Privacy Policy

We hereby inform you about the processing of your personal data ("data") when you visit our website or our social media profiles, when you have a client relationship or other business relationship with us or when you apply for a job at our firm.

We are responsible for data processing:

onto partners
Rechtsanwälte in Partnerschaft mbB
Kurfürstendamm 190/192
10707 Berlin
E-Mail: kontakt@onto-partners.com

Contents:

• I. Use of our website
• II. Clients
• III. Mandate-related contacts
• IV. Business contacts and their employees
• V. Video conferencing tools
• VI. Applicants
• VII. Social media profiles
• VIII. Your rights as a data subject
• IX. Contact and data protection officer
  
  

I. Use of our website

In this section we inform you about the processing of your data when you visit our website.

1. Scope of data processing
When you visit our website, the following data is transmitted to our web server and stored in a log file:
2. • IP address
   • date and time of the respective access to a page of the website
   • amount of data transferred to your device
   • files retrieved via the homepage
   • URL of the page/homepage from which you reached our website
   • browser used by you (type and version)
   • operating system used by you (type and version)

1. We also use JavaScript to display our website. The web server therefore checks whether JavaScript is activated in your browser and stores this information in a session cookie (a small text file) on your end device. The session cookie with the name "has_js" is only saved if JavaScript is activated.
   
   
2. Purposes of data processing
   The processing of this data is necessary to display the content of the website on your device in the best possible way. We also process this data to investigate and track attacks on our IT.
   
   
3. Legal basis for data processing
   This data is processed in accordance with Art. 6 para. 1 lit. f GDPR due to our legitimate interest in being able to display the website to you and to be able to track attacks on our IT.
   
   
4. Recipient of the data
   To provide the website, we use an external IT service provider, Pascalis Ismailidis, An der Fohlenweide 20, 67112 Mutterstadt, who provides this website on our behalf on the Internet. This service provider processes your data exclusively in accordance with our instructions and on the basis of an order processing contract in accordance with Art. 28 GDPR.
   
   
5. Storage period
   The log data is stored for a period of seven days and then deleted, unless it needs to be stored for longer in exceptional cases to track an identified attack .
   
   As soon as you close your browser, the session cookie is automatically deleted by default, unless you chose a different setting in the cookie settings of your browser.

II. Clients

In this section we inform you about the processing of data by us when you commission us.

1. Scope of data processing
   When you mandate us, we collect the following data:
   • form of address, title, first name, last name
   • if applicable, the name and designation of the company or institution in which you work
   • if applicable, your job title or professional training, your e-mail addresses for handling the mandate (mostly professional, possibly also private) as well as the names and e-mail addresses of the employees or contact persons you have provided or who are required for handling the mandate
   • your address (business and private, if applicable)
   • your telephone number(s) (landline and/or cell phone), fax numbers
   • information on facts and data that are necessary to assert and exercise your rights within the scope of the mandate or to handle a notarial matter
   • correspondence arising within the scope of the mandate with the personal data contained therein
   • all data collected for the purpose of invoicing our services (activity records, if applicable with contact persons from telephone calls or meetings) including account details and, if necessary, your tax identification number
   • in individual cases, further data required under the Money Laundering Act, in particular the date and place of birth, nationality, a copy of the identity card or passport, data on beneficial ownership and information on whether you or a beneficial owner in your mandate or their immediate family members or persons close to you are a politically exposed person
     
     
2. Purpose of data processing
   The processing of your aforementioned personal data is based on your mandate and is necessary for the lawful and appropriate processing of your mandate and the mutual fulfillment of obligations arising from the client relationship or for the processing of a notarial procedure. Furthermore, we process the data for correspondence with you, the parties to the mandate, opposing parties and courts or authorities involved as well as for invoicing. It may be necessary to process some of the above data in order to check for conflicts prior to the engagement.
   
   
3. Legal basis
   The legal basis for the processing of data in response to the mandate is Art. 6 para. 1 lit. b GDPR, insofar as the client is a natural person. If our client is a legal entity, we process employee data in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in being able to process and fulfill the mandate.
   We process your data for the money laundering check on the basis of a legal obligation and thus in accordance with Art. 6 para. 1 lit. c GDPR in conjunction with the Money Laundering Act.
   When processing notarial transactions, the legal basis is Art. 6 para. 1 lit. c and e GDPR.
   
