Privacy Policy

1. General Information About the Controller

The controller responsible for the data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is stetter Rechtsanwälte, owner Dr. Sabine Stetter, Amiraplatz 3, Im Luitpoldblock, 80333 Munich, Germany, email: info(at)stetterlegal.com. (hereinafter “we” or “us”).

The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2. Information on the Use of Cookies

We use cookies on our website to enable certain basic functions and to analyze the use of our website so that we can improve it on a regular basis. Cookies are small text files that are stored on your hard drive and assigned to the browser you are using, and through which certain information flows to the entity that sets the cookie. Cookies cannot execute programs or transmit viruses to your computer.

Depending on the purpose and function of the cookies, consent may be required for their use. A distinction is therefore made between cookies that do not require consent and cookies that require consent:

Cookies not requiring consent:

Cookies that are strictly necessary in order to provide a digital service expressly requested by the user do not require consent (Section 25(2) no. 2 TDDDG). These include cookies that help to enable the basic functions and that are necessary for the proper functioning of the website (so-called necessary or essential cookies).

We currently use the following cookie that does not require consent:

Cookies requiring consent:

All cookies used for purposes other than those mentioned above require consent (Section 25(1) TDDDG). These include, for example, cookies used to track the use of the website or to recognize visitors by means of a pseudonymous ID. We provide information about the cookies requiring consent that we use in our consent banner under “Manage Settings”. The specific information on the cookies requiring consent (provider, name, purpose, storage period) is displayed in each case together with the description of the technology or service that sets the respective cookie.

a) Managing the Cookies Used on This Website

Cookies requiring consent are only used by us if you have previously given your consent to do so (Section 25(1) TDDDG). When you access the website, we display a so-called “consent banner” for this purpose.

Via the “Accept All” button, you can declare your consent to the use of all cookies requiring consent that we use.

Via the “Manage Settings” button, you have the option of retrieving detailed information about the technologies we use and the cookies used in this context, and you can individualize your consent.

Alternatively, via the “Reject All” button, you can limit the use of cookies to necessary cookies. In this case, no cookies requiring consent are set. Necessary cookies cannot be deactivated via the cookie banner. However, you can delete these cookies via your browser settings. Please note that in this case individual basic functions of the website may no longer be available.

The settings you make in the consent banner are stored locally in your browser (so-called “local storage”) and are automatically deleted when the current session ends. The legal basis for this is Section 25(2) No. 2 TDDDG.

b) Changing Cookie Settings

Via the “Manage Consent” link in the footer of the website, you can also, at any later time, retrieve detailed information about the technologies and cookies requiring consent that are used, change your previous settings, or revoke your consent entirely.

3. Data Processing on the Website

In connection with the provision of our website, we process personal data of our website visitors. In this section, we explain in particular for which purposes we process which categories of personal data, on which legal basis the processing is based, and for how long we store the data. This depends in each case on the processing context, as set out below.

The provision of personal data for the following purposes is neither required by law nor by contract. However, without the data required for the technical provision of the website or for the playback of the embedded videos, we cannot display this content to you. In addition, without your contact details, we cannot respond to your contact request.

a) General Operation of the Website

aa) Technical Provision of the Website

When you visit the website, the website's web server, as a technical necessity, records the IP address of the requesting device, the date and time of access, the page/file accessed (URL) and the amount of data transferred, the message about the successful retrieval (HTTP status code), the browser used (e.g. Mozilla Firefox, Google Chrome, etc.), the operating system used (e.g. Windows 10), and the previously visited page (referrer URL), insofar as this is transmitted by the browser. This data is processed to deliver the website and the consent banner, to ensure stability, and, where applicable, to detect and defend against attempted attacks. In addition, this data may be processed in the event of system misuse or an attack on the website's IT infrastructure in order to identify the perpetrator of the misuse or attack in cooperation with the respective telecommunications providers and the competent authorities.

The legal basis for this processing is our legitimate interests (Art. 6(1)(f) GDPR) in delivering the website, ensuring stability, detecting and defending against attempted attacks, and, where applicable, identifying the perpetrator in the event of misuse or an attack. We assume that our users' interests are aligned in this respect, since only in this way is access to the website and the assurance of its stability and security possible.

