Privacy policy

Last updated: October 2026

This privacy policy informs you in accordance with Art. 13 GDPR about the personal data processed when you visit this website and when you contact me.

1. Controller

The controller responsible for data processing is:

HK Legal – Kanzlei Havlik
Rechtsanwalt Georg Havlik
Spenerstraße 24
60320 Frankfurt am Main
Germany
Phone (mobile): +49 171 7697328
Fax: +49 69 900 188 24
Email: havlik@hk-legal.de

No data protection officer has been appointed, as there is no legal obligation to do so. If you have any questions about data protection, please use the contact details above.

2. Overview

This website provides information about my work as a lawyer. It does not set cookies or use any comparable technologies to store or access information on your device (Section 25 TDDDG). No analytics or tracking tools, social media plugins, contact forms or embedded third-party content are used. Fonts and images are loaded from the website's own server; no connection to third-party servers (such as Google) is established when you visit the website.

Links to external websites (e.g. LinkedIn) are only accessed when you click them. The respective provider is responsible for data processing on those websites. For online appointment booking via Microsoft Bookings, see section 6.

3. Hosting and server log files

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (“STRATO”). When you access the website, your browser automatically transmits information to the server, which is stored in server log files. This includes in particular:

• IP address,
• date and time of the request,
• page or file requested,
• referrer URL (the previously visited page),
• browser type and version,
• operating system used,
• host name of the accessing computer.

This processing is necessary to deliver the website, to ensure its stability and security and to detect misuse. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the website in a technically error-free and secure manner. This data is not combined with other data sources. The log files are deleted as soon as they are no longer required for these purposes.

A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO. STRATO processes the data only on my instructions. Further information can be found in STRATO's privacy policy.

4. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar and the padlock symbol. When the connection is encrypted, the data you transmit to this website cannot be read by third parties.

5. Contact by email, telephone or fax

If you contact me by email, telephone or fax, I process the data you provide (e.g. name, contact details, content of your enquiry and any documents sent) in order to handle your enquiry and answer follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a mandate; otherwise, processing is based on my legitimate interest in handling enquiries addressed to me (Art. 6(1)(f) GDPR). Where I check for conflicts of interest before accepting a mandate, this is done to comply with my professional obligations (Section 43a(4) BRAO, Art. 6(1)(c) GDPR).

For email and online appointment booking I use Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Emails you send me are therefore stored and processed on Microsoft servers. Microsoft acts as a processor pursuant to Art. 28 GDPR on the basis of the Microsoft Products and Services Data Protection Addendum (DPA) and is obliged to maintain confidentiality in accordance with Section 43e BRAO. A transfer of personal data to the USA cannot be ruled out; such transfers are based on the EU-US Data Privacy Framework and, in addition, on the European Commission's standard contractual clauses.

Please note that unencrypted emails can be read by third parties in transit. Please do not send confidential documents before a mandate has been accepted.

6. Online appointment booking via Microsoft Bookings and Microsoft Teams

This website contains a “Book a consultation” button that you can use to arrange an initial consultation. It is a plain link: the Microsoft Bookings booking page only opens in a new tab once you click it. Before you click, no data is transferred to Microsoft via this website.

The provider of Microsoft Bookings and Microsoft Teams is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

When you book an appointment, the data you provide is processed, in particular your name, email address, telephone number (if provided), the topic of your enquiry and the chosen appointment time.

The initial consultation takes place via Microsoft Teams. The following data is processed: your name or display name and email address, video and audio data and the content of any screen sharing for the duration of the call, chat content (if you use the chat) and meeting metadata such as date, time and duration. For technical reasons, connection and device data (e.g. IP address, device and browser information) is also recorded in Microsoft's log files. Calls are not recorded. You can join as a guest via a web browser without a Microsoft account and switch off your camera and microphone at any time. If you prefer not to use Microsoft Teams, you can instead hold the initial consultation by telephone or in person at the office; please contact me by email or telephone to arrange this.

Data processed when booking an appointment and when holding the call via Microsoft Teams is processed for the purpose of arranging and holding the initial consultation and thus for the performance of a contract or for taking steps prior to entering into a contract. The legal basis is Art. 6(1)(b) GDPR. Where processing goes beyond this, it is based on my legitimate interest in efficient scheduling (Art. 6(1)(f) GDPR).

The data is processed on Microsoft servers. Microsoft acts as a processor within the meaning of Art. 28 GDPR and processes the data solely on my behalf and on my instructions on the basis of the Microsoft Products and Services Data Protection Addendum (DPA). As a service provider to a professional bound by legal privilege, Microsoft is obliged to maintain confidentiality in accordance with Section 43e of the Federal Lawyers' Act (BRAO).

A transfer of personal data to the USA cannot be ruled out. Such transfers are based on the EU-US Data Privacy Framework and, in addition, on the European Commission's standard contractual clauses.

Booking data is deleted as soon as it is no longer required for the stated purpose. If you cancel an appointment, the booking data is deleted without undue delay unless there is another reason for further storage. If no further mandate is given following the initial consultation, the booking data is deleted no later than six months after the appointment, unless statutory retention obligations prevent this. If a mandate is given, the data becomes part of the client file and is retained for six years in accordance with Section 50 BRAO; this period begins at the end of the calendar year in which the mandate ended. Invoices and other documents relevant under tax or commercial law, for example for billing the initial consultation, are retained in accordance with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). Any storage of data by Microsoft within its services (e.g. technical log data) is otherwise governed by Microsoft's contractual terms.

7. Confidentiality and recipients

As a lawyer, I am bound by professional secrecy (Section 43a(2) BRAO, Section 203 of the German Criminal Code (StGB)). I only disclose personal data where this is necessary to handle your enquiry, where there is a legal obligation or where you have consented. Recipients are the service providers named in this policy, STRATO (website hosting) and Microsoft (email, appointment booking, video calls), which act as processors. I select service providers who may gain access to information subject to professional secrecy carefully in accordance with Section 43e BRAO and oblige them to maintain confidentiality.

8. Storage period

I store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. Enquiries that do not lead to a mandate are deleted once they have been fully dealt with, unless statutory retention obligations prevent this. If a mandate is given, the data becomes part of the client file and is retained for six years in accordance with Section 50 BRAO; this period begins at the end of the calendar year in which the mandate ended. Invoices and other documents relevant under tax or commercial law are retained in accordance with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). For the storage period of server log files, see section 3; for booking data, see section 6.

9. Your rights

Subject to the statutory provisions, you have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) and
• object to processing (Art. 21 GDPR, see section 10).

These rights may be restricted by law, in particular where information is subject to lawyers' professional secrecy (Section 29 of the Federal Data Protection Act (BDSG)). To exercise your rights, simply send a message to the contact details in section 1.

10. Right to object under Art. 21 GDPR

11. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
(Hessian Commissioner for Data Protection and Freedom of Information)
Wilhelmstraße 7
65185 Wiesbaden, Germany
datenschutz.hessen.de

12. Provision of data and automated decision-making

You are under no legal or contractual obligation to provide me with personal data. Without your contact details, however, I cannot respond to your enquiry. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

13. Changes to this privacy policy

I update this privacy policy when the website, the services used or the legal situation change. The version published on this page applies.

Last updated: October 2026