Skip to content
Data protection structurally embedded in the code: software engineering workstation
Legal information

Privacy notice

Introduction

With this privacy notice I inform you about the processing of personal data (“data”) when you visit and use this website and in the context of my online presences on social networks (collectively, “online offering”). The processing of client data in the course of legal advice and representation is not the subject of this notice; I provide separate information on this in the course of the engagement.

The terms used are not gender-specific.

Controller

INN.LAW®
Peter Poleacov, attorney-at-law
Am Kaldenberg 3A
40489 Düsseldorf
Germany
Email: info@inn.law
Legal notice: https://inn.law/en/legal-notice/

Relevant legal bases

The following is an overview of the legal bases of the EU General Data Protection Regulation (“GDPR”) on which I process personal data. Please note that, in addition to the GDPR, national data protection rules may apply in your or my country of residence or domicile. If, in addition, more specific legal bases apply in an individual case, I will inform you of these in the privacy notice.

  • Consent (Article 6(1)(a) GDPR): The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual inquiries (Article 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Article 6(1)(c) GDPR): Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Article 6(1)(f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the GDPR, national data protection rules in Germany apply. These include, in particular, the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). Among other things, the BDSG contains specific rules on the right of access, on the right to erasure, on the right to object, on the processing of special categories of personal data, on processing for other purposes and on transfer as well as automated decision-making in individual cases, including profiling. State data protection laws of the individual German federal states may also apply.

Security measures

I take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of risk to the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.

The measures include safeguarding the confidentiality, integrity, and availability of data through access and authorization controls, as well as procedures for the exercise of data subjects’ rights and the erasure of data. I take the protection of personal data into account already when selecting hardware and software, in accordance with the principle of data protection by design and by default.

TLS encryption (https): To protect the data you transmit via my online offering, I use TLS encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Data backup: To ensure availability and protect against data loss, I carry out regular, encrypted data backups.

Attorney-client confidentiality

As an attorney, I am subject to the special duty of professional confidentiality under Section 43a of the German Federal Lawyers’ Act (Bundesrechtsanwaltsordnung, BRAO). All client data is processed under strict confidentiality. The transmission of client data to processors only takes place after they have been bound to confidentiality and in accordance with the rules of professional conduct.

Recipients and data processing in third countries

Where I transfer personal data to other entities, this only takes place to the extent necessary, for example to service providers entrusted with IT and hosting tasks, with whom I conclude the data processing agreements required by law.

Where data is processed outside the EU or the EEA in this context, this only takes place on the basis of Articles 44 to 49 GDPR, that is, under an adequacy decision of the EU Commission or appropriate safeguards such as the standard contractual clauses. I state the basis relevant to the respective service in its description (for further information, see the information page of the EU Commission: commission.europa.eu).

Erasure of data

The data processed by me is erased in accordance with the legal requirements as soon as the consents on the basis of which it was processed are withdrawn or other permissions cease to apply (for example, if the purpose of the processing has ceased to apply or the data is no longer required for the purpose). To the extent the data is not erased because it is required for other and legally permitted purposes, its processing will be limited to those purposes. That is, the data will be blocked and not processed for other purposes. This applies, for example, to data that has to be retained for commercial or tax law reasons, or whose storage is necessary for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person.

In the context of my privacy notice, I may inform users of further information on the erasure and on the storage of data specific to the particular processing operations.

Use of cookies

By “cookies” I mean here any technique that stores information on your device or reads information from it, including the browser’s local and session storage.

This website does not set any analytics or marketing cookies. The website itself stores on your device only what is strictly necessary: the settings you choose yourself (light or dark, the language, the dismissal of the notice bar) and, for the duration of the session, a note that it has checked your browser language. My hosting and security provider Cloudflare may set technically necessary security cookies (for example “__cf_bm” for bot and abuse defense); these are not used to track across websites or sessions. The local storage described and these security cookies are exempt from consent under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) because they are strictly necessary for a function you have expressly requested or for the security of the service; the related processing, where personal, is based on Article 6(1)(f) GDPR. Any reach measurement is performed exclusively cookie-free; see “Web analytics, monitoring, and optimization”. Consent and a cookie banner are therefore not required.

Provision of the online offering and web hosting

I process the data of users in order to provide them with my online services. For this purpose, I process the user’s IP address, which is necessary in order to transmit the content and functions of my online services to the user’s browser or end device.

