1. Controller
The party responsible for data processing on this website is:
Nieweg Law Firm
Petra Nieweg, Lawyer and Economist (Diplom-Volkswirtin)
Tulpenstraße 1
33803 Steinhagen
Germany
Phone: +49 5204 9249884
Fax: +49 5204 9249885
Email: info@anwaltskanzlei-nieweg.de
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
A Data Protection Officer has not been appointed for my firm, as the legal requirements for such an appointment are not met.
2. General Information on Data Processing
I process personal data only to the extent necessary to provide this website, process inquiries, communicate with interested parties and clients, or fulfill legal obligations.
Personal data refers to any information that can be used to identify you personally. This includes, in particular, your name, email address, phone number, IP address, or the content of your message.
3. Storage Duration
Unless a more specific storage period is specified in this privacy policy, I store personal data only as long as necessary for the respective processing purpose. Thereafter, the data will be deleted, provided that no legal retention obligations prevent this.
Professional retention obligations apply to mandate-related documents. Case files are generally kept for six years; the period begins at the end of the calendar year in which the assignment was completed.
Documents relevant for tax or accounting purposes are regularly stored for up to ten years within the framework of legal retention obligations.
Insofar as personal data is required for the assertion, exercise, or defense of legal claims, deletion will only take place once this purpose no longer applies.
4. Legal Basis
I process personal data in particular on the following legal bases:
Art. 6 (1) (a) GDPR , if you have consented to the processing,
Art. 6 (1) (b) GDPR , if the processing is necessary for the implementation of pre-contractual measures or for the performance of a contract or mandate,
Art. 6 (1) (c) GDPR , if I am legally obligated to process the data,
Art. 6 (1) (f) GDPR , if the processing is necessary to protect my legitimate interests and your interests or fundamental rights do not prevail.
Insofar as cookies or comparable technologies are used and consent is required for this, processing is additionally carried out on the basis of Section 25 (1) TDDDG. Technically necessary access to your terminal device may be based on Section 25 (2) TDDDG.
5. Hosting
This website is hosted externally. The provider is Telekom Deutschland GmbH, Landgrabenweg 149, 53227 Bonn.
As part of the hosting process, data that is technically necessary for the operation and delivery of the website is processed. This includes, in particular, IP addresses, server log data, and other technical information generated when the website is accessed.
Hosting is performed to ensure the secure, stable, and efficient provision of my online services. The legal basis is Art. 6 (1) (f) GDPR. Insofar as contact is made or mandates are initiated via the website, Art. 6 (1) (b) GDPR may also be relevant.
A data processing agreement has been concluded with the host in accordance with Art. 28 GDPR.
Host’s privacy policy: https://www.telekom.de/datenschutzhinweise
6. Server Log Files
When you visit this website, the host automatically collects information in so-called server log files. These include, in particular: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, and IP address.
This data is not merged with other data sources.
Processing is carried out for the technically error-free provision of the website and to ensure system security. The legal basis is Art. 6 (1) (f) GDPR.
Server log data is generally stored for 7 days and then deleted, unless further storage is exceptionally required for security or evidentiary purposes.
7. Cookies and Consent Management
This website uses cookies and similar technologies.
Insofar as such technologies are technically necessary, they are used on the basis of Art. 6 (1) (f) GDPR in conjunction with Section 25 (2) TDDDG. Insofar as consent is required, processing is based on Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG.
You can revoke any consent given at any time with effect for the future.
You can also set your browser so that you are informed about the setting of cookies, allow cookies only in individual cases, or generally exclude cookies. If technically necessary cookies are deactivated, the functionality of this website may be restricted.
8. Borlabs Cookie
To manage consents, I use Borlabs Cookie from Borlabs GmbH, Rübenkamp 32, 22305 Hamburg.
Borlabs Cookie stores the consents you have given or their revocation in order to document the legally required consent management. No consent data is transmitted to Borlabs itself.
The legal basis for its use is Art. 6 (1) (f) GDPR. My legitimate interest lies in the data protection-compliant management and proof of consents. Insofar as documentation is legally required, I additionally base the processing on Art. 6 (1) (c) GDPR. Insofar as Borlabs accesses your terminal device, Section 25 TDDDG must also be observed.
Consent data is stored exclusively locally on my server. No data is transmitted to Borlabs.
Borlabs privacy policy: https://de.borlabs.io/datenschutz/
9. WordPress Emojis (s.w.org)
By default, WordPress can load emoji graphics from external WordPress servers under the domain s.w.org. When these graphics are retrieved, your IP address may be transmitted to these servers.
The integration serves the uniform display of emojis and smileys. The legal basis is Art. 6 (1) (f) GDPR.
