PRIVACY POLICY

Calling our website (technical data with personal reference):

To provide the service of a web service, i.e. the presentation of the content of our website in the browser on your computer or mobile device, temporary specific technical details have to be stored by us.

The following data is being recorded:

• your IP address,
• your timestamp of access,
• your requested resource,
• your status,
• the transferred amount of data and
  the duration of data transmission;
• the origin/location of your request,
• the name and version of your browser software

The collected data are recorded in so-called server log files. Statistical evaluations ensure that the collected data ensures that the website functions properly. 

Should we obtain concrete indications for unlawful use of our web service, we will also process the data collected above from the point of view of misuse detection and tracking. 

Typically, these server logs are deleted after 8 days. 

This expanded analysis of technical data with reference to individuals is reflected in Art. 6 (1) (f) GDPR (in German Datenschutz-Grundverordnung, DSGVO) again. 

Transferred personal data:

We only save personal information from you if you provide it to us or if it is otherwise provided to us in the context of our legitimate interactions with you (for example, if you contact us by email, subscribe to our newsletter, register for restricted areas, or if we receive limited business contact details of representatives of clients, prospects, partners, or service providers in a professional context). Depending on the specific processing activity, the legal basis may be your consent (Art. 6 para. 1 lit. a GDPR), performance of a contract or steps prior to entering a contract (Art. 6 para. 1 lit. b GDPR), or our legitimate interests (Art. 6 para. 1 lit. f GDPR), in each case as described in the relevant sections of this Privacy Policy. 

Any forms for registration or contact are divided into necessary information (marked as required) and voluntary information. 

General processing in the context of our activities and contracts:  

We may process personal data in the context of our activities, projects, and contractual relationships, including business communications and the delivery of services for or on behalf of our clients and partners. Depending on the project, this may include processing personal data of business contacts, project participants, service providers, and patient representatives or similar roles. 

Purposes of processing may include: 

• performing contracts and taking steps prior to entering into a contract; 

• delivering projects and services (including the engagement and management of patient representatives or similar roles, where applicable); 

• relationship management and 1 to 1 business communications; 

• compliance with applicable laws and contractual obligations, and responding to competent authorities and/or data subject requests; 

• protecting and defending legal claims and managing disputes (where relevant). 

Legal bases (depending on the specific processing activity) may include: 

• Article 6(1)(b) GDPR (performance of a contract) and/or Article 6(1)(f) GDPR (legitimate interests) for relationship management, communications, and project delivery activities; 

• Article 6(1)(c) GDPR (compliance with a legal obligation), where applicable; 

• Article 6(1)(a) GDPR (consent), where we request and obtain consent for specific processing activities. 

Where, depending on the nature of the project, special category personal data is processed (for example, health data such as diagnosis name), such processing will be carried out in accordance with Article 9 GDPR, and we will apply appropriate safeguards. Where possible and appropriate, we apply pseudonymisation or anonymisation measures. 

Where necessary, we will provide the relevant individuals with the information required under Articles 13 and 14 GDPR, as applicable, including where personal data is obtained indirectly (for example through events, introductions, public websites, or professional networks), within a reasonable period and at the latest at the time of first communication, unless an exception applies. 

Business contacts (relationship management and 1 to 1 business communications): 

In the context of our professional relationship with clients, prospects, partners, service providers, and other organisations, we may process limited business contact personal data (for example name, company, job title, work email address and/or work phone number, relationship category, and last interaction date). We process such data to manage the relationship and for 1 to 1 business communications (including exploring potential partnerships and offers), to perform contracts and manage the parties’ relationship, to comply with applicable law, and to respond to competent authorities and/or data subject requests. 

Where required, our processing is based on Article 6(1)(b) GDPR (performance of a contract) and, where applicable, Article 6(1)(f) GDPR (legitimate interests), including the legitimate interest in administering and managing the contractual relationship. 

Where business contact details are obtained directly, we provide the information required under Article 13 GDPR at the time when personal data are obtained. Where business contact details are obtained indirectly (for example through events, introductions, public websites, or professional networks), we provide the information required under Article 14 GDPR within a reasonable period and at the latest at the time of first communication, unless an exception applies. 

We do not intentionally record special category data or irrelevant personal information in business contact lists. 

You contact us: 

If you contact us via the contact options offered on the website, your details will be stored so that they can be used to process and respond to your request. This data will be used within that limited purpose and will be deleted upon fulfillment of the purpose. 

We use cookies on our website: 

This website uses cookies to make your website visit as pleasant as possible. A cookie is a small piece of information that is stored locally on your computer. 

