Privacy Notice

When you engage HGNLW for legal services, I process the following categories of personal data as part of my professional activities:

• Identity Data, such as name, postal address, email address, telephone number, and website;

• Client Data, including contracts, correspondence, delivery notes, evidence, and information about witnesses or other parties;

• Profile Data, including the content of your enquiries, documentation of advice, legal memoranda, working notes, and legal assessments;

• Transaction Data and Financial Data, including documentation of services rendered, invoices, payment information, and other data required to assert or defend your rights;

• Special Categories of Personal Data, where strictly necessary in the context of the mandate (e.g. health data, criminal law-related data);

• as well as any other data you voluntarily provide in connection with the engagement.

Anti-Money Laundering (AML) Obligations

Where the scope of the German Anti-Money Laundering Act (GwG) applies, I am legally required to process additional personal data. This may be the case, in particular, if I assist you in planning or executing:

• the purchase or sale of real estate or businesses;

• the management of funds, securities, or other assets;

• the opening or administration of bank, savings, or securities accounts;

• the procurement of capital for the formation, operation, or management of companies;

• the formation, operation, or management of trusts, companies, or similar structures;

or if I act on your behalf in financial or real estate transactions, provide advice on your capital structure or strategic planning, assist in mergers or acquisitions, or provide professional tax-related services.

In this context, I am required to process Identity Data, data about beneficial ownership, the purpose and nature of the business relationship, Transaction Data, and information necessary for risk classification under AML law. For natural persons, a copy of an official ID document will be made; for legal entities, I collect all information required on beneficial owners.

Purpose and Legal Basis of Processing

Unless otherwise stated, the processing of your personal data is carried out for the purpose of performing the contract concluded with you or the entity you represent (Art. 6(1)(b) GDPR). This includes:

• out-of-court or in-court legal advice and representation,

• communication with courts, opponents, authorities, and third parties,

• invoicing and processing of any liability matters,

• enforcement or defence of legal claims.

In addition, personal data is processed where necessary to comply with legal obligations (Art. 6(1)(c) GDPR), particularly under the AML Act (GwG), professional law (BRAO), or tax legislation.

Additional Processing Situations

a) Contacting HGNLW
If you contact HGNLW via email or any other channel, I process the data you provide (such as Contact Data and message content) to respond to your inquiry. If a mandate exists, the legal basis is Art. 6(1)(b) GDPR; otherwise, the processing is based on my legitimate interest in responding to the enquiry (Art. 6(1)(f) GDPR).

b) Client Updates
From time to time, I may inform clients about current legal developments relevant to their matters. Where an ongoing mandate exists, this is part of the contract (Art. 6(1)(b) GDPR); otherwise, such communications are based on HGNLW’s legitimate interest in keeping clients informed (Art. 6(1)(f) GDPR). You may object to receiving such updates at any time.

c) Greeting Cards
On special occasions (e.g. holidays), I may send personal greetings to clients or contacts with whom there is a professional relationship. This is based on HGNLW’s legitimate interest in maintaining client relationships (Art. 6(1)(f) GDPR). If you do not wish to receive such communications, you may object at any time under Art. 21 GDPR.

d) Ongoing Relationship Management
To manage the client relationship, I may process Identity Data, Contact Data, Profile Data, and Marketing and Communication Data, for example to notify you about updates to my terms or privacy notice, or to invite you to provide feedback.

HGNLW’s website is hosted by the following provider:

Squarespace
Provider: Squarespace Ireland Ltd., Le Pole House, Ship Street Great, Dublin 8, Ireland
Website creation and hosting services are provided via Squarespace. When you access this website, your personal data may be processed on Squarespace servers. In certain cases, data may also be transferred to the parent company Squarespace Inc., 8 Clarkson St, New York, NY 10014, USA.

Squarespace also places cookies that are necessary for the proper display of the website and to ensure its security (“essential cookies”).

In addition, the hosting provider automatically collects and stores technical data in so-called server log files, which your browser transmits automatically. These include:

• Browser type and version

• Operating system used

• Referrer URL

• Host name of the accessing device

• Time of server request

• IP address

This data is collected on the basis of Article 6(1)(f) GDPR. The provider has a legitimate interest in the technically error-free presentation and optimisation of the website, which requires the use of server log files.

The use of Squarespace is based on Article 6(1)(f) GDPR. I have a legitimate interest in the reliable and secure provision of my website. If consent is requested (e.g. for cookies that go beyond what is technically necessary), the processing is based solely on Article 6(1)(a) GDPR and, where applicable, Section 25(1) of the German Telecommunications and Telemedia Data Protection Act (TDDDG). Such consent can be revoked at any time.

Data Transfers to Third Countries

Personal data may be transferred to the United States. Where this occurs, HGNLW relies on the Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of data protection. Squarespace Inc. is also certified under the EU-U.S. Data Privacy Framework (DPF), which provides additional assurances of compliance with EU data protection standards.

