Privacy Notice

In the context of our professional activities, CHSH Cerha Hempel Spiegelfeld Hlawati Rechtsanwälte GmbH and, where applicable, the independent lawyer cooperating with us advising you (hereinafter "we", "us" or "our") processes – as the controller within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter "GDPR") – your personal data and the personal data of your employees and/or members of corporate bodies (hereinafter "you" or "your"). This privacy notice informs you of the details of the processing of your personal data. Personal data is all information which relates to an identified or identifiable person, such as his/her name, date of birth, address etc. (hereinafter "data").

NOTE: If we provide our professional services to legal entities, we kindly ask our contract and business partners to bring this privacy notice to the attention of the natural persons concerned (in particular employees and members of corporate bodies).

A. Data processing in connection with our service

1) For what purposes do we process your data and on which legal basis?

We process your data for the following purposes and on the following legal bases:

a. Contractual performance

We process the data of our contract partners (clients, suppliers, etc.) for the purpose of the performance of a contract, i.e. so as to provide our legal services or other contractually agreed services. Such processing is lawful on the basis of Article 6(1)(b) GDPR (performance of a contract).
If this data is not provided to us in full or at all, we may not be able to meet all of our contractual obligations or to conclude the contract in the first place.

b. Compliance with legal obligations

Furthermore, we process personal data in order to comply with the legal obligations to which we are subject (e.g. retention periods established under the Federal Fiscal Code and the Act on Attorneys, anti-money laundering legislation). Such processing is lawful on the basis of Article 6(1)(c) GDPR (compliance with a legal obligation).
Also in this regard, we may not be able to meet all of our contractual obligations or conclude the contract in the first place, if data are not provided in full or at all.

c. Management and database of contract partners

Furthermore, we process your data for administration and business management purposes (e.g. bookkeeping, cost accounting, maintaining a database of contract partners). Such processing is conducted on the basis of our legitimate interest in running our business properly and efficiently and in managing and optimising the selection of our contract partners (suppliers, tradesmen, etc.) and thus is lawful on the basis of Article 6(1)(f) GDPR.

d. Client management and marketing

Lastly, we process the personal data of current, former and potential clients and their employees for the purposes of client management and marketing. Such processing is conducted on the grounds of our legitimate interest in maintaining and developing existing and former client contacts and in acquiring new clients and thus is lawful on the basis of Article 6(1)(f) GDPR.

2) Who receives your data?

Your data will be disclosed by us only if there is a valid legal basis for such disclosure and provided it does not violate our duty of confidentiality. In any case, we only disclose your data to the extent necessary for each specific purpose, or as required under the relevant legal provision, in line with any legitimate interest or, in the case of consent, as specified by you.
Where necessary, your data will be disclosed in particular to the following recipients:

  • Our CHSH partner law firms, to the extent this is necessary for the purpose of providing legal advice
  • Independent attorneys (substitutes) cooperating with CHSH
  • Tax consultants or auditors
  • Bar associations
  • Banks
  • Insurance undertakings
  • Courts and authorities
  • Opponents and their legal representation
  • Service providers (e.g. travel companies, chauffeur services, hotels)

Furthermore, we sometimes use service providers (data processors) for data processing (in particular for technical support). These processors have agreed to maintain the confidentiality of your data, are carefully selected by us, and are bound by our instructions. In particular, we employ the services of the following processors:

  • ADVOKAT Unternehmensberatung Greiter & Greiter GmbH, Andreas-Hofer-Straße 39B, 6020 Innsbruck
  • jweiland.net, Jochen Weiland, Echterdinger Straße 57, Gebäude 9, 70794 Filderstadt, Germany

3) How long will your personal data be retained?

In principle, we retain your data until the contractual relationship is fulfilled or has ended. Furthermore, we are subject to multiple retention obligations, in accordance with which data are also required to be retained beyond the term of the contract, as stipulated for instance on the basis of retention periods provided under tax law or professional rules of conduct. We also retain your data, where appropriate, as long as legal claims can be made in connection with your agreement. In the case of pending administrative or judicial proceedings, your data will be retained until termination of the respective proceedings.
Moreover, we retain your data beyond the term of the contractual relationship as part of our database of contract partners and for the purposes of client management. We delete your data if you object to such data processing or if there has been no contact with you for business purposes over a period of two years.

