Data protection
1. General Information
Introduction
We appreciate your interest in our website. Protecting your personal data is important to us. Below, we explain what data we process when you visit our website, for what purpose this is done, and what rights you have in this regard.
Data processing is always carried out in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection regulations (in particular the BDSG and TDDDG). In general, our website can be used without providing personal data; however, certain functions—such as contacting us—require data processing. If there is no legal basis for this, we will obtain your consent.
Person responsible
The controller within the meaning of the GDPR is:
Schoppe, Zimmermann, Stöckeler, Zinkler, Schenk & Partner mbB
Patent Attorneys
Radlkoferstr. 2
81373 Munich, Germany
Data Protection Officer
If you have any questions or suggestions regarding data protection, you can contact our Data Protection Officer as follows:
Stephan Krischke, datenschutzbeauftragte@schoppe-zimmermann.com
Definitions
This Privacy Policy uses the terms of the GDPR, including “personal data,” “processing,” “controller,” “processor,” and “consent,” as legally defined in Article 4 of the GDPR. A detailed explanation of these terms can be found in the text of the GDPR.
Your Rights as a Data Subject
Subject to the statutory requirements, you have the following rights: the right to access the personal data stored about you (Art. 15 GDPR), the right to rectification of inaccurate data (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object to processing based on a balancing of interests, in particular to processing for direct marketing purposes (Art. 21 GDPR). You may revoke any consent you have given at any time with future effect.
In addition, you have the right to file a complaint with a data protection supervisory authority.
Legal Basis for Processing
We process personal data on the following legal bases: with your consent (Art. 6(1)(a) GDPR in conjunction with § 25 TDDDG), to fulfill or enter into a contract or employment relationship (Art. 6(1)(b) GDPR, § 26 of the BDSG), to comply with legal obligations (Art. 6(1)(c) of the GDPR), and to protect legitimate interests (Art. 6(1)(f) of the GDPR), provided that your interests do not override these in individual cases.
Our services are intended for adults. Persons under the age of 16 may not provide us with any personal information without the consent of their legal guardians.
Disclosure of Data to Third Parties
Your data will only be disclosed to third parties to the extent permitted by law, if you have given your consent, if it is necessary for the performance of a contract, or if we have a legitimate interest in doing so. In connection with the services described below, data may also be transferred to countries outside the EU/EEA, in particular to the United States. To the extent possible, we base such transfers on an adequacy decision by the European Commission (e.g., the EU-U.S. Data Privacy Framework) or on EU Standard Contractual Clauses pursuant to Article 46 of the GDPR.
Retention Period and Deletion
We store personal data only for as long as is necessary for the respective purpose of processing or as required by statutory retention obligations. If the purpose of storage no longer applies or a statutory retention period expires, the relevant data is routinely deleted or blocked. For client files and case files, the retention periods under professional, commercial, and tax law apply.
2. Technology
Hosting and Website Platform (Squarespace)
Our website is created and operated using the Squarespace platform. The provider is Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland (parent company: Squarespace, Inc., 225 Varick Street, New York, NY 10014, USA). When you visit our website, your data (including your IP address in server log files) is processed on Squarespace’s servers; in the process, data may also be transferred to the United States.
Squarespace uses cookies and similar storage technologies for technical operations and to measure reach, including to recognize visits (ss_cvr, ss_cvt), to protect forms from unauthorized access (crumb), and to store your cookie preferences (ss_marketingCookiesAllowed, ss_performanceCookiesAllowed).
The legal basis is our legitimate interest in providing our website in a reliable, secure, and high-performance manner (Art. 6(1)(f) GDPR) or, to the extent that cookies are set that are not necessary for this purpose, your consent (Art. 6(1)(a) GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Article 45 of the GDPR is in place.
For more information: https://de.squarespace.com/datenschutz
Hosting and Website Builder (Onepage)
Our career portal is created and operated using the Onepage website builder. The provider is Onepage GmbH, Hanauer Landstraße 172, 60314 Frankfurt am Main, Germany. Content is delivered via the Google Cloud Platform infrastructure; according to the latest audit, the server is located in Germany. The provider of the cloud infrastructure is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
When you visit our career portal, your data (including your IP address in server log files) is processed on these servers.
The legal basis is our legitimate interest in providing our career portal in a reliable, secure, and high-performance manner (Art. 6(1)(f) of the GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR is in place.
For more information: https://onepage.io/documents/Onepage_GmbH_Data_Privacy_Information_Sep_2025_EN.pdf
Content Delivery Network (Cloudflare)
Our website is backed by Cloudflare’s Content Delivery Network, which speeds up the delivery of our content and protects the website from automated attacks. The provider is Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C – 8th Floor, 81671 Munich, Germany (parent company: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). This involves the processing of technical connection data, such as your IP address, as well as browser and device information; based on the current configuration, content is delivered via a server location in Canada.
The legal basis is our legitimate interest in ensuring the high performance and security of our website (Art. 6(1)(f) of the GDPR). For Canada, the European Commission has issued an adequacy decision pursuant to Art. 45 of the GDPR; in addition, the service provider is certified under the EU-U.S. Data Privacy Framework.
