Contact us without obligation. We are there for you 7 days a week.
0221 / 2716733-0
[email protected]
Last updated: October 2026
This is a translation of our German privacy policy. In case of discrepancies, the German version shall prevail.
Thank you for your interest in our website. The protection of your personal data is important to us.
Below you will find information about which personal data is collected and processed when you visit and use the services on our website www.lhr-law.de.
We take the protection of your personal data and the legal obligations serving this protection very seriously. The law requires full transparency about the processing of personal data. Only if the processing is comprehensible to you as a data subject are you sufficiently informed about the purpose, nature and scope of the processing.
Our privacy policy therefore explains in detail which personal data we process when you use our website, all subpages referring to it and in the other cases explained here, if any.
The controller within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other data protection provisions is:
| Name and contact details of the controller | Controller within the meaning of Art. 4(7) GDPR: LHR Rechtsanwälte – Lampmann Haberkamm Rosenbaum & Partner mbB Grüner Weg 12 50825 Köln (Cologne) Germany Phone: +49 221 2716733-0 Email: [email protected] Hereinafter referred to as the “controller” or “we”. |
| Contact details of the data protection officer | You can reach our data protection officer at: LHR Rechtsanwälte – Lampmann Haberkamm Rosenbaum & Partner mbB – Data Protection – Grüner Weg 12 50825 Köln (Cologne) Germany Email: [email protected] |
Please note that links on our website may lead you to other websites that are operated by third parties and not by us. Such links are either clearly marked by us or recognizable by a change in the address bar of your browser.
We are not responsible for compliance with data protection regulations and the secure handling of your personal data on websites operated by third parties.
This privacy policy uses the terms of the GDPR. You can find the definitions (Art. 4 GDPR) e.g. at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679.
Cookies are text files that a website stores on or reads from your device. They contain combinations of letters and numbers in order, for example, to recognize the user and their settings when reconnecting to the website that set the cookie, to keep the user logged in to a customer account or to statistically analyze certain usage behavior.
Web storage technology allows variables and values to be stored locally in the user’s browser cache. It comprises the so-called “sessionStorage”, which remains stored until the browser tab is closed, and the “localStorage”, which remains stored in the browser cache until the user clears the cache. The localStorage technology makes it possible, among other things, to recognize the user and their settings when they visit our website.
Storing information on the user’s terminal equipment (e.g. setting cookies) or accessing information already stored there is based on Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where storage or access is not strictly necessary, we obtain your consent pursuant to Section 25(1) TDDDG; otherwise we rely on Section 25(2) TDDDG.
Where we specify the categories of data processed, this refers in particular to the following data: master data (e.g. names, address, dates of birth), contact data (e.g. email addresses, telephone number, messenger services), content data (e.g. text entries, photographs, videos, contents of documents/files), contract data (e.g. subject matter of the contract, terms, customer category), payment data (e.g. bank details, payment history, use of other payment service providers), usage data (e.g. history on our website, use of certain content, access times, contact or order history), connection data (e.g. device information, IP addresses, URL referrers), location data (e.g. GPS data, IP geolocation, access points).
We only process personal data to the extent permitted by law. Personal data is only disclosed in the cases described below. Personal data is protected by appropriate technical and organizational measures (e.g. pseudonymization, encryption).
Unless we are legally obliged to store data or disclose it to third parties (in particular law enforcement authorities), the decision as to which personal data we process, for how long, and to what extent we disclose it depends on which functions of the website you use in the individual case.
Personal data will be deleted as soon as the purpose of processing ceases to apply or a prescribed retention period expires, unless further storage is necessary for the conclusion or performance of a contract. Where we are required to provide information on the storage period of cookies and similar technologies, you will find it at the end of this privacy policy (see section III).
Personal data that we process in connection with an application (see below) will be stored for six months after the conclusion of the application procedure.
There is no automated individual decision-making, including profiling.
As a data subject, you have the right of access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR and the right to data portability pursuant to Art. 20 GDPR. The right of access and the right to erasure are subject to the restrictions under Sections 33 and 34 BDSG.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR in conjunction with Section 19 BDSG).
| Our competent data protection supervisory authority | Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestr. 2-4 40213 Düsseldorf, Germany |
You are free to lodge a complaint with another data protection supervisory authority. A list of supervisory authorities can be found at: https://www.bfdi.bund.de/ (under Infothek/Anschriften und Links).
Unless otherwise explained below in the information on the legal basis, you are not obliged to provide personal data. In the cases of Art. 6(1)(b) GDPR, however, personal data is required for the performance or conclusion of a contract. If you do not provide the relevant personal data, the contract cannot be performed or concluded. If you do not provide the data in the cases of Art. 6(1)(a) and (f) GDPR, you will not be able to use the relevant parts of our website.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing.
