Skip Navigation View Sitemap

Privacy Notice for our clients (m/f/d)
How we handle your data and your rights
Information pursuant to Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR)

With the following information, we provide you as a client (m/f/d) with an overview of the processing of your personal data by us and your rights. If you as our client are not a natural person, please forward this information to the persons whose personal data we process because they are our contact persons or are mentioned on documents such as invoices and deeds.

1. Who is responsible for data processing and who can I contact?

The responsible party is:

RD RECHT + DIALOG
Attorney and Notary Ralf-Bernd Rabe
Hauptstraße 138
33647 Bielefeld
Telephone: 0521 94240-0
E-Mail:

You can reach our Data Protection Officer at:

GDI Gesellschaft für Datenschutz und Informationssicherheit mbH
Mr. Dipl.-Inform. Olaf Tenti
Alter Schloßweg 30, 58119 Hagen
Telephone: +49 (0) 2331/356832-0
E-Mail: datenschutz@gdi-mbh.eu

2. What sources and data do we use?

We process data that you transmit to us or that we have received from third parties in the course of the respective mandate or with your permission. In particular, the following personal data and categories of data are processed for the purposes stated in Section 3:

  • Data relating to your person (e.g.: salutation, first name, last name, address, telephone number, e-mail address, nationality, registration numbers, data of an existing legal expenses insurance, information necessary for advice and representation within the scope of the mandate)
  • If you mandate us as a company or association of persons: salutation, first name, last name, e-mail address, contact details, and where applicable the function of the representative person within the company
  • Mandate information such as data on opponents, witnesses and other parties involved, as well as facts and evidence
  • Correspondence with you and on your behalf
  • Payment information such as bank details or data for internet-based payment services
  • Legal relationships with third parties (e.g.: file reference numbers, account or credit numbers, contracts)

On a case-by-case basis, we may also process special categories of personal data within the meaning of Art. 9 Para. 1 GDPR.

3. For what purposes do we process your data (purpose of processing) and on what legal basis?

In the following, we inform you about the purposes for which and the legal basis on which we process your data.

3.1 For the fulfilment of the mandate relationship (Art. 6 Para. 1 lit. b GDPR)
The processing of personal data is necessary for the conduct of legal activities in accordance with professional duties and the content of the mandate, in particular for the preparation of legal briefs, for the conduct of consultations and for litigation, negotiation and enforcement as well as for the preparation of fee invoices.

3.2 Within the framework of the balancing of interests (Art. 6 Para. 1 lit. f GDPR)
We may also use your data on the basis of a balancing of interests to safeguard the legitimate interests of us or of third parties. This may take place in particular for the following purposes:

  • Supporting our employees in client care;
  • Assertion of legal claims and defence in legal disputes;
  • Prevention and investigation of criminal offences;
  • Ensuring IT security and IT operations. Our interest in the respective processing results from the respective purposes and is otherwise of an economic nature (efficient fulfilment of tasks, avoidance of legal risks).

3.3 On the basis of your consent (Art. 6 Para. 1 lit. a GDPR)
Insofar as you have given us your consent to the processing of personal data, the respective consent is the legal basis for the processing stated therein. A consent may be revoked at any time. This also applies to the revocation of declarations of consent that were given before the GDPR came into force, i.e. before 25 May 2018. The revocation only takes effect for the future. Processings that took place before the revocation are not affected. A revocation may be directed to the party named under Section 1.

3.4 On the basis of statutory requirements (Art. 6 Para. 1 lit. c GDPR)
We are subject to various statutory obligations to carry out certain data processing operations (e.g.: the professional and procedural provisions applicable to lawyers under the Federal Lawyers Act (BRAO), e.g. obligations under the Money Laundering Act (GWG) or the obligation to carry out conflict of interest checks).

4. Who receives my data?
Your data will only be disclosed insofar as a legal basis permits this. The data mentioned under Section 2 will be transmitted to other parties involved in the mandate, opposing parties and their representatives (in particular their lawyers) for the purpose of communication as well as for the advice and representation of the mandate. In particular, we may be required to forward your data to courts and authorities. Transmission to public bodies takes place insofar as a statutory obligation exists or you have given your consent to such transmission. Such public bodies may in particular be the tax authorities. Within our firm, only those departments receive your data that require it for the fulfilment of our contractual and statutory obligations or for the fulfilment of their respective tasks. Furthermore, personal data may be transmitted for the purpose of processing the mandate, in particular to tax advisors and IT service providers. This is necessary for the fulfilment of contractual obligations (cf. Section 3), for the identification of potential conflicts of interest, for the carrying out of legally required checks such as anti-money laundering measures or Know-Your-Customer (KYC) checks and for the purposes of general mandate management. In addition, processors (Art. 28 GDPR) engaged by us, in particular in the area of IT services, may process your data on our behalf on the basis of instructions. The data disclosed may only be processed by the respective third party for the stated purposes. The duty of professional confidentiality of lawyers remains unaffected. Insofar as the data is subject to the duty of professional confidentiality of lawyers, disclosure to third parties takes place either in agreement with you or on the basis of a contract pursuant to § 43e Para. 3 BRAO.

