Rufen Sie uns an: 030 3561190 E-Mail an office@erlburg.law senden

Privacy Policy

Privacy Policy

This privacy policy informs you about how your personal data is handled on this website and in connection with the services provided by ERLBURG Rechtsanwaltsgesellschaft mbH, in particular in relation to:  

  • the use of our website and our LinkedIn page;
  • the initiation and handling of legal mandates;
  • communication via the Microsoft Teams communication tool;
  • business relationships outside the handling of legal mandates (e.g. suppliers, service providers);
  • applying for a job vacancy at ERLBURG Rechtsanwaltsgesellschaft mbH or submitting an unsolicited application.  

You will also receive general information regarding the disclosure of your data to third parties and your rights in relation to the processing of your data. 

Further information on the processing of personal data in connection with notarial services provided by Notary Dr. Ulrike Grübler can be found here: Notary’s Privacy Policy

1. General Information

1.1 Contact

ERLBURG Rechtsanwaltsgesellschaft mbH is responsible for data processing. If you have any suggestions or questions regarding this privacy policy or the processing of your personal data, or if you wish to exercise your rights in this regard, please direct your enquiry to:

ERLBURG Rechtsanwaltsgesellschaft mbH
Dorotheenstraße 37
D-10117 Berlin
E-Mail: office(at)erlburg.law

1.2 Legal Basis

The data protection term ‘personal data’ refers to all information relating to an identified or identifiable natural person. This includes, for example, name, address or email address. We process personal data in compliance with the relevant data protection regulations and only to the extent permitted by law. This means that, as a general rule, we only process personal data where we have your consent (Art. 6(1)(a) GDPR), where this is necessary for the performance of a contract to which you are a party or in response to your request for pre-contractual measures (Art. 6(1)(b) GDPR), to comply with a legal obligation (Art. 6(1)(c) GDPR) or where processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, provided that your interests, fundamental rights or freedoms requiring the protection of personal data do not override those interests (Art. 6(1)(f) GDPR).

1.3 Duration of storage

Unless otherwise stated in the information below, we will only store your personal data for as long as is necessary to achieve the purpose of processing or to fulfil the contractual or legal obligations incumbent upon us. Such statutory retention periods may arise in particular from specific provisions under commercial, tax or legal practice law.

1.4 Recipients of the data

We use contracted service providers for certain data processing activities. These include, amongst other things, the maintenance, hosting and support of IT systems, brand management, translations, and the destruction of files and data carriers. Such service providers commissioned by us process the relevant personal data only in accordance with our express instructions and are obliged to ensure confidentiality and the legally required level of data protection by means of appropriate technical and organisational measures. In addition, we may transfer our clients’ personal data to postal and delivery services, courts, opposing parties, our principal bank, tax advisers/auditors, the tax authorities or other public authorities.

1.5 Processing in connection with the exercise of your rights under Articles 15–22 of the GDPR

Where you exercise your rights under Articles 15–22 of the GDPR, we will process the personal data provided to us in this context for the purpose of enabling us to fulfil these rights. This allows us to provide evidence of such processing, as we are legally obliged to do so (Article 6(1)(c) of the GDPR).

1.6 Your rights

Where you are affected as an individual by our data processing, you may exercise your data subject rights against us. In particular, you are entitled to the following rights:

  • Subject to the conditions set out in Article 15 of the GDPR and Section 34 of the BDSG, you have the right to request information as to whether, and if so to what extent, we process personal data relating to you.
  • Subject to the conditions set out in Article 16 of the GDPR, you have the right to request that we rectify your data.
  • Subject to the conditions set out in Article 17 of the GDPR and Section 35 of the BDSG, you have the right to request that we erase your personal data.
  • Subject to the conditions set out in Article 18 of the GDPR, you have the right to restrict the processing of your personal data.
  • Subject to the conditions set out in Article 20 of the GDPR, you have the right to receive the personal data concerning you, which you have provided, in a structured, commonly used and machine-readable format, and to transmit this data to another controller.
  • If you have given us separate consent to the processing of your data, you may withdraw this consent at any time under the conditions set out in Article 7 of the GDPR. Please note that this does not affect the lawfulness of any data processing carried out on the basis of your consent prior to its withdrawal.
  • If you consider that the processing of your personal data infringes the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR.

1.7 Right to object

Subject to the conditions set out in Article 21(1) of the GDPR, you have the right to object to processing based on the legal grounds of Article 6(1)(e) or (f) of the GDPR on grounds relating to your particular situation. If we process personal data about you for the purposes of direct marketing, you may object to such processing in accordance with Article 21(2) and (3) of the GDPR.

2. Data processing on our website

2.1 Processing of server log files

When you use our website, general information that your browser transmits to our server is stored automatically, i.e. simply by using the site without registering. By default, this includes the browser type and version, the operating system used, the website accessed, the previously visited website (referrer URL), the host name of the accessing computer, the IP address, and the date and time of the server request. This processing is necessary to enable you to access our website content and serves our legitimate interest in providing a website, Article 6(1)(f) GDPR. The log files are not stored.

