OUR PRIVACY POLICY
The protection of your personal data (hereinafter “data”) is very important to us. We therefore provide you with detailed information about which data is collected when you visit our website and use our services, and how this data is processed.
Please note that this privacy policy may be updated in response to new technologies or changes in the law. In doing so, we will of course always take your interests into account.
1. Controllers
Rickert Rechtsanwaltsgesellschaft mbH, Colmantstraße 15, 53115 Bonn, Germany, and IT.LAW GmbH, Colmantstraße 15, 53115 Bonn, Germany, are joint controllers for the processing of your personal data submitted via the contact form for services (e.g. GDPR representative) pursuant to Art. 4(7) and Art. 26 GDPR.
In all other respects, Rickert Rechtsanwaltsgesellschaft mbH is the sole controller for the processing of your personal data via the website within the meaning of the GDPR.
Overview of the respective responsibilities:
| Area | Detailed tasks | Responsible company |
| Software | Acquisition and administration of software | Rickert Rechtsanwaltsgesellschaft mbH |
| Services | Acquisition and administration of services | Rickert Rechtsanwaltsgesellschaft mbH |
| Contract management | Conclusion of service agreements with third-party providers | Rickert Rechtsanwaltsgesellschaft mbH |
| Technical operation | Technical operation of the website, IT infrastructure | Rickert Rechtsanwaltsgesellschaft mbH |
| Contact form (services) | Contact form for service agreements (e.g. GDPR representative) | IT.LAW GmbH & Rickert Rechtsanwaltsgesellschaft mbH |
| Contact form | Handling of general enquiries, mandate requests, applications | Rickert Rechtsanwaltsgesellschaft mbH |
| Data management | Access to analytics data and log files | Rickert Rechtsanwaltsgesellschaft mbH |
| Data protection | Fulfilment of information obligations (Art. 13, 14 GDPR), implementation of general data protection principles (Art. 5 GDPR) for the protection of data subjects (Art. 32 GDPR) | Rickert Rechtsanwaltsgesellschaft mbH |
Questions or comments regarding this privacy policy or data protection on this website in general should be addressed to our Data Protection Officer by email at datenschutz@rickert.law or confidentially by post, for the attention of the Data Protection Officer, to the following address:
Data Protection Officer
c/o Rickert Rechtsanwaltsgesellschaft mbH
Colmantstraße 15
53115 Bonn, Germany
2. Legal bases for processing your data
We only process your personal data where permitted by law. For this purpose, we rely on various legal bases:
| Legal basis | Explanation | Example |
| Consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG) | You have expressly permitted us to use your data for a specific purpose. | You have consented to statistics or marketing services via the cookie banner. |
| Performance of a contract (Art. 6(1)(b) GDPR) | Your data is necessary to enter into or perform a contract with you. | We need your address in order to invoice you for the requested service. |
| Legal obligation (Art. 6(1)(c) GDPR) | We are legally required to process your data. | We are required to retain your invoicing data. |
| Legitimate interest (Art. 6(1)(f) GDPR) | The processing is important for our company or third parties and does not override your rights. | Strictly necessary cookies to display our website correctly and to ensure its stability and security. |
For each processing activity we carry out, we indicate the applicable legal basis below. Processing may also be based on several legal bases.
We store information on your device (e.g. your computer or smartphone) only where permitted by law:
- where you have given your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG),
- in order to carry out the transmission of a communication,
- where strictly necessary to provide a service explicitly requested by you (Sec. 25(2) TDDDG).
3. Recipients of data / conditions for transfers to third countries
Processors are companies we engage to process your personal data. They act exclusively on our instructions and are contractually obliged to ensure data protection. Further information on the processors can be found under the individual processing activities.
