Privacy policy

Privacy policy for the website www.upwind-legal.de Upwind Legal Rechtsanwälte Wiechell Malinowski PartG mbB

The basis of effective data protection is comprehensive information about the collection, processing and use of your data ("data processing"). We would therefore like to inform you,

When and for which actions we process data
Which data we process and why
Who receives data
What rights you have regarding data processing by us.

This privacy policy applies to the processing of personal data on our website www.upwind-legal.de including the respective subpages (hereinafter: "website").
The transmission of information to or from this website is secured with TLS encryption.
You can access, print or download this privacy policy permanently and at any time at https://upwind-legal.de/datenschutzerklaerung.html.

1. General part

1.1. Person responsible
The processing of personal data within the scope of this privacy policy is carried out by
Upwind Legal Rechtsanwälte Wiechell Malinowski PartG mbB
Elbchaussee 372b
22609 Hamburg
Germany
Info(at)upwind-legal.de

1.2. Scope of the processing of personal data
We only process our users' personal data insofar as this is necessary to provide a functional website and our content and services. The processing of our users' personal data only takes place regularly with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

1.3. Legal basis for the processing of personal data
The legal basis for the processing of personal data is presented below.

Processing reason	Legal basis in the GDPR	Explanation
Consent	Art. 6 para. 1 a)	Processing takes place if you have expressly consented to the type and scope of data processing. You can withdraw your consent at any time with effect for the future. However, the processing carried out up to this point in time will not be affected by this.
Fulfillment of the contract or implementation of pre-contractual measures	Art. 6 para. 1 b)	Processing only takes place to the extent necessary for the exercise and fulfillment of the rights and obligations arising from the contract. Unless expressly stated otherwise, we only process data to this extent.
Legal obligation	Art. 6 para. 1 c)	Processing takes place insofar as this is necessary to fulfill German or European legal obligations.
Vital interests	Art. 6 para. 1 d)	If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.
Legitimate interest	Art. 6 para. 1 f)	Processing takes place insofar as we have a legitimate interest and no conflicting overriding interests of the data subject are apparent. The specific interest is explained in this privacy policy as part of the processing description.

1.4. Data erasure and storage duration
We delete your personal data as soon as the legal basis for its processing no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. In some cases, legal bases may also exist in parallel or a new legal basis may apply when a legal basis ceases to exist, such as the obligation to store certain data to fulfill a statutory retention obligation.

1.5. Possibility of objection and removal
If the data processing is based on your consent or our legitimate interest, you have the right to object to the processing or to withdraw your consent at any time. Your objection or revocation only has effect for the future. If the analysis cookies and/or services used offer their own technical options for deactivation, this is shown there in each case.

You can contact info(at)upwind-legal.de at any time to exercise your right of objection or revocation.

1.6. Rights of data subjects
If your personal data is processed, you are a data subject within the meaning of Art. 4 (1) GDPR. As a data subject, you have the following rights in relation to your personal data. To exercise these rights, you can contact us using the contact details provided above.

Right to information in accordance with Art. 15 GDPR You have a right to information about your personal data processed by us. This includes the mandatory information set out in Art. 15 GDPR.

Right to rectification in accordance with Art. 16 GDPR You have the right to obtain without undue delay the rectification of inaccurate personal data and the completion of incomplete personal data.

Right to erasure in accordance with Art. 17 GDPR You have the right to request the erasure of your personal data if one of the grounds specified in Art. 17 GDPR applies, in particular if there is no longer a legal basis for the processing.

Right to restriction of processing in accordance with Art. 18 GDPR You have the right to request the restriction of the processing of your personal data if one of the reasons stated in Art. 18 GDPR applies, in particular at your request instead of deletion of the data.

Right to data portability in accordance with Art. 20 GDPR You have the right to receive all personal data we have stored about you in a structured, commonly used and machine-readable format and to transmit this data to another controller without hindrance from the controller to which the personal data has been provided.

Right to lodge a complaint with the competent supervisory authority, Art. 77 GDPR In accordance with Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority responsible for you.

1.7. Recipients of data
The processing of your personal data in the context of the website is also partly carried out by processors, e.g. the hosting of the website, the use of analysis tools and newsletter dispatch. These are involved exclusively on the basis of an agreement on order processing in accordance with Art. 28 para. 3 GDPR.