5. How long is the data stored?
Where necessary, we process your personal data for the duration of the mandate processing. Your personal data must be stored until the expiry of the statutory retention obligation for lawyers' working files (6 years after the end of the calendar year in which the mandate was concluded, § 50 Para. 1 S. 2 and 3 BRAO) and deleted thereafter, unless we are entitled and obligated to store it for a longer period due to tax and commercial law retention and documentation obligations, for the purposes of conflict of interest checks or for the preservation of evidence within the framework of statutory limitation periods. Records for the fulfilment of obligations under the Money Laundering Act will be deleted after the storage period of five years has expired (§ 8 Para. 4 GWG). Furthermore, we are subject to various retention and documentation obligations, which arise among other things from the German Commercial Code (HGB) and the Tax Code (AO). The periods for retention or documentation stipulated therein are two to ten years. Finally, the storage period is also determined by the statutory limitation periods, which, for example, pursuant to §§ 195 et seq. of the German Civil Code (BGB) are generally three years. This applies to contractual and other data of the legal relationship between you and us.

6. Is data transferred to a third country?
Your data will only be transferred to states outside the European Economic Area – EEA (third countries) if and to the extent that this is necessary for the execution of the contractual relationship or required by law (e.g. accounting, administration) or you have given us your consent. Insofar as we use software from providers based in third countries or software from providers with subcontractors/service providers in third countries for the performance of our contractual relationship, your data or parts of your data may – depending on the purpose of processing – be transferred to third countries (e.g. to the USA). For the USA, an adequacy decision exists within the meaning of Art. 45 Para. 3 GDPR. Personal data from the EU can now be transferred to companies and organisations in the USA that have certified themselves for the EU-U.S. Data Privacy Framework without the need for any further protective measures. This adequacy decision thus serves as the basis for the transfer of data to the service providers we use in the USA. If no adequacy decision within the meaning of Art. 45 Para. 3 GDPR exists or the company or organisation in the USA has not certified itself for the EU-U.S. Data Privacy Framework, we conclude with the respective service providers/suppliers standard data protection clauses issued by the EU Commission within the meaning of Art. 46 Para. 2 lit. c GDPR for the protection of your data. Furthermore, some of our service providers have implemented binding corporate rules (BCR) within the meaning of Art. 47 GDPR for their corporate group or the same group of companies, which have been approved by the respectively competent supervisory authority.

7. What other data protection rights do I have?
You have, under the respective statutory requirements, the right to information (Art. 15 GDPR, § 34 Federal Data Protection Act – BDSG), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR, § 35 BDSG), to restriction of processing (Art. 18 GDPR), to object (Art. 21 GDPR) as well as to data portability (Art. 20 GDPR). The aforementioned rights only apply insofar as they are not precluded by the duty of professional confidentiality of lawyers pursuant to § 43, 43a Para. 2 BRAO (cf. § 29 Para. 1 S. 2 BDSG). In addition, you have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR, § 19 BDSG).

8. To what extent does automated individual decision-making exist?
For the performance of the contractual relationship with you, we do not use automated decision-making pursuant to Art. 22 GDPR. Should we use such procedures in individual cases, we will inform you separately, insofar as this is required by law.

9. To what extent is my data used for profiling?
We do not process your data with the aim of evaluating certain personal aspects (so-called "profiling").

10. Am I obligated to provide data?
You are not legally obligated to provide us with personal data. However, if you do not provide us with the data necessary for the processing of the mandate and the requested legal activity, as well as the data that we must collect and process for legal reasons during and after this activity, we will generally have to refuse to process the mandate.

11. What rights of objection do I have? (Art. 21 GDPR)
You have the right, on grounds arising from your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6 Para. 1 lit. f GDPR (data processing on the basis of a balancing of interests); this also applies to profiling based on this provision within the meaning of Art. 4 No. 4 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims. The objection may be made in any form and should preferably be directed to the contact options stated under Section 1.

As of: 01.06.2026

Back to top