Third parties are companies we engage to perform certain services (e.g. payment) or to which we are required to transfer data on the basis of legal requirements. These companies are independently responsible for handling your data.
| Category | Recipient | Purpose | Legal basis |
| Processor | IT service providers (e.g. hosting providers, software providers, email providers) | Technical operation of the website, provision of software solutions | Data processing agreement (Art. 28 GDPR) |
| Third party | Payment service providers | Processing of payments | Art. 6(1)(b) GDPR |
| Third party | Public authorities (e.g. tax office, supervisory authorities) | Fulfilment of statutory reporting obligations | Art. 6(1)(c) GDPR |
Transfers to third countries (in particular the USA)
Some of the services we use (in particular services provided by Google and YouTube, as well as Cloudflare) may transfer personal data to the USA. The integration and use of these services is based on your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG).
We base the transfer of data to the USA on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR), provided that the respective US recipient is certified under the EU-US Data Privacy Framework; Google LLC and Cloudflare, Inc. are DPF-certified. Where a recipient is not certified, the transfer is based on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).
4. Retention periods
As a rule, we store your personal data only for as long as is necessary to fulfil the respective purposes. Once the purpose ceases to apply, the data is deleted (Art. 17 and 18 GDPR).
In some cases, we are legally required to retain your data for a certain period (e.g. for tax and commercial law purposes). As long as legal proceedings are pending in which your data is required as evidence, we are likewise unable to delete your data.
5. Your rights
In accordance with the statutory provisions, you may assert the following rights against the controller responsible for the data processing:
| Your right | Meaning | Legal basis |
| Access | You can find out at any time which data we store about you. | Art. 15 GDPR |
| Rectification | Is your data incorrect? We are happy to correct it. | Art. 16 GDPR |
| Erasure | Under certain conditions, you may request the erasure of your data. | Art. 17 GDPR |
| Restriction of processing | In certain cases, you may have the processing of your data restricted. | Art. 18 GDPR |
| Data portability | You may receive the data you have provided in a structured, commonly used and machine-readable format, or request its transfer to another controller. | Art. 20 GDPR |
| Objection | You may object to the processing of your data in certain cases, provided the processing is based on Art. 6(1)(e) or (f) GDPR. | Art. 21 GDPR |
| Withdrawal of consent | Where you have given us consent, you may withdraw it at any time with effect for the future. | Art. 7(3) GDPR |
To assert claims under the GDPR, please contact us at datenschutz@rickert.law. You may of course also assert your rights against the individual joint controllers via the “Contact” section of our website.
If you believe that the processing of your personal data infringes data protection law, you have the right under Art. 77(1) GDPR to lodge a complaint with a data protection supervisory authority of your choice.
6. Data security
Our foremost objective is to ensure the confidentiality, integrity and availability of your personal data. We use technical and organisational security measures to protect the personal data we collect, in particular against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons. Our website is delivered via an encrypted HTTPS connection (TLS). Our security measures are continuously improved in line with technological developments.
7. Collection and processing of your personal data
a. Provision of rickert.law for informational use (log files)
When you visit our website, certain information is automatically stored in what are known as server log files. This information helps us to improve our website and to ensure that it functions smoothly.
The data collected includes:
- technical data (date and time of access; your browser type and settings; your operating system; the pages you visit and the duration of your visit; the volume of data transferred and the access status, e.g. success or error message),
- IP address.
This is done to enable the use of the pages you access and to improve our website. We store your IP address only for the duration of your visit. Any further evaluation takes place only in accordance with the provisions set out below, on the basis of your consent.
The processing of the aforementioned data is strictly necessary pursuant to Art. 6(1)(f) GDPR for the correct display of our website and to ensure its stability and security.
b. Contact form
Getting in touch with us is easy: simply complete the contact form. Select your request and enter the required information (name, email address, message, and where applicable company name and number of employees). We use the data you provide solely to process your request.
The legal basis is your consent (Art. 6(1)(a) GDPR) or, where your request relates to a contract, the performance or initiation of a contract (Art. 6(1)(b) GDPR).
To protect the form against misuse (spam, bots), we use a captcha procedure (see the sections on “Google reCAPTCHA” and “Cloudflare Turnstile”).
