Privacy policy

When you use this website, we process personal data relating to you. Below we inform you which data this concerns, how we process it and what rights you have in connection with it. Pursuant to Art. 4(1) of the General Data Protection Regulation (“GDPR”), personal data means any information relating to an identified or identifiable natural person.

1. Name and contact details of the controller

This privacy notice applies to the processing of data on the website bwlaw.de, including all subpages, by the controller:

If you have any questions about our data protection measures, please contact: Dr. Artur Barczewski, a.barczewski@bwlaw.de.

2. Processing of personal data and purposes of the processing

a) Web hosting

To provide this website we use the web hosting services of LH.pl Sp. z o.o., Pl. Wolności 6/4, 61-738 Poznań (Poland).

A web hosting service is required to operate a website. The use of LH.pl is based on Art. 6(1) sentence 1 lit. f) GDPR on the grounds of our legitimate economic interest in making our services available on this website. LH.pl processes on our behalf personal data generated in the course of the use of the website.

We have concluded a data processing agreement with LH.pl. In this way we ensure that the service provider processes personal data in accordance with the GDPR and guarantees the protection of the rights of the data subjects.

b) Visiting our website / log files

When you use our website for purely informational purposes, your browser automatically sends information to the server of our website. This is necessary for establishing a smooth connection and for a user-friendly provision and use of the online services. The information collected is temporarily stored in so-called log files in our systems for the duration of the session. The following information is collected:

• browser type and version
• internet service provider
• IP address of the end device
• operating system
• date and time of the server request
• place and country of the server request
• time zone difference to Greenwich Mean Time (GMT)
• websites accessed by your system via our website (referrer URL)

The legal basis for the data processing is Art. 6(1) sentence 1 lit. f) GDPR. Our legitimate interest follows from the necessity of a trouble-free provision of the website and from our interest in its security.

The information is stored for security reasons (e.g. to investigate cases of misuse) for a maximum period of 8 weeks.

The provision of this information is required neither by law nor by contract. However, without this information the functionality of the website is not, or not fully, guaranteed.

c) Contact by e-mail, telephone or contact form

For questions of any kind, we offer you the possibility of contacting us by e-mail, telephone or via the contact form. When filling in the contact form, an e-mail address is required so that we can answer the enquiry and process your request. Further information can be provided voluntarily.

The legal basis for the data processing is Art. 6(1) sentence 1 lit. f) GDPR. The legitimate interest consists in enabling you to contact us quickly and reliably and in processing your enquiry. If a contractual relationship already exists between us, or if the contact serves the initiation of such a contractual relationship, the processing is based on Art. 6(1) sentence 1 lit. b) GDPR.

We delete the data from the contact enquiry as soon as your request has been fully and conclusively dealt with and no further communication is required. If a contractual relationship is concluded, we store the data until the contractual relationship has been fully completed. A longer storage period may result from statutory retention obligations (e.g. § 147 AO or § 257 HGB).

d) Cookies

On your first visit to our website we display a cookie consent banner and obtain your consent insofar as cookies or similar technologies that are not technically necessary are used. Technically necessary cookies may be set without consent (Section 25(2) TDDDG).

Cookies are small text files that are stored in your browser or on your device when you open the website. For analysis purposes we use Google Analytics — however, only with your consent (see section 2 f) below). In addition, cookies may be set by the third-party services we embed (Google Maps, YouTube, Calendly) — and only once you enable the respective service via the consent banner or by actively clicking.

You can disable the use of cookies wholly or partially in your browser settings and delete cookies already set. You can also withdraw the consent given via the banner at any time with effect for the future via the cookie settings (link in the footer).

Please note that certain content (map, videos, online appointment booking) is only available once you enable the corresponding services. Without your consent this content is not loaded and no cookies are set in this respect.

e) Google Maps

We use the map service Google Maps on our website to display map material. For users from the European Economic Area and Switzerland, the display is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and for all other users by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Further information on the purpose and scope of data processing by Google is available at: https://www.google.de/intl/en/policies/privacy

Google transfers the data to Google servers in the USA. Pseudonyms are transferred which do not allow any conclusions to be drawn about your name.