1.8. Data transfer to third countries
The personal data that we collect from you in the context of the website is generally not transferred to third countries outside the European Economic Area. When using Google Analytics, data may be transferred to the USA. The transfer to third countries takes place on the basis of the EU-US Data Privacy Framework or standard contractual clauses.

1.9. Joint responsibility pursuant to Art. 26 GDPR
As part of the cross-border cooperation with our law firm location in Spain (Upwind Legal SL, Calle des Velazquez 10, 07002 Palma, Spain), we process personal data jointly within the meaning of Art. 26 GDPR. Upwind Legal Rechtsanwälte Wiechell Malinowski PartGmbB assumes primary responsibility for the fulfillment of data protection information obligations and acts as a central point of contact for data subjects. However, you can assert your rights (e.g. information, correction, deletion) against both companies. We will be happy to provide you with an overview of the main contents of the agreement on joint responsibility on request

2. Processing of data when visiting our website

2.1. Scope of the processing of personal data
We only process our users' personal data insofar as this is necessary to provide a functional website and our content and services. The processing of our users' personal data only takes place regularly with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

As a visitor to our websites, you are not subject to automated decision-making within the meaning of Art. 22 GDPR.

2.2. Log files

2.2.1. Description and scope of data processing
When you visit our website, your browser sends various pieces of information to our server, so-called server log files. We need these to establish and maintain the connection. The following data is also collected:
Date and time at the time of access

Operating system
Internet service provider
IP address
Browser/version used
Call successful/not successful
Referer (source from which you reached the page)

We store this data in so-called server log files. This does not affect the user's IP addresses or other data that enable the data to be assigned to a user. This data is not stored together with other personal data of the user.

2.2.2. Legal basis for data processing
The legal basis for the temporary storage of data is Art. 6 para. 1 lit. f) GDPR.

2.2.3. Purpose of data processing
Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

2.2.4. Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

2.2.5. Possibility of objection and removal
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, the user has no option to object.

2.3. Cookies

2.3.1. Description and scope of use
We use cookies on our website for various purposes. A cookie is a small text file containing information that is transmitted by your browser and stored on your computer. These cookies do not contain any personal data. You can also control the use of cookies in your browser and delete cookies yourself at any time. If the cookies listed below have their own option to delete or block them, this is shown in the respective description. Cookies may be required to establish a connection or to improve the use of the website. The cookies used are exclusively technically necessary cookies. They are used to provide you with additional functionalities or to make using the website more convenient, e.g. by saving your country or language settings. Technically necessary cookies are also usually deleted automatically when you close your browser (session cookies), but in other cases only after a longer period of time (persistent cookies). The storage period can be viewed in your browser.

We use a Consent Management Platform (CMP) to manage your consent. You can use the CMP to give your consent to certain data processing procedures and revoke any consent you have already given. There you will also find information on the purposes, providers, technologies used, stored data and the storage duration of individual cookies.

CMP also helps us to provide proof of your declarations. Log data on your declarations are processed for this purpose. The processing of this data is necessary in order to be able to prove that you have given your consent. The legal basis is Art. 6 para. 1 lit. c GDPR in conjunction with. Art. 7 para. 1 GDPR. 2.3.2. Legal basis for data processing The legal basis for the processing of personal data using technically necessary cookies within the meaning of Section 25 (2) TDDDG is Art. 6 (1) (f) GDPR.

2.3.3. Purpose of data processing
The purpose of using technically necessary cookies is to enable the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary for the browser to be recognized even after a page change. Analysis cookies (technically unnecessary cookies) are used for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus constantly optimize our offer.

2.3.4. Duration of storage, objection and removal options
Cookies are stored on the user's computer and transmitted by it to our website. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the storage of cookies by changing the settings in your Internet browser. Cookies already stored at can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

3. Other data processing operations in connection with the website

3.1. Applications for job advertisements by e-mail
We advertise current vacancies on our website in a separate section, for which interested parties can apply by e-mail to the contact address provided.
In order to be included in the application process, applicants must provide us with all personal data required for a well-founded and informed assessment and selection together with their application by e-mail.