Once your request has been answered, it is archived; access to it is strictly limited. Requests without a contractual basis are deleted after one year. Requests with a contractual basis are subject to statutory retention periods (see section 4).
c. Applications
You are welcome to apply to us by email at karriere@rickert.law. We process the personal data you submit solely for the purpose of selecting suitable candidates and for subsequent contact. In the event of a successful application, your data may be further processed to establish and maintain the employment relationship.
The processing is carried out pursuant to Art. 6(1)(b) GDPR in conjunction with Sec. 26 BDSG for the purpose of taking pre-contractual steps. Once the application process has been completed, we retain your data for six months in order to defend against potential legal claims (Art. 6(1)(f) GDPR and Art. 17(3)(e) GDPR).
At your express request, we store your application data in a talent pool in order to consider you for future vacancies. Such storage takes place only with your consent pursuant to Art. 6(1)(a) GDPR, which you may withdraw at any time. Please note this request in your cover letter. If you provide us with special categories of data such as photographs or information on severe disability, this is likewise processed on the basis of your consent pursuant to Art. 9 GDPR.
d. Use of cookies and similar technologies – overview and legal bases
The legal basis for strictly necessary cookies and tools that are required to provide you with the service you have requested is Sec. 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. The use of statistics, advertising, tracking and integration services (cookies and similar technologies such as web beacons, pixels, tags and scripts) is based on your consent pursuant to Sec. 25(1) TDDDG and Art. 6(1)(a) GDPR.
You can find out at any time which cookies and similar technologies we use, and how to manage your privacy settings and disable individual categories, via the settings in our cookie banner.
(a) Consent management (Borlabs Cookie)
We use the consent management service “Borlabs Cookie” (provider: Borlabs GmbH, Germany). This tool enables us to obtain, document and manage your explicit consent to the use of cookies and tracking technologies in a legally audit-proof manner. For this purpose, a strictly necessary cookie (borlabs-cookie, retention period 60 days) is set, which stores your selection. The legal basis for this processing is Art. 6(1)(c) GDPR, as it serves to fulfil our legal obligation under the GDPR and TDDDG to provide a compliant consent mechanism.
(b) Strictly necessary services
The following services are technically required for the secure operation, functionality and multilingualism of our website and are used without consent on the basis of Sec. 25(2) TDDDG and Art. 6(1)(f) GDPR.
| Service & Provider | Purpose | Data Processed | Settings / Opt-Out |
| WPML OnTheGoSystems Ltd. (EU) | Multilingual provision of the website; storage of the selected or detected language. | Language preference in cookies (e.g. wp-wpml_current_language, _icl_visitor_lang_js). | Strictly necessary; cannot be disabled via the banner. |
| Wordfence Defiant, Inc. (USA) | Website security, protection against attacks and unauthorised access, operation of the web application firewall. | Security-related cookies (e.g. wfwaf-authcookie-*, wfls-remembered-*), technical access data. | Strictly necessary; transfer only to the extent required for security operations (Art. 46 SCC). |
| Google Tag Manager Google Ireland Ltd. (Ireland) | Central technical management and triggering of website scripts and tags. | Does not itself set consent-relevant cookies; controls downstream services based on consent signals. | Triggering of downstream services is controlled via the cookie banner (Consent Mode). |
(c) Consent-based statistics, marketing and integration services
The following services are executed solely on the basis of your voluntary and explicit consent pursuant to Sec. 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw your consent at any time via the settings in our cookie banner with effect for the future. Until consent is given, the services are blocked by Borlabs Cookie. For transfers to the USA, see section 3.