The WordPress servers from which emoji graphics are retrieved may be located outside the European Economic Area.
10. Multilingualism with WPML and Automatic Translation
This website uses WPML to provide content in multiple languages. The provider is OnTheGoSystems Limited, 22/F, 3 Lockhart Road, Wanchai, Hong Kong.
Technically necessary cookies may be used to store the selected language and language-related functional states.
Automatic translation via the Private Translation Cloud (PTC)
I use automatic translation via WPML. The content to be translated is transmitted to the Private Translation Cloud (PTC) of OnTheGoSystems. This is an AI-supported translation system that translates website content contextually.
Personal data contained in the content to be translated, such as names, contact details, or personal information within texts, may also be transmitted to the PTC servers.
The legal basis for processing is Art. 6 (1) (f) GDPR. My legitimate interest lies in the user-friendly provision of a multilingual online offering.
A data processing agreement has been concluded with OnTheGoSystems in accordance with Art. 28 GDPR.
As part of the automatic translation, personal data is transferred to a third country. The transfer is based on standard contractual clauses in accordance with Art. 46 (2) (c) GDPR.
WPML privacy policy: https://wpml.org/documentation/privacy-policy-and-gdpr-compliance/
11. Contact Form
If you send me a message via the contact form, I process the data you enter, including your contact details, to handle your inquiry and clarify any follow-up questions.
Processing is based on Art. 6 (1) (b) GDPR, provided your inquiry is aimed at initiating a contract or mandate. In other cases, processing is based on Art. 6 (1) (f) GDPR for the appropriate handling of incoming inquiries.
I store the data transmitted via the contact form until your inquiry has been conclusively processed. If no client relationship arises from the inquiry, the data will be deleted no later than 6 months after final processing. If a client relationship is established, the storage duration is determined by the principles mentioned under Section 3.
11a. Form Plugin (WPForms)
For the contact form, I use the WPForms plugin from WPForms LLC / Awesome Motive, Inc., 7732 Maywood Crest Dr, Suite 308, West Palm Beach, FL 33412, USA.
WPForms serves the technical provision of the contact form. The content you enter into the form is processed on my server during regular operation.
According to the provider, usage or telemetry data regarding the website and plugin installation may be transmitted to WPForms in connection with license management, updates, and—depending on the product and configuration. Form content is not captured by this according to the intended functionality.
The legal basis is Art. 6 (1) (b) GDPR, insofar as your inquiry is aimed at initiating a contract or mandate; otherwise, it is Art. 6 (1) (f) GDPR.
Insofar as data is transmitted to WPForms in connection with license management, updates, or technical usage functions, the provider processes this data according to its own privacy policy. The content entered via the contact form remains on my server according to the intended functionality.
WPForms privacy policy: https://wpforms.com/privacy-policy/
12. Contact by Email, Phone, or Fax
If you contact me by email, phone, or fax, I process your details, including the personal data transmitted in the process, for the purpose of processing your inquiry.
Processing is based on Art. 6 (1) (b) GDPR, insofar as your inquiry is related to the initiation or execution of a contract or mandate. Otherwise, processing is based on Art. 6 (1) (f) GDPR.
I store the data transmitted in connection with your inquiry until your request has been conclusively processed. If no client relationship arises, the data will be deleted no later than 6 months after completion. In the case of a client relationship, the retention principles described under Section 3 apply.
13. Communication via WhatsApp Business
I also offer communication via WhatsApp Business. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
If you contact me via WhatsApp, the communication content you transmit and the metadata generated in connection with its use will be processed. This includes, in particular, communication times, device data, and contact details.
Please note: WhatsApp or Meta also processes certain data for its own purposes under its own responsibility under data protection law. In this respect, the privacy policies of WhatsApp or Meta apply additionally. I have no influence on this data processing.
Note on Attorney-Client Privilege
WhatsApp’s end-to-end encryption protects the content of your messages during transit. However, Meta has access to certain metadata. If you wish to transmit particularly confidential information or extensive mandate-related documents, WhatsApp should not be used for this purpose. In such cases, please use email, phone, or fax.
The use of WhatsApp is based on Art. 6 (1) (b) GDPR, insofar as the communication serves the initiation or execution of a mandate, and otherwise on the basis of Art. 6 (1) (f) GDPR for fast and practical communication.
When using WhatsApp Business, personal data may be transferred to recipients outside the European Economic Area, particularly to the USA. For data transfers to the USA, WhatsApp/Meta states that it relies, among other things, on the EU-U.S. Data Privacy Framework.
The current DPF entry for WhatsApp LLC can be found here: https://www.dataprivacyframework.gov/participant/7735
I store the content exchanged via WhatsApp only as long as necessary to process your inquiry or to carry out the respective mandate. The retention obligations mentioned under Section 3 apply accordingly.