For more information, see:

• Squarespace GDPR information

• Squarespace DPF certification

Data Processing Agreement

HGNLW has concluded a Data Processing Agreement (DPA) with Squarespace Ireland Ltd. in accordance with Article 28 GDPR. This agreement ensures that Squarespace processes the personal data of website visitors exclusively in accordance with HGNLW’s instructions and in compliance with GDPR requirements.

HGNLW’s website uses so-called “cookies”. Cookies are small data files that are stored on your device. They do not harm your device.

Cookies may be stored temporarily for the duration of your session (session cookies) or persistently (permanent cookies) until they are manually deleted or automatically removed by your browser. Session cookies are automatically deleted when you leave the website.

Cookies may be set either by HGNLW (first-party cookies) or by third-party providers (third-party cookies). Third-party cookies are used, for example, to integrate external services such as payment providers or media platforms.

Cookies serve various purposes:

• Some are technically necessary, for example to enable basic website functions such as navigation or video display.

• Others may be used for analytical purposes or online marketing, such as measuring user behaviour or personalising advertising.

Legal Basis for Cookie Use

Cookies that are strictly necessary to enable electronic communications, to provide a service that you have expressly requested, or to ensure the proper technical functioning and optimisation of the website are used on the basis of Article 6(1)(f) GDPR (legitimate interest), Section 25(2)(2) TDDDG. No consent is required for these necessary cookies.

Where cookies or similar technologies are used for non-essential purposes, these are only activated with your explicit consent, pursuant to Article 6(1)(a) GDPR, and Section 25(1) TDDDG.

You may withdraw your consent at any time with effect for the future.

Managing Cookies

You can configure your browser to:

• notify you when a cookie is being placed;

• allow cookies only in specific cases;

• block cookies entirely or in certain situations; and

• automatically delete cookies when the browser is closed.

Please note: Disabling cookies may limit the functionality of the website.

Details on the specific cookies and services used on this website can be found in this Privacy Notice or in the cookie banner or interface provided upon your visit.

Contact Form

If you contact HGNLW via the contact form provided on this website, the information you enter into the form, including the contact details you provide, will be stored and processed in order to handle your enquiry and any follow-up questions.

The legal basis for processing your data is Article 6(1)(b) GDPR, where your request is related to the performance of a contract or is necessary to take steps at your request prior to entering into a contract. In all other cases, processing is based on HGNLW’s legitimate interest in efficiently handling incoming enquiries (Article 6(1)(f) GDPR).

The data you submit via the contact form will be retained until:

• you request its deletion

• the purpose for storage no longer applies (e.g. after your enquiry has been fully resolved).

Statutory retention obligations—particularly those under professional, commercial, or tax law—remain unaffected.

Contact by Email or Telephone

If you contact HGNLW by email, telephone, or fax, I will process the information you provide (including Identity Data, Contact Data, and the content of your enquiry) for the purpose of addressing your request.

Processing is carried out under Article 6(1)(b) GDPR, where the request is contractually relevant or part of pre-contractual correspondence. In other cases, processing is based on Article 6(1)(f) GDPR due to my legitimate interest in handling such communications efficiently.

The data received through these contact channels will be stored until:

• you request deletion;

• the purpose of processing has been fulfilled (e.g. your enquiry is resolved).

Mandatory retention periods under law remain unaffected.

HGNLW uses Microsoft Bookings, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, to enable online appointment scheduling.

When you book an appointment through Microsoft Bookings, the following categories of personal data may be processed:

• Identity Data, such as your name and title;

• Contact Data, such as your email address and phone number;

• Profile Data, such as your selected appointment type, preferred times, and any information you provide voluntarily in the booking form;

• Technical Data, such as IP address, device metadata, or browser information, depending on how you access the booking page.

Your data is processed to:

• enable the scheduling and confirmation of appointments;

• communicate relevant details (e.g. reminders, meeting links, follow-ups);

• ensure the appointment is properly prepared and documented.

The legal basis for processing is:

• Article 6(1)(b) GDPR, where the booking is made in the context of initiating or fulfilling a contract (e.g. legal consultation);

• Article 6(1)(f) GDPR, where HGNLW has a legitimate interest in simplifying and efficiently managing appointment scheduling; and

• Article 6(1)(a) GDPR, where you voluntarily provide additional information beyond what is required, based on your consent.

Microsoft processes data on servers within the European Economic Area (EEA). However, as part of Microsoft’s global cloud infrastructure, data may be accessed from outside the EEA by affiliated entities under strict safeguards.

HGNLW has concluded a Data Processing Agreement with Microsoft in accordance with Art. 28 GDPR, and Microsoft relies on Standard Contractual Clauses (SCCs) where necessary. Microsoft is also certified under the EU-U.S. Data Privacy Framework (DPF).

