---
title: "Trust Center — Compound Law"
description: "How Compound Law protects your data: GDPR compliance, subprocessors, and answers to common data-protection questions."
image: "https://compound.law/assets/images/og-image-en.webp"
source: "https://compound.law/en-DE/trust-center/"
language: "en"
---

# Trust Center

How Compound Law protects your data: GDPR compliance, subprocessors, and answers to common data-protection questions.

[privacy@compound.law ](mailto:privacy@compound.law)[Privacy Policy ](https://compound.law/en-DE/privacy/)Last updated: June 9, 2026

## Overview

Data protection is part of how we practise law. We process personal data only on a valid legal basis, with data minimisation and transparency. The sections below describe the vendors we work with and answer common data-protection questions.

## Compliance

![GDPR Compliant](https://compound.law/trust/gdpr-badge.svg) GDPR Compliant

## Documents

- [Privacy Policy](https://compound.law/en-DE/privacy/)
- [Imprint](https://compound.law/en-DE/imprint/)
- [Cookie Policy](https://compound.law/en-DE/cookies/)

## Subprocessors

- ![Hetzner Online GmbH logo](https://compound.law/trust/logos/hetzner.svg)

  Hetzner Online GmbH Germany

  Server hosting and infrastructure.

- ![Cloudflare, Inc. logo](https://compound.law/trust/logos/cloudflare.svg)

  Cloudflare, Inc. European Union

  Application hosting and database.

- ![Microsoft Azure logo](https://compound.law/trust/logos/microsoft.svg)

  Microsoft Azure European Union

  Cloud hosting and AI/LLM services.

## FAQ

Yes. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Our Privacy Policy explains what we collect, the legal basis, and why.

Our infrastructure runs on Hetzner servers located in Germany and on Cloudflare’s platform (Workers and the D1 database) within the European Union. Personal data is stored in the EU.

No. Our hosting and database are located in Germany and the EU, so personal data is not transferred to third countries in the ordinary course of running our website and services.

The vendors that may process personal data on our behalf are listed in the Subprocessors section above. We keep this list current and review each vendor’s data-protection posture.

When we provide legal advice we act as an independent data controller under our own professional and statutory duties — not as a processor acting on a client’s instructions. For that reason we do not enter into a data processing agreement (DPA) for our legal services.

Client information is protected by attorney-client confidentiality (§ 43a BRAO, § 203 StGB) in addition to GDPR. We apply appropriate technical and organisational measures to keep that data secure.

Contact us using the address in the Contact section below. We respond to access, rectification, erasure and other requests within the statutory timeframe, subject to our legal retention and confidentiality obligations.

Where a breach is likely to result in a risk to data subjects, we notify the competent supervisory authority within 72 hours and affected individuals without undue delay, as required by Articles 33 and 34 GDPR.

## Contact

Questions about privacy or security? We are happy to help.

[Get in touch](https://compound.law/en-DE/quote/)

