Back to home

Privacy Policy

Last updated: 25 September 2026

This is a translation of the German original for your convenience. In case of discrepancies, the German version at czirnich.de/datenschutz prevails.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Christian Czirnich, Attorney at Law (Rechtsanwalt) Hubertusstr. 8a, 85614 Kirchseeon, Germany Telephone: +49 8091 617 7777 E-mail: anwalt@czirnich.de

Please direct any data protection enquiries to the address above. No data protection officer has been appointed; the statutory conditions requiring such an appointment are not met.

2. General information

I process personal data of users of this website only where this is necessary to provide a functional website and my content, or where you actively submit data to me, for example via the enquiry form. For each processing operation, the sections below state which data are concerned, for what purpose they are processed, on what legal basis, and for how long they are stored.

This website is largely implemented as a static site without a database. Server-side processing takes place only when you submit the enquiry form (section 8).

3. Hosting and e-mail

This website runs on a dedicated virtual server of OVH GmbH, Oskar-Jäger-Straße 173/K6, 50825 Köln, Germany. The server is located in a data centre in Germany. Personal data collected when you visit this website are processed on this server. This concerns in particular the technical access data described in section 4, such as your IP address, and the details and files submitted via the enquiry form and the message box until I retrieve them. On the server they are stored only in encrypted form; only I can decrypt them.

The law office’s e-mails, including the acknowledgements sent by this website, run through the mail server of WildCat Media, proprietor Thomas Albrecht, Katharina-Fischer-Platz 1, 85435 Erding, Germany (www.wildcat.media, service SecureHost).

The legal basis is my legitimate interest in the secure and efficient provision of this website pursuant to Art. 6(1)(f) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with both providers. The e-mail provider is additionally bound to confidentiality as a person assisting in professional practice within the meaning of Section 203(3) sentence 2 of the German Criminal Code. The operator of the web server has no access to the content of your enquiries, because they are stored there only in encrypted form and the key needed to decrypt them is not on the server. Processing takes place on servers in Germany; no transfer of personal data to third countries outside the EU or EEA takes place in this respect.

4. Provision of the website and server log files

Each time this website is accessed, data and information about the accessing device are recorded automatically:

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in the technical delivery of the website, in ensuring system security and stability, in detecting misuse, and in a data-minimising measurement of reach that operates without cookies and without recognising individual users. Log files are deleted as soon as they are no longer required for the purpose for which they were collected, as a rule after 30 days at the latest, unless longer storage is required in an individual case to preserve evidence.

5. Cookies, local storage and language preference

This website does not set cookies. No analytics, tracking or advertising cookies and no comparable technologies serving such purposes are used. No cross-site tracking takes place.

Information in your browser's local storage is accessed in two cases:

Language preference. If you switch between German and English using the language symbol, your choice is stored locally in your browser (localStorage, not a cookie) so that the site appears in the chosen language on your next visit. This storage is strictly necessary for the service you have expressly requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); no consent is required. The setting is not transmitted to me or to any third party.

Saving a partially completed enquiry. In the enquiry form you may tick a box to have your entries so far and the files you have selected stored locally in your browser (localStorage or IndexedDB) so that you can continue later. This function is switched off by default and is activated only at your express request. The legal basis for accessing your terminal equipment is your consent pursuant to Section 25(1) TDDDG, and for any associated processing of personal data Art. 6(1)(a) GDPR. Here too, no data are transmitted to me or to any third party unless and until you submit the enquiry. You may end the storage and delete the data at any time by unticking the box, using the button provided in the form, or via your browser settings.

6. Fonts

For consistent presentation, the Fraunces typeface is served locally from my own server. Body text uses the system fonts already present on your device. No connection to servers operated by Google or other providers is established when the page loads; no personal data are transmitted to third parties in this respect.

7. Cost calculator and deadline calculator

This website offers a calculator giving non-binding guidance on likely legal and court fees, and a calculator for determining the time limit for bringing an action after a dismissal. Both calculations run exclusively locally in your browser (client-side JavaScript). The values you enter are not transmitted to me or to any third party, are not stored, and are discarded when you leave or reload the page. No processing of personal data by me takes place.

This applies equally when you enter a date in the deadline calculator. Data are transmitted to me only once you complete and submit the enquiry form (section 8).

8. Enquiry form and submission of documents

8.1 Scope of processing

The enquiry form allows you to describe your case and submit documents. The following are processed:

No data leave your device before you click the submit button. Selecting files and using the camera function occur solely at your initiative; no access to your camera or file system takes place without your selection. Transmission is encrypted in transit (TLS).

