In this privacy policy, Luecke und Partner mbB, Rechtsanwälte Steuerberater (attorneys at law, tax advisors), informs you about the nature, scope and purpose of the collection and use of your personal data when you visit and use our website www.luecke-und-partner.com (II. and III.), when you contact us (IV.), when you instruct us (V.) and in court proceedings or other proceedings (VI.).

If you are redirected to other websites via links we provide, please inform yourself there about the scope of the collection, processing, use and/or disclosure of your personal data, as we have no influence on this.

The operator of this website and the controller responsible for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

Luecke und Partner mbB
Rechtsanwälte Steuerberater
Im Fleetkontor Gertrudenkirchhof 10
20095 Hamburg
Germany

Phone +49 40 278 758 40
Fax +49 40 278 758 428

Email: info@luecke-und-partner.com

Web: www.luecke-und-partner.com

Pursuant to Art. 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes, for example, first and last name, title, postal address, email address, telephone number, mobile phone number, user name and password as well as IP addresses.

You can visit our website www.luecke-und-partner.com without disclosing your identity; only so-called access data is collected and temporarily stored by our hosting provider (see section II. 5.) in a log file. The following information is recorded without any action on your part and stored until it is automatically deleted:

We process the above data for the following purposes:

The IP address is only evaluated in the event of attacks on the network infrastructure. It is not evaluated for statistical, analytical or marketing purposes.

The log file information listed above is automatically deleted after 30 days.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest arises from our interest in security and the need to provide our website without disruption.

You may request the erasure of the data collected about you by writing informally to info@luecke-und-partner.com. You may also object to the processing pursuant to Art. 21 GDPR (see section X.). Please note that recording the access data is technically necessary to provide the website; the log files are in any case automatically deleted after 30 days.

Our website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The access data listed in section II. is processed on IONOS servers. We have concluded a data processing agreement with IONOS pursuant to Art. 28 GDPR, which ensures that IONOS processes the data exclusively in accordance with our instructions and in compliance with the GDPR. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and reliable provision of our website.

All content on our website, including fonts and scripts, is delivered from our own web space. We do not embed content from external providers (e.g. Google Fonts, content delivery networks, video platforms or map services) and do not use any analytics, tracking or marketing services.

Our website does not set any cookies, nor does it otherwise access or store information on your device (Section 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG). Consent is therefore not required, and no cookie banner is displayed.

You can contact us by email or by telephone. Our work for clients may also require us to contact you as an opposing party in litigation or other proceedings (see section VI.).

If you send us an email, the personal data you transmit by email will be stored.

If you contact us by telephone, your telephone number is stored by our telephone system so that we can call you back if necessary. Telephone numbers stored in the telephone system are automatically deleted after 30 days. If contact is successfully established, we record your telephone number, your name and your concern in order to deal with it.

Where this involves information relating to a client matter, it is added to the case file.

The following data is regularly stored when you contact us by email or telephone

The purpose of processing your personal data is to handle your enquiry.

Your data will be deleted as soon as the respective purpose of communication no longer applies, i.e. when the circumstances indicate that the matter concerned has been conclusively resolved or any contractual relationship has ended and the statutory retention period has expired. The retention periods under tax and commercial law pursuant to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB) are six, eight or ten years, depending on the type of document. The periods begin at the end of the calendar year in which the documents were created.

If your data has been included in a case file, we are obliged under Section 50 of the Federal Lawyers' Act (BRAO) to retain it for six years; for tax advisory mandates, the retention period for case files is ten years under Section 66 of the Tax Advisors Act (StBerG) (see also section V.). The period begins at the end of the calendar year in which the mandate ended. We ensure that the data is protected against unauthorised access until then.

The legal basis for processing the data transmitted when you contact us is Art. 6(1)(f) GDPR. Our legitimate interest lies in handling your enquiry. If your enquiry is aimed at instructing us or at another contractual relationship, the processing is based on Art. 6(1)(b) GDPR.

You have the right to object to the processing of your personal data. To do so, please send an email to: info@luecke-und-partner.com. In this case, all personal data stored in connection with your enquiry will be deleted, provided that no retention periods prevent this and we no longer need your data to perform a contract.

If you instruct us to look after and represent your legal interests, personal data will be collected and processed within the scope of this client relationship, either from you or through our own research.

