Privacy Notice for our clients (m/f/d)
How we handle your data and your rights
Information pursuant to Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR)

With the following information, we provide you as a client (m/f/d) with an overview of the processing of your personal data by us and your rights. If you as our client are not a natural person, please forward this information to the persons whose personal data we process because they are our contact persons or are mentioned on documents such as invoices and deeds.

1. Who is responsible for data processing and who can I contact?

The responsible party is:

RD RECHT + DIALOG Attorney and Notary Ralf-Bernd Rabe Hauptstraße 138 33647 Bielefeld Telephone: 0521 94240-0 E-Mail: info∂rd-rechtunddialog.de

You can reach our Data Protection Officer at:

GDI Gesellschaft für Datenschutz und Informationssicherheit mbH
Mr. Dipl.-Inform. Olaf Tenti
Alter Schloßweg 30, 58119 Hagen
Telephone: +49 (0) 2331/356832-0
E-Mail: datenschutz∂gdi-mbh.eu

2. What sources and data do we use?
We process data that you transmit to us or that we have received from third parties in the course of the respective official act or with your permission, e.g. from lawyers, brokers or credit institutions commissioned by you. Furthermore, we also collect personal data from publicly accessible sources, e.g.: property data from the land registry office, register data from the commercial register.

In addition, we collect data from other sources, e.g. from creditors. However, this only takes place on the basis of prior instigation by you and for the processing of your specific matter or for the fulfilment of statutory obligations or sovereign activities.

In particular, the following personal data and categories of data are processed for the purposes stated in Section 3:

• Data relating to your person (e.g.: salutation, first name, last name, address, telephone number, e-mail address, nationality, registration numbers, marital status)
• Data relating to persons represented by you (e.g.: salutation, first name, last name, address, date of birth, place of birth, family relationship, nationality, marital status, registration numbers)
• Contents of declarations to be notarised
• Data relating to financial circumstances (e.g.: real estate ownership, other rights to land, business interests, income, insurance, etc.)
• Data in connection with contracts (e.g.: in the case of real estate purchase contracts your tax identification number, where necessary details of your family situation or your financial position or other sensitive data such as health data)
• Payment information such as bank details or data for internet-based payment services
• Legal relationships with third parties (e.g.: file reference numbers, account or credit numbers, contracts)

On a case-by-case basis, we may also process special categories of personal data within the meaning of Art. 9 Para. 1 GDPR.

3. For what purposes do we process your data (purpose of processing) and on what legal basis?

In the following, we inform you about the purposes for which and the legal basis on which we process your data.

3.1 Within the framework of the performance of a task assigned to us that is in the public interest or carried out in the exercise of official authority (Art. 6 Para. 1 lit. e GDPR)
The processing of personal data is necessary for the conduct of notarial activities in accordance with official duties, in particular for the preparation of draft deeds, for the conduct of consultations and for notarisation, for the execution of notarial transactions and for the preparation of fee invoices, for the conduct of consultations.

3.2 On the basis of statutory requirements (Art. 6 Para. 1 lit. c GDPR)
We are subject to various statutory obligations to carry out certain data processing operations (e.g.: the professional and procedural provisions applicable to notaries under the Federal Notarial Code and the Authentication Act).

3.3 Within the framework of the balancing of interests (Art. 6 Para. 1 lit. f GDPR)
We may also use your data on the basis of a balancing of interests to safeguard the legitimate interests of us or of third parties. This may take place in particular for the following purposes:

• Supporting our employees in client care
• Assertion of legal claims and defence in legal disputes
• Prevention and investigation of criminal offences
• Ensuring IT security and IT operations

Our interest in the respective processing results from the respective purposes and is otherwise of an economic nature (efficient fulfilment of tasks, avoidance of legal risks). Insofar as the specific purpose permits, we process your data in pseudonymised or anonymised form.

3.4 On the basis of your consent (Art. 6 Para. 1 lit. a GDPR)
Insofar as you have given us your consent to the processing of personal data, the respective consent is the legal basis for the processing stated therein. A consent may be revoked at any time. This also applies to the revocation of declarations of consent that were given before the GDPR came into force, i.e. before 25 May 2018. The revocation only takes effect for the future. Processings that took place before the revocation are not affected. A revocation may be directed to the party named under Section 1.

4. Who receives my data?
Your data will only be disclosed insofar as a legal basis permits this. The data mentioned under Section 2 will be transmitted to public bodies insofar as a statutory obligation exists or you have given your consent to such transmission. Such public bodies may in particular be other notaries, the tax authorities, the registration courts, the land registry office, the Central Will Registry, the Central Register of Powers of Attorney as well as the Notary Chamber.