Pursuant to Art. 7(3) sentence 1 GDPR, you have the right to withdraw any consent you have given us at any time. The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal; it only applies to processing planned after the withdrawal. You may withdraw your consent informally by post or email. If you object, we will no longer process your personal data unless another (legal) basis permits this. If you withdraw your consent and there is no other legal basis, your personal data must be erased without undue delay at your request pursuant to Art. 17(1)(b) GDPR.
| Objections and withdrawals can be made informally and should be addressed to | LHR Rechtsanwälte – Lampmann Haberkamm Rosenbaum & Partner mbB Grüner Weg 12 50825 Köln (Cologne), Germany [email protected] |
Using the website and its functions regularly requires the processing of personal data.
| Purpose of processing | Functionality and optimization of the website, ensuring the security of our IT systems in the case of purely informational use of our website (without additional functions such as contact forms or social media plugins); integration and display of functions and content (e.g. graphics) that we do not provide ourselves. |
| Legal basis | Art. 6(1)(f) GDPR |
| Data categories | Usage data, connection data |
| Storage period of server log files | Server log files are only stored for as long as necessary for the purposes stated and are then deleted or anonymized. |
| Recipients | Data is only disclosed to third parties to the extent necessary for operating our website. For this purpose, personal data is transferred to the following recipients: the website host; Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (delivery of the website via a content delivery network and protection against attacks) |
| Intended transfer to third countries | In individual cases USA (Cloudflare; on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework) |
| Storage of data on your device based on consent | No |
| Purpose of processing | Processing your application and conducting the application procedure; considering your application in future application procedures if you have expressly consented to this. |
| Legal basis | Art. 6(1)(b) GDPR and Art. 88(1) GDPR in conjunction with Section 26(1) sentence 1 BDSG (where applicable); for storage for future application procedures Art. 6(1)(a) GDPR in conjunction with Art. 7 GDPR, Section 26(2) BDSG |
| Data categories | Master data, contact data, content data, contract data, connection data and usage data where applicable, and where applicable special categories of personal data within the meaning of Art. 9(1) GDPR (depending on the specific vacancy; we only store the data relating to your application that you provide to us and that we are permitted to process in the context of applications) |
| Recipients | None |
| Intended transfer to third countries | None |
| Storage of data on your device based on consent | No |
| Purpose of processing | Processing your enquiry. |
| Legal basis | Art. 6(1)(f) GDPR; Art. 6(1)(b) GDPR (if the enquiry leads to the (later) conclusion of a contract or concerns an existing contract) |
| Data categories | Master data, contact data, content data, usage data where applicable, connection data, contract data where applicable (depending on the type of enquiry) |
| Recipients | When using the contact form: HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA (provision of the form and management of your enquiry, see “HubSpot” below) |
| Intended transfer to third countries | When using the contact form USA (on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework) |
| Storage of data on your device based on consent | No |
| Purpose of processing | Recording information and documents when establishing contact and taking on mandates, recording further case-specific information and creating corresponding files in our organization system. |
| Legal basis | Art. 6(1)(b) GDPR |
| Data categories | Master data, contact data, content data, connection data |
| Recipients | JUPUS GmbH, Hohenzollernring 89-93, 50672 Köln (Cologne), Germany |
| Intended transfer to third countries | None |
| Storage of data on your device based on consent | No |
| Purpose of processing | Management of enquiries and client relationships (CRM), provision of our contact forms and online appointment booking (HubSpot Meetings). HubSpot is not used to analyze your usage behavior on our website. The contact form is only loaded once you click “Load contact form”; only then is a connection to HubSpot established, transmitting in particular your IP address. |
| Legal basis | Art. 6(1)(b) and (f) GDPR; for technically necessary cookies set when loading the form (protection against abuse) Section 25(2) no. 2 TDDDG |
| Data categories | Master data, contact data, content data (form entries), connection data |
| Recipients | HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA |
| Intended transfer to third countries | USA (on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework; additionally Standard Contractual Clauses of the European Commission, Art. 46(2)(c) GDPR) |
| Storage of data on your device based on consent | No |
| Purpose of processing | Preventing misuse of our website by checking whether access is made by humans and not by bots or similar programs; ensuring the security of our website and our IT systems. |
| Legal basis | Art. 6(1)(f) GDPR; for storing and reading strictly necessary information Section 25(2) TDDDG |
| Data categories | Connection data, usage data |
| Recipients | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland |
| Intended transfer to third countries | USA (on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework; additionally Standard Contractual Clauses of the European Commission, Art. 46(2)(c) GDPR) |
| Storage of data on your device based on consent | No |
