DATA PRIVACY NOTICE

General information

We hereby inform you about the processing of your personal data by Boficon GmbH (“Boficon”). We take the confidentiality and protection of your personal data very seriously. We therefore only process your personal data to the extent permitted by legal regulations, in particular the EU General Data Protection Regulation (“GDPR”) and the Federal Data Protection Act (“BDSG”).

If you have any questions about this privacy policy or how we handle your personal data, you can contact us at any time using the contact addresses listed below.

Responsibilities

Responsible for processing your personal data (data controller) is:

Boficon GmbH

Gondershauser Str. 35

80939 München

Email: info@boficon.de

Type and origin of the data processed

Depending on the mandate or business relationship, we process different types of personal data. Usually, this is:

• Identity data (e.g. name, date of birth, data contained in identity cards and other identification documents);

• Contact details (e.g. address, email, telephone number);

• Mandate data (e.g. information that (i) is typically contained in legal documents such as contracts or pleadings and/or public registers, e.g. land register, commercial and association registers, (ii) the subject of our correspondence with you or with our clients, counterparties, parties to the proceedings, courts, authorities or other business partners, or (iii) affect your legal relationships with your employer or third parties, such as personal data, file numbers or loan or account numbers at credit institutions, and

• Other communication data (e.g. data that is the subject of our correspondence and communication (oral/written, electronic (e-mail / via MS Teams)) with you).

If you have not provided us with your personal data yourself, we have received it from our clients, business partners, service providers or cooperation partners for whom you may work as a representative or employee or through whom you are invited to our events.

Purpose and legal basis of data processing

We process your personal data to the extent that this is necessary to protect the legitimate interests of Boficon GmbH (Art. 6 Para. 1 lit. f GDPR), in particular

• to conclude or carry out mandate agreements, contracts and other business relationships or to create or respond to requests for quotations and to determine the conditions of the contractual relationship with our clients, business partners, service providers or cooperation partners for whom you may work as a representative or employee are;

• for internal administrative purposes of Boficon GmbH (e.g. for accounting, knowledge management);

• to send you our client information, such as newsletters with information about current legal topics or law firm events, to the extent relevant to your business activities;

• for the purpose of communication using modern communication tools, such as MS Teams;

• to ensure the IT security and IT operations of Boficon GmbH;

• to use service providers (e.g. external IT service providers) who support our business processes;

• to prevent criminal offenses and, in individual cases, to carry out compliance investigations and the associated (including electronic) review of correspondence and documents;

• to plan and conduct events to which you are invited, including registering on our website and reporting on those events on our intranet, which may include publishing images and video material on the intranet on which you are pictured.

Personal data is also processed to fulfill contracts with or orders from individuals (natural persons) with whom we have business relationships (Art. 6 Para. 1 lit. b GDPR). If you do not provide us with your personal data, we cannot carry out the contractual relationship or fulfill the communication purposes mentioned above. Data processing is also partly required by law (Art. 6 Para. 1 lit. c) GDPR). For example, according to the provisions of the Money Laundering Act, we are obliged to identify our clients and require the necessary information from you (Section 11 Paragraph 6 Sentence 1 GWG). According to § 50 BRAO, we are professionally obliged to keep legal files and can use electronic data processing for this purpose.

Sharing your personal information

We only transmit your personal data to third parties on the basis of legal regulations or if you have given your consent in individual cases. Your personal data may be passed on to external service providers within and outside the European Economic Area (EEA) to the extent necessary for the purposes stated above. In the course of our work, we also use cloud-based IT solutions from third-party providers (e.g. Microsoft Office365). In particular, we use (cloud-based) services for document management, collaboration and automation or analysis of documents as well as external (cloud) providers of mail servers, e-discovery platforms, data rooms or artificial intelligence. We carefully select the service providers and commission them in compliance with data protection and professional regulations.

As part of normal business operations and for the purposes mentioned above, we may also pass on your data to other third parties within and outside the EEA, such as business partners or law firms with whom we work on a mandate, translators, opponents and other third parties. In addition, to the extent legally permissible, we may transmit your personal data to authorities (e.g. social security institutions, tax authorities or law enforcement authorities), public registers and courts at home and abroad in order to fulfill legal obligations or in the interests of Boficon GmbH. These can also be foreign authorities and courts.

Protection of your personal data

Each of our employees and all employees of external service providers who have access to personal data are obliged to treat this data confidentially and to protect it accordingly. We have also implemented various technical and organizational measures to process your data securely. However, communication via email in particular involves risks such as delayed or non-delivery, transmission to persons other than the recipient, data loss or damage, interception, alteration or other manipulation by third parties. In addition, viruses and similar malware can be transmitted via email despite the anti-virus software we use. Mobile means of telecommunication and other communication via the Internet such as video conferences involve comparable risks, particularly with regard to unauthorized access by third parties. With regard to the use of cloud-based IT applications, it cannot be ruled out that third parties (particularly U.S. authorities) may openly or covertly access your data. Loss of your data or damage to it cannot be ruled out with cloud-based services, despite applying due care and observing the current technical standards.

Deletion of your personal data

We delete the personal data after the end of the mandate, order or contractual relationship or our contact if storage is no longer necessary to fulfill our (post-)contractual obligations or the legitimate interests stated in this data protection declaration and there are no legal retention obligations. If there are legal retention requirements, we restrict the processing of the data.

Your rights

Subject to the legal requirements, the existence of which must be checked on a case-by-case basis, you have the right to receive information about your personal data and to request the correction or deletion of your personal data or the restriction of processing and to have your personal data stored in a structured, common and machine-readable format (data portability). Subject to the legal requirements, the existence of which must be checked on a case-by-case basis, you also have the right to object to the processing of your personal data. To the extent that we process your personal data in order to inform you about our consulting activities and current developments to the extent relevant to your business activities, you can object to the processing of your personal data at any time without giving reasons. You have the right to lodge complaints with a supervisory authority regarding the processing of your personal data. For further information you can contact your local data protection authority.