If you do not wish to use this communication channel, please use email, phone, or the contact form.
WhatsApp Privacy Policy: https://www.whatsapp.com/legal/privacy-policy
14. Google Fonts (Local Hosting)
Google Fonts are used on this website for the uniform display of fonts. The fonts are integrated locally on my server. Therefore, no connection to Google servers is established solely for the purpose of displaying the fonts.
Information about Google Fonts: https://developers.google.com/fonts/faq
Google Privacy Policy: https://policies.google.com/privacy?hl=en
15. Google reCAPTCHA
To protect the contact form from abusive automated entries, I use Google reCAPTCHA. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
reCAPTCHA analyzes the behavior of website visitors to determine whether entries come from a human or from automated programs. In doing so, Google processes, in particular, the IP address, mouse movements, keyboard behavior, duration of stay, browser information, device settings, and cookies, including existing Google cookies.
The exact nature and scope of the data processed in the background are not fully transparent.
The use of reCAPTCHA is based exclusively on your prior consent in accordance with Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG.
The reCAPTCHA script is only loaded after you have given your consent via my consent tool. No data is transmitted to Google before consent is given. You can revoke your consent at any time with effect for the future.
If you do not grant consent, you can still contact me via email, phone, or fax.
Google also processes the data collected via reCAPTCHA partly for its own purposes, in particular to improve the service and for general security purposes. In this respect, Google acts under its own responsibility under data protection law.
When using reCAPTCHA, personal data may be transferred to Google servers in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework.
The current DPF entry for Google LLC can be found here: https://www.dataprivacyframework.gov/participant/5780
Google Privacy Policy: https://policies.google.com/privacy?hl=en
16. External Links, in Particular LinkedIn
This website contains a link to my profile on LinkedIn. This is a simple external link. A connection to LinkedIn is only established when you actively click on the link.
When accessing the LinkedIn page, the privacy policies of the respective provider apply exclusively.
LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy
17. SSL or TLS Encryption
For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of your browser begins with “https://” and a lock symbol is displayed.
18. Recipients of Personal Data
Personal data is only passed on to third parties if this is legally permissible. This is particularly the case if the disclosure is necessary for processing your inquiry or for the execution of a contract or mandate, if I am legally obliged to do so, if processors are working for me, or if you have given your consent.
Insofar as I use processors, they are contractually obligated under Art. 28 GDPR to process personal data only on my instructions and to ensure an appropriate level of data protection.
Details on the respective recipients or service providers can be found in the corresponding sections of this privacy policy.
19. Your Rights
Within the framework of legal requirements, you have the following rights:
Access to the personal data processed by me in accordance with Art. 15 GDPR,
Rectification of incorrect data in accordance with Art. 16 GDPR,
Erasure of your data in accordance with Art. 17 GDPR,
Restriction of processing in accordance with Art. 18 GDPR,
Data portability in accordance with Art. 20 GDPR,
Notification to recipients in the event of rectification, erasure, or restriction in accordance with Art. 19 GDPR,
Withdrawal of consent given with effect for the future in accordance with Art. 7 (3) GDPR,
Objection to the processing of your data, insofar as this is based on Art. 6 (1) (e) or (f) GDPR, in accordance with Art. 21 GDPR.
Separate Notice on the Right to Object
Insofar as I process your personal data on the basis of a legitimate interest in accordance with Art. 6 (1) (f) GDPR, you have the right to object to the processing at any time for reasons arising from your particular situation.
I will then stop the processing unless I can demonstrate compelling legitimate grounds that outweigh your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims.
Restrictions for Persons Subject to Professional Secrecy
As a lawyer, I am subject to legal confidentiality obligations, in particular according to Section 203 of the German Criminal Code (StGB). Data subject rights may therefore be restricted to the extent provided by law, insofar as the fulfillment of a claim for access or information would disclose information subject to attorney-client privilege.
Insofar as this is legally permissible, I will inform you of such a restriction and the reasons for it, unless this information itself would jeopardize the confidentiality obligation.
Furthermore, you have the right to lodge a complaint with a data protection supervisory authority.
19a. Competent Supervisory Authority
The data protection supervisory authority competent for me is:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de
You have the right to lodge a complaint with this or another competent data protection supervisory authority if you believe that the processing of your personal data violates data protection regulations.
20. Objection to Advertising Emails
The use of contact data published within the scope of the legal notice obligation for the purpose of sending advertising that has not been expressly requested is hereby prohibited.
I reserve the right to take legal action in the event of unsolicited advertising, particularly spam emails.
21. Status
Status of this Privacy Policy: March 2026
