Privacy policy

As of November 2026

This website sets no cookies, uses no analytics or tracking tools and loads no content from other providers. This policy explains which data is still processed and what rights you have.

This is a courtesy translation. Only the German version is legally binding.

Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR, Datenschutz-Grundverordnung, DSGVO) is:

Rechtsanwältin Karolin Hagemann de Grzymala, LL.M. confirm full name
Kanzlei Hagemann de Grzymala
Oppenhoffallee 138–140
52066 Aachen
Germany
Phone: +49 163 8461632
Email: Hagemann@strafverteidigung-ac.de

Check whether a data protection officer must be appointed (Art. 37 GDPR, § 38 BDSG); only name one here if so

Summary

  • No cookies are set and no information is stored on your device.
  • There are no analytics, tracking or advertising tools and no social media plugins.
  • No maps, videos or other content from other providers are embedded.
  • Fonts and video are hosted on our own server. Visiting the site creates no connection to Google Fonts or other third parties.
  • When you visit the pages, the server stores access data that is technically necessary (server log files).
  • The enquiry form sends your details over an encrypted connection to our server, which forwards them straight away as an email to the firm. They are not stored on the server.

Hosting and server log files

This website is run by an external service provider who processes the data on our behalf and according to our instructions: united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. conclude the data processing agreement under Art. 28 GDPR in the customer account add server location

Each time you open a page, your browser sends data to the server for technical reasons. This data is stored in log files (server log files):

  • IP address of the requesting device
  • date and time of access
  • file or page requested
  • the page visited before (referrer), if your browser transmits it
  • browser used (the so-called user agent)

The data is processed to deliver the website, to keep it running reliably and to detect and fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a secure and functioning website. We do not evaluate the log files for analytics or advertising purposes and do not combine them with other data.

Storage period: ask the hosting provider how long log files are kept and add it here

Encrypted connection

The website is delivered only over an encrypted connection (TLS). You can recognise this by “https://” in your browser’s address bar. This means that third parties cannot read the data you transmit when visiting the site while it is on its way.

No cookies, no analytics, no third-party content

We do not set cookies, nor do we store any other information on your device, for example in your browser’s local storage. Consent under § 25 TDDDG (German Telecommunications and Digital Services Data Protection Act) is therefore not required, and there is no cookie banner.

The fonts (Newsreader and Hanken Grotesk) and the video on the homepage are loaded from our own server. Maps, videos or posts from other providers are not embedded.

Links to other websites

Some pages contain links to other services, for example to OpenStreetMap for directions or to the regional bar (Rechtsanwaltskammer). Your browser only connects to that provider when you click such a link. The provider then receives, among other things, your IP address and possibly the information that you came from our website. From then on, that provider’s privacy policy applies.

Contact by phone, email or fax

If you call us or send us an email or a fax, we process the information you give us, such as your name, your contact details and what your enquiry is about. We use it to answer your enquiry and, where applicable, to prepare and carry out an engagement.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at or concerns an engagement, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in answering your enquiry. If you share health data or other special categories of personal data with us, we process them only as far as this is necessary for advice and defence (Art. 9(2)(f) GDPR). We process information about criminal allegations solely in the context of the defence (Art. 10 GDPR in conjunction with § 137 StPO).

Everything you entrust to us is subject to the lawyer’s duty of confidentiality (anwaltliche Verschwiegenheitspflicht, § 43a Abs. 2 BRAO, § 2 BORA). This applies from your very first enquiry and even if no engagement follows. A breach of this duty is also a criminal offence (§ 203 StGB).

Our email inbox is run by a service provider on our behalf: add email provider, data processing agreement under Art. 28 GDPR

A note on email: Emails that are not end-to-end encrypted are not fully protected from access by third parties on their way. So please describe your matter only in broad terms and discuss confidential details by phone or in person.

Enquiry form

When you click “Send enquiry”, your browser transmits what you have entered over an encrypted connection (HTTPS) to our web server. The server forwards it straight away as an email to the firm’s inbox and does not store it. Only the details you enter yourself are processed: topic, title, name, phone number or email address and your message. The legal basis is Art. 6(1)(b) GDPR, because you are asking for advice. Further processing is covered by the section “Contact by phone, email or fax”.

To protect against mass enquiries, the server stores for one hour a check value calculated from your IP address and a secret key. Your IP address itself is not stored for this purpose. The legal basis is our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).

If the enquiry cannot be sent through the server, your own email program opens instead with a prepared message. It is only sent when you send it yourself from there.

Ticking the box in the form only confirms that you have read this privacy policy. Your consent is not required for us to deal with your enquiry.

How long we keep enquiries and case files

If no engagement follows, we delete your enquiry once it has been dealt with, unless statutory retention obligations require us to keep it.

If an engagement follows, we generally keep the case file (Handakte) for six years under § 50 Abs. 1 BRAO. This period begins at the end of the calendar year in which the engagement ended. Documents relevant under tax and commercial law, such as invoices and accounting records, may be subject to separate statutory retention periods of up to ten years (in particular § 147 AO, § 257 HGB).

Recipients and transfers

We only pass on your data where this is necessary to carry out the engagement (for example to the court or the public prosecutor’s office, in agreement with you), where you have consented or where we are legally obliged to do so. Technical service providers such as our hosting provider and email provider process data only on our behalf.

We only transfer data to countries outside the European Union and the European Economic Area if this is necessary for your case, for example in proceedings with a link to another country, and the requirements of Art. 44 et seq. GDPR are met.

Your rights

With regard to the personal data concerning you, you have the following rights towards us:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, simply contact us using the details above. No particular form is required. Where information is subject to the lawyer’s duty of confidentiality, for example data about third parties from a case, the right of access and the duty to provide information may be restricted (§ 29 Abs. 1 BDSG, German Federal Data Protection Act).

Right to object

If we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Art. 21(1) GDPR).

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for the firm is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (Data Protection and Freedom of Information Commissioner of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Postal address: Postfach 20 04 44, 40102 Düsseldorf
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
www.ldi.nrw.de

Obligation to provide data and automated decision-making

You are not obliged to provide us with personal data. Without contact details, however, we cannot answer your enquiry. There is no automated decision-making, including profiling (Art. 22 GDPR).

Changes

This privacy policy is as of November 2026. We will update it if our website, our procedures or the legal situation change.