Privacy policy

1. Controller

Rechtsanwalt Alexander von Bauer, Seidlstraße 18a, 80335 München, Germany
Phone +49 89 999 54 160 · Email anwalt@vonbauer.de

2. Principle

This website is built to minimise data. No cookies are set for analytics or advertising, no tracking or statistics services are embedded, and no content is loaded from third-party servers. Fonts and images are hosted entirely on this website’s own server. No consent banner is therefore required.

3. Visiting the website (server logs)

When you access the site, the web server records technically necessary data: the file requested, date and time, volume of data transferred, the access status message, browser type and version, operating system, the referring page and the IP address of the requesting computer.

Purpose and legal basis: provision and security of the service. Article 6(1)(f) GDPR; the legitimate interest lies in technically sound and secure operation.

4. Processing on our behalf by the host

This website is hosted by a well-established German hosting company. The provider processes the above data on my behalf under a data processing agreement pursuant to Article 28 GDPR.

5. Contact by form, email, telephone or fax

When you contact me, I process the details you provide in order to deal with your enquiry. In the contact form, name, email address and message are mandatory; the telephone number is optional.

Legal basis: Article 6(1)(b) GDPR where the enquiry concerns a mandate or its initiation; otherwise Article 6(1)(f) GDPR, and Article 6(1)(a) GDPR where consent has been given.

Retention: enquiries that do not lead to a mandate are deleted once processing is complete and no retention obligation applies. Data relating to a mandate is subject to the retention obligation under section 50 BRAO (six years after the end of the engagement) and to tax and commercial law periods.

Confidentiality: an unencrypted email can be read by third parties in transit. For particularly confidential documents, please use the post or arrange an appointment.

6. Protection of the contact form against automated submissions

Several checks run to prevent the form being abused by programs. No third-party service is used – in particular no reCAPTCHA, hCaptcha or comparable product. Such services would transmit every visitor’s address to an outside provider.

• Invisible fields. The form contains fields that are not visible to people. No data about you is collected through them.
• Content check. The text you enter is checked for characteristics typical of unsolicited advertising. This happens on this website’s own server; the text is neither stored nor passed to third parties.
• Rate limiting. To prevent bulk submissions, the number of messages from an internet connection is counted. The IP address is converted into a hash using a secret key. Only that hash is stored, together with timestamps; your IP address itself is not stored and cannot be recovered from the hash. Entries are deleted after 24 hours.
• Follow-up question. If a message stands out, a simple arithmetic question in plain text appears. It works with a keyboard and a screen reader; no image puzzles are used.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest lies in preventing misuse and keeping the form functional.

7. Encryption

The website is delivered over TLS; transmission between your browser and the server is encrypted. You can recognise this by https:// in the address bar.

8. Map display (Google Maps)

A Google Maps map can be displayed on the contact page. The map is loaded only after you expressly click. Before that, no connection to Google takes place whatsoever. After the click, your IP address and further connection data are transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; transfer to Google LLC in the United States cannot be ruled out.

Google’s own data protection provisions apply to the data transmitted. Google’s terms for Google Maps are available at www.google.com/intl/en/help/terms_maps/, and Google’s privacy policy at policies.google.com/privacy.

Legal basis: Article 6(1)(a) GDPR. You give consent by clicking the button and may withdraw it at any time with effect for the future by reloading the page and not activating the map again.

9. Recipients

Your data is passed on only where necessary to deal with your enquiry, where you have consented, or where a legal obligation exists. Processors acting on my behalf may include the hosting provider and service providers in the field of IT, IT security or law practice software.

10. Your rights

• Access to the data processed (Article 15 GDPR)
• Rectification of inaccurate data (Article 16 GDPR)
• Erasure (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)
• Withdrawal of consent with effect for the future (Article 7(3) GDPR)

A message to the contact details above is sufficient to exercise these rights.

11. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority here is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 27, 91522 Ansbach, www.lda.bayern.de.

12. Whether provision is required

Providing your data is neither required by law nor by contract. Without the details marked as mandatory, however, I cannot deal with your enquiry.

13. Automated decision-making

No automated decision-making, including profiling, takes place.

14. Version

Version of this privacy policy: August 2026