Privacy policy

Last updated: 5 September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Rechtsanwalt Lothar Radermacher
Wilhelmstraße 30
53111 Bonn, Germany
Telephone: +49 26 31 9 44 98 90
E-mail: lr@rechtsanwalt-radermacher.de

No data protection officer has been appointed; the conditions of § 38 of the German Federal Data Protection Act (BDSG) are not met.

2. What this site does not do

This website is purely static. It sets no cookies, uses no analytics or tracking tools (no Google Analytics, no tracking pixels) and embeds no maps, no videos, no advertising networks and no social media buttons.

The fonts are served from this site’s own server. In particular, no connection to Google Fonts is made. A consent banner is therefore not required — there is nothing for you to consent to.

The only third-party service this site loads is the spam check on the contact form. It is described under section 5 and is loaded only on the contact page.

3. Visiting the site (server log data)

When you open this site, your browser transmits technically necessary data to the server so that the page can be delivered at all. The following are processed:

• your IP address,
• the date and time of the request,
• the address requested (URL) and the HTTP status code,
• the volume of data transferred,
• the browser and operating system used (user agent),
• where applicable, the page previously visited (referrer).

Purpose is the technical delivery of the page, ensuring system security and defending against attacks. Legal basis is Art. 6 (1) (f) GDPR; my legitimate interest lies in the secure and undisturbed operation of this site. These data are not merged with other sources and are not evaluated for advertising purposes.

4. Hosting

This website runs on Microsoft Azure Static Web Apps. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Microsoft processes the data named under section 3 on my behalf as a processor. The basis is a data processing agreement under Art. 28 GDPR (Microsoft Products and Services Data Protection Addendum). Delivery takes place through a global server network; this may involve transfers to third countries, in particular the United States. Microsoft bases such transfers on the European Commission’s standard contractual clauses and is certified under the EU-US Data Privacy Framework, for which the Commission established an adequate level of protection by decision of 10 July 2023.

Further information: privacy.microsoft.com.

5. Contact form

You can send me a message through the contact form. Only the details you enter yourself are processed:

• Required: name, e-mail address and your message,
• optional: telephone number and subject,
• technically in addition your IP address and the time of sending — solely in order to prevent mass automated submissions.

Purpose is dealing with your enquiry. Legal basis is Art. 6 (1) (b) GDPR where the enquiry is directed at concluding or performing a lawyer–client relationship, otherwise Art. 6 (1) (a) and (f) GDPR. You may withdraw your consent at any time with effect for the future.

Transmission: the message is delivered by e-mail to my mailbox. For sending I use Azure Communication Services of Microsoft Ireland Operations Limited as a processor; the data location of the service is Germany. No open or click tracking takes place; it is expressly disabled in the service.

No storage on the website: the message is not written to a database. It is received, sent on and not retained thereafter. The IP address used for abuse detection is held only in memory and expires after ten minutes.

Spam check with Cloudflare Turnstile

To prevent automated misuse of the form, Cloudflare Turnstile checks before sending whether the enquiry comes from a human being. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Your IP address is transmitted to Cloudflare and evaluated together with technical characteristics of your browser and your behaviour on the page (such as mouse and keyboard input). Turnstile sets no cookies for advertising or recognition purposes and does not create cross-device profiles.

Purpose is defending against automated submissions. Legal basis is Art. 6 (1) (f) GDPR; my legitimate interest lies in the undisturbed operation of the contact form. A data processing agreement under Art. 28 GDPR is in place with Cloudflare. For transfers to the United States, Cloudflare relies on the European Commission’s standard contractual clauses and is certified under the EU-US Data Privacy Framework.

Further information: cloudflare.com/privacypolicy and developers.cloudflare.com/turnstile.

The check requires JavaScript. If JavaScript is disabled you cannot use the form — telephone, e-mail and post remain available unchanged.

Please note: although the form itself is transmitted over an encrypted connection (HTTPS), the subsequent e-mail delivery is not end-to-end encrypted. Please do not send confidential details or documents through the form. A lawyer–client relationship arises only once instructions have been expressly accepted; sending a message does not meet any legal deadline.

6. Contact by e-mail, telephone or post

If you contact me, I process the data you provide (in particular your name, contact details and the content of your message) in order to deal with your enquiry.

Legal basis is Art. 6 (1) (b) GDPR where the contact is directed at concluding or performing a lawyer–client relationship, otherwise Art. 6 (1) (f) GDPR.

Please note: an unencrypted e-mail can be read by third parties in transit. For confidential details, the telephone, the post and a personal meeting are available; on request we can agree an encrypted route.

7. The mandate and legal professional privilege

Within a mandate I process personal data in order to perform the retainer (Art. 6 (1) (b) GDPR) and to comply with legal obligations (Art. 6 (1) (c) GDPR). In doing so I am bound by legal professional privilege under § 43a (2) BRAO and § 203 of the German Criminal Code.

This policy concerns only your visit to this website. I inform you separately about data processing within a running mandate in accordance with Art. 13 and 14 GDPR.

8. Retention

Server log data are stored only as long as necessary for the stated purposes and are then deleted. Enquiries outside a mandate are deleted once they have been dealt with conclusively and no statutory retention obligations stand in the way. Within a mandate, the professional and commercial retention periods apply, in particular six years under § 50 (1) BRAO as well as the tax law periods.

9. Your rights

Under the GDPR you have the right to:

• access to the data processed about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR).

Consent once given may be withdrawn at any time with effect for the future (Art. 7 (3) GDPR). Please use the contact details under section 1.

These rights may be limited by legal professional privilege where access or inspection would reveal information about third parties (§ 29 (1) sentence 2 BDSG).

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for the Bonn office is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
ldi.nrw.de

11. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

12. Changes to this policy

I adapt this policy whenever the legal position or the structure of this site changes. The version published here applies in each case.