We only transfer your data to Google if you have given your consent. In that case you also consent to your data being transferred to the USA in accordance with Art. 49(1) lit. a) GDPR.

The legal basis is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR, which you give by actively clicking the “Show map” button. Without your click the map is not loaded and no data is transferred to Google.

When the map is loaded, Google may set cookies and similar technologies on your device.

f) Google Analytics

If you have given your consent via the cookie banner, we use Google Analytics 4 on our website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It is integrated via the WordPress plugin Site Kit by Google. Google Analytics uses cookies (_ga, _ga_*) that enable an analysis of your use of the website. Your IP address is processed in truncated form only. In addition, we have implemented Google Consent Mode: without your consent no cookies are set and no data is transmitted to Google.

The data collected may be transferred to Google servers in the USA (Art. 49(1)(a) GDPR). The legal basis is your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings (link in the footer). Further information: https://policies.google.com/privacy

g) Google Ads – conversion measurement

We use Google Ads, an online advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to place ads in Google Search. When you click on one of our ads, Google appends a click identifier (the “gclid” parameter) to the address of the landing page.

If you have consented to the “Google Ads” service (“Marketing” category) in the cookie settings and then send us an enquiry via the contact form, we store the click identifier together with the date and time of the enquiry and the time and identifier of your consent. We transmit the click identifier and the time of the enquiry to Google in order to attribute the enquiry to the ad (so-called conversion import). Google thereby learns that an enquiry to our law firm resulted from the ad click identified by this parameter. Your name, e-mail address, telephone number and the content of your enquiry are not transmitted. Without this consent, we do not store the click identifier and do not send Google any information about your enquiry.

Google may link this information to your device or your Google account and processes it as an independent controller under the Google Ads Controller-Controller Data Protection Terms, including for its own purposes such as measuring and improving its services. To the extent that we and Google jointly determine the collection of the click identifier on our website and its transmission to Google, we may be joint controllers in this respect (Art. 26 GDPR). Google alone is responsible for any further processing by Google.

The legal basis is your consent (Art. 6(1) sentence 1 lit. a) GDPR and Section 25(1) TDDDG). Consent is voluntary. You can withdraw it at any time with effect for the future in the cookie settings. If you withdraw your consent in the same browser, we will take this into account for future transmissions. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We store the click identifier and the consent information for no longer than 90 days. We only transmit to Google click identifiers from enquiries made within the last 60 days.

If you have consented to Google Analytics (letter f), the events “form submitted” and “phone number clicked” recorded there are transmitted to Google Ads as conversions. The legal basis in this respect is your consent (Art. 6(1) sentence 1 lit. a) GDPR and Section 25(1) TDDDG), which you can withdraw in the cookie settings.

If you have consented to the “Marketing” category (Google Ads) in the cookie settings, the Google tag used on our website may store and read cookies on your device in order to attribute clicks on our ads to subsequent enquiries (in particular “_gcl_au”, “_gcl_aw” and “_gcl_gs”, each stored for 90 days). At the same time, we send Google a signal that you have agreed to the use of your data for measuring our advertising. We do not use your data for personalised advertising (remarketing). The Google tag is only loaded if you have also consented to Google Analytics (letter f). The legal basis is your consent (Art. 6(1) sentence 1 lit. a) GDPR and Section 25(1) TDDDG), which you can withdraw at any time with effect for the future in the cookie settings.

If you call the telephone number shown in one of our ads, the call is routed to us via a Google forwarding number. Google records the start time and duration of the call, whether the call was connected and, for calls longer than 15 seconds, the caller’s telephone number, in order to count calls from ads. The legal basis is our legitimate interest in measuring the effectiveness of our ads (Art. 6(1) sentence 1 lit. f) GDPR).