When you first visit our website, a cookie consent banner is displayed, allowing you to choose which cookies you accept. Cookies that are strictly necessary for the functioning of the website are set on the basis of Art. 6(1)(f) GDPR and § 25(2) TDDDG. All other cookies (e.g. analytics, marketing) are only set with your prior consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. Note that consent can be withdrawn at any time via the banner. 

We use two categories of cookies: 

When you first visit our website, our consent management banner allows you to choose which cookies you accept. 

1. a) Strictly necessary cookies (no consentrequired)

These cookies are essential for the technical operation of the website. They enable core functions such as assigning a session number to ensure smooth communication between your browser and our web server, and processing registrations or login sessions correctly. Legal basis: Art. 6(1)(f) GDPR, § 25(2) no. 2 TDDDG. These cookies cannot be deactivated. 

1. b) Preference/comfort cookies (consentrequired)

These cookies allow us to remember choices you have made (e.g. language settings, display preferences) to provide a more personalised experience on future visits. They are only set with your prior consent. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG. You may withdraw your consent at any time via our cookie settings (accessible through the cookie icon or “Cookie Settings” link on our website).

Browser settings: 

Most browsers allow you to restrict or block cookies. However, limiting cookies may affect the functionality of our website. Please note that browser-level settings do not replace the consent choices made via our cookie banner. 

Furthermore, we do not use any methods that include automated decision making including profiling i. P. V. Provide or support Article 22 (1) and (4) GDPR.  

We do not use automated decision-making, including profiling, within the meaning of Art. 22 (1) and (4) GDPR. 

We also do not rely on third party data sources to identify our visitors. 

Duration of storage of personal data: 

We retain personal data only for as long as necessary for the purposes for which it was collected and processed, in accordance with the principles of storage limitation and data minimization. 

Where you have contacted us with a request, we will retain your personal data for the time necessary to respond to and close your request. After the purpose has been fulfilled, your data will be deleted, anonymised, or restricted (blocked) as appropriate, unless we are required or permitted to retain it for longer for legal obligations or for the establishment, exercise, or defence of legal claims. 

Personal data should generally not be retained for longer than necessary and, where applicable, the retention period is determined by data category and applicable legal requirements. As a general baseline, project-related personal data should not be retained beyond three (3) years after the end of the relevant project or the last interaction with the individual. Specific categories are subject to different periods, including: contract and financial documents up to 10 years (§ 257 HGB, § 147 AO), applicant data 6 months after the recruitment decision, server logs 180 days, and consent-based data (e.g. newsletter subscriptions) until withdrawal of consent. A longer period may apply where required to comply with legal obligations or for the establishment, exercise, or defense of legal claims. 
Irrespective of this, other legal requirements may require that personal data be retained for a longer period of time. 

Transfer of personal data to third parties: 

We may share personal data with service providers acting as processors on our behalf (for example, IT providers) to the extent necessary to operate the website and provide our services, and under appropriate contractual safeguards. 

Data processing outside the European Union:

The servers used for the internet presence are all located in the Federal Republic of Germany. If, in specific cases, personal data is transferred outside the European Economic Area (EEA), this will only take place to a country recognised by the European Commission as providing an adequate level of protection, or otherwise subject to appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Your rights regarding the processing of personal data: 

Right of access (Art. 15 GDPR): 

You can at any time exercise your right to request information from us, which personal data we have stored by you. 

Right to correct incorrect data (Art. 16 GDPR): 

If personal data have been incorrectly collected from you or are no longer correct, we will immediately comply with your right of correction. 

Right to cancellation (Art. 17 GDPR): 

You have the right to ask us for an immediate deletion if the personal data are no longer processed for the original purpose or are no longer necessary. 

You may also exercise the right to cancellation if you have revoked your consent and there is no other legal basis for the processing. 

Right to restriction of processing (Art. 18 GDPR): 
You have the right to request a limitation of the processing of your data.

Right to object to processing (Art. 21 (1) GDPR): 

You have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. 

Right to withdraw consent (Art.7 (3) GDPR):  
Where processing is based on your consent, you have the right to withdraw that consent at any time with effect for the future, without affecting the lawfulness of processing carried out prior to the withdrawal. 

Right to data portability (Art. 20 GDPR) 

If you want to take your data with you, you have the right of data portability. We will make the relevant data available to you in a structured, commonly used and machine-readable format or transmit it directly to another controller at your request. 

Use the email address to tell us your request:
legal@patvocates.net

Right to lodge a complaint with a supervisory authority: 

If all previous attempts have not brought a satisfactory solution to your concern, then you have the right to complain to the regulatory authority responsible for us: 

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA – Bavarian Data Protection Authority)  
Promenade 27 
91522 Ansbach 
Germany 

Under Art. 77 (1) GDPR, data subjects may also lodge a complaint with the supervisory authority of their place of residence, place of work or place of the alleged infringement.