mwp
mwp

—  Rechtliches

Privacy Policy

Privacy Policy

Last updated: November 2026

This Privacy Policy explains, pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR), what personal data we process when you visit this website, contact us or engage our legal services, the purposes and legal bases of such processing, and the rights available to you.

Controllers

The controllers within the meaning of the GDPR are:

Attorney-at-law Dr. Sepehr Moshiri
Attorney-at-law Dr. Matthias Wurm, LL.M. (Glasgow)
both at Kaistraße 5, 40221 Düsseldorf, Germany
Telephone: +49 211 542 60470
Email: info@mwp.legal  

Both attorneys currently practise independently. The mwp Rechtsanwälte Partnerschaftsgesellschaft mbB has been filed for registration in the Partnership Register; we will update this Privacy Policy after its registration.

Joint Controllership

Both attorneys act as joint controllers for the processing of personal data in connection with the operation of this website, general enquiries and job applications (Article 26 GDPR). They have agreed to fulfil their GDPR obligations jointly. The central contact point for your requests is the postal address or email address indicated above. However, you may also exercise your rights with and against either controller (Article 26(3) GDPR).

Enquiries About Legal Representation and Client Matters

The attorney who handles an enquiry or accepts an engagement is solely responsible for reviewing that enquiry and carrying out the engagement.

Principles of Data Processing

Attorney–Client Confidentiality

As attorneys-at-law, we are subject to professional duties of confidentiality (section 43a(2) BRAO, section 2 BORA, section 203 of the German Criminal Code (StGB)). We treat everything entrusted to us in connection with an enquiry or an engagement as confidential. We require service providers who may become aware of protected information to undertake confidentiality obligations (section 43e BRAO).

Legal Bases

We process personal data in particular on the following legal bases:

  • Article 6(1)(a) GDPR – your consent
  • Article 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract, for example in response to enquiries about legal representation
  • Article 6(1)(c) GDPR – compliance with legal obligations, including professional, tax and anti-money-laundering obligations
  • Article 6(1)(f) GDPR – legitimate interests, which we specify for the relevant processing activity
  • Article 9(2)(f) GDPR – special categories of personal data, where necessary for the establishment, exercise or defence of legal claims
  • Section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG) – storage of and access to information on your device, for example through cookies (subsection 1: with consent; subsection 2 no. 2: where strictly necessary for technical reasons)

Recipients

We disclose personal data only where a legal basis permits us to do so. Recipients may include, in particular, our web host and IT and maintenance service providers, including the agency responsible for technically maintaining this website. These service providers process data only on our instructions under agreements pursuant to Article 28 GDPR. For recipients in connection with client engagements, please see “Data Processing in Connection with Client Engagements”.

Transfers to Third Countries

Data are transferred to countries outside the European Union and the European Economic Area only where expressly stated in this Privacy Policy. This concerns the Wordfence security software and, subject to your consent, Google services.

Retention Periods

We retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention obligations. We then delete the data; if a statutory retention obligation still applies, we restrict processing until the applicable period expires. Specific periods are stated for the individual processing activities.

Provision of the Website, Hosting and Security

Server Log Files

Whenever you access this website, your browser automatically transmits data to our server, where they are stored in log files: IP address, date and time of access, page or file accessed, volume of data transferred, status code, previously visited page (referrer), browser type and version, and operating system.

We process these data to deliver the website, ensure its stability and security, and prevent attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is operating a secure and functional website. Log files are deleted or anonymised no later than 30 days after collection, unless longer retention is required to investigate a specific security incident.

Hosting

This website is hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in data centres in Dresden. A data processing agreement pursuant to Article 28 GDPR is in place with the hosting provider.

Encryption

This website uses TLS encryption, indicated by “https://” in your browser’s address bar. This protects data you send through the contact form against third-party access during transmission.

Protection Against Attacks (Wordfence)

To protect against attacks, we use the Wordfence security software provided by Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA (firewall and malware protection). In particular, IP addresses, access times and pages accessed are processed, checked against the provider’s threat intelligence and transmitted to the provider in this context. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the website and the data transmitted through it. Transfers to the USA are based on EU Standard Contractual Clauses (Article 46(2)(c) GDPR).