8.2 Purpose and legal basis

The purpose of processing is to assess your enquiry, to check for conflicts of interest (Section 43a(4) of the Federal Lawyers' Act, Section 3 of the Professional Rules for Lawyers) and to initiate a client relationship.

The legal basis is Art. 6(1)(b) GDPR, as the processing serves to take steps at your request prior to entering into a contract. Insofar as processing additionally serves my legitimate interest in answering and documenting enquiries, it is based on Art. 6(1)(f) GDPR.

Your name and at least one means of contact are required so that I can reply to you. All other information is voluntary; its absence will at most lead to follow-up questions.

8.3 Special categories of personal data

Depending on the facts, you may provide information falling within the special categories of personal data under Art. 9(1) GDPR. In employment law this concerns in particular information about a severe disability or equivalent status, illness, pregnancy or trade union membership.

The legal basis for processing such information is Art. 9(2)(f) GDPR. The processing is necessary for the establishment, exercise or defence of legal claims, because such information co-determines whether special protection against dismissal applies and therefore the outcome of the matter. Additionally, I rely on Art. 9(2)(a) GDPR where you provide such information on your own initiative.

You are not obliged to provide such information via the form. If you prefer, you may raise these points in personal conversation instead.

All such information is additionally subject to legal professional privilege (section 14). It is never transmitted to Google or to any other third party.

8.4 Acknowledgement of receipt

After submitting, you will receive an acknowledgement at the e-mail address you provided. It contains no information about the substance of your matter. Please note that although e-mails are usually encrypted in transit, they are not end-to-end encrypted. If you do not wish to receive an e-mail acknowledgement, provide a telephone number only.

8.5 Retention period

If a client relationship is established, your information becomes part of the case file and is retained in accordance with section 16.

If no client relationship is established, I delete your enquiry including any files submitted no later than 14 days after my final response to you. Files stored on the server are deleted automatically once transferred to my practice management system, and in any event after 14 days.

8.6 Protection against misuse

To guard against automated submissions, the form contains a field invisible to you, the interval between page load and submission is evaluated, and the number of submissions per IP address is limited. No third-party services are used for this purpose, in particular no reCAPTCHA. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in preventing abusive use. The technical data collected for this purpose are deleted after 7 days at the latest.

8.7 No mandate, no preservation of time limits

Submitting the form does not create a client relationship and does not preserve any time limit. A mandate arises only once I accept it and you grant me a power of attorney. Please do not use the form to submit declarations subject to a deadline.

8.8 Message via the box below a guide article or on an advertising page

Below every guide article and on the pages my advertisements lead to, you can write me a message. I process your message, your name (if you give it), your phone number or e-mail address, the article or page from which you wrote, and the technical data described in section 8.6. The purpose is to answer your enquiry and to prepare a possible engagement; the legal basis is Article 6(1)(b) GDPR. No consent is required.

On the pages my advertisements lead to, a calculator (claim deadline, severance or costs) stands above the message box. It calculates only in your browser; nothing is transmitted as long as you do not send a message. If you have calculated and then send me a message, your entries and the result are sent with it, for instance gross salary, month of joining and benchmark figure, unless you first untick the box “Sent along” above the button. The figures are stored encrypted like your message, serve the same purpose and are deleted with it; the legal basis is likewise Article 6(1)(b) GDPR.

Transmission is encrypted (TLS). On the server your message is encrypted with my public key the moment it arrives; only I can decrypt it, because the private key needed for that is not on the server. The server is located in Germany. Once it has been transferred to my office system, usually within minutes and at the latest after 30 days, it is deleted from the server. My office computer decrypts it and delivers it to my office mailbox with transport encryption; the web server itself does not send the content.

If you give an e-mail address, you receive an acknowledgement that does not repeat your message; section 8.4 applies accordingly. If no engagement comes about, I delete your message at the latest 14 days after it arrives; if one does, section 8.5 applies. Your message is not passed on to anyone.

While you are writing, your browser keeps the draft in session storage so that it is not lost if you switch to the phone in between. The draft is not transmitted and is deleted when you close the window. This storage is strictly necessary for the message box you are using (§ 25(2) no. 2 TDDDG).

Everything you write to me is covered by legal professional privilege (§ 43a(2) BRAO, § 203 StGB), even if no engagement comes about. Your rights under section 17 apply, subject to the restriction that professional secrecy may take precedence over the right of access (§ 29(1) sentence 2 BDSG).

9. Measuring the effectiveness of advertisements (Google Ads)

I run search advertisements on Google. For this purpose, no Google scripts are loaded on this website, no cookies are set, and no user tracking takes place.

9.1 Enquiries via advertisements

If you reach this website via such an advertisement, Google appends a click identifier to the address (parameter gclid, gbraid or wbraid). If you then submit the enquiry form or send me a message, this identifier is stored together with the time and type of enquiry and reported back to Google, so that I can see which advertisements lead to enquiries.