   
4. Recipients of the data, transfer to third countries
   Insofar as this is necessary in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR for the processing of client relationships or for the processing of a notarial procedure (Art. 6 para. 1 lit. c and e GDPR) with you, your personal data will be passed on to third parties. This includes in particular the disclosure to opposing parties, in notarial matters to parties of proceedings or documents, and their representatives (in particular their lawyers) as well as courts, public registers and other public authorities for the purpose of correspondence and to assert and exercise your rights. Third parties are legally obliged to use the data passed on exclusively to the extent required or necessary for the purposes stated for the processing of the mandate.
   
   In addition, data will only be passed on if you as the data subject give your consent (Art. 6 para. 1 lit. a GDPR) or if we as the controller are legally obliged to pass on data in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR, for example to tax and financial authorities in the context of corresponding audits.
   
   As part of our tax obligations, we use the services of a tax advisor. Only to the extent necessary for tax law reasons the tax consultant may view personal data (e.g. on fee invoices). The tax consultant is already obliged to protect your data as a result of his professional duty of confidentiality.
   
   We use the following service provider for the support, storage and hosting of our IT systems and applications, who processes your data only in accordance with our instructions and on the basis of an order processing contract in accordance with Art. 28 GDPR:
   
   ALLY Gesellschaft für Systemlösungen, Software- und Datenbankentwicklungs mbH
   a company of the ally-GROUP
   Buckower Chaussee 106-107
   D-12277 Berlin
   Germany
   Phone: + 49 30 762 89-210
   Email: m.funke@ally.de
   
   We may transfer data to countries outside the EU and the European Economic Area ("third countries") if, for example, you communicate with us from a third country or via E-mail providers in a third country (such as Google or Microsoft in the context of Office 365). This is also possible if the mandate relates to a matter in third countries and therefore requires communication with parties in third countries. In these cases, the transfer to third countries takes place on the basis of Art. 49 para. 1 lit. b GDPR.
   
   Your data will not be transferred to third parties for purposes other than those listed.
   The attorney-client privilege remains unaffected, as does the obligation of our notaries to maintain confidentiality. Insofar as data is concerned that is subject to attorney-client privilege, it will only be passed on to third parties with your explicit consent (Art. 6 para. 1 lit. a GDPR), or insofar as this is necessary to safeguard legitimate interests, e.g. to enforce or defend claims arising from the client relationship or to defend our own interests (Art. 6 para. 1 lit. f GDPR).
   
   
5. Storage period
   The data collected by us in the context of the mandate and the processing of the mandate will be stored until the expiry of the statutory retention obligation for lawyers (pursuant to Sec. 50 para. 1 BRAO 6 years after the end of the calendar year in which the mandate was terminated) and then deleted, unless we are obliged to store the data pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR due to tax and commercial law storage and documentation obligations (of HGB (German Commercial Code), StGB (German Criminal Code) or AO (German Tax Code) or in notarial matters due to the permission according to Art. 6 para. 1 sentence 1 lit. c and e GDPR are obliged to a longer storage (DONot), the storage is necessary for the assertion, exercise or defense of civil law claims according to Sec. 24 para. 1 no. 2 BDSG or you have consented to a further storage according to Art. 6 para. 1 sentence 1 lit. a GDPR.

III. Mandate-related contacts

Below we inform you how we process your data for the purpose of a mandate if you are not our client but, for example, a witness, family member or employee of a public authority.

1. Scope of data processing
   We process data that we receive from you when we contact you on the basis of a client relationship and that we need to process our mandate. This may include the following data:
   • form of address, title, first name, last name
   • if applicable, the name and designation of the company or institution which you work at
   • if applicable, your job title or professional training, your e-mail addresses for handling the mandate (professional or, if applicable, private) as well as the names and e-mail addresses of the employees or contact persons provided by you or required for handling the mandate
   • your address (business or private)
   • your telephone number(s) (landline and/or cell phone), fax numbers
   • information on facts and data that are necessary for the assertion and exercise of our client's rights or for the handling of a notarial matter
   • correspondence arising in the context of this communication with the personal data contained therein
     
     
2. Purpose of data processing
   Your data will be processed for the purpose of performing the mandate and safeguarding the interests of our clients.
   