Backups (UpdraftPlus)

We regularly create backups of this website using the UpdraftPlus WordPress plugin. Backups may contain personal data stored on the web server, such as files uploaded via the contact form. The backups are stored with ALL-INKL and deleted after 28 days. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is being able to restore the website following disruptions.

Cookies and Consent Management

Cookies are small text files that your browser stores on your device. Without your consent, we use only cookies that are strictly necessary for the technical operation of this website:

  • “cmplz_…” cookies (Complianz): store your selection in the consent management tool; retention period: 365 days
  • “pll_language” cookie (Polylang): stores your selected website language; retention period: one year

The legal basis is section 25(2) no. 2 TDDDG. The associated processing of personal data is based on Article 6(1)(f) GDPR; storing evidence of your consent decision is additionally based on Article 6(1)(c) in conjunction with Article 7(1) GDPR (proof of consent). We use services that additionally store or access information on your device only with your consent (section 25(1) TDDDG).

Consent Management (Complianz)

We use the Complianz WordPress plugin to obtain and manage your consent. It runs on our own server; your selection is stored only in the cookies mentioned above in your browser and is not transmitted to the plugin provider. You may withdraw or change any consent you have given at any time with future effect by reopening the settings using the “Manage Consent” button.

Fonts

This website uses fonts from the Google Fonts library. The font files are hosted on our own server; accessing the website does not establish a connection to Google servers. We also integrate icons without using external providers.

Website Analytics (WP Statistics)

To analyse website usage statistically and improve our services, we use the WP Statistics WordPress plugin. Analysis takes place entirely on our own server; data are not transmitted to the plugin provider or other third parties. WP Statistics does not set cookies.

The data collected comprise pages accessed, date and time, the previously visited page (referrer), browser, operating system and device type, and an approximate location (country or region) derived from the IP address. Your IP address is anonymised before storage.

Analytics are performed only if you have consented to the “Statistics” category in the consent management tool. The legal basis is your consent (section 25(1) TDDDG, Article 6(1)(a) GDPR), which you may withdraw at any time with future effect. Statistical data are automatically deleted after [12] months.

Google Maps

On the “Location” page, we embed a map provided by Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is loaded only after you have consented. Your IP address is then transmitted to Google; Google may also set cookies or access information on your device and transfer data to Google LLC in the USA. The basis for this transfer is the European Commission’s adequacy decision on the EU–U.S. Data Privacy Framework (Article 45 GDPR), under which Google LLC is certified.

The legal basis is your consent (section 25(1) TDDDG, Article 6(1)(a) GDPR), which you can withdraw at any time via “Manage Consent”. Further information is available in Google’s Privacy Policy at https://policies.google.com/privacy.https://policies.google.com/privacy

Google Ads – Conversion Tracking

We run advertisements through Google Ads. To measure their effectiveness, we use Google Ads conversion tracking only with your consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you reach our website via a Google advertisement, Google stores a cookie or accesses information on your device to determine whether you subsequently perform certain actions, such as sending an enquiry through the contact form. We receive statistical analyses only, from which we cannot identify you. Google may transfer data to Google LLC in the USA; this transfer is based on the EU–U.S. Data Privacy Framework (Article 45 GDPR).

The legal basis is your consent (section 25(1) TDDDG, Article 6(1)(a) GDPR), which you can withdraw at any time via “Manage Consent”.

Contact and Enquiries About Legal Representation

You may contact us by telephone, email or the contact form. Name and email address are mandatory fields in the contact form; you may optionally provide your telephone number, the name of the opposing party and a description of your matter, and upload documents. The form data are transmitted to us by email. For this purpose, uploaded files are temporarily stored on our web server and deleted from it no later than [30] days after upload.

We process the information you provide to respond to your enquiry and assess whether we can accept an engagement. This includes the conflict-of-interest check required under professional regulations (section 43a(4) BRAO, section 3 BORA); we need the opposing party’s name for that purpose.

The legal bases are Article 6(1)(b) GDPR (pre-contractual steps taken at your request), Article 6(1)(c) GDPR (conflict-of-interest checks) and, for other enquiries, Article 6(1)(f) GDPR; our legitimate interest is responding to your request. If you provide special categories of personal data, such as health data, we process them pursuant to Article 9(2)(f) GDPR insofar as necessary for the establishment, exercise or defence of legal claims. By ticking the checkbox in the contact form, you confirm that you have read this Privacy Policy.