| Purpose of processing | Automated process control for certain enquiries, in particular transferring your details from contact forms and online checks to our systems for processing |
| Legal basis | Art. 6(1)(b) and (f) GDPR |
| Data categories | Master data, contact data, content data, usage data, connection data |
| Recipients | Zapier, Inc., 548 Market St. #62411 San Francisco, CA 94104-5401, USA |
| Intended transfer to third countries | USA (on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework; additionally Standard Contractual Clauses of the European Commission, Art. 46(2)(c) GDPR) |
| Storage of data on your device based on consent | No |
| Purpose of processing | On our website we offer free AI-assisted online checks (e.g. Claim Check (Forderungs-Check), Review Check (Bewertungs-Check), Crefo Check, AI Act Check (KI-VO-Check), EmpCo Check). The texts you enter and the documents you upload are analyzed automatically in order to show you a non-binding initial assessment. In the EmpCo Check you can also enter the address of a web page instead of a text (“read in page via link” feature): at your request, our server (Cloudflare) retrieves this page once and transmits only its text to your browser; we do not store the address or the content in the process. To prevent misuse, we count retrievals per connection and day based on your IP address; this counter is deleted after 25 hours. If you subsequently order a service or instruct us, we process your details to perform the order, to process payment and to handle the mandate. In the Review Check and the Crefo Check, the entries and the result of each free check are additionally transmitted to our law firm so that we can evaluate and improve the use and quality of the checks. Your data is not used to train AI models. Your usage behavior is not analyzed with tracking services in the checks; for the measurement of advertisements, see “Google Ads conversion measurement” below. |
| Legal basis | Art. 6(1)(b) GDPR (performance of the check you requested and of an order or mandate); where consent is obtained in the respective check, Art. 6(1)(a) GDPR and, where special categories of personal data are concerned, Art. 9(2)(a) GDPR; for the internal evaluation of the checks Art. 6(1)(f) GDPR (legitimate interest in improving our services); for statutory retention obligations Art. 6(1)(c) GDPR |
| Data categories | Content data (texts, documents), master data, contact data, contract data, payment data, usage data, connection data |
| Storage period | In the free check, your entries and documents are only kept for a short time and then deleted automatically; the period is stated in the respective check. In the case of an order or mandate, the statutory retention periods apply, in particular for the client file (Section 50 BRAO) and under commercial and tax law. |
| Recipients | Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (operation of the checks, short-term storage and protection against abuse); Anthropic Ireland, Limited, Dublin, Ireland (AI analysis with the “Claude” model; processing is also carried out by Anthropic, PBC, USA); in the case of an order or mandate additionally Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (payment processing); Google Cloud EMEA Limited, Dublin, Ireland (storage of documents, spreadsheets for case management and sending emails); Zapier, Inc., San Francisco, USA (technical connection of systems, see above; in the Review Check and Crefo Check also for transmitting the free checks to the law firm); depending on the check, for sending emails and generating documents also Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; Resend, Inc., USA; Plumsail |
| Intended transfer to third countries | USA (Cloudflare, Stripe, Google, Microsoft, Resend and Zapier on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework; Anthropic and Plumsail pursuant to Standard Contractual Clauses of the European Commission, Art. 46(2)(c) GDPR and, where obtained in the respective check, your explicit consent, Art. 49(1)(a) GDPR) |
| Storage of data on your device based on consent | No |
| Purpose of processing | On individual pages of our online services (e.g. Claim Check, Review Check, Crefo Check) we offer an AI-assisted chat assistant. It answers general questions about the process, costs and use of the respective service; no individual legal advice is given in the chat. When the assistant is loaded, a connection to Jotform’s servers is established, during which in particular your IP address and information about your browser are transmitted. Your entries in the chat are processed to generate an answer and stored as a conversation history so that we can follow up on enquiries and improve the assistant. The answers are generated using AI models that Jotform uses as sub-processors (in particular OpenAI); according to Jotform, the content is not stored there and not used to train the models. The assistant is only loaded once you activate it by clicking “Chat starten” (two-click solution); no data is transmitted to Jotform before that. Your choice is only stored for the duration of the browser session in sessionStorage (“lhr_agent”). Please do not enter names, invoice numbers, documents or other confidential information in the chat. |
| Legal basis | Art. 6(1)(a) GDPR; for storing and reading information on your device by Jotform Section 25(1) TDDDG, for storing your choice in sessionStorage Section 25(2) no. 2 TDDDG |
| Data categories | Content data (your entries in the chat), usage data, connection data |
| Recipients | Jotform Inc., 4 Embarcadero Center, Suite 780 San Francisco, CA 94111, USA; the conversation data is stored in a Jotform data center in Frankfurt am Main (Germany). Jotform uses sub-processors, among others for AI processing, hosting and error analysis; the current list is available at https://www.jotform.com/subprocessors/. |
