Right to object

Insofar as your data is processed on the basis of legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR, you have the right to object pursuant to Art. 21 GDPR. If you wish to exercise this right, an e-mail to mail@kanzlei-feldhaus.de is sufficient.

11. Validity and changes to this privacy policy

This privacy policy is currently valid and dated May 2026.