B. Data processing in connection with our website

1) Provision of the website and creation of log files

a. Description and scope of data processing

Each time our internet site is accessed, our system collects automated data and information from the computer system accessing our site.
The following data is collected:

  • Information on the type of browser and the version being used
  • Language and version of the browser software
  • Operating system and interface used
  • The user's IP address
  • Date and time of access and time zone difference to Greenwich Mean Time (GMT)
  • Volume of data transmitted
  • Websites from which the user's system accesses our website
  • Websites accessed by the user's system via our website
  • Access status / HTTP status code

The data are likewise stored in our system's log files.

b. Legal basis for data processing

The temporary storage of data and log files is lawful under Article 6(1)(f) GDPR.

c. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the user's computer to retrieve and display the website. For this purpose, the user's IP address must be stored for the duration of the session.
The data is stored in log files to guarantee the functionality of the website. Furthermore, the data help us optimise the website and guarantee the security of our information technology systems.
Our legitimate interest in processing data as provided for under Article 6(1)(f) GDPR also consists in achieving these objectives.

d. Duration of storage

The data are deleted or anonymised at the end of each session.
In the event the data are stored in log files, these files will be deleted after 3 days. Data are not stored for a period exceeding this in any format which would make it possible for the persons concerned to be identified.

e. Recipients

Your data will be transferred to:

  • jweiland.net, Jochen Weiland, Echterdinger Straße 57, Gebäude 9, 70794 Filderstadt, Germany (IT service provider)
  • Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

2) Use of cookies

a. Definition of cookies

Cookies are small text files stored in your browser. They are downloaded by your browser the first time you visit our website. The next time this website is visited using the same terminal or browser, the cookie and the information stored in it will be sent either to the respective website which set it (first party cookie) or to another website to which it belongs (third party cookie). In this way, the cookie recognises that the website was requested using the respective browser and this changes the way in which content is displayed. For instance, cookies "remember" your preferences, how you use a site, and to some degree they adapt the offers shown to the individual.

b. Functionally necessary cookies

We use the following cookies for the purpose of transmitting messages and providing the services requested by you. The data processing activities undertaken by employing the use of cookies are based on our legitimate interests in providing a fully functioning website and the services requested by you (Article 6(1)(f) GDPR, Section 96 para. 3 of the Telecommunications Act).

Cookie

Types of data

Purposes

Storage period

Recipients

fe_typo_user

Hash (a sequence of randomly generated numbers) (no personal data involved)

Recognition of the user during the session

Session

jweiland.net (Hosting Provider)

c. Other cookies

i. General

Furthermore, we use the following cookies based on the consent you may have given (Article 6(1)(a) GDPR, Section 96 para. 3 of the Telecommunications Act).

Cookie

Types of data

Purposes

Storage period

Recipients

_gat

Integer value (e.g. 1)

Reduction of the request rate

1 minute

Google LLC

_gid

Randomly allocated identification number

Differentiation of users and the tracking of user behaviour

1 day

Google LLC

_ga

Randomly allocated identification number

Differentiation of users and the tracking of user behaviour

2 years

Google LLC

ii. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics uses what are known as "cookies", i.e. text files stored on your computer, which make it possible to analyse your use of the website. The information generated by the cookie concerning your use of the website (including a truncated version of your IP address) is – as a general rule – transferred to and stored on a server operated by Google in the United States.
This website uses Google Analytics solely with the "anonymizeIp()" extension, which guarantees the anonymization of the IP address by a process of truncation and eliminates any direct reference to individuals. By using this extension, your IP address will be truncated by Google within the Member States of the European Union or in other states party to the Agreement on the European Economic Area before such transfer of data takes place. Only in exceptional circumstances will the complete IP address be transferred to and stored on a server operated by Google in the United States.

iii. Your cookie settings on this website

If you block cookies completely or would like to limit the placement of cookies, you can change the settings in your internet browser. Cookies already stored can be deleted at any time. If cookies are deactivated for our website, it is possible that you will not be able to take full advantage of all of the functions of the website.
You can find out how to manage and delete cookies in the help function integrated into the respective browser. Further information on this subject can be found under the following links:

Internet Explorer:

http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies

Firefox:

https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

Chrome:

http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647

Safari:

https://support.apple.com/kb/ph21411?locale=de_DE

Opera:

http://help.opera.com/Windows/10.20/de/cookies.html

Deactivate first and third party cookies that are not functionally necessary.

3. Newsletter

a. Purpose

CHSH stores and processes your email address and your name for the purpose of sending to you emails that contain useful information about CHSH, events and the latest economic and legal developments.
Furthermore, CHSH stores your IP address and the times of registration respectively for the purpose of proving your registration and, where appropriate, investigating and clarifying any possible misuse of your personal data.
For the purposes of customer care, CHSH stores other contact details (such as telephone number and address) and your position and information regarding the company you work for.
Furthermore, we measure the performance of the newsletter by processing data on whether the newsletter was opened (yes/no) ("opening rate"), information on which sections of the newsletter were clicked ("click behaviour"), as well as information on the technical deliverability of the newsletter ("bounces", e.g. whether the newsletter could not be delivered due to an incorrect email address). Such data are generated by the system.