   
3. Legal basis for data processing
   We process your data either on the basis of Art. 6 para. 1 lit. c GDPR due to legal obligations or on the basis of Art. 6 para. 1 lit. f GDPR due to our legitimate interest. In this case, the legitimate interest is the protection of our clients' interests and proper processing of the mandate.
   
   
4. Recipients of the data
   Your data or the data of your employees will be received by bodies, institutions or individuals. Recipients may in particular be authorities, offices, courts, but also experts, opponents of our clients or other parties involved. The data is transmitted on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) in being able to process the mandate properly, but only to the extent necessary to safeguard this interest.
   
   
5. Storage period
   We delete your data together with all client-related data after expiry of the statutory retention obligation for lawyers (pursuant to Sec. 50 para. 1 BRAO 6 years after the end of the calendar year in which the mandate was terminated), unless we are obliged to store your data for a longer period of time pursuant to Art. 6 (1) sentence 1 lit. c GDPR due to tax and commercial law retention and documentation obligations (of HGB, StGB or AO) or in notarial matters due to the permission pursuant to Art. 6 para. 1 sentence 1 lit. c and e GDPR to a longer storage period (DONot), the storage in accordance with Sec. 24 para. 1 no. 2 BDSG is necessary for the assertion, exercise or defense of civil law claims or you have consented to further storage in accordance with Sec. 6 para. 1 sentence 1 lit. a GDPR.

IV. Business contacts and their employees

In the following, we inform you about how we process data of our business partners or employees of our business partners.

1. Scope of data processing
   As part of our business relationship with you as a business partner or employee of business partners, we process the data that we receive from you or your employer.
   In particular, this is data that we receive if you or your colleagues are in contact with our employees.
   In this context, we process the following categories of data:

1. • professional contact and organizational data: e.g. surname, first name, title, academic degree, gender, name of the company you work for, department, professional e-mail address, address, telephone number
   • data on professional circumstances: e.g. job title, tasks, activity, qualifications
   • other: in addition, we may process other data that you provide interacting with our employees or that we have legitimately collected about you from publicly available sources (e.g. commercial register)
     
     
2. Purpose of data processing
   We process your data for the purpose of establishing and implementing the contractual relationship with our business partner and to comply with legal requirements.
   
   
3. Legal basis for data processing
   We process the data on the following legal basis:
   • If you are personally our business partner, the processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR for the execution or initiation of a contract.
   • For the purpose of fulfilling legal obligations, processing is carried out on the basis of Art. 6 para. 1 lit. c GDPR in conjunction with legal and official requirements (e.g. from tax and commercial law).
   • If you are an employee of one of our business partners, your data will be processed on the basis of our overriding legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the functioning and practicable cooperation with our business partners and the employees of our business partners.
     
     
4. Recipients of the data
   Within our law firm, only those persons have access to your data who need it for the purposes described.
   We also transfer your data to authorities (e.g. tax authorities, police, public prosecutor's office, social security institutions) or courts within the scope of their respective responsibilities if we are obliged to do so by law or by order. In these cases, too, we will only transfer data to the extent necessary for the respective purposes.
   
   
5. Storage period
   We store your data for as long as we need it for the specific processing purpose. We regularly store your data for at least the duration of our business relationship with you or the business partner for whom you work.
   
   In addition, we store certain data for the duration of statutory limitation periods (usually three years, in individual cases up to thirty years) and for as long as statutory retention periods (e.g. of HGB, AO) prescribe (but usually for a maximum of ten years).
   Under certain circumstances, we may have to store your data for longer. This is the case, for example, if a ban on data erasure is ordered for the duration of the proceedings in connection with official or court proceedings.

V. Video conferencing tools

We use the video conferencing tool Microsoft Teams ("MS Teams") to conduct video and audio conferences, webinars and other types of video and audio meetings.

Below we show you which data we process when you have a video or audio conference with us via the MS Teams video conferencing software.

1. Scope of data processing
   • inventory data (e.g. names, addresses)
   • contact details (e.g. e-mail, telephone numbers)
   • content data (e.g. text entries, photographs, videos)
   • meta/communication data (e.g. device information, IP addresses, user ID)
   • transmission of image and sound during a video or audio conference
     
     
2. Purpose of data processing
   The purpose of processing the above-mentioned personal data is to set up and provide online meetings/video conferences and to conduct them within the scope of the client relationship.
   