For more information: https://www.cloudflare.com/de-de/privacypolicy/
Server Log Files
Every time you visit our website or our career portal, data transmitted by your browser is automatically collected: browser type and version, operating system used, referrer URL, subpages accessed, date and time of access, and IP address. This data is used to ensure the website functions properly and is secure, as well as, if necessary, to facilitate criminal prosecution in the event of a cyberattack. This data cannot be used to identify you personally; the log file data is stored separately from other data.
The legal basis is our legitimate interest in system security and stability (Art. 6(1)(f) of the GDPR).
Cookies and Consent Management
Cookies are small files that your browser stores on your device; similar technologies include local and session storage. We use technically necessary cookies to enable our website to function, as well as—with your consent—additional cookies and services.
To obtain and document your consent, we use the cookie banner integrated into our website platform (for the provider, see above, “Hosting and Website Platform (Squarespace)” and “Hosting and Website Builder (Onepage)”). Your decision in this regard is stored in cookies on your device (ss_marketingCookiesAllowed, ss_performanceCookiesAllowed; each with a retention period of approximately 30 days).
The legal basis for technically necessary cookies is Article 6(1)(f) of the GDPR; for all other cookies, it is your consent pursuant to Article 6(1)(a) of the GDPR. The consent itself is obtained to fulfill our legal obligation under Article 7 of the GDPR in conjunction with Section 25 of the TDDDG. You may revoke your consent at any time with future effect via the cookie banner.
You can also delete cookies or restrict their storage at any time through your browser settings (for example, via the help pages for Chrome, Safari, Firefox, or Microsoft Edge).
Error Analysis (Sentry)
To detect and resolve technical errors on our website, we use the Sentry service via our website platform. The provider is Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. If an error occurs, technical information regarding the time of the error is transmitted, including your IP address, the page you visited, and browser and device information; in addition, information is stored in your device’s web storage.
The legal basis is our legitimate interest in the error-free and secure operation of our website (Art. 6(1)(f) of the GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR is in place.
For more information: https://sentry.io/privacy/
3. Additional Content
Contact Us
If you contact us by email, phone, fax, or through a form on our website, we will process the information you provide (e.g., name, contact information, inquiry) solely for the purpose of handling your request.
The legal basis is our legitimate interest in responding to your inquiry (Art. 6(1)(f) GDPR) or, if your inquiry is aimed at initiating a client relationship, Art. 6(1)(b) GDPR. Your data will be deleted as soon as your inquiry has been fully processed and there are no legal or professional retention requirements that prevent this.
Job Postings and Applications (softgarden)
We display our job openings using an embedded widget from the softgarden applicant tracking system. The provider is softgarden e-recruiting GmbH, Tauentzienstraße 14, 10789 Berlin, Germany. As soon as you visit the page, a connection is established with softgarden’s servers, during which, among other things, your IP address is transmitted and a cookie is set.
When you click on a job posting, you will be directed to softgarden’s application portal. There, you will enter the information required for your application and upload your application documents. These documents typically contain additional personal data and, in some cases, may also include special categories of personal data as defined in Article 9 of the GDPR (e.g., information regarding a severe disability). According to the provider, the data is stored exclusively in data centers in Germany.
The legal basis for the processing of your application data is Article 6(1)(b) of the GDPR in conjunction with Section 26(1) of the BDSG. According to these provisions, the processing of data necessary in connection with the decision to establish an employment relationship is permitted. If special categories of personal data within the meaning of Article 9 of the GDPR are processed, the legal basis is Section 26(3) of the BDSG or Article 9(2)(b) of the GDPR. The legal basis for loading the widget on our career portal is your consent pursuant to Article 6(1)(a) of the GDPR.
If your application is rejected, your application data will be deleted or anonymized after 6 months. If you would like to be considered for our applicant pool beyond that, this will only occur based on your separate consent pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 26(2) of the BDSG.
For more information: https://softgarden.com/de/datenschutz-software-und-service/
If you submit your application to us via email, we will process your information solely for the purpose of conducting the application process. The legal basis is Article 6(1)(b) of the GDPR in conjunction with Section 26(1) of the BDSG; if special categories of personal data within the meaning of Article 9 of the GDPR are processed (e.g., information regarding a severe disability), the legal basis is Section 26(3) of the BDSG or Article 9(2)(b) of the GDPR. If your application is rejected, your data will be deleted after 6 months; if you have consented to further storage, we will transfer your data to our applicant pool, where it will be deleted after 24 months.
4. Plug-ins and Services
Multilingualism (Weglot)
We use the Weglot translation service for the multilingual version of our website. The provider is Weglot SAS, 7 Cité Paradis, 75010 Paris, France. When you visit our pages, a connection is established to Weglot’s servers, during which your IP address and information about the page you visited, among other things, are processed. According to the provider, the data is hosted on servers within the European Union.
The legal basis is your consent (Art. 6(1)(a) of the GDPR).
