The data controller within the meaning of the GDPR is:

Compound Law Rechtsanwaltsgesellschaft mbH
Simplonstraße 52
10245 Berlin
Germany

Represented by: Julian Jantze (Managing Director)

Email: [email protected]

We process personal data based on the following legal grounds:

• Art. 6 (1) (a) GDPR (Consent): You have given consent for one or more specific purposes. Consent can be withdrawn at any time with effect for the future.
• Art. 6 (1) (b) GDPR (Contract Performance): Processing is necessary for the performance of a contract or pre-contractual measures.
• Art. 6 (1) (c) GDPR (Legal Obligation): Processing is necessary for compliance with a legal obligation to which we are subject (e.g., professional or tax law obligations).
• Art. 6 (1) (f) GDPR (Legitimate Interests): Processing is necessary for the purposes of legitimate interests pursued by us or a third party, unless overridden by your interests or fundamental rights.

Some of the service providers we use are based outside the European Economic Area (EEA). When we transfer personal data to third countries, we ensure appropriate safeguards are in place:

Adequacy Decision: For some countries, the European Commission has determined that an adequate level of data protection exists (e.g., for the United Kingdom, Switzerland). For the USA, this applies under the EU-U.S. Data Privacy Framework for certified companies.

Standard Contractual Clauses: With service providers in other third countries, we have agreed on the Standard Contractual Clauses approved by the EU Commission pursuant to Art. 46 (2) (c) GDPR.

Further information on the service providers used and the respective safeguards can be found in the relevant sections of this Privacy Policy.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. After that, the data is deleted unless longer retention is required by law.

Statutory Retention Obligations: Under German commercial and tax law, we are required to retain certain business documents for 6 or 10 years (§ 147 AO, § 257 HGB).

Professional Retention: For client matters, we retain data for at least 6 years after termination of the mandate (§ 50 BRAO).

Our website is hosted and delivered via Cloudflare Pages.

Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA

Data Processed: When accessing our website, information is automatically collected and stored in server log files: IP address, date and time of request, time zone difference to GMT, content of request (specific page), access status/HTTP status code, data volume transferred, referring website, browser, operating system, and language.

Purpose: Technical provision of the website, ensuring security and stability, defense against attacks.

Legal Basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and stable website operation).

Retention Period: Server log files are deleted after a maximum of 14 days.

Third Country Transfer: Cloudflare is certified under the EU-U.S. Data Privacy Framework. Additionally, Standard Contractual Clauses have been agreed.

Further Information: Cloudflare Privacy Policy

Our website uses technically necessary cookies that are required for the operation of the website.

Data Processed: Cookie ID, language settings, session information.

Purpose: Ensuring basic website functions (e.g., language selection, session management).

Legal Basis: Art. 6 (1) (f) GDPR (legitimate interest in providing a functional website). Technically necessary cookies are exempt from consent requirements under § 25 (2) No. 2 TDDDG.

Retention Period: Session cookies are deleted when the browser is closed. Persistent cookies (e.g., language settings) are deleted after a maximum of 1 year.

We use Google Analytics to analyze website usage. Processing only takes place with your explicit consent.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)

Data Processed: Usage data (pages visited, time on site, bounce rate), device information (device type, operating system, screen resolution), approximate location (based on IP address), referrer URL.

Purpose: Analysis of user behavior to improve our website and services.

Legal Basis: Art. 6 (1) (a) GDPR (consent). Consent can be withdrawn at any time via our cookie settings.

Retention Period: Data is stored for 14 months and then automatically deleted.

IP Anonymization: We use Google Analytics with IP anonymization enabled. Your IP address is truncated within the EU before being transmitted to Google servers.

Third Country Transfer: Google LLC is certified under the EU-U.S. Data Privacy Framework.

Further Information: Google Privacy Policy, Browser Add-on to Opt Out

We use Microsoft Clarity to analyze website usage. Processing only takes place with your explicit consent.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA)

Data Processed: Usage data (clicks, scroll behavior, mouse movements), device information, session recordings (excluding personal data entered in forms), heatmaps.

Purpose: Analysis of user behavior and usability of our website.

Legal Basis: Art. 6 (1) (a) GDPR (consent). Consent can be withdrawn at any time via our cookie settings.

Retention Period: Data is stored for 13 months.

Third Country Transfer: Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework.

Further Information: Microsoft Privacy Statement

When you contact us via our contact form, we process the data you provide to handle your inquiry.