Types of data processed: Usage data, meta/communication data, content data.
Data subjects: Users.
Purposes: Provision of my online offering and usability, information-technology infrastructure, security measures, content delivery network (CDN).
Legal bases: Legitimate interests (Article 6(1)(f) GDPR).

Access data and server logs: My website is provided as a static site via my hosting and CDN provider Cloudflare. When it is accessed, connection data is generated for technical reasons (in particular IP address, date and time, the file accessed, data volume transferred, browser type, operating system, and referrer), which Cloudflare processes as a processor for the delivery, stability, and security of the offering. I do not keep my own server log files with a fixed retention period and have no access to the raw connection logs. Cloudflare does not retain full access logs for retrieval by default; the retention period is governed by Cloudflare’s data protection terms and data processing agreement. Data whose further retention is necessary for evidentiary purposes is exempt from erasure until the respective incident has been clarified.

Email dispatch and hosting: The web-hosting services I use also include the dispatch, receipt, and storage of emails. For these purposes, the addresses of the recipients and senders as well as further information regarding email dispatch (for example, the providers involved) and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting SPAM. Please note that emails on the internet are generally not sent in encrypted form. As a rule, emails are encrypted in transit, but (unless a so-called end-to-end encryption procedure is used) not on the servers from which they are sent and received. I can therefore accept no responsibility for the transmission path of emails between the sender and receipt on my server.

Cloudflare: Web hosting and content delivery network (Cloudflare Pages). Service provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Basis for third-country transfers: adequacy decision EU-US Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses of the EU Commission (Article 46(2)(c) GDPR). Website: cloudflare.com; privacy policy: cloudflare.com/privacypolicy; data processing agreement: cloudflare.com/cloudflare-customer-dpa; standard contractual clauses: cloudflare.com/cloudflare-customer-scc.

Local fonts: Fonts are served exclusively from my own server; no external font services (such as Google Fonts) are integrated.

Contact and inquiry management

When you contact me (for example, by email, telephone, or via social media) and in the context of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact inquiries and any requested measures.

Transmission through my forms: If you use an inquiry form on this website, it sends your details to my office mailbox. I use Cloudflare Email Service to send them, and nothing is stored outside the mailbox. The form is protected against automated entries by Cloudflare Turnstile. The dispatch via Cloudflare Email Service is described in more detail in the section “Registration for webinars and events”, the use of Cloudflare Turnstile in the section “Newsletter and electronic notifications”.

Types of data processed: Contact data, content data, usage data, meta/communication data.
Data subjects: Communication partners.
Purposes: Contact requests and communication, management and reply to inquiries, feedback, provision of my online offering and usability.
Legal bases: Legitimate interests (Article 6(1)(f) GDPR); performance of a contract and pre-contractual inquiries (Article 6(1)(b) GDPR). Erasure of data: contact inquiries are erased after three years unless a mandate relationship develops. For mandates, the statutory retention periods under the BRAO apply.

Registration for webinars and events

You can register for my webinars and other events through a registration form or by email. In the registration form, first and last name, email address, company and billing address, the date and the number of participants, and the confirmation that the invoice goes to a company or organization, or to you as a self-employed professional, are required; if you register more than one participant, the names of all participants are also required. VAT ID and additional details are optional. I use these details to confirm the registration, to issue the invoice, to send the access details and the materials, and to issue the certificates of attendance. If you register by email, this applies equally to the details in your email. I erase the registration data once it is no longer required for conducting and following up on the event; records subject to commercial or tax retention duties (in particular invoicing data) are retained until the statutory periods of up to ten years expire.

Transmission of the registration: The form sends your details to my office mailbox. I use Cloudflare Email Service to send them. The registration is not stored anywhere outside my email mailbox. Service provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Basis for third-country transfers: adequacy decision EU-US Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses of the EU Commission (Article 46(2)(c) GDPR).

Protection against automated registrations: The registration form is protected by Cloudflare Turnstile, as described in the section “Newsletter and electronic notifications”.

Voluntary consent to further information: In the registration form you may voluntarily allow me to inform you about future events and to send you my newsletter. These consents are not required for participation and can be withdrawn at any time with effect for the future. They are confirmed in a double opt-in procedure through my dispatch service provider Loops, as described in the section “Newsletter and electronic notifications”.