If you would like to receive the newsletter offered on this website, HGNLW requires your email address as well as information that allows verification that you are the owner of the email address and that you consent to receiving the newsletter.

The processing of your data for newsletter distribution is based on your consent under Article 6(1)(a) GDPR. You can withdraw your consent at any time by using the “unsubscribe” link provided in the newsletter. The lawfulness of data processing prior to the withdrawal remains unaffected.

Your data will be stored for as long as you remain subscribed. Once you unsubscribe or the purpose for data processing no longer applies, your data will be removed from the newsletter mailing list. HGNLW reserves the right to delete or block email addresses from the mailing list at its own discretion based on a legitimate interest in accordance with Article 6(1)(f) GDPR.

Data stored by HGNLW for other purposes remains unaffected by this.

Blacklisting After Unsubscribing

After unsubscribing, your email address may be stored in a separate blacklist if this is necessary to prevent future mailings. This blacklist is used solely for this purpose and is not combined with other data. The processing is based on HGNLW’s legitimate interest in complying with legal requirements regarding email communications (Article 6(1)(f) GDPR). The blacklist is retained indefinitely. You may object to this storage if your interests outweigh the legitimate interests of HGNLW.

HGNLW uses Google reCAPTCHA to protect the contact form from spam and automated abuse.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA analyses user behaviour to determine whether an action (such as submitting a form) is being performed by a human or an automated script. This analysis includes various data points such as:

• IP address

• Time spent on the website

• Mouse movements and other browser interactions

This analysis starts automatically when you access the website and runs entirely in the background. No separate notice is shown.

The use of reCAPTCHA is based on Article 6(1)(f) GDPR. HGNLW has a legitimate interest in protecting its services from abuse and spam.

Google may process data in the United States. Google is certified under the EU-U.S. Data Privacy Framework (DPF), which ensures an adequate level of data protection. For more information, see:

• Google Privacy Policy

• Google Terms of Service

• Google DPF Certification

Events

If you register for or attend an event hosted or organised by HGNLW, I may process personal data that is necessary to manage your participation and ensure proper communication before, during, and after the event.

This may include:

• Identity Data, such as your name, title, and professional role;

• Contact Data, such as your email address or telephone number;

• Client Data, where your attendance relates to an existing client relationship;

• Marketing and Communication Data, if you consent to receive invitations, event updates, or related materials.

The processing of your data for event participation is based on:

• Article 6(1)(b) GDPR, where your participation is part of a contractual or pre-contractual relationship (e.g. a reserved seminar);

• Article 6(1)(f) GDPR, where HGNLW has a legitimate interest in managing event logistics and communications efficiently;

• Article 6(1)(a) GDPR, where you have expressly consented to receive further information or communications (e.g. follow-up materials or invitations to future events).

Your data will be stored only as long as necessary for event administration, or until you withdraw your consent, if applicable. Legal retention obligations remain unaffected.

Surveys

If you choose to participate in a survey issued by HGNLW, I will process the data you provide for the purpose of collecting feedback, evaluating opinions, or improving legal services and communication.

This may include:

• Identity Data, where provided voluntarily;

• Contact Data, if you choose to be contacted with follow-up questions or results;

• Profile Data, including your responses, preferences, and any additional remarks

The processing of survey-related data is based on Article 6(1)(a) GDPR, where you have given explicit consent to participate and provide feedback.

Participation is voluntary. Data will be stored only as long as necessary for the evaluation of results or until you withdraw your consent. Legal retention obligations remain unaffected.

To ensure that this website is visually consistent and functions smoothly across all browsers and devices, HGNLW integrates several third-party services that load fonts, maps, or scripts from external sources.

Use of Google Web Fonts

For consistent and visually appealing presentation of content, this website uses Google Web Fonts, a service provided by:

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Operated in the EU by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

When you visit the website, your browser loads the necessary fonts directly from Google servers. To do this, your IP address is transmitted to Google.

The use of Google Fonts is based on Article 6(1)(f) GDPR. HGNLW has a legitimate interest in a consistent and technically reliable display of text across all devices and browsers.

Further information:

• Google Fonts FAQ

• Google Privacy Policy

Google is certified under the EU-U.S. Data Privacy Framework (DPF). This certification confirms Google's commitment to European data protection standards when processing data in the United States.
More info: Google’s DPF entry

Use of Adobe Fonts (Typekit)

This website also uses Adobe Fonts (formerly Typekit) to integrate high-quality web fonts. The provider is:

Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland

To load the fonts, your browser connects to an Adobe server, which may be located in the United States. This connection involves the transfer of your IP address.

The use of Adobe Fonts is based on Article 6(1)(f) GDPR, due to HGNLW’s legitimate interest in a visually optimised and professional presentation of online content.