Data Processed: Name, email address, phone number (if provided), company, message content.

Purpose: Processing your inquiry, contacting you, potentially initiating a client relationship.

Legal Basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in responding to inquiries).

Retention Period: We delete the data after final processing of your inquiry, unless statutory retention obligations apply or a client relationship is established.

For online appointment booking, we use Cal.com.

Provider: Cal.com, Inc., 340 S. Lemon Ave #7805, Walnut, CA 91789, USA

Data Processed: Name, email address, selected appointment, any additional information you provide.

Purpose: Enabling convenient online appointment scheduling.

Legal Basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in user-friendly appointment booking).

Retention Period: Data is stored for the duration of appointment management and deleted after completion of the appointment or inquiry, unless a further business relationship is established.

Third Country Transfer: Standard Contractual Clauses have been agreed with Cal.com.

Further Information: Cal.com Privacy Policy

If you subscribe to our newsletter, we process your data to send the newsletter.

Provider: Intuit Inc. (Mailchimp), 2700 Coast Avenue, Mountain View, CA 94043, USA

Data Processed: Email address, name (if provided), time of registration, IP address at registration (to document consent).

Purpose: Sending our newsletter with information about our services and legal topics.

Legal Basis: Art. 6 (1) (a) GDPR (consent). Consent is obtained via double opt-in and can be withdrawn at any time by unsubscribing.

Performance Measurement: The newsletter contains a web beacon that enables measurement of open rates and click behavior. This data is analyzed pseudonymously. You can object to performance measurement by disabling images in your email program.

Retention Period: Your email address is stored until you unsubscribe from the newsletter. Documentation of consent is retained for 3 years after unsubscription.

Third Country Transfer: Intuit/Mailchimp is certified under the EU-U.S. Data Privacy Framework. Additionally, Standard Contractual Clauses have been agreed.

Further Information: Mailchimp Privacy Policy

In the context of establishing and conducting a client relationship, we process the following data:

• Contact data (name, address, email, phone)
• Company data (for legal entities)
• Matter-relevant information
• Communications within the client relationship
• Billing data
• Identification data pursuant to the German Money Laundering Act (GwG), where required

Purpose: Providing the commissioned legal services, matter management, billing.
Legal Basis: Art. 6 (1) (b) GDPR (contract performance), Art. 6 (1) (c) GDPR (legal obligations, e.g., GwG, tax law), Art. 9 (2) (f) GDPR where applicable (for special categories of personal data in the context of legal advice).
Retention Period: 6 years after termination of the mandate pursuant to § 50 BRAO, longer retention for tax law obligations (up to 10 years).

When you apply for a position with us, we process the data contained in your application.

Data Processed: Contact data, CV, certificates, cover letter, other information you provide.

Purpose: Conducting the application process, assessing your suitability.

Legal Basis: Art. 6 (1) (b) GDPR in conjunction with § 26 (1) BDSG (decision on establishing an employment relationship).

Retention Period: In case of rejection, your application documents are deleted 6 months after completion of the process, unless you consent to longer storage for future job openings (legal basis then: Art. 6 (1) (a) GDPR). If hired, the data is transferred to your personnel file.

We maintain presences on LinkedIn and X (Twitter). When you visit our social media pages, your data is also processed by the platform operators.

LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy Policy

X (Twitter): Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Privacy Policy

The platform operators process your data under their own responsibility. We have no influence on the nature and scope of data processed by the platforms. For questions about data processing by the platforms, please contact their data protection officers directly.

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You can request information about your personal data we process.
• Right to Rectification (Art. 16 GDPR): You can request correction of inaccurate or completion of incomplete data.
• Right to Erasure (Art. 17 GDPR): You can request deletion of your data under certain conditions.
• Right to Restriction (Art. 18 GDPR): You can request restriction of processing under certain conditions.
• Right to Data Portability (Art. 20 GDPR): You can request to receive the data you provided in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to processing of your data based on Art. 6 (1) (f) GDPR.
• Right to Withdraw Consent (Art. 7 (3) GDPR): You can withdraw any consent given at any time with effect for the future.

To exercise your rights, please contact: [email protected]

You have the right to lodge a complaint with a data protection supervisory authority about our processing of personal data (Art. 77 GDPR).

The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: [email protected]
www.ldi.nrw.de

We do not use automated decision-making including profiling pursuant to Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

We reserve the right to amend this Privacy Policy to adapt it to changed legal situations or changes to our services or data processing. The current version is always available on our website.

Last updated: January 2026