1. Controller

Attorney-at-law Alexander Zyrewitz
Thierschstraße 3
80538 Munich
Email: a.zyrewitz@zyrewitz.com
Tel.: +49 177 174 97 53

No data protection officer has been appointed, as this is not required by law.

2. Scope

This Privacy Notice explains how the firm processes personal data (referred to below as “data”) both in connection with client engagements and when this website is visited. Personal data means any information relating to an identified or identifiable natural person.

3. Data processing in connection with client engagements (Articles 13 and 14 GDPR)

3.1. Categories, sources and recipients of data

• Categories of data processed: Name, contact details, engagement details, communications, payment and billing information, and any other engagement-related information required to handle the matter.
• Data sources: Data is generally collected directly from the client; where necessary to handle the matter, it may also be obtained from publicly available sources or registers, or from third parties (e.g. the transaction parties, courts or authorities).
• Data recipients (depending on the matter): Courts, authorities, other advisers to the client, the transaction parties and their representatives (when providing my legal services), IT service providers (in compliance with Article 28 GDPR) and, where applicable, experts. Legal professional secrecy remains unaffected; where data is subject to legal professional secrecy, it is disclosed to third parties only in consultation with the client or insofar as permitted or required by professional rules.

3.2. Purposes of processing and legal bases

Personal data is processed for the following purposes:

• Performance of the contract under Article 6(1)(b) GDPR (in particular, provision of legal services, communication and billing);
• Compliance with legal obligations under Article 6(1)(c) GDPR (e.g. professional, tax or anti-money laundering obligations); and
• Pursuit of legitimate interests under Article 6(1)(f) GDPR (e.g. IT security, fraud prevention and the establishment, exercise or defence of legal claims)

The provision of personal data is necessary to provide the legal services and fulfil my professional obligations. Although there is no statutory obligation to provide the data, refusal to do so may make effective representation impossible.

3.3 Retention period

Personal data collected for the engagement is retained until the statutory retention periods applicable to lawyers have expired (generally six years after the end of the calendar year in which the engagement ended) and is then deleted, unless tax or commercial law retention and documentation requirements oblige me to retain it for longer, or continued retention is necessary or permissible.

4. Data processing in connection with the website

4.1. Provision of the website, hosting and server log files

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

When this website is accessed, the hosting provider processes the following information in server log files in particular:

• IP address
• Date and time of access
• URL or file accessed
• Volume of data transferred
• Referrer URL
• Browser or client information (user agent)

Processing such data serves the technical provision, stability and security of the website (e.g. detecting and preventing attacks, analysing errors and ensuring uninterrupted operation).

Legal basis: Article 6(1)(f) GDPR (legitimate interest in secure and functional operation).

IP addresses are generally stored in log files only for as long as necessary to detect and prevent attacks and ensure operation; according to Strato, this period is usually up to seven days, unless security incidents require longer retention in an individual case.

4.2. External fonts (Google Fonts)

This website uses the “Inter” typeface via Google Fonts, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When this website is accessed, the browser connects to Google’s servers to load the font. In doing so, information including the website visitor’s IP address is transmitted to Google. Cookies are not used for marketing purposes in this context.

The fonts are incorporated to ensure a consistent, attractive and technically stable presentation of the website.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in a functional and attractive design).

It cannot be ruled out that data may also be transferred to third countries (e.g. the USA). Transfers are based on appropriate safeguards (in particular, the European Commission’s standard contractual clauses); nevertheless, a residual risk cannot be entirely ruled out.

Further information: https://policies.google.com/privacy

4.3. External icons (Font Awesome via a CDN)

This website uses Font Awesome, delivered via a content delivery network (CDN), to display icons. Font Awesome is provided by Fonticons, Inc., 6 Porter Road, Apartment 3R, Cambridge, MA 02140, USA. The CDN content is generally delivered by Cloudflare, Inc.

When the website loads, the browser connects to the CDN’s servers to retrieve the icons. In doing so, information including the website visitor’s IP address is transmitted.

The icons are incorporated to ensure a consistent and technically reliable presentation.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in a functional and attractive design).

It cannot be ruled out that personal data may be transferred to the USA in this context. Transfers are based on appropriate safeguards (in particular, standard contractual clauses); nevertheless, a residual risk remains.

Further information: https://fontawesome.com/privacy

4.4. Contact by email or telephone

If a website visitor contacts me by email, telephone or via a “mailto:” or “tel:” link, I process the information provided (e.g. name, contact details and the content of the request) to deal with the request and, where applicable, to initiate or carry out an engagement.

Legal basis: Article 6(1)(b) GDPR (steps prior to entering into a contract or performance of a contract) and, alternatively, Article 6(1)(f) GDPR (legitimate interest in efficient communication).

Retention period: Until the request has been dealt with; where it relates to an engagement, the retention periods in section 3.3 apply.

4.5. External links (e.g. LinkedIn)

This website contains links to external websites (e.g. LinkedIn). Clicking an external link takes the website visitor away from this website; from that point onwards, the respective provider is responsible for data processing. Please refer to the respective provider’s privacy notice.

4.6. Cookies / tracking

This website does not use tracking services (e.g. Google Analytics, Matomo or similar services) or marketing or analytics cookies. Technically necessary processing (in particular, server log files) remains unaffected.

5. Rights of data subjects

Individuals whose data is processed as described above have the right:

• under Article 7(3) GDPR, to withdraw any consent given at any time,
• under Article 15 GDPR, to obtain access to the personal data processed,
• under Article 16 GDPR, to request the rectification of inaccurate personal data or the completion of incomplete personal data,
• under Article 17 GDPR, to request deletion, unless a statutory exception applies,
• under Article 18 GDPR, to request restriction of processing,
• under Article 20 GDPR, to data portability,
• under Article 77 GDPR, to lodge a complaint with a supervisory authority.

6. Right to object

Where personal data is processed on the basis of legitimate interests under Article 6(1)(f) GDPR, data subjects have the right under Article 21 GDPR to object to processing on grounds relating to their particular situation. An email to a.zyrewitz@zyrewitz.com is sufficient.

7. Updates and amendments to this Privacy Notice

I reserve the right to update this Privacy Notice to reflect changes in the law or technical changes. The current version published on this website applies.

Last updated: 29 October 2026