When you instruct us, we regularly hold the following personal data about you:

This data is collected for the following purposes:

In accordance with our professional retention obligations, the personal data we collect in the course of a mandate is stored for six years (Section 50(1) BRAO) or, for tax advisory mandates, ten years (Section 66(1) StBerG), in each case from the end of the calendar year in which the mandate ended, and is deleted within a reasonable period thereafter, unless we are obliged under Art. 6(1)(c) GDPR to store it for longer due to retention and documentation obligations under tax and commercial law (in particular under the HGB, AO and GwG), or you have consented to longer storage pursuant to Art. 6(1)(a) and/or Art. 9(2)(a) GDPR.

Documents and information that we have collected to fulfil our due diligence obligations under the GwG are retained for five years pursuant to Section 8(4) GwG; the period begins at the end of the calendar year in which the business relationship ends.

The data is processed at your request and is necessary under Art. 6(1)(b) GDPR for the stated purposes, for the proper handling of the mandate and for the performance of mutual obligations under the engagement agreement. In the course of properly conducting the mandate, we are also obliged to process your data in accordance with Art. 6(1)(c) GDPR. Processing to fulfil obligations under the GwG is based on Art. 6(1)(c) GDPR in conjunction with the provisions of the GwG. Insofar as we process special categories of personal data (Art. 9(1) GDPR), this is done on the basis of Art. 9(2)(f) GDPR (establishment, exercise or defence of legal claims) or your explicit consent pursuant to Art. 9(2)(a) GDPR.

Providing the above data is necessary for concluding and performing the engagement agreement; in some cases you are also legally obliged to do so (e.g. duty to cooperate under Section 11(6) GwG). Without this data, we cannot accept or continue the mandate.

Due to our professional duty of confidentiality, we are generally not permitted to disclose your data to third parties. Data is therefore not disclosed without your express consent pursuant to Art. 6(1)(a) GDPR and/or Art. 9(2)(a) GDPR, unless this is necessary for handling the client relationship with you (Art. 6(1)(b) GDPR), for complying with a legal obligation (Art. 6(1)(c) GDPR), or for enforcing our rights, such as claims arising from the contractual relationship with you.

In handling the client relationship, it may for example be necessary to disclose some of your personal data to opposing parties and/or their representatives (in particular their lawyers), as well as to courts, tax authorities and other authorities, to your legal expenses insurer where applicable (insofar as you have instructed us to do so), and, in the event of a liability claim, to our professional liability insurer, for the purpose of correspondence and the assertion and defence of your rights. The data disclosed may be used by third parties exclusively for the stated purposes. For the purposes of file management and maintenance of our IT infrastructure, external service providers are given access to personal data only if they have undertaken in data processing agreements to take special precautions to protect your data, have been obliged to maintain confidentiality pursuant to Section 43e BRAO or Section 62a StBerG, and can guarantee compliance with these precautions.

Within our firm, only those employees whose knowledge is necessary to perform the respective task within the client relationship have access to your data.

Insofar as the processing is based on Art. 6(1)(b) or (c) GDPR, there is no right to object under Art. 21 GDPR. However, you may request the erasure of your data (Art. 17 GDPR); we will comply with this provided that no statutory retention obligations prevent it and we no longer need your data to handle the mandate or to establish, exercise or defend legal claims. To do so, please send an email to: info@luecke-und-partner.com.

In the course of our work as lawyers, we may process your personal data as a party to proceedings or litigation. In this case, we usually receive your data from our clients for the purpose of properly representing their interests, or from public bodies such as courts in the course of handling the mandate.

This regularly includes:

Your personal data is processed for the purpose of legal advice and representation of interests and, where applicable, the proper conduct of litigation.

In accordance with our professional retention obligations, the personal data collected in the course of a mandate is retained for six years (Section 50(1) BRAO) or, for tax advisory mandates, ten years (Section 66(1) StBerG), in each case from the end of the calendar year in which the respective mandate ended, and is deleted within a reasonable period thereafter, unless we are obliged under Art. 6(1)(c) GDPR to store it for longer due to retention and documentation obligations under tax and commercial law (in particular under the HGB and AO).