For more information: https://www.weglot.com/privacy
Adobe Fonts
To ensure consistent font display, we use the Adobe Fonts service (formerly Typekit). The provider is Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Park, Dublin 24, Ireland (parent company: Adobe Inc., 345 Park Avenue, San Jose, CA 95110, USA). When you visit our website, a connection is established to Adobe’s servers, and your IP address, among other things, is transmitted.
The legal basis is your consent (Art. 6(1)(a) of the GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR is in place.
For more information: https://www.adobe.com/de/privacy/policy.html
Google Fonts
On some pages, we also use the Google Fonts service to display fonts. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a company of the Google Group (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). When you visit these pages, a connection is established with Google’s servers, and your IP address is transmitted in the process.
The legal basis is your consent (Art. 6(1)(a) of the GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR is in place.
For more information: https://policies.google.com/privacy?hl=de
Google Maps
We use Google Maps to display our location. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a company of the Google Group (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). When you visit a page with an embedded map, a connection is established to Google’s servers, and your IP address, among other things, is transmitted—this can occur as soon as the page loads, even without any interaction with the map.
The legal basis is your consent (Art. 6(1)(a) of the GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR is in place.
For more information: https://policies.google.com/privacy?hl=de
Google reCAPTCHA
To protect our forms from unauthorized automated access (bots), we use the Google reCAPTCHA service on certain pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a company of the Google Group (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). In the process, your IP address, as well as browser and device information, are collected and transmitted to Google.
The legal basis is your consent (Art. 6(1)(a) of the GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR is in place.
For more information: https://policies.google.com/privacy?hl=de
Vimeo
On our career portal, we embed videos from the Vimeo platform in which our law firm and our employees introduce themselves. The provider is Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA; and the European Data Protection Office (EDPO) SRL, located at Avenue Huart Hamoir 71, 1030 Brussels, Belgium, has been designated as its representative in the EU. When you visit a page with an embedded video, a connection is established to Vimeo’s servers, during which, among other things, your IP address is transmitted and a number of cookies and storage values are set (including vuid, player, and __cf_bm).
The legal basis is your consent (Art. 6(1)(a) of the GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR is in place.
For more information: https://vimeo.com/privacy
Meta-pixel
On our career portal, we use the Meta Pixel to measure the success of our job postings on Meta’s networks and to target interested candidates. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (parent company: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA). This involves the use of cookies and similar technologies (including _fbp and local storage entries), and information about your usage behavior is transmitted to Meta.
With regard to the collection and transmission of this data, we are jointly responsible with Meta for the processing within the meaning of Article 26 of the GDPR. Any further processing by Meta is carried out under Meta’s sole responsibility.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you may revoke at any time with future effect via the cookie banner. The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place.
For more information: https://www.facebook.com/privacy/policy/
5. Social Media Presence
In addition to our career portal, we maintain our own pages on social media to showcase our law firm as an employer and connect with interested individuals. These pages are hosted on the infrastructure of the respective social media platform; we have only limited influence over how that platform processes data.
When you visit one of our pages, the respective provider processes your data regardless of whether you have an account there, and regularly uses cookies and similar technologies to do so. If you are logged into your account during your visit, the provider can associate your visit with your profile and combine the data with other information it has stored.
We do not share any data about you with the providers ourselves. If you contact us through one of our pages or post a comment there, we process the information visible in that context in order to respond to your inquiry. In addition, we receive aggregated statistics from the providers regarding the use of our pages. We are jointly responsible with the respective provider for the collection of this statistical data within the meaning of Article 26 of the GDPR; further processing by the provider is carried out under the provider’s own responsibility. You may exercise your rights as a data subject both with us and with the respective provider.
The legal basis for operating our website and analyzing statistics is our legitimate interest in maintaining a modern public image and in recruiting young talent and skilled professionals (Art. 6(1)(f) of the GDPR). If the provider also uses cookies for its own purposes, it does so based on the consent it has obtained from you.
We maintain a page on Facebook. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (parent company: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA). When you visit our page, Meta processes, among other things, your IP address, information about your device, and your usage behavior to compile reach statistics and display advertisements.
The Page Insights provided to us are based on a shared responsibility with Meta; the division of responsibilities is governed by Meta’s Supplement to the Page Insights Responsibility Statement. We cannot fully determine what additional data Meta processes for its own purposes.
The legal basis is our legitimate interest in corporate image and recruitment (Art. 6(1)(f) of the GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR is in place.
For more information: https://www.facebook.com/privacy/policy/
We maintain a company page on LinkedIn. LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (parent company: LinkedIn Corporation, 1000 W Maude Avenue, Sunnyvale, CA 94085, USA) is responsible for users in the European Economic Area. When you visit our page, LinkedIn processes, among other things, your IP address, information about your device, and your usage behavior.
We share responsibility with LinkedIn for collecting the data that LinkedIn provides to us as page analytics. We receive these analytics exclusively in aggregated form, so we cannot draw any conclusions about individual persons from them.
The legal basis is our legitimate interest in corporate image and recruitment (Art. 6(1)(f) of the GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR is in place.
For more information: https://de.linkedin.com/legal/privacy-policy/