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": [
      "Organization",
      "LegalService"
    ],
    "@id": "https://compound.law/#organization",
    "name": "Compound Law",
    "alternateName": "Compound Law — AI Law Firm",
    "url": "https://compound.law/",
    "logo": {
      "@type": "ImageObject",
      "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png",
      "width": 1024,
      "height": 1024
    },
    "image": "https://compound.law/assets/images/og-image.webp",
    "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.",
    "foundingDate": "2026",
    "founder": [
      {
        "@type": "Person",
        "name": "Marko Bradic",
        "jobTitle": "CEO",
        "url": "https://compound.law/en-DE/tech-team/marko-bradic/",
        "sameAs": [
          "https://www.linkedin.com/in/markobradic/"
        ],
        "knowsAbout": [
          "Product strategy and development",
          "Scaling technology companies",
          "FinTech and financial services",
          "AI-powered product innovation",
          "Business operations and growth",
          "Digital transformation"
        ]
      },
      {
        "@type": "Person",
        "name": "Mohit Tilwani",
        "jobTitle": "CTO",
        "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/",
        "sameAs": [
          "https://www.linkedin.com/in/mohit-tilwani/"
        ],
        "knowsAbout": [
          "Engineering leadership and architecture",
          "Scaling high-traffic systems",
          "AI and machine learning infrastructure",
          "FinTech platform development",
          "Cloud infrastructure and DevOps",
          "Product engineering"
        ]
      },
      {
        "@type": "Person",
        "name": "Julian Jantze",
        "jobTitle": "Rechtsanwalt",
        "url": "https://compound.law/en-DE/lawyers/julian-jantze/",
        "sameAs": [
          "https://www.linkedin.com/in/julian-jantze-957b95158/"
        ],
        "knowsAbout": [
          "Corporate law and corporate governance for technology companies",
          "Employment law and HR compliance",
          "EU AI Act compliance and AI governance",
          "Employee participation models (VSOP/ESOP)",
          "Regulatory compliance for tech companies",
          "Legal operations and Legal Tech implementation"
        ]
      }
    ],
    "employee": [
      {
        "@type": "Person",
        "name": "Marko Bradic",
        "jobTitle": "CEO",
        "url": "https://compound.law/en-DE/tech-team/marko-bradic/",
        "sameAs": [
          "https://www.linkedin.com/in/markobradic/"
        ],
        "knowsAbout": [
          "Product strategy and development",
          "Scaling technology companies",
          "FinTech and financial services",
          "AI-powered product innovation",
          "Business operations and growth",
          "Digital transformation"
        ]
      },
      {
        "@type": "Person",
        "name": "Mohit Tilwani",
        "jobTitle": "CTO",
        "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/",
        "sameAs": [
          "https://www.linkedin.com/in/mohit-tilwani/"
        ],
        "knowsAbout": [
          "Engineering leadership and architecture",
          "Scaling high-traffic systems",
          "AI and machine learning infrastructure",
          "FinTech platform development",
          "Cloud infrastructure and DevOps",
          "Product engineering"
        ]
      },
      {
        "@type": "Person",
        "name": "Julian Jantze",
        "jobTitle": "Rechtsanwalt",
        "url": "https://compound.law/en-DE/lawyers/julian-jantze/",
        "sameAs": [
          "https://www.linkedin.com/in/julian-jantze-957b95158/"
        ],
        "knowsAbout": [
          "Corporate law and corporate governance for technology companies",
          "Employment law and HR compliance",
          "EU AI Act compliance and AI governance",
          "Employee participation models (VSOP/ESOP)",
          "Regulatory compliance for tech companies",
          "Legal operations and Legal Tech implementation"
        ]
      },
      {
        "@type": "Person",
        "name": "Marc Schuba",
        "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)",
        "url": "https://compound.law/en-DE/lawyers/marc-schuba/",
        "sameAs": [
          "https://www.linkedin.com/in/marcschuba/"
        ],
        "knowsAbout": [
          "IP and IT law",
          "SaaS and IT contracts, IT outsourcing",
          "Software and open-source licensing",
          "Data protection law (GDPR)",
          "AI law and the EU AI Act"
        ]
      },
      {
        "@type": "Person",
        "name": "Dr. Markus Dreißigacker",
        "jobTitle": "Rechtsanwalt",
        "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/",
        "sameAs": [
          "https://www.linkedin.com/in/markusdreissigacker"
        ],
        "knowsAbout": [
          "M&A (Due diligence, post-merger integration, IPO readiness)",
          "Corporate Law (Governance, board work, restructuring)",
          "Commercial Law (Customer contracts, supplier agreements, NDAs)",
          "IP (Trademark management, IP transfer agreements)",
          "Compliance & ESG (Global compliance programs, human rights, sustainability)",
          "Data Protection (GDPR strategy, DPO experience, privacy programs)"
        ]
      },
      {
        "@type": "Person",
        "name": "Philipp Brandt",
