Privacy Policy

pursuant to Articles 12 and 13 GDPR and Section 13 TMG


We at Kapellmann und Partner Rechtsanwälte mbB take the protection and privacy of the users of our websites very seriously. For us, the responsible and confidential treatment of personal data goes without saying. We undertake to process your personal data only in accordance with the German and European data protection laws currently in force, in particular the European General Data Protection Regulation (“GDPR”). In this privacy policy, we explain which personal data we collect on our websites and how that data is used.


Our privacy statement is regularly updated in accordance with the relevant legal and technical requirements. Please refer to the latest version of our privacy statement.


Scope of this privacy statement


The data protection provisions set out below apply only to the websites of Kapellmann und Partner Rechtsanwälte mbB, namely,, and their subpages. They do not apply to other websites or online products and services to which you may be directed from our website via a link. We are not responsible for any data processing involved in using these external websites.


For an explanation of the terms used herein (e.g. “processing” or “controller”), we refer you to the Definitions in Article 4 GDPR.


1. Contact details of the controller responsible for the processing of personal data and of the firm’s data protection officer(s)


The controller as defined in Article 4(7) GDPR and the service provider within the meaning of Section 13 of the German Telemedia Act (Telemediengesetz or TMG) is:


Kapellmann und Partner Rechtsanwälte mbB (hereinafter: Kapellmann),
Viersener Strasse 16,
D-41061 Mönchengladbach
Email: mg[@]
Tel: +49 2161 811-8
Fax: +49 2161 811-777


You can contact our firm’s data protection officer at datenschutz[@] or by writing to our postal address, “Attention: Data Protection Officer”.


2. Nature, purpose and legal basis of the personal data processed


We process your personal data for different reasons when you use our websites depending on the kind of applications, services and contact options made available on our websites.


Personal data thus means any information relating to an identified or identifiable natural person (“data subject”). Personal data includes, for example, your name, address, email address, and where applicable, IP address or user behaviour.


a) Visiting our websites


In the case of a purely informational use of our websites, i.e. by simply visiting the websites or, information is automatically sent (for unavoidable technical reasons) by the browser used on your terminal device to our website server. This information is stored temporarily in a log file. This means that, without any other action on your part, the following information is collected and stored until deleted automatically:


  • IP address of the computer requesting access
  • date and time of access
  • name and URL of the retrieved file
  • website from which access was initiated (referrer URL)
  • browser used and operating system of your computer where applicable
  • name of the host of the IP address and of your access provider.


We process this data for the following purposes:


  • to ensure that the website connection is smoothly established;
  • to ensure that our website is user-friendly;
  • to evaluate system security and stability; and
  • for other administrative purposes (e.g. risk prevention and support with connection problems).


For the purpose of the data processing described above, we have hired an external service provider, the firm of M. Balluff EDV-Dienstleistungen, Hebewerkstrasse 60, 44581 Castrop-Rauxel, to take care of hosting and support services. This firm will be able to access this data during its work for us (and are thus a “processor”).


For security reasons (e.g. if we need to investigate improper uses or attacks on our web server), this information is stored for a maximum of 30 days. After that it is erased.


The legal basis for the processing of this data is derived from Article 6(1)(f) GDPR and Section 15(1), sentence 1 TMG. Our legitimate interest is based on the data processing purposes listed above. Under no circumstances do we use the collected data to draw conclusions about you as an individual.


We also use the analytical service Google Analytics for visits to our website. You can find more details about this in section 3 of this privacy policy.


b) Registering for our newsletters


On our websites, we offer you the possibility of registering to receive our newsletters. We use our newsletters to inform you about current legal developments and issues (e.g. recent court decisions and legislative amendments), news about the firm’s legal practice and planned events, and to publish specialist articles.


To receive the newsletter you only need to provide an email address. If you so wish, you may also provide us with your title, name and company to allow us to address you personally in the newsletter.


If you have provided your personal data to us via the registration form on our websites or by email to newsletter[@] in order to receive our newsletter, we will process your data only for the purpose of sending our newsletter. Your data may be saved in a customer relationship management system (“CRM System”) or similar inquiry system in order to administer your contact details. Your data is not processed for other purposes.


The newsletter is sent via the mailing service of the firm episerver GmbH, Wallstrasse 16, 10179 Berlin. Your data has been sent to this firm for this purpose under a contractual processing arrangement.


