This is a convenience translation. The German version is legally binding.
The following privacy notice applies to all services provided by the firm in the course of which personal data is processed. I process personal data, including the personal data of your representatives, employees and other contact persons, in strict compliance with the applicable data protection and professional regulations, this general privacy notice and any specific privacy notices applicable in the individual case. This applies regardless of the reason for the data processing and of the persons acting on my behalf.
1. Controller
Rechtsanwalt (attorney-at-law) Leonhard J. Strub
Kiehlufer 53
12059 Berlin
Germany
Email: info@strub.law
Telephone: +49 176 411 934 65
2. Categories and sources of personal data
As a rule, I collect the personal data I process directly from the data subjects or receive it from you for the purposes set out in section 3.
The categories of personal data I process include in particular address data and other contact data, bank details, data from communications, device data that can be linked to a specific person, photographs and video recordings in which persons can be identified (insofar as you provide these to me or they arise in the course of building security at my premises), and other data required for the purposes set out in section 3. In individual cases, the data I process may also include special categories of personal data within the meaning of Article 9(1) GDPR.
In the course of our collaboration, I may receive personal data about the representatives, employees and other contact persons you deploy from third parties, for example from service providers I engage as processors, from opposing parties and their legal advisers, from insurers, financial institutions, authorities or courts. In such a case I will inform you in an appropriate form, and on request, about the origin of the data received.
3. Purpose and legal basis of the processing
I process personal data exclusively in connection with, and for the preparation, performance and promotion of, my legal services, the provision of my other services, and the contractual relationships and collaborations that arise in connection with my work. This includes the business relationships with the service providers from whom I obtain goods and services. Data may also be processed to pursue my legitimate interests, to enforce claims, to fulfil statutory obligations and in exchanges with authorities and courts.
The legal bases are Article 6(1)(b) GDPR (performance of a contract), Article 6(1)(c) GDPR (legal obligations) and Article 6(1)(f) GDPR (legitimate interests, in particular the establishment, exercise or defence of legal claims). Insofar as special categories of personal data (Article 9 GDPR) are concerned, Article 9(2)(f) GDPR applies.
Where required by applicable law, I rely on the consent of the data subjects (Article 6(1)(a) GDPR), for example for direct marketing measures and event management. I will always obtain any necessary consent from you separately and in a transparent and appropriate form.
4. Recipients
In the course of providing my services and the related processes and measures of conducting my business, I may give the following recipients access to the personal data I process or transfer it to them: courts, authorities, other law firms, service providers, banks, insurers, doctors, experts and assessors.
Data is passed on only insofar as this is necessary for handling the mandate (e.g. courts, authorities, the opposing party and their lawyers, experts) or where a legal obligation exists. IT service providers that process data on my behalf do so exclusively on the basis of a data processing agreement concluded with me (Article 28 GDPR).
In the course of processing personal data, data may be transferred to countries outside the European Union and the European Economic Area, for example when I use external service providers.
Transfers of personal data from the EU to locations outside the EEA take place exclusively on the basis of appropriate safeguards and in compliance with the applicable data protection and professional regulations. This ensures that the data is subject to the level of protection applicable in the EU/EEA. I generally ensure this by using the EU standard contractual clauses, which can be viewed on the European Commission’s website at ec.europa.eu, or otherwise by other appropriate safeguards within the meaning of Chapter V GDPR.
5. Services used
I use the following services for communication, documents, research and the operation of this website:
- Microsoft 365 (Microsoft Ireland Operations Ltd.) for email and documents. A data processing agreement under Article 28 GDPR is in place. Data may be transferred to the USA in the process. Microsoft relies on the EU standard contractual clauses and is certified under the EU-US Data Privacy Framework.
- Libra (Libra Technology GmbH, Germany), AI-supported software for legal document work and research. A data processing agreement under Article 28 GDPR is in place. The data is processed on servers in Germany.
- DeepL for translations. A data processing agreement under Article 28 GDPR is in place.
- IONOS as the hosting provider for this website and my server. A data processing agreement under Article 28 GDPR is in place.
A data processing agreement (DPA) is a contract required under data protection law. It ensures that the service provider processes personal data only on my instructions and in accordance with the GDPR.
If I use another service that processes client matter data in an individual case, I will inform you separately.
If you would like to know who else may receive your data and which security measures I use, please contact me. My contact details are set out in section 1.
6. Retention period
I process personal data for as long as is necessary to achieve the respective purpose, including the time required for legal defence and, where applicable, beyond that insofar as I am obliged to do so by contractual or statutory retention obligations (e.g. accounting obligations and tax law requirements under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), professional retention obligations under Section 50(1) of the Federal Lawyers’ Act (BRAO)). Once the required retention periods have expired, I delete the data unless a statutory exception to the obligation to erase it applies. Restriction of processing replaces erasure only where the legal requirements for this are met.