        "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law",
        "url": "https://compound.law/en-DE/lawyers/philipp-brandt/",
        "sameAs": [
          "https://www.linkedin.com/in/philipp-brandt-81b446a/"
        ],
        "knowsAbout": [
          "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)",
          "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)",
          "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)",
          "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)"
        ]
      }
    ],
    "address": {
      "@type": "PostalAddress",
      "addressLocality": "Berlin",
      "addressCountry": "DE"
    },
    "areaServed": [
      "Germany",
      "Austria",
      "Switzerland",
      "European Union",
      "United Kingdom",
      "United States",
      "Singapore"
    ],
    "availableLanguage": [
      "de",
      "en"
    ],
    "serviceType": [
      "AI law firm",
      "AI-native legal services",
      "legal counsel for start-ups and growth companies",
      "legal counsel for mid-sized companies and corporates",
      "Commercial Law",
      "Corporate Law",
      "Employment Law",
      "Regulatory & Compliance",
      "Intellectual Property",
      "Insolvency & Restructuring"
    ],
    "hasOfferCatalog": {
      "@type": "OfferCatalog",
      "name": "Compound Law services",
      "itemListElement": [
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Commercial Contracts",
            "description": "Battle-tested contracts for your sales process",
            "serviceType": [
              "enterprise contracts",
              "MSA",
              "DPA",
              "sales contracts"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "International Employment",
            "description": "Compliant hiring across borders",
            "serviceType": [
              "international employment",
              "hiring abroad",
              "employment contracts"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "VSOP/ESOP Setup",
            "description": "Employee participation that actually works",
            "serviceType": [
              "VSOP",
              "ESOP",
              "employee stock options",
              "equity incentives"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Funding Round Support",
            "description": "Clean legal for your next raise",
            "serviceType": [
              "funding round",
              "term sheet",
              "SHA",
              "due diligence",
              "cap table"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Corporate Housekeeping",
            "description": "Get your legal house in order",
            "serviceType": [
              "corporate governance",
              "board resolutions",
              "shareholder register"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Data Protection & Privacy",
            "description": "GDPR compliance that doesn't slow you down",
            "serviceType": [
              "GDPR",
              "data protection",
              "privacy",
              "DPA",
              "cookies",
              "data breach response",
              "GDPR fines",
              "Art. 82 GDPR"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "AI Act Compliance",
            "description": "Navigate EU AI regulation",
            "serviceType": [
              "AI Act",
              "AI compliance",
              "AI governance",
              "EU AI regulation"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "IP & Competition",
            "description": "Protect and enforce what you've built",
            "serviceType": [
              "IP protection",
              "intellectual property",
              "trademarks",
              "trademark enforcement",
              "warning letters",
              "preliminary injunctions",
              "unfair competition",
              "software licensing",
              "open source compliance"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Fractional General Counsel",
            "description": "In-house legal without the full-time cost",
            "serviceType": [
              "fractional GC",
              "fractional general counsel",
              "outsourced legal",
              "legal retainer"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "FinTech Compliance",
            "description": "Navigate financial regulation",
            "serviceType": [
              "fintech compliance",
              "BaFin",
              "banking regulation",
              "AML",
              "KYC"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Legal Retainer",
            "description": "Predictable legal support when you need it",
            "serviceType": [
              "legal retainer",
              "legal subscription",
              "ongoing legal support"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "M&A Preparation",
            "description": "Get ready for acquisition interest",
            "serviceType": [
              "M&A preparation",
              "acquisition",
              "due diligence",
              "exit"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Restructuring & Insolvency",
            "description": "From the first liquidity check to the restructuring itself",
            "serviceType": [
              "restructuring",
              "insolvency",
              "StaRUG",