Transmission of data to private third parties takes place only for the fulfilment of your specific matter and only at your instigation.

Within our firm, only those departments receive your data that require it for the fulfilment of our contractual and statutory obligations or for the fulfilment of their respective tasks.

Furthermore, personal data may be passed on to IT service providers or similar for the purpose of processing the mandate. This is necessary for the fulfilment of contractual obligations (cf. Section 3). In addition, processors (Art. 28 GDPR) engaged by us, in particular in the area of IT services, notary software providers, web hosters as well as NotarNet GmbH, may process your data on our behalf on the basis of instructions.

5. How long is the data stored?
For notarial deeds and other documentation from notarial matters, the retention periods from the Service Regulations for Notaries (DONot) and pursuant to § 50 Para. 1 of the Regulation on the Keeping of Notarial Files and Registers (NotAktVV) apply, namely:

• 100 years for the deed register, electronic deed collection, inheritance contract collection and special collection,
• 30 years for the paper-based deed collection, custody register and general files,
• 7 years for the collective file for bills of exchange and cheque protests and ancillary files, whereby the notary may determine in writing a longer retention period at the latest upon the last substantive processing, e.g. in the case of testamentary dispositions or in the event of the risk of recourse; the determination may also be made generally for individual types of legal transactions.

Furthermore, we are subject to various retention and documentation obligations, which arise among other things from the German Commercial Code (HGB) and the Tax Code (AO). The periods for retention or documentation stipulated therein are two to ten years. Finally, the storage period is also determined by the statutory limitation periods, which, for example, pursuant to §§ 195 et seq. of the German Civil Code (BGB) are generally three years. This applies to contractual and other data of the legal relationship between you and us.

6. Is data transferred to a third country?
Your data will only be transferred to states outside the European Economic Area – EEA (third countries) if and to the extent that this is necessary for the execution of the contractual relationship or required by law (e.g. accounting, administration) or you have given us your consent. Insofar as we use software from providers based in third countries or software from providers with subcontractors/service providers in third countries for the performance of notarial activities, your data or parts of your data may – depending on the purpose of processing – be transferred to third countries (e.g. to the USA). For the USA, an adequacy decision exists within the meaning of Art. 45 Para. 3 GDPR. Personal data from the EU can now be transferred to companies and organisations in the USA that have certified themselves for the EU-U.S. Data Privacy Framework without the need for any further protective measures. This adequacy decision thus serves as the basis for the transfer of data to the service providers we use in the USA. If no adequacy decision within the meaning of Art. 45 Para. 3 GDPR exists or the company or organisation in the USA has not certified itself for the EU-U.S. Data Privacy Framework, we conclude with the respective service providers/suppliers standard data protection clauses issued by the EU Commission within the meaning of Art. 46 Para. 2 lit. c GDPR for the protection of your data. Furthermore, some of our service providers have implemented binding corporate rules (BCR) within the meaning of Art. 47 GDPR for their corporate group or the same group of companies, which have been approved by the respectively competent supervisory authority.

7. What other data protection rights do I have?
You have, under the respective statutory requirements, the right to information (Art. 15 GDPR, § 34 Federal Data Protection Act – BDSG), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR, § 35 BDSG), to restriction of processing (Art. 18 GDPR), to object (Art. 21 GDPR) as well as to data portability (Art. 20 GDPR). The aforementioned rights only apply insofar as they are not precluded by the duty of notarial confidentiality pursuant to § 18 BNotO (cf. § 29 Para. 1 S. 2 BDSG). In addition, you have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR, § 19 BDSG).

8. To what extent does automated individual decision-making exist?
For the performance of notarial activities, we do not use automated decision-making pursuant to Art. 22 GDPR. Should we use such procedures in individual cases, we will inform you separately, insofar as this is required by law.

9. To what extent is my data used for profiling?
We do not process your data with the aim of evaluating certain personal aspects (so-called "profiling").

10. Am I obligated to provide data?
You are not legally obligated to provide us with personal data. However, if you do not provide us with the data necessary for the processing of the official transaction and the requested notarial activity, as well as the data that we must collect and process for legal reasons during and after this activity, we will generally have to refuse to carry out the official transaction.

11. What rights of objection do I have? (Art. 21 GDPR)
You have the right, on grounds arising from your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6 Para. 1 lit. f GDPR (data processing on the basis of a balancing of interests); this also applies to profiling based on this provision within the meaning of Art. 4 No. 4 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims. The objection may be made in any form and should preferably be directed to the contact options stated under Section 1.

As of: 01.06.2026