Further information:

• Adobe Fonts Privacy Policy

Adobe is certified under the EU-U.S. Data Privacy Framework (DPF). This ensures that Adobe complies with EU-level data protection standards when transferring and processing personal data in the U.S.
More info: Adobe’s DPF entry.

HGNLW operates a public company profile on the social media platform LinkedIn, provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

Interaction and Communication

HGNLW processes personal data when users interact with the LinkedIn company profile. This includes using platform functions such as following the profile, sending messages, commenting, liking or sharing posts, or viewing published content.

In these cases, HGNLW may process personal data visible during the interaction — typically:

• ·your name and LinkedIn username,

• profile image (if available),

• message content (including any attached files or media),

• date and time of the interaction.

This data is processed to respond to your inquiry and to represent HGNLW’s legal services to the public. HGNLW also uses LinkedIn for communication with potential clients, business contacts, and to inform the public about legal developments, services, or other relevant activities.

The legal basis is:

• Article 6(1)(f) GDPR – legitimate interest in engaging with the public, potential clients, or other stakeholders via LinkedIn;

• ·Article 6(1)(b) GDPR – if the interaction is related to the performance of a contract or the initiation of a contractual relationship.

Statistical Insights (LinkedIn Page Insights)

HGNLW uses LinkedIn's Page Insights functionality to receive statistical, anonymized reports about interactions on the LinkedIn company profile. These statistics include information such as:

• page visits and impressions,

• follower demographics (aggregated),

• engagement with posts.

This processing is used to evaluate the effectiveness of HGNLW’s LinkedIn presence and to tailor content to the interests of its audience.

The legal basis is Article 6(1)(f) GDPR – legitimate interest in analyzing usage patterns to improve HGNLW’s communication and service offerings.

For this purpose, HGNLW and LinkedIn act as joint controllers under Article 26 GDPR. LinkedIn provides details of this joint controller arrangement here: LinkedIn Page Insights Joint Controller Addendum

Targeted Social Media Advertising

If HGNLW were to engage in targeted advertising on LinkedIn using custom audiences (e.g. uploading contact lists for matching), such processing would only occur on the basis of your prior, explicit consent, Article 6(1)(a) GDPR, which can be withdrawn at any time.

Data Recipients and Transfers

Primary recipient of data is LinkedIn, which processes personal data in accordance with its privacy policy.

LinkedIn may transfer data to countries outside the European Economic Area (EEA), including the United States. Such transfers are governed by appropriate safeguards such as Standard Contractual Clauses (SCCs), as described in LinkedIn’s privacy policy.

HGNLW may process personal data for the purpose of analysing website usage and improving the relevance and effectiveness of content, services, and communications. This includes providing relevant website content and marketing messages and tracking how effective those messages are.

The following categories of personal data may be processed for these purposes:

• Identity Data, such as name or title (where available);

• Contact Data, including email address or phone number (where applicable);

• Profile Data, such as interests, preferences, feedback, or interactions with newsletters or events;

• Marketing and Communication Data, including subscription status and interaction history;

• Technical Data, such as IP address, browser information, usage logs, and interaction data (e.g. clicks, scrolls, page duration).

Personal data is used to:

• evaluate and improve the effectiveness of the website and its content;

• better understand how clients and visitors interact with services;

• develop or adapt services and offerings;

• improve the performance of marketing campaigns and digital outreach;

• refine customer relationship management; and

• build an informed marketing and business development strategy.

The processing of personal data for analytics and marketing purposes is based on HGNLW’s legitimate interest under Article 6(1)(f) GDPR. This interest includes understanding how clients and website visitors interact with legal services and online content, identifying relevant client groups, and optimising offerings accordingly.

Where analytics involve cookies or similar technologies, or where data is used for tracking across devices or platforms, such processing will only occur with your prior consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time.

HGNLW processes certain personal data to manage and secure its operations, digital services, and infrastructure. This includes protecting the website, any integrated systems, and communication tools from unauthorised access, misuse, or attacks.

The following categories of personal data may be processed in this context:

• Identity Data, where needed to authenticate or manage user access;

• Contact Data, in the course of communication, incident response, or access logging;

• Technical Data, including IP addresses, access logs, browser metadata, and other system-level interaction data.

Personal data may be used to:

• operate and maintain IT and administrative systems;

• ensure network and information security;

• prevent fraud, abuse, and unauthorised access;

• manage incidents or breaches;

• comply with obligations relating to legal oversight or system integrity;

• support or document lawful restructuring processes (e.g. business transitions).

Processing in the context of security and operational protection is based on:

• Article 6(1)(f) GDPR — HGNLW’s legitimate interest in securing IT systems, preventing misuse, ensuring availability of services, and managing business continuity;

• Article 6(1)(c) GDPR — where processing is necessary to comply with legal obligations, such as data security requirements under professional, telecommunications, or data protection law.