   
3. Legal basis for data processing
   If a client relationship with us exists or is to be established, we process your data to fulfill our obligations arising from the client relationship. The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as the client is a natural person. If our client is a legal entity, we process employee data and data of other natural persons whose participation in the video/audio conference takes place in the context of processing the mandate on the basis of our legitimate interests in efficient and secure communication with our communication partners in accordance with Art. 6 para. 1 sentence 1 lit. f. GDPR.
   
   
4. Recipient of the data
   MS Teams is a cloud application provided to us by Microsoft Ireland Operations Ltd ("Microsoft"). In this context, Microsoft processes personal data on our behalf in accordance with our instructions on the basis of an order processing agreement (Art. 28 GDPR). In addition, we have concluded a separate confidentiality agreement with Microsoft for professional secrecy holders, in which Microsoft recognizes that the data processed by us is subject to special legal or notarial confidentiality.
   We only use MS Teams as a cloud application. We operate other data processing programs from Microsoft (e.g. Office) on our own servers (on-premise). Insofar as personal data is stored in the cloud when using MS Teams, it is stored exclusively in the European Union (dormant data). However, data processed during the use of MS Teams may also be processed in third countries - especially if communication participants are not located in the EU. In these cases, Microsoft uses subcontracted processors (e.g. Microsoft Inc.) and ensures sufficient data protection guarantees for any third country transfers in accordance with Art. 44 et seq. GDPR.
   
   
5. Storage period
   Your personal data that we process when you use MS Teams will generally be deleted as soon as it is no longer required for the purposes for which it was collected. We delete metadata after 30 days.
   
   

VI. Applicants

You can apply for a position with us in response to our published vacancies or send us an unsolicited application. Below we show you which data is processed in this context.

1. Scope of data processing
   We process the following categories of data during the application procedure:
   • private contact and identification data: e.g. surname, first name, academic degree, gender, e-mail address, address and telephone number
   • data on your professional qualifications, such as school-leaving and educational qualifications, language skills, as well as your place of study or training, certificates
   • if you send us your CV, we will process the data provided in it, such as photos of you or the existence of a driving license
   • any other data provided by you as part of your application

1. Your application documents will be sent to the contact person listed in the job advertisement and will be forwarded internally to other partners and employees responsible for the application procedure.
   
   
2. Purpose of data processing
   We process your data in order to check whether you are eligible for an employment relationship with us as part of the applicant selection procedure.
   
   
3. Legal basis for data processing
   The legal basis for data processing is Sec. 26 para. 1 BDSG and Art. 6 para. 1 lit. b GDPR (contract initiation). Information that you provide voluntarily and that goes beyond what is necessary is processed on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) in being able to respond to your application in the best possible way. If you provide information in individual cases for which we have no legal basis for processing, we will not process it.
   
   
4. Recipients of the data
   Internally, only those persons have access to your data who require it for the stated purposes. These are primarily the responsible partners, responsible HR employees and all persons who are necessarily involved in the applicant selection process.
   
   
5. Storage period
   If an employment relationship is established with you, we will continue to process your data for the purposes of the employment relationship in accordance with a separate data protection declaration, which you will then receive from us.
   
   In the event that no employment relationship is established with you, we will generally store your data for a period of six months from the date of receipt of your rejection. Your application documents will then be deleted.

VII. Social media profiles

No cookies from social media platform operators are integrated on our website (e.g. via plug-ins). However, we operate various social media profiles of our own in order to constantly improve our public presence and to provide information on the respective social media platforms.

Below you will find information about data processing by us on the individual social media platforms.

LinkedIn
Scope of data processing
You can interact with our profile on LinkedIn, for example by following, leaving comments on posts, liking posts or sharing updates from us. In this case, we will receive a notification from LinkedIn that you have visited or interacted with our account. We can see your profile name, your interaction and - if available - your profile picture. If you contact us via LinkedIn via direct notification, we can see your user profile and your message.
We also receive information from LinkedIn about visitors, followers and updates to our LinkedIn page ("Page Insights"). This information is displayed to us on our administrator page. Both we and LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland, "LinkedIn") are jointly responsible for the processing of your data in connection with this function on our LinkedIn page. In particular, LinkedIn is responsible for the fulfillment of your data protection rights in connection with Page Insights. However, you can still contact us to assert your rights.

Purpose of data processing
We process the data in order to be able to interact with you on your initiative and to read and respond to your request or notification.
We do not use the analysis function, but we cannot deactivate it because LinkedIn does not provide this option.