We therefore collect and process the personal data you provide to us via the registration form or by email solely based on your consent. The legal basis for this is Article 6(1)(a) and Article 7 GDPR.


You have the right to withdraw your consent at any time at no cost. This can be done by using the unsubscribe link at the end of every newsletter. Alternatively, you can email your wish to cancel the subscription at any time to newsletter[@] or by writing to the postal address given in section 1.


Your withdrawal will mean the erasure of the data we have collected except for the data we may need to ensure that you do not receive any more newsletters. Your withdrawal does not affect the lawfulness of the consent-based processing up until the time of your withdrawal.


c) Email contact


On our website we provide you with the option of requesting certain information or offers by email. From time to time we also publish information on our websites about the possibility of requesting brochures and material about issues in the field of legal and corporate practice by email. In addition, on our websites we offer the possibility of registering by email for the events we are organising.


If you contact us in this connection, we will collect and use only the personal data you provide us with which we need to process, answer and deal with your request. This generally means your name, your company name where applicable, your email address, your address if relevant and – if you are registering for an event – the position and business telephone number of the participant.


The legal basis for this data processing is Article 6(1)(b) GDPR in the event that the initiation and possible execution of a contract is involved. Otherwise the legal basis is Article 6(1)(f) GDPR; our legitimate interest consists in replying to and dealing with your request, which is why we need the stored data.


The personal data we collect and store will not be used for other purposes without your consent and will be erased once your request has been dealt with, unless the data has to be kept for a longer period of time to comply with any statutory information-keeping obligations.


d) Using the services “Kapellmann Online Schlichtung” (online mediation) and “Kapellmann Sofort Expertise” (immediate expertise)


When you use our online services Kapellmann Online Schlichtung and Kapellmann Sofort Expertise, personal data which we need to carry out your request are collected through forms and processed. These include the name and contact details of the contact person, company name and address, and the details of the assignment (e.g. project description, client, subject on which advice is sought).


The data is processed only for the purpose of dealing with the assignment you have engaged us for and in accordance with Article 6(1)(b) GDPR only to the extent that this is required to perform the contract. The data is not used for other purposes.


Once our engagement is complete, the data is erased unless it has to be kept to comply with professional or other statutory information-keeping obligations. In particular, case files are kept for a period of six years after the end of the assignment pursuant to Section 50(1), sentence 2 of the German Federal Lawyers’ Act (Bundesrechtsanwaltsordnung or BRAO).


e) Using the Kapellmann procurement management platform


When downloading procurement documents on our procurement management platform, you have the option of entering your contact details in an online form (title, name, company name, email address).


The data is not necessary to download the documents. However, we need this information to be able to inform you of any new developments regarding the procurement procedures. This data is used solely for this purpose and is erased as soon as any statutory information-keeping obligations cease to apply (usually three years under Section 8(4) of the German Regulation on the Award of Public Contracts (Vergabeverordnung or VGV)).


In accordance with Article 6(1)(a) GDPR, data processed for the purpose of the information in the procurement procedure is done so based on your freely granted consent.


You have the right to withdraw your consent at any time at no cost. To this end, you can email your wish to cancel your registration at any time to vergabemanagement-intern[@] or by writing to the postal address given in section 1.


Your withdrawal will mean the erasure of the data we have collected except for any data we may need to ensure that we no longer inform you of new developments about the relevant procurement procedures. Your withdrawal does not affect the lawfulness of the consent-based processing up until the time of your withdrawal.


3. Google Analytics


We use Google Analytics on our websites. This is a web analysis service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).


a) Purpose, type and working method


The use of Google Analytics means that pseudonymised use profiles are created and cookies are used. Cookies are small text files automatically created by your browser and stored on your terminal (e.g. laptop, tablet, smartphone) when you visit our websites. The use of cookies generates certain types of information which allow analysis of your use of the website. This information includes


  • browser type/version
  • operating system
  • referrer URL (the website visited before ours)
  • host name of the accessing computer (IP address)
  • time of server request


The reason for using Google Analytics is to be able to analyse the use of our websites so that we can ensure that the layout responds to user needs and so that we can enhance the sites continually. Based on the statistics obtained from this, we can improve the sites we offer and make them more interesting to our users.