| Intended transfer to third countries | In individual cases USA (Jotform Inc. and its sub-processors; on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework) |
| Storage of data on your device based on consent | Yes |
| Purpose of processing | Measuring whether an order in the Review Check originates from one of our Google ads. For this purpose, the Google tag is loaded on the confirmation page after an order. We do not obtain consent for this; the Google tag therefore does not set or read any cookies (Google consent mode, status “denied”); Google receives a notification of the completed order with the order value and an order ID. |
| Legal basis | Art. 6(1)(f) GDPR (legitimate interest in measuring the success of our advertisements) |
| Data categories | Usage data, connection data, contract data (order value) |
| Recipients | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland |
| Intended transfer to third countries | In individual cases USA (on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework) |
| Storage of data on your device based on consent | No |
| Purpose of processing | Embedding videos from the YouTube platform in individual articles. The videos are only loaded once you allow this in the respective placeholder; only then is data transmitted to YouTube. Once you enable it, we embed the video in privacy-enhanced mode (youtube-nocookie.com). |
| Legal basis | Art. 6(1)(a) GDPR; for storing and reading cookies Section 25(1) TDDDG |
| Data categories | Usage data, connection data |
| Recipients | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland |
| Intended transfer to third countries | In individual cases USA (on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework) |
| Storage of data on your device based on consent | Yes |
Our website does not set any cookies requiring consent without your involvement. Only when you expressly activate a service are the following cookies and similar technologies used on the basis of your consent (Section 25(1) TDDDG):
| Jotform (only after clicking “Chat starten”): |
|
| YouTube (only after enabling the video): |
|
| Purpose of processing | We have set up a page for our firm on the “Facebook” platform (“Facebook page”). When you visit this page, Facebook processes your personal data. We receive statistics on the use of this page derived from this data. |
| Legal basis | Art. 6(1)(f) GDPR |
| Data categories | Master data, contact data, content data, usage data, connection data |
| Recipients | Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”) (as joint controller, Art. 26 GDPR – the essence of the agreement is available at https://www.facebook.com/legal/terms/page_controller_addendum) |
| Intended transfer to third countries | In individual cases USA (on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework; additionally Standard Contractual Clauses of the European Commission, Art. 46(2)(c) GDPR) |
| Storage of data on your device based on consent | No |
| Data subject rights | Facebook is responsible for implementing your data subject rights. Facebook informs you about your rights at https://www.facebook.com/legal/terms/information_about_page_insights_data. You can also assert your rights against us; we will then forward your request to Facebook without delay. |
| Purpose of processing | We have set up a profile on the “X (formerly Twitter)” platform. When you visit this page, X processes your personal data. We receive statistics on the use of this page derived from this data. |
| Legal basis | Art. 6(1)(f) GDPR |
| Data categories | Master data, contact data, content data, usage data, connection data |
| Recipients | Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (“X”) |
| Intended transfer to third countries | In individual cases USA (pursuant to Standard Contractual Clauses of the European Commission, Art. 46(2)(c) GDPR) |
| Storage of data on your device based on consent | No |
| Purpose of processing | We have set up a page for our firm on the “LinkedIn” platform. When you visit this page, LinkedIn processes your personal data. We receive statistics on the use of this page derived from this data. |
| Legal basis | Art. 6(1)(f) GDPR |
| Data categories | Master data, contact data, content data, usage data, connection data |
| Recipients | LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (as joint controller, Art. 26 GDPR – the essence of the agreement is available at https://legal.linkedin.com/pages-joint-controller-addendum) |
| Intended transfer to third countries | In individual cases USA (on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework; additionally Standard Contractual Clauses of the European Commission, Art. 46(2)(c) GDPR) |
| Storage of data on your device based on consent | No |
| Data subject rights | LinkedIn is responsible for implementing your data subject rights. LinkedIn informs you about your rights at https://www.linkedin.com/legal/privacy-policy. You can also assert your rights against us; we will then forward your request to LinkedIn without delay. |
| Purpose of processing | We have set up a video channel on the “YouTube” platform of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). When you visit this page, Google processes your personal data. We receive statistics on the use of this page derived from this data. |
| Legal basis | Art. 6(1)(f) GDPR |
| Data categories | Master data, contact data, content data, usage data, connection data |
| Recipients | Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland |
| Intended transfer to third countries | In individual cases USA (on the basis of an adequacy decision pursuant to Art. 45 GDPR – EU-U.S. Data Privacy Framework; additionally Standard Contractual Clauses of the European Commission, Art. 46(2)(c) GDPR) |
| Storage of data on your device based on consent | No |
Arranged chronologically, differentiated structure, numerous cross-references and, brand new: Extensive practical information on every process situation.
Learn more