Legal basis
We process your data on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the interaction with you described above.

Recipients of the data
Your data will be viewed by our employees who manage our LinkedIn account.
In addition, LinkedIn processes your data in accordance with its own privacy policy.
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Privacy policy: https://www.linkedin.com/legal/privacy-policy
Opt-out with regard to advertising: www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Storage period
We cannot delete your messages or other data because we do not have the authorization to do so. We do not actively use direct messages on LinkedIn to communicate with you - we prefer encrypted communication by E-mail for this purpose. If you send us direct messages, we will delete them no later than one year after receiving your message.

Xing
Scope of data processing
You can interact with our profile on Xing by writing us messages or liking our posts. In this case, we will receive a notification from Xing that you have visited or interacted with our account. We can then see your profile name, your interaction and - if available - your profile picture.

We receive overviews and anonymized evaluation results from Xing about the visitors and followers of our page over the last 30 days ("profile analysis" function). This includes, for example, anonymized information about company affiliation, industry affiliation, career levels and age groups. We and New Work SE (Dammtorstraße 30, 20354 Hamburg, Germany) are responsible for processing your data in connection with the profile analysis.

Purpose of data processing
We process the data in order to be able to interact with you at your initiative, in particular to read and respond to your request or notification.
We do not evaluate the data within the scope of the "Profile analysis" function. However, we cannot deactivate the function as Xing does not provide this option.

Legal basis
We process this data on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the interaction with you described above.

Recipients
Your data will be viewed by our employees who manage our Xing account.
In addition, Xing processes your data in accordance with its own privacy policy.
Provider: New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany
Privacy policy: privacy.xing.com/de/datenschutzerklaerung
Opt-out regarding the analysis of visitor sessions: https://nats.xing.com/optout.html?popup=1&locale=de_DE

Storage period
We cannot delete your messages or other data because we do not have the authorization to do so.

VIII. Your rights as a data subject

The following rights may be restricted by client confidentiality or the duty of confidentiality of lawyers in accordance with Art. 23 GDPR in conjunction with Sec. 29 BDSG may be restricted. Provided there is no conflict with the client relationship, you have the following rights:

1. Right to information
   You have the right to request information free of charge about whether data concerning you is being processed and, if this is the case, what data we are processing about you (Art. 15 GDPR). You may make this request again within a reasonable period of time. You also have the right to receive a copy of your data that is subject of our processing.
   
   
2. Right to rectification
   You may also request the rectification of inaccurate data concerning you in accordance with Art. 16 GDPR. Taking into account the purposes of the processing, you may also request the completion of incomplete data concerning you.
   
   
3. Right to erasure
   Under the conditions of Art. 17 GDPR, you may request the deletion of your data.
   
   
4. Right to restriction
   You have the right to demand that we restrict the processing of your data if the requirements of Art. 18 GDPR are met. This is the case, for example, if the processing of your data is no longer necessary for our purposes, but you need it to assert, exercise or defend legal claims. If the processing of your data is restricted, this data - apart from its storage - may only be processed by us with your consent or in the special cases specified in Art. 18 para. 2 GDPR.
   
   
5. Right to data portability
   Insofar as data provided by you is processed by us on the basis of Art. 6 para. 1 lit. b or lit. a GDPR (for the initiation or fulfillment of a contract or on the basis of your consent) using automated procedures, you can request the surrender of this data in a structured, common and machine-readable format under the conditions of Art. 20 GDPR. In this case, you may also request that we transfer this data to another controller.
   
   
6. Right of withdrawal
   If we process your data on the basis of your consent, you have the right to withdraw your consent at any time with effect for the future (Art. 7 para. 3 GDPR).
   
   
7. Right to object
   If your data is processed by us on the basis of our overriding legitimate interest (Art. 6 para. 1 lit. f GDPR), you also have the right to object if your interests against data processing outweigh our interests in processing for reasons arising from your particular situation. In the event of an objection, we therefore ask you to inform us of your reasons for objecting to data processing.
   
   
8. Assertion of your rights as a data subject
   To assert your rights as a data subject, please contact us by E-mail or letter.
   
   
9. Right to lodge a complaint with a data protection supervisory authority
   If you believe that your personal data is being processed unlawfully, you may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).
   
   

If you have any questions about this privacy policy or the processing of your personal data by us, you can contact us.