| Service & Provider | Purpose | Data Processed | Settings / Opt-Out |
| Google Analytics Google Ireland Ltd. (Ireland); Google LLC (USA) | Web analytics, evaluation of user behaviour, recognition of returning visitors, optimisation of our offering. | Abbreviated IP address, approximate location, browser/device type, operating system. Pages visited, clicks, dwell time, referrer. Cookies: _ga, _ga_*. | Deactivation via the cookie banner or Google ad settings. |
| Google Ads (incl. Conversion Tracking & Remarketing) Google Ireland Ltd. (Ireland); Google LLC (USA) | Statistical evaluation of campaigns, conversion measurement, and personalised retargeting across the Google advertising network. | Marketing cookie IDs, click paths, interaction timestamps (e.g. _gcl_au, __gads, IDE, NID, ANID, DoubleClick cookies). | Deactivation via the cookie banner or adssettings.google.com. |
| YouTube Google Ireland Ltd. (Ireland); Google LLC (USA) | Embedding and playback of videos on individual pages of the website. | Usage information relating to the video, cookies (e.g. VISITOR_INFO1_LIVE, YSC), technical connection data. | Content is loaded only after consent; deactivation via the cookie banner. |
| Google reCAPTCHA Google Ireland Ltd. (Ireland); Google LLC (USA) | Protection of forms against automated misuse (spam, bots). | Behavioural and interaction characteristics to distinguish humans from bots, cookies (e.g. _GRECAPTCHA). | Deactivation via the cookie banner. Alternatively, we use Cloudflare Turnstile. |
| Cloudflare Turnstile Cloudflare Germany GmbH (Munich); Cloudflare, Inc. (USA) | Privacy-friendly captcha alternative for verifying human interaction without puzzles. | Technical interaction and device characteristics for abuse detection. | Deactivation via the cookie banner. |
| Google Reviews / TrustIndex Trustindex Informatikai Kft., Hungary (EU) | Display of customer reviews (review widget) on the website. | Connection and usage data processed when the widget from trustindex.io is loaded. Provider located in the EU – no third-country transfer. | Content is loaded only after consent; deactivation via the cookie banner. |
e. LinkedIn profile
We deliberately refrain from integrating social media plug-ins with direct data transmission to social networks on our website. However, to provide you with information, we maintain a profile on LinkedIn. We inform you below about the associated data processing.
We are joint controllers together with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, for the data processing in connection with our LinkedIn profile. LinkedIn processes your personal data in accordance with its privacy policy. This includes:
- data you provide upon registration and in your profile (e.g. name, email address, education),
- information about your activities on LinkedIn (e.g. posts, likes, group memberships),
- technical data (e.g. IP address, device information).
LinkedIn uses this information for various purposes, including the provision and improvement of its services and for personalised advertising. We receive anonymised statistics (Page Insights) from LinkedIn about the use of our profile; these do not allow any conclusions to be drawn about individual users. LinkedIn may transfer data to the USA and is a participant in the EU-US Data Privacy Framework, thereby ensuring an adequate level of data protection pursuant to Art. 45 GDPR.
f. Stripe (payment processing)
For our services, we use the payment service provider Stripe (Stripe, Inc., 510 Townsend St., San Francisco, CA 94103, USA) to offer you a secure and efficient payment method and to manage your contract data. Stripe acts as an independent payment provider within the meaning of Art. 4(7) GDPR; we also use Stripe as a processor for the management of your customer data for payment processing.
The legal basis for the transfer of data to Stripe is Art. 6(1)(b) GDPR (necessity for the performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in secure payment processing and fraud prevention). Stripe is a participant in the EU-US Data Privacy Framework (Art. 45 GDPR).
g. DocuSign – electronic signature
For the electronic signing of contracts and documents, we use the tool “SAP Signature Management by DocuSign” (hereinafter “DocuSign”) of our processor DocuSign, Inc., 221 Main St., Suite 1000, San Francisco, CA 94105, USA. Documents to be signed are uploaded to the DocuSign environment; as a signing party, you receive a link by email and can sign the documents electronically in the fields provided.
In this context, DocuSign processes in particular your name and email address, IP address, date and time of the signature, electronic signatures and initials, and – depending on the settings – identification data for authentication.
The use of DocuSign serves our legitimate interest in an efficient and legally valid signing process. The legal basis is Art. 6(1)(f) GDPR and – depending on the specific case – Art. 6(1)(b) GDPR (taking pre-contractual steps). We have concluded a data processing agreement with DocuSign pursuant to Art. 28 GDPR. To ensure appropriate safeguards, DocuSign has adopted binding corporate rules pursuant to Art. 47 GDPR.