Data may be transferred to Google servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework, so the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). Further information: https://policies.google.com/privacy

h) Calendly (online appointment booking)

On selected pages we offer the possibility of booking a consultation via the Calendly service (Calendly LLC, Atlanta, Georgia, USA). The scheduler is only loaded when you actively click the corresponding button. When loaded, your IP address is transmitted to Calendly and data may be transferred to the USA (Art. 49(1)(a) GDPR). When you book, Calendly processes the data you enter (name, e-mail address, chosen time slot). The legal basis is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR, given by actively loading the scheduler. Further information: https://calendly.com/privacy

When the scheduler is loaded, Calendly may set cookies and similar technologies on your device.

i) YouTube

On selected pages (knowledge base) we embed videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The videos are embedded in extended privacy mode (youtube-nocookie.com) and are only loaded when you actively click the thumbnail — before that no connection to YouTube is established. After the click, YouTube or Google may set cookies and similar technologies, process your IP address and transfer data to the USA (Art. 49(1)(a) GDPR). The legal basis is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR and Section 25(1) TDDDG, which you give by clicking. Further information: https://policies.google.com/privacy

3. Disclosure of personal data to third parties

We only pass on your personal data to third parties if:

• you have given us your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR,
• the disclosure is necessary pursuant to Art. 6(1) sentence 1 lit. b) GDPR for the performance of a contract with you,
• there is a legal obligation for the disclosure pursuant to Art. 6(1) sentence 1 lit. c) GDPR,
• the disclosure is necessary pursuant to Art. 6(1) sentence 1 lit. f) GDPR for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in your data not being disclosed.

In addition, your data may be transferred to other recipients in the following cases:

• to third parties involved in the handling of business transactions, such as credit institutions and telecommunications service providers,
• lawyers, tax advisors, accountants,
• IT contractors and web service providers engaged in connection with the maintenance of our website,
• to authorities and public bodies, such as courts, tax and law enforcement authorities.

With external service providers — insofar as they act as processors — we conclude a data processing agreement and ensure, through legal, technical and organisational measures, that the data protection provisions are complied with.

4. Data transfers to third countries

Your personal data is only transferred to a third country or international organisation if the requirements of Art. 44 et seq. GDPR are met and we inform you thereof.

States outside the European Economic Area (EEA) for which no adequacy decision pursuant to Art. 45(1) GDPR has been issued are regarded as unsafe third countries. Among others, the USA is considered a third country. The level of data protection there is lower than within the EU and not comparable with that in the EU. In particular, there is a risk that US authorities may access your personal data. EU citizens cannot effectively defend themselves against such access.

We only transfer personal data to unsafe third countries if

• sufficient guarantees pursuant to Art. 46 GDPR are provided for the protection of the data,
• you have expressly consented to the transfer pursuant to Art. 49(1) lit. a) GDPR after having been informed of the possible risks of such data transfers for you in the absence of an adequacy decision and appropriate safeguards,
• the transfer is necessary for the conclusion of a contract in your interest or for the performance of contractual obligations between you and us,
• another exception pursuant to Art. 49(1) GDPR applies.

Appropriate safeguards include so-called standard contractual clauses, in which the recipient of the data guarantees to protect the data adequately and to establish a level of data protection comparable to the GDPR.

5. Storage period

Personal data is stored — unless otherwise specified in this privacy policy — for as long as is necessary for the respective purposes and for the fulfilment of our legal obligations.

Where statutory retention obligations exist (e.g. under § 147 AO, § 257 HGB), the data is stored at least for the duration of the statutory retention period.

6. Rights of data subjects

You have the right:

• pursuant to Art. 7(3) GDPR, to revoke your once-given consent at any time with effect for the future,
• pursuant to Art. 15 GDPR, to request information about the personal data we process,
• pursuant to Art. 16 GDPR, to request the immediate rectification of inaccurate personal data or the completion of your personal data stored by us,
• pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us,
• pursuant to Art. 18 GDPR, to request the restriction of the processing of your personal data,
• pursuant to Art. 20 GDPR, to receive your personal data in a structured, machine-readable format or to request its transfer to another controller,
• pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority if you consider that our data processing is not lawful.

7. Data security

The website uses SSL encryption. You can recognise an encrypted connection by the padlock symbol in the browser bar.

In addition, we take appropriate technical and organisational measures to ensure the security, integrity and functionality of the website and of the IT systems we use.

8. Currency and amendment of this privacy policy

This privacy policy is currently valid and reflects the status as of July 2026.

Further development of the website or changed legal or technical requirements may make it necessary to amend this privacy policy.