7. Your rights
Within the scope of the statutory provisions (Articles 15–22 GDPR, Sections 33 and 34 of the German Federal Data Protection Act (BDSG)), you have in particular the following rights:
- to request confirmation as to whether I process personal data concerning you. If this is the case, you have the right to access this personal data and to further information, e.g. the purposes of the processing, the categories of personal data processed, the recipients and the envisaged period of storage or the criteria used to determine that period (right of access);
- to request the rectification of inaccurate personal data without undue delay and, taking into account the purposes of the processing, the right to have incomplete personal data completed (right to rectification and completion);
- to request the erasure of your personal data insofar as further processing is not necessary. This is the case, for example, if the personal data is no longer necessary for the original purposes, if you have withdrawn your consent under data protection law, or if the data has been processed unlawfully (right to erasure);
- to request the restriction of processing, e.g. if you consider your personal data to be inaccurate (right to restriction of processing);
- to object at any time to the processing of personal data that is carried out on the basis of a legitimate interest. In the case of direct marketing, you have the right to object at any time to the processing of personal data for the purposes of such marketing (right to object);
- to receive the personal data concerning you in a structured, commonly used and machine-readable format (right to data portability);
- insofar as the processing is based on consent, to withdraw that consent at any time with effect for the future (right of withdrawal).
To exercise your rights and for any questions about the processing of your personal data, you can contact me using the contact details given in section 1.
8. Provision of personal data
You are neither legally nor contractually obliged to provide your personal data. However, providing the data required to establish and handle a mandate (in particular name, contact details, information about the facts) is a prerequisite for concluding and performing the engagement contract. Without this data, the client relationship cannot be established or carried out.
9. Automated decision-making
No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.
10. Right to lodge a complaint
You have the right to lodge a complaint with the competent supervisory authority:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59-61, 10555 Berlin, Germany
www.datenschutz-berlin.de
You may also contact any other data protection supervisory authority, in particular the authority competent in your country of residence.
11. Specific information on the use of this website
The following information concerns the data processing that takes place when you visit this website.
Hosting and server log files
This website is hosted by IONOS. When the website is accessed, the server automatically records information transmitted by your browser (in particular IP address, date and time of access, page accessed, amount of data transferred, browser type and operating system). This processing is necessary for the secure and stable provision of the website. The legal basis is Article 6(1)(f) GDPR (legitimate interest in a technically error-free and secure website). A data processing agreement under Article 28 GDPR is in place with IONOS.
Contact form
If you contact me via the form on this website, I process the data you provide (e.g. title, name, email address, company, industry, preferred language and form of address, and your message) in order to handle your enquiry and to get in touch with you. The legal basis is Article 6(1)(b) GDPR (pre-contractual measures) or Article 6(1)(f) GDPR (legitimate interest in responding to your enquiry). The data is deleted as soon as it is no longer required for this purpose, unless statutory retention obligations prevent this. Please do not send any confidential details via the form yet; the initial contact does not yet create a client relationship.
To prevent abusive submissions, I process your IP address and store an identifier derived from it together with a counter for submission attempts. No more than three submission attempts per identifier are possible within one hour. The counter expires one hour after the last counted submission attempt. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is the secure operation of the contact form.
Fonts
This website uses only fonts stored locally on the server. When the pages are loaded, no data is transmitted to providers of external font services (such as Google Fonts) in this respect.
Website analytics with Matomo
With your consent, I use Matomo to analyse how this website is used and improve its content. I operate Matomo on my own server hosted by IONOS. The usage data collected is not transmitted to the provider of the Matomo software.
The data collected includes pages viewed, the time and duration of visits, referral sources and campaign labels, and technical information about your browser and device. It also includes scroll depth, clicks on contact links, downloads and external links, and whether a form was started or successfully submitted. Form contents, names, email addresses and free-text search terms are not sent to Matomo. Sessions are not recorded.
Your IP address is shortened before Matomo stores it. Only the domain of a referring page is stored. Matomo uses analytics cookies to identify visits and returning browsers. These cookies are stored for up to 180 days. Session cookies expire after 30 minutes of inactivity.
Analytics begins only after you give consent. The legal bases are Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications and Digital Services Data Protection Act (TDDDG). You can use the website without giving consent. An enabled Do Not Track setting in your browser is respected.
Individual visit and event data is deleted after 180 days. Aggregated reports are retained for 24 months. Deleted data may temporarily remain in backups. These copies are used only for recovery and are deleted during the daily backup run once 30 days have elapsed.
You can withdraw your consent at any time through “Privacy settings” in the footer. Further collection then stops and the analytics cookies are deleted. Withdrawal does not affect the lawfulness of processing before consent was withdrawn.
Saving your choice with Klaro
Klaro manages your privacy choices and is loaded directly from this website. Your choice is stored for 180 days in the “strub_consent_v1” cookie so that the website can respect it on later visits. No data is transmitted to the provider of Klaro in this process.
The necessary storage of your choice is based on Section 25(2)(2) TDDDG. Where personal data is processed, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is to respect your privacy choices reliably and avoid repeatedly asking you to make the same choice.
As at October 2026