              "self-administration",
              "insolvency plan",
              "director liability"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        }
      ]
    },
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "sales",
      "email": "contact@compound.law",
      "availableLanguage": [
        "English",
        "German"
      ],
      "areaServed": [
        "DE",
        "AT",
        "CH",
        "EU",
        "GB",
        "US",
        "SG"
      ]
    },
    "email": "contact@compound.law",
    "sameAs": [
      "https://www.linkedin.com/company/compoundlawfirm",
      "https://x.com/CompoundLawFirm"
    ],
    "knowsAbout": [
      "Commercial Contracts",
      "enterprise contracts",
      "MSA",
      "DPA",
      "sales contracts",
      "International Employment",
      "international employment",
      "hiring abroad",
      "employment contracts",
      "VSOP/ESOP Setup",
      "VSOP",
      "ESOP",
      "employee stock options",
      "equity incentives",
      "Funding Round Support",
      "funding round",
      "term sheet",
      "SHA",
      "due diligence",
      "cap table",
      "Corporate Housekeeping",
      "corporate governance",
      "board resolutions",
      "shareholder register",
      "Data Protection & Privacy",
      "GDPR",
      "data protection",
      "privacy",
      "cookies",
      "data breach response",
      "GDPR fines",
      "Art. 82 GDPR",
      "AI Act Compliance",
      "AI Act",
      "AI compliance",
      "AI governance",
      "EU AI regulation",
      "IP & Competition",
      "IP protection",
      "intellectual property",
      "trademarks",
      "trademark enforcement",
      "warning letters",
      "preliminary injunctions",
      "unfair competition",
      "software licensing",
      "open source compliance",
      "Fractional General Counsel",
      "fractional GC",
      "fractional general counsel",
      "outsourced legal",
      "legal retainer",
      "FinTech Compliance",
      "fintech compliance",
      "BaFin",
      "banking regulation",
      "AML",
      "KYC",
      "Legal Retainer",
      "legal subscription",
      "ongoing legal support",
      "M&A Preparation",
      "M&A preparation",
      "acquisition",
      "exit",
      "Restructuring & Insolvency",
      "restructuring",
      "insolvency",
      "StaRUG",
      "self-administration",
      "insolvency plan",
      "director liability"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://compound.law/en-DE/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Trust Center",
        "item": "https://compound.law/en-DE/trust-center/"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "Is Compound Law GDPR compliant?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Our Privacy Policy explains what we collect, the legal basis, and why."
        }
      },
      {
        "@type": "Question",
        "name": "Where is our data stored?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Our infrastructure runs on Hetzner servers located in Germany and on Cloudflare’s platform (Workers and the D1 database) within the European Union. Personal data is stored in the EU."
        }
      },
      {
        "@type": "Question",
        "name": "Do you transfer personal data outside the EU?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "No. Our hosting and database are located in Germany and the EU, so personal data is not transferred to third countries in the ordinary course of running our website and services."
        }
      },
      {
        "@type": "Question",
        "name": "Who are your subprocessors?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "The vendors that may process personal data on our behalf are listed in the Subprocessors section above. We keep this list current and review each vendor’s data-protection posture."
        }
      },
      {
        "@type": "Question",
        "name": "Is Compound Law a data controller or a data processor?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "When we provide legal advice we act as an independent data controller under our own professional and statutory duties — not as a processor acting on a client’s instructions. For that reason we do not enter into a data processing agreement (DPA) for our legal services."
        }
      },
      {
        "@type": "Question",
        "name": "How do you protect client confidentiality?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Client information is protected by attorney-client confidentiality (§ 43a BRAO, § 203 StGB) in addition to GDPR. We apply appropriate technical and organisational measures to keep that data secure."
        }
      },
      {
        "@type": "Question",
        "name": "How can I exercise my data subject rights?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Contact us using the address in the Contact section below. We respond to access, rectification, erasure and other requests within the statutory timeframe, subject to our legal retention and confidentiality obligations."
        }
      },
      {
        "@type": "Question",
        "name": "How do you handle data breaches?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Where a breach is likely to result in a risk to data subjects, we notify the competent supervisory authority within 72 hours and affected individuals without undue delay, as required by Articles 33 and 34 GDPR."
        }
      }
    ]
  }
]
```