b. Legal basis

Your email address is processed on the basis of the consent you have given in accordance with Section 107 of the Telecommunications Act and Article 6(1)(a) GDPR. You have the right to revoke your consent at any time free of charge.
You can revoke your consent at any time by clicking on the link in any email providing information or by sending an email to dataprotection@chsh.com.
Your IP address, the times of registration and confirmation from the confirmation link are processed on the basis of our legitimate interest under Article 6(1)(f) GDPR. Our legitimate interest consists in proving your registration and, where appropriate, investigating and clarifying any possible misuse of your personal data.
The data stored for the purposes of customer care are processed on the basis of the legitimate interest we have in maintaining contact and good relations with our clients, as provided for under Article 6(1)(f) GDPR.
We base our processing of the information you provide to us on a voluntarily basis and the collection of data in order to measure performance on the legitimate interests of CHSH (marketing purposes; Article 6(1)(f) GDPR).
You provide your data to CHSH on a voluntarily basis without being under a statutory or contractual obligation to do so. However, the processing of your email address is necessary in order to be able to send you the respective newsletter. Failure to provide an email address means that CHSH cannot send the newsletter to you.

c. Storage / deletion

When you unsubscribe from the newsletter, this is automatically noted in the newsletter database. This ensures you do not receive the newsletter from the time you unsubscribe. 
The consent given to receive the newsletter is stored for a period of 12 months from the time of registration for the newsletter.
Email address data are stored in our system so long as the newsletter subscription is active. If the user decides to unsubscribe from the newsletter, the data on our servers will be deleted within four weeks. For statistical purposes, only anonymised data and data that cannot be used to identify the user are retained.

d. Recipients

We employ the services of a processor to distribute the newsletter. eworx Network & Internet GmbH, with its registered office at Hanriederstraße 25, 4150 Rohrbach-Berg, Austria, distributes the newsletter on our behalf. We provide the company with your email address and name.

4) Career portal

Your data will also be processed and stored by CHSH if you register on our career portal. More details can be found in the separate privacy notice which is automatically made available to you during the registration process.

5) Processors

In some instances, we engage the services of external service providers (so-called processors) to process personal data. They were carefully selected and commissioned by us, are bound by our instructions and are regularly monitored.
The following processors act on our behalf:

  • jweiland.net, Jochen Weiland, Echterdinger Straße 57, Gebäude 9, 70794 Filderstadt, Germany
  • eworx Network & Internet GmbH, Hanriederstraße 25, 4150 Rohrbach-Berg
  • Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
  • next layer Telekommunikationsdienstleistungs- und BeratungsGmbH, Mariahilfer Gürtel 37/7, 1150 Vienna, Austria

6) Transfers outside of the EEA

Google LLC ("Google"), which has its registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, processes data on our behalf. We send Google your IP address (in an anonymised format), information on websites accessed (URLs) and estimations regarding demography and age. This transfer is lawful on the grounds of our legitimate interest in performing statistical analysis of user behaviour for optimisation and marketing purposes (Article 6(1)(f) GDPR).
Google is certified for the US-EU data protection framework "Privacy Shield", which guarantees compliance with the level of data protection applicable in the European Union. Furthermore, in addition to Google's general security measures which are used group-wide, the data will only be transmitted in pseudonymous form. It is thus not possible to associate any specific data with you.

C. Your rights in connection with the processing of your data

The General Data Protection Regulation (Regulation (EU) 2016/679) grants you as a data subject certain rights to which we wish to draw your attention in the following. Please note that these rights are complementary, which means that you can for instance either request that your data be rectified/completed or that it be erased.

  1. Revocation of consent

    Where CHSH processes your personal data with your consent, you have the right to revoke your consent at any time. However, this does not affect the lawfulness of the processing of data conducted up until the time of revocation.
  2. Right of access

    You have the right to obtain information on the origin, categories, storage duration, recipients, and purpose of the data relating to you processed by CHSH, as well as information on the nature of the processing.
  3. Right to rectification and erasure

    In the event CHSH processes data relating to you that are incorrect or incomplete, you have the right to request that the data be rectified or completed. Further, you have the right to request the erasure of data processed unlawfully.
  4. Right to restrict processing

    If it is unclear whether the processed data relating to you are incorrect or incomplete or whether they are being or have been unlawfully processed, you have the right to request the restriction of the processing of your data until such time as this issue is clarified.
  5. Right to object

    You have the right to object to the processing of your data even if the data relating to you are correct and complete and even if they are being processed lawfully by CHSH. However, you may only do so in situations in which you provide special justification.
  6. Right to data portability

    You have a right to obtain data relating to you that have been processed by CHSH, which CHSH received from you, in a machine-readable format determined by CHSH or you may instruct CHSH to transfer the data directly to a third party of your choosing provided, however, that CHSH makes this possible for the recipient from a technical perspective and that the transfer of data is not hindered or impeded due to it being an unreasonable burden and providing no other confidentiality obligations or considerations on the part of CHSH or third parties stand in the way of such transfer.
  7. Right to lodge a complaint

    Lastly, you have a right to lodge a complaint with the Data Protection Agency if you are of the view that the processing of the personal data relating to you breaches the provisions of the General Data Protection Regulation (Regulation (EU) 2016/679).
  8. To whom can you turn to enforce your rights as a data subject?

    To assert the aforementioned rights, please write (via letter or email) to the contact specified below.

Contact us:
Cerha Hempel Spiegelfeld Hlawati
Rechtsanwälte GmbH
Parkring 2
A-1010 Vienna
Email: datenschutz(at)chsh.com