As part of the technical provision of our website, we work together with external service providers who support us in delivering our services. For the hosting of the website, we use an external hosting service provider. We have commissioned an external agency with the web design, data maintenance, and development of our website. The service providers each receive access only to the personal data required for the provision of services.

A transfer of personal data to countries outside the EU/EEA (so-called third countries) does not take place in connection with the technical provision of the website.

The aforementioned data is deleted by us as soon as it is no longer required for the purpose for which it was collected. In the case of the processing of data for accessing the website, this is generally the case once the respective session has ended. In addition, the data may be temporarily stored in log files for the purposes of website security. These are routinely deleted after 14 days at the latest.

bb) Contacting Us

When you contact us (e.g. via the contact form or by email), personal data is processed.

Which data is collected and further processed when you use our contact form is apparent from the contact form and depends on your entries. Mandatory fields are marked with an *. When you contact us via our contact form, the data you submit is forwarded to us by email. We point out that unencrypted email communication generally does not offer complete protection against being read by third parties and, in this respect, is not considered a particularly secure means of transmission. Should you wish to share information with us that has an increased need for protection, please feel free to contact us and we will then agree with you on a suitable, more secure means of communication.

The legal basis for the processing of data in connection with contacting us is our legitimate interest in responding to your request pursuant to Art. 6(1)(f) GDPR. Insofar as your contact is aimed at concluding or performing a mandate relationship or other contractual relationship, an additional legal basis for the processing is Art. 6(1)(b) GDPR.

For the technical provision of our contact form, we are supported by external hosting service providers for our website and our email server, as well as by an external agency. These service providers each receive access only to the personal data required for the provision of services.

A transfer of personal data to countries outside the EU/EEA (so-called third countries) does not take place in this context.

Your data is deleted as soon as your request has been conclusively handled – this is particularly the case where it is apparent from the circumstances that the matter concerned has been definitively clarified, and provided that no statutory retention obligations conflict with this. If a mandate is established, the mandate-related retention periods apply.

cc) Defense Against Spam Submissions

To defend against automated spam submissions, we use an invisible control field (so-called honeypot) in the contact form as well as a server-side limitation of the request frequency.

For this purpose, your IP address is processed briefly for the duration of the current session and deleted after the end of the session.

The legal basis for this processing is our legitimate interest pursuant to Art. 6(1)(f) GDPR in a functional contact form that is protected against abusive automated use.

For the technical implementation of the spam protection, we are supported by the hosting service provider for our website as well as by an external agency. These service providers each receive access only to the personal data required for the provision of services.

A transfer of personal data to countries outside the EU/EEA (so-called third countries) does not take place in this context.

b) Analysis and Tracking Technologies

Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as: “Google”), to measure and analyze the use of our website, to compile reports on website activity, and to conduct, measure, and optimize target-group-oriented advertising campaigns.

For this purpose, Google uses, among other things, cookies that are stored on and read from your computer. Further information on the cookies used by Google can be found in the consent banner; general information on cookies can be found in the section “Information on the Use of Cookies”.

For the aforementioned purposes, the following categories of personal data are processed by Google:

• Usage data: pages accessed, time spent, approximate location (derived on the basis of the IP address)
• Event data: custom events (e.g. interactions with elements such as links, buttons)
• Technical data: origin page (referrer), IP address (stored in anonymized form), device and browser information
• Identifiers (IDs provided by Google that make it possible to track the success of an advertising campaign)
• Advertising/attribution data: campaign information, traffic source, medium, campaign, search terms (where available), ad interactions, as well as contact via form, email, or telephone.
• Consent data: consent status according to Google Consent Mode

On the basis of this information, pseudonymous usage profiles are created using the IDs generated by Google. Google uses the information on our behalf to analyze the use of our website, to compile reports on website activity, and to measure and optimize the success of our advertising campaigns. For this purpose, Google shows us which advertising measure or traffic source (e.g. a search query) led to a conversion (e.g. a contact inquiry). Google also uses the aforementioned information to specifically present advertisements placed on our behalf via the linked Google advertising service “Google Ads” to those users who have already shown interest in our website.

