1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Schanz & Coll. Rechtsanwälte
Grüneburgweg 119
D-60323 Frankfurt am Main, Germany
Phone: +49 - 69 9726 401 10
Fax: +49 - 69 9726 401 29
E-mail: info@schanz-law.de
For data protection queries you can also reach us at: dataprotection@schanz-law.de
No data protection officer has been appointed, as we are not required to do so as a sole practice pursuant to Art. 37 GDPR in conjunction with Section 38 of the German Federal Data Protection Act (BDSG).
2. Overview of data processing
We only process personal data within the framework of the applicable legal provisions. If you merely visit this website for information purposes, i.e. if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our hosting provider (see section 3). If you contact us by e-mail, telephone or fax, or if a mandate is established, we process the data provided for the purpose of handling your request or carrying out the mandate.
3. Hosting and server log files
This website is hosted by STRATO AG, Pascalstraße 10, 10587 Berlin, Germany. Each time this website is accessed, our hosting provider automatically collects information in so-called server log files, which your browser transmits. These are: IP address, date and time of the request, content of the request (specific page), access status/HTTP status code, amount of data transferred, the website from which the request originates (referrer URL), browser type and version, and the operating system used.
This processing serves the technical provision and security of the website (troubleshooting, load management, IT security) on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. For security reasons (e.g. to investigate misuse), log files are kept for a limited period and then deleted or anonymised.
4. Cookies
This website only uses technically necessary cookies stored on your device:
- a cookie storing your chosen language version (German/English),
- cookies storing display preferences (e.g. font size),
- when using password-protected areas (e.g. client/project area, teaching materials for students, internal administration area), a session cookie to maintain your login status.
These cookies are required for the respective function of the website to work properly; they are deleted automatically when you close your browser. The legal basis is Art. 6(1)(f) GDPR and/or Section 25(2) No. 2 TTDSG, as the cookies are technically necessary to provide a service you have expressly requested (e.g. language selection or login). No consent is required for this. You can generally prevent the storage of cookies in your browser; however, this may limit the functionality of certain areas of this website.
This website does not use any third-party analytics, marketing or tracking cookies.
5. Embedded map (Google Maps)
On the "How to find us" page we offer the option of displaying a map provided by Google Maps, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (and/or Google LLC, USA). The map is not loaded automatically when the page is accessed; it is only loaded once you actively click the "Load map" button. Only this click establishes a connection to Google's servers; in doing so Google may collect your IP address and further usage data, even if you are not logged in with Google. Processing may also take place on servers in the USA. The legal basis in this case is Art. 6(1)(a) GDPR and/or Section 25(2) No. 2 TTDSG, as you expressly request the loading of the map by clicking; without a click, no connection to Google is established. Regardless of this, our address is also available as plain text on the "How to find us" page and in the legal notice. Information on data protection at Google is available at https://policies.google.com/privacy.
6. Contact by e-mail, phone or fax
If you contact us by e-mail, telephone or fax, we process the data you provide (e.g. name, contact details, content of your enquiry) for the purpose of handling your request. The legal basis is Art. 6(1)(f) GDPR (responding to your enquiry) or, where your enquiry aims at establishing or carrying out a mandate, Art. 6(1)(b) GDPR.
7. Data processing within client mandates
When establishing, carrying out and terminating client mandates, we process the personal data of our clients and, where applicable, third parties required for this purpose on the basis of Art. 6(1)(b) and (f) GDPR, and to comply with legal obligations on the basis of Art. 6(1)(c) GDPR. As lawyers we are subject to statutory professional secrecy (Section 43a BRAO, Section 2 BORA); personal data from mandates is only disclosed within the legally permissible framework. Pursuant to Section 50(2) of the German Federal Lawyers' Act (BRAO), client files are retained for six years after the end of the mandate (the period begins at the end of the calendar year in which the mandate ended); individual documents of tax relevance (e.g. invoices) may be subject to longer retention periods of up to ten years under Section 147 of the German Fiscal Code (AO).
8. Disclosure of data
We do not transfer your personal data to third parties for purposes other than those stated. We use carefully selected service providers for certain services (e.g. hosting), who are contractually bound to confidentiality and compliance with data protection requirements (data processing agreements pursuant to Art. 28 GDPR).
9. No automated decision-making
We do not use any automated decision-making procedures, including profiling, within the meaning of Art. 22 GDPR.
10. Your rights as a data subject
You have the following rights with respect to personal data concerning you:
- right of access (Art. 15 GDPR),
- right to rectification (Art. 16 GDPR),
- right to erasure (Art. 17 GDPR),
- right to restriction of processing (Art. 18 GDPR),
- right to data portability (Art. 20 GDPR), and
- right to object to processing (Art. 21 GDPR).
To exercise these rights, please contact us using the details given in section 1.
11. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR). The authority responsible for us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
12. Data security
We use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction or against access by unauthorised persons. This includes in particular encrypted transmission via HTTPS/TLS.
13. Changes to this privacy policy
We will adapt this privacy policy whenever changes to our data processing make this necessary. The version published on this page at the time of your visit shall apply.
Last updated: October 2026