The information about your use of our website generated by cookies is usually transmitted to a Google server in the United States and stored there. This website uses Google Analytics to this end with the IP anonymisation “_anonymizeIp()”. This means that your IP address is processed in abbreviated form, excluding the possibility that you can be identified. Where the data collected about you is assigned a personal reference, this reference is therefore immediately excluded and the personal data promptly erased. Your IP address is usually abbreviated by Google within the Member States of the European Union or another contracting state to the Agreement on the European Economic Area prior to its transmission to the United States. Only in exceptional cases is the complete IP address sent to a Google server in the United States and abbreviated there. For the exceptional cases in which personal data is sent to the United States, Google has agreed to abide by the EU-US Privacy Shield:


Google uses the information generated by cookies on our behalf in order to evaluate your use of our website, to compile reports for us about website activity and to provide us with other services related to website use and internet activity.


The information gathered by Google Analytics is stored for up to 14 months. Erasure of data that has reached the retention limit is performed automatically once a month. The IP address transmitted from your browser by Google Analytics is not combined with other data held by Google.


b) Legal basis


The use of Google Analytics is based on Section 15(3) TMG and Article 6(1)(f) GDPR. Our legitimate interest consists in ensuring that the layout of our website meets user needs and in allowing us to enhance it continually. We also have a legitimate interest in collecting statistical information about the use of our website and in order to enhance the services we offer to you. These interests qualify as legitimate within the meaning of Article 6(1)(f) GDPR.


c) Objection, blocking and deletion

You may object to the use of Google Analytics at any time by preventing the installation of cookies in the settings of your browser software. This means that in principle you can configure your internet browser so as to prevent the storage of cookies on your terminal device altogether or so that you are asked, on each such occasion, whether you agree with the use of cookies. You can also delete cookies at any time even after they have been created.

You can find detailed information about exactly how all this works in your browser’s Help function or for the most common browsers at the following links:

Mozilla Firefox
Microsoft Internet Explorer
Google Chrome
Apple Safari 6/7

Please note that the general blocking of cookies may lead to limitations to the functionality of our website.

You can also prevent the capture of data generated by the cookie that refers to your use of the website (including your IP address) as well as the processing of this data by Google by downloading and installing a browser add-on (

As an alternative to the browser add-on, particularly for browsers in mobile devices, you can prevent the collection of information by Google Analytics by clicking on this link: - JavaScript has to be activated. - block Google Analytics. This sets up an opt-out cookie preventing the future capture of your data when visiting this website. The opt-out cookie applies only to this browser and only to our website and is downloaded to your device. If you delete the cookies in this browser, you will have to set up the opt-out cookie again.

You can find further information about data protection in connection with Google Analytics in the Google Analytics Help page (


d) Recipients, use by Google


The recipient of the information is the third-party provider Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.
Click here for the Terms of Service of Google Analytics. Click here for the data privacy and security principles of Google Analytics. Click here for the privacy statement of Google.


4. Social media share buttons


In our News section, we provide you with the option of sharing specific news items using the social media services Facebook, Xing, Google+, LinkedIn und Twitter by clicking on a share button.


We deliberately do not use the plug-ins offered by these services, but instead employ a plug-in developed specifically for our website. This means that data is not sent to the servers of social media services just by visiting our website. Not until you click on one of the social media logos to share an item on our website is a connection established between your browser and the server of the relevant social media service. We do not collect any personal data on our websites through use of the plug-in and therefore neither do we transmit any data to social media services.


Each provider of social media services is responsible for ensuring that their operation is in compliance with data protection legislation. You can find further information in their respective privacy statements:




5. Sharing of data


We will only disclose your personal data to other individuals, companies or bodies if


  • you have given your explicit consent in a specific situation pursuant to Article 6(1)(a) GDPR;
  • sharing the information is necessary under Article 6(1)(f) GDPR for the establishment, exercise or defence of legal claims and there is no reason to believe that you have an overriding legitimate interest in your data not being shared;
  • there is a statutory obligation to share the information under Article 6(1)(c) GDPR; and
  • this is required under Article 6(1)(b) GDPR for the implementation of contractual relationships with you (e.g. where transmission of the data to a payment service provider is necessary to perform the contract); or
  • based on our legitimate interests under Article 6(1)(f) GDPR (e.g. a tax advisor, in the use of external service providers).