Types of data processed: Master data, contact data, contract data, payment data, meta/communication data.
Data subjects: Participants, interested parties.
Purposes: Organizing and conducting events, performance of the contract, communication; subject to consent, information about further events and dispatch of the newsletter.
Legal bases: Performance of a contract and pre-contractual inquiries (Article 6(1)(b) GDPR); legal obligations (Article 6(1)(c) GDPR) for commercial and tax retention; consent (Article 6(1)(a) GDPR) for information about further events and the newsletter; legitimate interests (Article 6(1)(f) GDPR) for protection against automated registrations.

Video conferencing (webinars and video calls)

For webinars and video calls I use the browser-based video conferencing of mailbox.org (mailbox.org Meet). I process the data required to participate, in particular the displayed name, audio and video data during the session, and technical connection data. No recording takes place unless this is expressly announced.

Types of data processed: Master data, contact data, content data, meta/communication data.
Data subjects: Participants.
Purposes: Conducting the event, communication.
Legal bases: Performance of a contract and pre-contractual inquiries (Article 6(1)(b) GDPR); legitimate interests (Article 6(1)(f) GDPR).

mailbox.org Meet: Video conferencing service. Service provider: Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Germany. Processing within the European Union, no third-country transfer. Website: mailbox.org; privacy policy: mailbox.org/en/data-protection.

Newsletter and electronic notifications

I send newsletters, emails, and other electronic notifications (“newsletter”) only with the consent of the recipients or on the basis of a legal permission. To the extent the content of the newsletter is specifically described in the context of registration for the newsletter, that description is decisive for the consent of the users. Beyond that, my newsletters contain information about my services and me.

To register for my newsletters, it is generally sufficient if you provide your email address. However, I may ask you to provide additional information if this is necessary for the purposes of the newsletter.

Double opt-in procedure: Registration for my newsletter is carried out in a so-called double opt-in procedure. That is, after registration, you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with other people’s email addresses. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes the storage of the registration and confirmation time as well as the IP address. Changes to your data stored at the dispatch service provider are also logged.

Protection against automated input (Cloudflare Turnstile): My forms (newsletter and webinar registration as well as contact and inquiry forms) are protected against automated and abusive input (bots) by Cloudflare Turnstile. To check whether the input is made by a human, a token is generated and verified server-side at Cloudflare; in the process, your IP address is transmitted to Cloudflare. In the standard configuration I use, Turnstile does not set cookies and does not create cross-device or cross-site profiles. The processing is strictly necessary for the security of this function you have expressly requested (Section 25(2) No. 2 TDDDG) and is based, where personal, on Article 6(1)(f) GDPR. The storage period at Cloudflare is governed by Cloudflare’s data protection terms and data processing agreement.

Erasure and restriction of processing: I may store unsubscribed email addresses for up to three years on the basis of my legitimate interests before I erase them, in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of a possible defense against claims. If you request the erasure of your email address and confirm in your request that you had given your consent, I erase it without undue delay, because I then no longer need to prove the consent. Without this confirmation, I retain it until the three years have expired, solely for this proof. In the case of obligations to observe objections permanently, I reserve the right to store the email address solely for this purpose in a block list (“blocklist”).

The logging of the registration process takes place on the basis of my legitimate interests for the purpose of proving its proper conduct. To the extent I commission a service provider with the dispatch of emails, this takes place on the basis of my legitimate interests in an efficient and secure dispatch system.

Contents: I inform you about contract-law topics as well as about me, my services, products, promotions, and offers.

Types of data processed: Master data, contact data, meta/communication data.
Data subjects: Communication partners.
Purposes: Direct marketing.
Legal bases: Consent (Article 6(1)(a) GDPR); legitimate interests (Article 6(1)(f) GDPR) for logging the registration, retaining unsubscribed email addresses, the dispatch service provider, and protection against automated input.

Opt-out option: You can cancel the receipt of my newsletter at any time, i.e., withdraw your consents or object to further receipt. You will find the link to unsubscribe at the end of each newsletter; you can also unsubscribe through one of the contact options listed above, preferably by email.

No performance measurement: I do not measure open or click rates, do not use tracking pixels (web beacons), and do not create recipient profiles. No analysis of individual reading behavior takes place.