The legal basis for setting and reading the Google Analytics cookies as well as the further processing of the aforementioned data is the consent you have given via the consent banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, no data is collected and no elements are loaded from Google. In addition, the consent also applies to Google itself, since under the Digital Markets Act (DMA) Google is obliged to obtain consent so that Google Analytics can be used in conjunction with other Google services (in our case the advertising service “Google Ads”). For this purpose, we share the status of the consent given by users via our consent banner with Google through the so-called Google Consent Mode, so that Google can control the use of its services in accordance with the consent granted or refused. In this way, Google is able, for example, to ensure that the consent status of our users can be appropriately taken into account when using Google Analytics and the linked Google service “Google Ads”.

The recipient of the collected data is Google Ireland Limited, which processes it on our behalf. In addition, it is possible that Google Ireland is supported in this by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, as a subcontractor. Any transfer of data to Google LLC takes place on the basis of an adequacy decision (Art. 45 GDPR): Google LLC is certified under the EU-US Data Privacy Framework.

The processed data is deleted by Google after 14 months. Further information on the storage period of the cookies used by Google can be found in the consent banner.

You can revoke your consent to the data processing and the setting or reading of cookies at any time via the consent banner. You can access the consent banner by clicking on “Manage Consent” in the footer of the website.

c) Integration of External Media

We embed video content from the streaming service “bunny.net” on our website. The service provider is BunnyWay, informacijske storitve d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia.

Video content from bunny.net is embedded on our website in such a way that a connection to the servers of bunny.net is only established once you have actively consented to the display of the respective video by clicking on the video's preview image (so-called two-click solution). This ensures that, when the respective subpage of our website is loaded, no data processing by bunny.net initially takes place and no cookies from bunny.net are set. If you consent to the display of the video, bunny.net sets a session cookie that is required to control the playback of the video. You can find more information on this in the section “Information on the Use of Cookies”.

For the display and playback of the videos on our website, the following data categories are processed: your IP address, your device/browser information, and the video file accessed.

The legal basis for the processing of the data is our legitimate interest in the presentation and delivery of our video content pursuant to Art. 6(1)(f) GDPR. In this respect, we assume that your interests as the data subject are aligned when you consciously decide to play a video embedded via the two-click solution described above and to trigger the data processing required for this.

The recipient of the data is BunnyWay, informacijske storitve d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia, which processes it on our behalf for the playback and display of the video content.

A transfer of personal data to countries outside the EU/EEA (so-called third countries) does not take place in this context.

The aforementioned data is processed for the duration of the video playback and deleted afterwards.

d) Links to External Websites

Our website contains various links to external third-party websites. When you merely visit our website, no data is transferred to these providers; these are pure links without embedded content from the target pages. When you click a link, you leave our website and are directed to the page of the respective service. Please note that the data processing then triggered is outside our sphere of influence and that the data protection provisions of the respective service must be observed.

4. Data Subject Rights

Natural persons whose personal data is processed (so-called data subjects) may, depending on the circumstances of the specific case, have the rights listed below under the GDPR:

• The right to information about, rectification, or erasure of your personal data and, where applicable, the right to restriction of the processing of your personal data.
• In certain cases, a right to data portability.
• Right to object: Where the processing of your personal data is based on a legitimate interest (Art. 6(1)(f) GDPR), there is a right to object to this processing on grounds relating to the particular situation of the data subject. We will then no longer process this personal data, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims. With regard to processing for the purposes of direct marketing, the data subject may object at any time.
• Where the processing of personal data is based on consent, the data subject has the right to withdraw the consent at any time, without affecting the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.

Please note that, pursuant to Section 29(1) BDSG in conjunction with Art. 14 and 15 GDPR, restrictions may arise with regard to the right to information and access due to the confidentiality obligation of lawyers.

To exercise your rights or if you have questions about data protection, you can contact us using the contact details specified in section 1.

You also have the right to lodge a complaint with a competent supervisory authority, in particular in the Member State of your residence, your place of work, or the place of the alleged infringement of the GDPR, if you are of the opinion that the processing of the personal data concerning you infringes data protection provisions.

5. Contact Details of the Data Protection Officer

You can reach our Data Protection Officer using the following contact details: Data Protection Officer, stetter Rechtsanwälte, Amiraplatz 3, Im Luitpoldblock, 80333 Munich, email: dsb@stetterlegal.com.

Last updated: August 2026