The following, and only the following, are transmitted to Google:

The following are not transmitted: your name, address, e-mail address, telephone number, any description of your matter, any uploaded files, or any information under section 8.3. Transmission of contact details in hashed form ("enhanced conversions") expressly does not take place.

Nothing is stored on or read from your device for this purpose; Section 25 TDDDG therefore does not apply. The legal basis for the processing is Art. 6(1)(f) GDPR. My legitimate interest lies in assessing the economic effectiveness of my advertising while protecting your data as far as possible.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google also processes the click identifier for its own purposes; joint controllership under Art. 26 GDPR must therefore be assumed in this respect. Transfer to Google LLC in the United States cannot be excluded; it is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 and, additionally, on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

The report is subject to a window of 90 days from the advertisement click; thereafter attribution is technically impossible. The click identifier is deleted after 90 days at the latest.

You may object to this processing at any time and without formality under Art. 21(1) GDPR. If you wish to avoid the transmission altogether, remove the part of the address beginning with "?gclid=", "?gbraid=" or "?wbraid=" before completing the form, or simply call me.

9.2 Calls via advertisements

My telephone number is shown in my search advertisements. If you call via the advertisement, Google tells me at what time, through which advertisement and through which keyword the call came about, how long it lasted and from which dialling area it was made. The content of the conversation is neither transmitted nor recorded; call recording is expressly switched off in my account.

On the pages my advertisements lead to, and in the advertisements themselves, I give a second telephone number (08091 638 3868). It simply forwards to the same line at the office; no third party is on the call and nothing is recorded. Its only purpose is to distinguish calls from the campaign from other calls — only the time and duration are counted, not the content. On all other pages and in the legal notice, the office number appears as before; you can always dial that one.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in identifying which advertisements lead to enquiries about representation. The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. What is said in section 9.1 about transfer to the United States applies accordingly. You may object to this processing at any time under Art. 21(1) GDPR; in that case, please dial the telephone number given on this website directly rather than through the advertisement.

9.3 Anonymous counting of page use

To see at which point visitors abandon an enquiry, this website counts a few events on the pages of the enquiry form: whether the form came into view, whether a field was touched, whether the "Next" and "Send enquiry" buttons were pressed and whether one of the calculators (deadline, severance, costs) displayed a result. For each event one line is stored, consisting of the date without time, the name of the event, the page visited and its variant, the language version and whether you came via an advertisement. This last item is a plain yes or no; the click identifier itself is neither transmitted nor stored. The counter thus distinguishes between visitors from advertisements and from search without recognising individual persons.

In the same way, the message box below the guide articles and on the advertising pages (section 8.8) counts whether it came into view, whether the text field was clicked, whether a message was sent or held up at a field, whether the phone number was tapped and whether calculator figures were sent along or unticked — with the same data, with the article instead of the page variant. The content of your message and the figures themselves are not recorded.

Not stored are your IP address, any identifier, the time, your browser or any input from the form — in particular no figure you entered into a calculator. A single line cannot be attributed to any visit, not even afterwards and not by means of the server logs. Nothing is stored on or read from your device for this purpose; Section 25 TDDDG therefore does not apply. Counting takes place only if JavaScript runs; the form is fully usable without JavaScript. The legal basis is Art. 6(1)(f) GDPR — my legitimate interest in offering an enquiry form that works.

10. Directions and map (OpenStreetMap)

The contact page shows a static map image served from my own server to illustrate the location of my office. No personal data, in particular no IP address, are transmitted to third parties when the page loads; no map tiles, fonts or scripts are loaded from third-party servers. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a data-minimising presentation of directions). The map material is licensed under the Open Database License (ODbL); map data © OpenStreetMap contributors.

A link to OpenStreetMap is also provided, through which you can open an enlarged map and route planning. This link becomes active only when you click it. By clicking it you leave this website; from that point the privacy policy of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom applies (osmfoundation.org/wiki/Privacy_Policy).

11. Newsletter "Auf Ihrer Seite"

On this website you can subscribe to my guide newsletter "Auf Ihrer Seite" (published in German). Only your e-mail address is required to subscribe; no other data are collected. Subscription uses the double opt-in procedure: after you submit the form you receive a confirmation e-mail, and only when you click the link it contains is your address added to the mailing list. The confirmation link is valid for seven days; without confirmation your subscription does not take effect and the data are deleted. As proof of your consent, I log the time of your subscription and of your confirmation and the version of the consent text.