2.2 Enquiries

You can send us a message via the contact email address provided on the website. We process the data you provide for this purpose in order to respond to your enquiry. If your enquiry relates to the conclusion of a client agreement or any other contract with us, Article 6(1)(b) of the GDPR forms the legal basis for the data processing. Otherwise, we process the data on the basis of our legitimate interest in contacting enquirers. In this case, the legal basis for data processing is Article 6(1)(f) of the GDPR.

2.3 Data security 

We take technical and organisational measures to protect your personal 

data from loss, destruction, falsification and unauthorised access. The erlburg.law website uses SSL/TLS encryption to ensure the secure transmission of confidential content. You can identify whether a specific page on our website is being transmitted securely by the closed key or padlock symbol displayed in the status bar at the bottom of your browser.

2.4 Cookies

We do not use cookies.

3. Data processing via our LinkedIn page

We operate a LinkedIn page through which we present our company, provide information about our services and communicate with our clients and prospective clients. If you contact us via LinkedIn or interact with our page, we process personal data relating to you. Where the enquiry relates to the conclusion or performance of a client agreement or a contract of a different nature with us, this is carried out on the basis of Article 6(1)(b) of the GDPR. In all other cases, we process the data on the basis of our legitimate interest in being able to contact enquirers. The legal basis for data processing in this case is Article 6(1)(f) of the GDPR.

In addition, LinkedIn’s operating company processes the relevant personal data under its own responsibility. For users based in the European Economic Area and Switzerland, LinkedIn is operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (‘LinkedIn Ireland’). You can find LinkedIn Ireland’s privacy policy here: https://www.linkedin.com/legal/privacy-policy?trk=organization-guest_footer-privacy-policy. There you will also find information on the settings options for your LinkedIn profile. Finally, we receive non-personal information and analytics from LinkedIn Ireland regarding the use of our account and interactions with our posts. We use this information to analyse and optimise the effectiveness of our LinkedIn activities. This processing is based on Article 6(1)(f) of the GDPR and serves our legitimate interests in optimising our LinkedIn page.

4. Further data processing

4.1 Contracts with service providers

The processing of personal master data, contractual data and payment data is regularly required for the conclusion or performance of a contractual relationship with you as a service provider. Article 6(1)(b) of the GDPR forms the legal basis for this processing.

4.2 Client relationship

Within the framework of the client relationship or the initiation of a client relationship, your personal data will be processed to the extent necessary for the establishment and performance of the client relationship. This includes, in particular, your first name and surname, your contact details, and other data required for the performance of the mandate, depending on the nature and scope of the mandate granted. The legal basis for this processing is Article 6(1)(b) of the GDPR.

Where your personal data is transferred to us by third parties in relation to an existing or future client relationship, the data processing serves the purpose of carrying out the client relationship. If your personal data is transmitted to us because our client is considering bringing claims against you or anticipates that such claims will be brought by you, the data processing also serves to assert, exercise or defend legal claims. The processing thus serves to safeguard the legitimate interests of our client in accordance with Article 6(1)(f) of the GDPR.

4.3 Email communication 

To protect your data when communicating via email, we use end-to-end encryption (S/MIME). This means that the content of our emails and any attachments is encrypted on our device and can only be decrypted on your device. 

4.4 Microsoft Teams conference tool

We use the Microsoft Teams online conference tool to communicate with our clients. When you communicate with us via video or audio conference in this way over the internet, your personal data is collected and processed by us and the provider of the respective conference tool. To initiate a Microsoft Teams conference, we must first process the data you have provided for this purpose, specifically your email address and/or your telephone number. Before the conference, you will receive a confirmation email containing an invitation link or a calendar event.

As part of the conference, Microsoft Teams also processes the duration of the conference, the start and end times of participation in the conference, the number of participants, and other ‘contextual information’ relating to the communication process (metadata). All technical data required to facilitate the online communication is also processed. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker, and the type of connection. If content is exchanged, uploaded or otherwise made available within Microsoft Teams, the conference tool provider also stores this on its servers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared whilst using the service.

Microsoft Teams is provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. For details on data processing, please refer to the Microsoft Teams Privacy Statement: https://privacy.microsoft.com/de-de/privacystatement. Microsoft Ireland Operations Limited is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA designed to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this is available from the provider via the following link: https://www.dataprivacyframework.gov/participant/6474.

4.5 Job Applications

If you apply for a position at ERLBURG Rechtsanwaltsgesellschaft mbH, we will process your application data solely for purposes related to your interest in working with us and the processing of your application. Your application will only be viewed and processed by the relevant contact persons within our firm. All employees entrusted with data processing in this regard are bound by confidentiality obligations with regard to the data. If we do not offer you a position, the data you have provided will be retained by us for up to 3 months following a rejection, in order to answer any questions regarding your application or a possible rejection. This does not apply if statutory provisions preclude deletion, if further storage is necessary for evidential purposes, or if you have expressly consented to longer storage. The legal basis for data processing is Section 26(1) sentence 1 of the Federal Data Protection Act (BDSG).

5. Amendments to the Privacy Policy

Due to the ongoing development of our website and our legal advisory services, as well as changes to legal or regulatory requirements, it may become necessary to amend this Privacy Policy. 

Date: June 2026