In addition to the service providers already mentioned in sections 2(a), 2(b) and 3, at the present time we have also hired the advertising agency EGGERT GROUP GmbH & Co. KG, Steinstrasse 4, 40212 Düsseldorf, to deal with the content management and support services relating to the design of our website. Where necessary to ensure the performance of their services, EGGERT GROUP may have access to the personal data of users of our online services as previously described.


Any external service providers we hire to deal with the processing of data in relation to a processing contract are engaged on the basis of the provisions of Article 28 GDPR and strictly subject to our instructions.


6. Rights of data subjects


You have the following rights in connection with the processing of your personal data under the GDPR:


  • Under Article 15 GDPR, you may obtain at any time information about any personal data of yours we process. In particular, you may obtain information about the purpose of the processing, the categories of personal data, the categories of recipients to whom the personal data has been or will be disclosed, the envisaged storage period, the existence of the right of rectification, erasure or restriction of processing of personal data or of objection, the right to lodge a complaint, the source of the data when not collected by us, and the existence of automated decision-making, including profiling, and meaningful information about the logic involved.

    Your right of information includes the right to obtain a copy of your personal data. We generally provide data copies in electronic form unless you have indicated otherwise. The first copy is provided at no cost to you, while a reasonable fee may be charged for additional copies. The information is provided subject to the rights and freedoms of others who may be affected by the transmission of the data copy. In addition, the limitations on your right of information pursuant to Section 34 of the German Federal Data Protection Act (Bundesdatenschutzgesetz or BDSG) must be observed.
  • Under Article 16 GDPR, you may obtain without undue delay the rectification of inaccurate personal data concerning you or the completion of personal data we store about you.
  • Under Article 17 GDPR, you may obtain the erasure of personal data we store about you, unless the processing is required to exercise the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims. The right of erasure is subject to certain restrictions under the requirements of Section 35 BDSG.
  • Under Article 18 GDPR, you may request the restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose erasure of the data and we no longer need the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR.
  • Under Article 20 GDPR, you have the right to obtain the personal data which you have provided to us in a structured, commonly used and machine-readable format, or, where technically feasible, to request the transmission directly to another controller (right to portability). This right is subject to restrictions in Article 20(3) and (4) GDPR.
  • Under Article 7(3) GDPR, you have the right to withdraw your consent at any time. This means that in the future we will no longer be allowed to continue the consent-based processing of this data.
  • Where your personal data is processed based on legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right to object to the processing of your personal data under Article 21 GDPR where there are grounds relating to your particular situation or because the objection is against the use of your data for direct marketing purposes. In the latter case, you have a general right of objection, which we will implement without you having to indicate a particular situation. In the former case, namely an objection to the processing of your personal data based on Article 6(1)(f) GDPR, we are obliged to cease processing your data unless this processing is necessary on overriding, compelling and legitimate grounds or for the establishment, exercise or defence of legal claims. The right of objection is subject to the restrictions of Section 36 BDSG.

If you would like to exercise any of these rights, simply send an email to datenschutz[@] or write to our postal address given in section 1, “Attention: Data Protection Officer”.


7. Right of complaint


If you consider that our processing of your personal data infringes data protection laws, you also have the right to lodge a complaint with the competent supervisory authority pursuant to Article 77 GDPR. In North Rhine-Westphalia, the competent supervisory authority is the Office for Data Protection and Freedom of Information of the State of North Rhine-Westphalia, which can be contacted at the following address:


Landesbeauftragte für Datenschutz und Informationsfreiheit
(Office for Data Protection and Freedom of Information)
North Rhine-Westphalia
PO box 200444
40102 Düsseldorf


Tel: 0211/38424-0
Fax: 0211/38424-10
Email: poststelle[@]


8. Data security
During your visit to our website, we employ the standard SSL procedure (secure socket layer) in combination with the highest encryption level supported by your browser. This usually means a 256-bit encryption. If your browser does not support a 256 bit encryption, we will instead use 128-bit v3 technology. You can tell whether a particular page of our online presence is being sent in encrypted form from the closed appearance of the key or padlock symbol in the address bar of your browser.


We also take appropriate technical and organisational security measures to protect your data from accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties. Our security measures are constantly improved in line with technological developments.


9. Current status and changes to this privacy statement


This privacy statement is valid at the present time and is dated May 2018.


It may prove necessary to make changes to this privacy statement as our website and online services evolve or because of amended statutory provisions or official requirements. You can download and print out the current version of this privacy statement from the website at any time at