The legal basis for the processing is your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG). You may withdraw your consent at any time with effect for the future — via the unsubscribe link contained in every issue, which works with a single click, or informally by e-mail to anwalt@czirnich.de. After withdrawal, your e-mail address is deleted from the mailing list.

The newsletter is produced and sent on the law office's own infrastructure without a newsletter service provider; your e-mail address is stored in encrypted form and does not leave the law office's systems. Section 3 applies to technical hosting. There is no tracking: the newsletter contains no tracking pixels and no personalised or rewritten links; I do not learn whether or when you open an issue or which articles you click.

12. Question of the week (submissions and voting)

Submitting a question: On the page czirnich.de/frage you can suggest a general legal question to me. Submissions are anonymous — no e-mail address or other contact details are requested, and there is no personal reply. Please do not include names or other details about yourself or third parties in your submission. Should your submission nevertheless contain personal data, I will neither publish nor otherwise use them; published questions are rephrased and generalised. Submitted texts are deleted once the selection cycle has ended, at the latest 56 days after receipt. The legal basis for this short-term processing is Art. 6(1)(f) GDPR (legitimate interest in the editorial selection of the question of the week).

Voting: Using the voting links in the newsletter, you can choose which question I answer in the next issue. Voting is anonymous: the links contain no identifier relating to you or your subscription; only a count per question is recorded. No processing of personal data by me takes place in this respect beyond the server log files (section 4).

Storage of your vote: So that the same device does not vote more than once in the same poll, a note is stored locally in your browser when you vote (localStorage, not a cookie), containing only the identifier of the poll and the time of your vote. This storage is strictly necessary for the service you have expressly requested — taking part in the vote (Section 25(2) no. 2 TDDDG); no consent is required for it. The note is set only when you vote, is not transmitted to me or to third parties, is no longer used after the seven-day voting period and is deleted the next time you visit the voting page. You can delete it at any time via your browser settings.

13. Video consultation

For video consultations I operate my own installation of the Jitsi Meet software at video.czirnich.de on a server commissioned by me. There is no redirection to a provider such as Zoom, Microsoft Teams or Google Meet. The connection data necessary to conduct the conversation and the display name you choose are processed. Conversations are not recorded. The legal basis is Art. 6(1)(b) GDPR.

14. Legal professional privilege and client data

Personal data entrusted to me in the course of an enquiry or a mandate are subject to legal professional privilege (Section 43a(2) of the Federal Lawyers' Act, Section 2 of the Professional Rules for Lawyers) and to the criminal-law protection of Section 203 of the German Criminal Code. They are processed exclusively for the purpose of handling the enquiry or the mandate.

Service providers who may technically gain access to such data, in particular the e-mail provider, are bound to confidentiality pursuant to Section 203(3) sentence 2 of the German Criminal Code.

15. Recipients and disclosure of data

Your personal data are disclosed to third parties only where you have consented (Art. 6(1)(a) GDPR), where disclosure is necessary to perform a contract or mandate (Art. 6(1)(b) GDPR), where a legal obligation exists (Art. 6(1)(c) GDPR), or where this is necessary to safeguard legitimate interests and no overriding interests of yours prevail (Art. 6(1)(f) GDPR).

Regular recipients are:

16. Retention periods

Personal data are deleted as soon as the purpose of storage ceases to apply. The specific periods for enquiries not leading to a mandate are set out in section 8.5.

Where data are subject to statutory or professional retention obligations, they are retained for the duration of the relevant periods and their processing is restricted for other purposes. The lawyer's case file is subject to a retention period of six years after the end of the mandate (Section 50(1) of the Federal Lawyers' Act); commercial (six years, Section 257 of the Commercial Code) and tax (ten years, Section 147 of the Fiscal Code) retention obligations apply in addition.

17. Your rights as a data subject

You have the following rights in respect of personal data relating to you:

Where I process personal data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.

The right of access does not apply insofar as it would disclose information which, by law or by its nature, must be kept confidential, in particular because of the overriding legitimate interests of a third party (Section 29(1) sentence 2 of the Federal Data Protection Act). This concerns in particular information subject to legal professional privilege owed to other clients.

18. Right to lodge a complaint with a supervisory authority

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany

19. Automated decision-making and profiling

There is no automated decision-making within the meaning of Art. 22 GDPR and no profiling on the basis of data collected via this website. In particular, the decision whether to accept a mandate is taken by me personally in every case.

20. Data security

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address bar changing from "http://" to "https://" and by the padlock symbol in your browser.

Files submitted via the enquiry form are stored on the server outside the publicly accessible area, cannot be retrieved via any address, and are deleted in accordance with section 8.5.

21. Currency of this privacy policy

This privacy policy is dated 25 September 2026. Further development of this website or changes in legal or regulatory requirements may make it necessary to amend it.