Loops: Email services. Service provider: Astrodon Corporation, 9450 SW Gemini Dr PMB 22902, Beaverton, OR 97008-7105, USA. Basis for third-country transfers: adequacy decision EU-US Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses of the EU Commission (Article 46(2)(c) GDPR). Website: loops.so; privacy policy: loops.so/privacy.

Cloudflare Turnstile: Protection against bots and abuse on my forms (newsletter and webinar registration, contact and inquiry forms). Service provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Basis for third-country transfers: adequacy decision EU-US Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses of the EU Commission (Article 46(2)(c) GDPR). Website: cloudflare.com; privacy policy: cloudflare.com/privacypolicy.

Web analytics, monitoring, and optimization

Web analytics (also referred to as “reach measurement”) serves to evaluate my online offering. With it, I can, for example, recognize the extent to which my online offering is being used. I can also understand which areas need to be optimized.

Among other things, I collect the website(s) visited (page URL), the websites via which visitors access my online offering (HTTP referrer), the browser used, the operating system used, the device type, and the country from which access takes place.

Types of data processed: Usage data, meta/communication data.
Data subjects: Users.
Purposes: Reach measurement.
Legal bases: Legitimate interests (Article 6(1)(f) GDPR).

Cloudflare Web Analytics: Reach measurement via my hosting provider. According to the provider, it operates cookie-free and without client-side storage or reading of information on the device; no cookies are set, no cross-site tracking, no profiling, IP addresses are not stored. Collected in aggregate: page views, referrer sources, browser, operating system, device type, and approximate origin (country). Service provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Basis for third-country transfers: adequacy decision EU-US Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses of the EU Commission (Article 46(2)(c) GDPR). Website: cloudflare.com/web-analytics; privacy policy: cloudflare.com/privacypolicy.

Presence on social networks (social media)

I maintain publicly accessible profiles on social networks in order to provide information about my work and to communicate with interested parties. No content, buttons, or scripts of these networks are embedded on my website; therefore, no data is transmitted to the networks when you visit my pages.

If you access my profiles within a network, that network’s provider processes your data under its own responsibility and, in part, under joint responsibility with me (Article 26 GDPR), regularly also outside the EU and for market research and advertising purposes. I have only limited influence on the nature and scope of this processing. Details and objection options can be found in the privacy policy of the respective provider; data subjects’ rights can also be asserted most effectively there. The networks I use are listed in my legal notice.

Types of data processed: Contact data, content data, usage data, meta/communication data.
Data subjects: Users.
Purposes: Communication, public relations.
Legal bases: Legitimate interests (Article 6(1)(f) GDPR).

Amendment and update of the privacy notice

I ask you to inform yourself regularly about the content of my privacy notice. I adjust the privacy notice as soon as the changes to the data processing carried out by me make this necessary. I will inform you as soon as the changes require any cooperation on your part (for example, consent) or other individual notification.

If I provide addresses and contact information of companies and organizations in this privacy notice, please note that the addresses may change over time and please check the information before making contact.

Rights of data subjects

As a data subject, you have various rights under the GDPR, in particular under Articles 15 to 21 GDPR:

  • Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consents granted at any time.
  • Right of access: You have the right to request confirmation as to whether the data in question is being processed and to obtain access to that data as well as further information and a copy of the data in accordance with the legal requirements.
  • Right to rectification: You have the right, in accordance with the legal requirements, to request the completion of the data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and to restriction of processing: You have the right, in accordance with the legal requirements, to request that data concerning you be erased without undue delay, or, in the alternative, to request a restriction of the processing of the data in accordance with the legal requirements.
  • Right to be informed: You have the right to rectification, erasure, or restriction of processing. If you exercise one of these rights, I will communicate this to all recipients of your data, unless this proves impossible or involves disproportionate effort. You also have the right to be informed about these recipients.
  • Right to data portability: You have the right, in accordance with the legal requirements, to receive data concerning you which you have provided to me in a structured, commonly used, and machine-readable format, or to request its transmission to another controller.
  • Complaint to a supervisory authority: In accordance with the legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the member state in which you habitually reside, the supervisory authority of your place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you violates the GDPR.

Supervisory authority competent for me:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Germany

No automated decision-making: No decision based solely on automated processing, and no profiling within the meaning of Article 22 GDPR, takes place.

As of 4 November 2026