The required information includes general personal information (name, address, telephone or electronic contact details) as well as performance-specific proof of the qualifications required for a position. In addition, health-related information may be required, which must be given special consideration under labor and social law in the interest of the applicant's social protection.
Please refer to the respective job advertisement to find out which components an application must contain in order to be considered and in which form these components must be sent by e-mail.
After receipt of the application sent using the email contact address provided, the applicant data will be stored by us and evaluated exclusively for the purpose of processing the application. For any queries arising in the course of processing, we use either the e-mail address provided by the applicant with their application or a telephone number provided, at our discretion.
The legal basis for this processing, including contacting us for queries, is generally Art. 6 para. 1 lit. b GDPR (for processing in Germany in conjunction with § 26 para. 1 BDSG), in the sense of which the application process is considered to be the initiation of an employment contract.
Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR (e.g. health data such as information on severely disabled status) are requested from applicants as part of the application process, processing is carried out in accordance with Art. Art. 9 para. 2 lit. b. GDPR so that we can exercise the rights arising from labor law and social security and social protection law and fulfill our obligations in this regard.
Cumulatively or alternatively, the processing of special categories of data may also be based on Art. 9 para. 1 lit. h GDPR if it is carried out for the purposes of preventive health care or occupational medicine, for the assessment of the applicant's fitness for work, for medical diagnostics, health or social care or treatment or for the management of health or social care systems and services.
f the applicant is not selected in the course of the evaluation described above or if an applicant withdraws their application prematurely, their data transmitted by email and all electronic correspondence including the original application email will be deleted after 6 months at the latest following a corresponding notification. This period is based on our legitimate interest in being able to answer any follow-up questions regarding the application and, if necessary, to comply with our obligations to provide evidence under the regulations on equal treatment of applicants.
In the event of a successful application, the data provided will be processed on the basis of Art. 6 para. 1 lit. b GDPR (for processing in Germany in conjunction with Section 26 para. 1 BDSG) for the purposes of implementing the employment relationship.

3.2. Contact
When you contact us (e.g., via the contact form or email), personal data is collected. The data collected when you use a contact form is evident from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and the associated technical administration. The legal basis for the processing of this data is our legitimate interest in responding to your request in accordance with Art. 6 para. 1 lit. f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted after your request has been processed. This is the case if it can be inferred from the circumstances that the matter in question has been finally clarified and provided that there are no legal storage obligations to the contrary.

3.3. Google Maps
On our website we use Google Maps (API) from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google Maps is a web service for displaying interactive (land) maps in order to visualize geographical information. Using this service will show you our location and make it easier for you to find us.

Information about your use of our website (such as your IP address) is transmitted to Google servers and stored there when you access those subpages in which the Google Maps map is integrated; this may also involve transmission to the servers of Google LLC. in the USA. This occurs regardless of whether Google provides a user account through which you are logged in or whether a user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and analyzes them. The collection, storage and evaluation are carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of Google's legitimate interest in the display of personalized advertising, market research and/or the needs-based design of Google websites. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right. If you do not agree to the future transmission of your data to Google in connection with the use of Google Maps, you also have the option of completely deactivating the Google Maps web service by switching off the JavaScript application in your browser. Google Maps and thus also the map display on this website can then not be used.

Detailed information on data protection in connection with the use of Google Maps can be found on the Google website ("Google Privacy Policy"): https://www.google.de/intl/de/policies/privacy/

Insofar as legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future. To exercise your revocation, please follow the option described above for making an objection.

3.4. Microsoft Teams
We use the "Microsoft Teams" service from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA (hereinafter "Microsoft Teams") to conduct online meetings, video conferences and/or webinars.

If you use Microsoft Teams, different data will be processed. The scope of the data processed depends on the data you provide before or during participation in an online meeting, video conference or webinar. When using Microsoft Teams, data of the communication participants is processed and stored on Microsoft Teams servers. This data may include, in particular, your login data (name, email address, telephone (optional) and password) and meeting data (topic, participant IP address, device information, description (optional)). In addition, visual and audio contributions from participants as well as voice input in chats can be processed.

When processing personal data that is required to fulfill a contract with you (this also applies to processing operations that are required to carry out pre-contractual measures), Art. 6 para. 1 lit. b GDPR serves as the legal basis. If you have given us your consent to process your data, the processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR. Any consent given can be revoked at any time with effect for the future.

In addition, the legal basis for data processing when conducting online meetings, video conferences or webinars is our legitimate interest in the effective conduct of the online meeting, webinar or video conference in accordance with Art. 6 para. 1 lit. f GDPR. Further information on data use by Microsoft Teams can be found in the Microsoft Teams privacy policy at https://privacy.microsoft.com/de-de/privacystatement

Status: July 2025