The legal basis for the processing is Art. 6(1)(f) GDPR and Art. 6(1)(c) GDPR; in the course of properly conducting a mandate, we are obliged to process your data. The legitimate interest of our clients and our own legitimate interest lie in the establishment, exercise and defence of legal claims and in the proper representation of interests. Insofar as special categories of personal data (Art. 9(1) GDPR) are concerned, the legal basis is Art. 9(2)(f) GDPR.

Due to our professional duty of confidentiality, we are generally not permitted to disclose data that has become known to us in the course of a client relationship to third parties. In order to assert and defend the rights of our clients, it may be necessary to disclose some of your personal data to your representative (in particular your lawyer) as well as to courts and other authorities for the purpose of correspondence and the assertion and defence of our client's rights. The data disclosed may be used by third parties exclusively for the stated purposes.

For the purposes of file management and maintenance of our IT infrastructure, external service providers are given access to personal data only if they have undertaken in data processing agreements to take special precautions to protect your data, have been obliged to maintain confidentiality pursuant to Section 43e BRAO or Section 62a StBerG, and can guarantee compliance with these precautions.

Within our firm, only those employees who need your data to perform the respective task within the client relationship have access to it.

You have the right to object to the processing of your personal data. To do so, please send an email to: info@luecke-und-partner.com. In this case, your personal data will be deleted, provided that no retention periods prevent this and we cannot demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Art. 21(1) sentence 2 GDPR).

As a rule, we only disclose your personal data if

The data disclosed may be used by the third party exclusively for the stated purposes. Personal data is transferred to a third country (outside the EU or EEA) or to an international organisation only in the cases described below. If this is necessary in an individual case to handle a mandate (e.g. in proceedings or with parties abroad), the transfer takes place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision (Art. 45 GDPR) or pursuant to Art. 49(1)(b) or (e) GDPR.

For our IT infrastructure (in particular document storage and Office applications), we use Microsoft 365 provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft acts as our processor on the basis of an agreement pursuant to Art. 28 GDPR; the data is stored in data centres within the EU. Personal data may be transferred to Microsoft Corporation in the USA. Such transfers are based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), under which Microsoft Corporation is certified, and additionally on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Microsoft has also undertaken to maintain confidentiality pursuant to Section 43e BRAO and Section 62a StBerG.

For email communication, we use the email services (including webmail) of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which also hosts our website (see section II.5). IONOS acts as our processor on the basis of an agreement pursuant to Art. 28 GDPR and has undertaken to maintain confidentiality pursuant to Section 43e BRAO and Section 62a StBerG. Emails are stored in data centres within the EU.

Email correspondence is also handled via mobile devices (iPhone, iPad). To back up these devices, we use the iCloud service of Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. The backup is end-to-end encrypted (“Advanced Data Protection for iCloud”), so that Apple has no access to the backed-up content. Processing of data by Apple Inc. in the USA cannot be ruled out; it takes place on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

We take all necessary technical and organisational security measures to protect personal data against loss and misuse. For example, data is stored in a secure operating environment that is not accessible to the public. Our security measures are continuously updated in line with technological developments.

Our website is delivered exclusively via an encrypted connection (HTTPS/TLS).

We transmit emails using transport encryption (TLS). If the recipient does not use this protocol to communicate with their server (data centre), this part of the transmission is unencrypted.

If you contact us by email and continue to use this means of communication after this notice, we assume, within the meaning of Section 2(2) of the Professional Code of Conduct for Lawyers (BORA), that you agree to communication that is only transport-encrypted. If you would prefer a different means of communication (e.g. end-to-end encrypted email or post), please let us know.

You have the right

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Please contact us by email at: info@luecke-und-partner.com or by post at:

Luecke und Partner mbB
Rechtsanwälte Steuerberater
Im Fleetkontor
Gertrudenkirchhof 10
20095 Hamburg
Germany

Please note that your rights to information and access may be restricted under Section 29(1) BDSG insofar as this would disclose information that must be kept secret by law or by its nature, in particular because of the overriding legitimate interests of a third party (e.g. due to our professional duty of confidentiality towards our clients).

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR on grounds relating to your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If you wish to exercise your right to object, an email to info@luecke-und-partner.com is sufficient.

This privacy policy is currently valid and is as of October 2026. As our website and the services offered on it evolve, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. If you have any further questions about our data processing, please feel free to contact us at: info@luecke-und-partner.com.

This English version is provided for convenience only. In the event of any discrepancy, the German version shall prevail.