Third-Party Data

If you provide data concerning third parties, in particular the opposing party, we process them for the same purposes. We do not inform those persons insofar as the data are subject to attorney–client confidentiality (Article 14(5)(d) GDPR, section 29(1), first sentence, BDSG).

Communication by Email

Emails are generally encrypted in transit only, rather than end-to-end. Please therefore do not send particularly confidential information without encryption; contact us to arrange a secure transmission method. Our email mailboxes are hosted on Microsoft 365 / Exchange Online.

Retention Period

If no engagement is established, we delete your enquiry and associated documents no later than six months after communication has concluded, unless statutory retention obligations prevent this. We retain beyond that period the information required for conflict-of-interest checks – the names of the parties and the subject matter of the enquiry – so that we can reliably identify and avoid future conflicts of interest (Article 6(1)(c) and (f) GDPR in conjunction with section 43a(4) BRAO).

Data Processing in Connection with Client Engagements

If we accept an engagement, we process the data required to carry it out, including contact and master data, information about the facts of the case, correspondence and documents, billing and payment information, and data concerning opposing parties, witnesses and other participants.

The legal bases are Article 6(1)(b) GDPR (legal services agreement), Article 6(1)(c) GDPR (in particular professional, tax and anti-money-laundering obligations) and Article 6(1)(f) GDPR (representing our clients’ interests vis-à-vis third parties). We process special categories of personal data under Article 9(2)(f) GDPR, and data relating to criminal allegations and convictions (Article 10 GDPR) in the context of defence and advice in accordance with professional and procedural rules.

Where necessary for an engagement, we disclose data in particular to courts, public authorities, opposing parties and their legal representatives, experts, legal expenses insurers and other insurers, and financial institutions for payment processing.

We retain client files for six years; the period begins at the end of the calendar year in which the engagement ended (section 50(1) BRAO). We retain documents relevant for tax purposes for eight or ten years (section 147 AO, section 14b UStG), and records under the German Money Laundering Act for five years (section 8(4) GwG).

Job Applications

You may send job applications by email to anfragen@mwp.legal. We process the information you provide – such as contact details, CV, certificates and cover letter – to carry out the recruitment process. The legal basis is Article 6(1)(b) GDPR (steps towards entering into an employment relationship); any special categories of personal data that you voluntarily provide are processed under Article 9(2)(b) GDPR.anfragen@mwp.legal

If no employment relationship is established, we delete your documents no later than six months after the selection process ends, unless we need to retain them longer to defend against claims, such as those under the German General Equal Treatment Act, or you have consented to longer retention. If an employment relationship is established, we add your documents to your personnel file.

Your Rights

Subject to the statutory requirements, you have the right to:

  • access the data we process about you (Article 15 GDPR);
  • rectification of inaccurate data (Article 16 GDPR);
  • erasure (Article 17 GDPR);
  • restriction of processing (Article 18 GDPR);
  • data portability (Article 20 GDPR); and
  • withdrawal of consent previously given, with future effect (Article 7(3) GDPR).

You may submit your request informally using the contact details provided above.

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen)
Kavalleriestraße 2–4
40213 Düsseldorf
Telephone: +49 211 38424-0
Email: poststelle@ldi.nrw.depoststelle@ldi.nrw.de

The right of access and information obligations do not apply where their fulfilment would disclose information that must be kept confidential under a legal provision or by its nature, particularly on account of overriding legitimate interests of third parties (section 29(1) BDSG). This applies especially to information protected by attorney–client confidentiality.

Right to Object Under Article 21 GDPR

Where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you may object to such processing at any time on grounds relating to your particular situation. We will then cease processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Provision of Data and Automated Decisions

As a general rule, you are not required to provide us with personal data. However, without the mandatory information in the contact form we cannot process your enquiry, and without the information necessary for a client engagement we cannot accept the engagement. For engagements subject to the German Money Laundering Act, you are legally obliged to provide the information and documents required to verify your identity (section 11(6) GwG). No automated decision-making, including profiling (Article 22 GDPR), takes place.

Changes to This Privacy Policy

We update this Privacy Policy if our data processing or the legal framework changes, particularly after the registration of mwp Rechtsanwälte Partnerschaftsgesellschaft mbB. The version published on this website at the relevant time applies.