Data protection

The protection of your personal data is important to us. With the following data protection declaration, we inform you about how we process your data when you visit our website and how we use personal data when advising clients. If you have any further questions, please feel free to contact us at any time at hendrik.witt@wittlegal.de.

1. Controller

The controller responsible for the processing of your personal data in connection with your visit to our website, the use of our contact options and our handling of clients: Witt Legal GmbH & Co. KG, Rochusstr. 2a 53123 Bonn, Amtsgericht Bonn HRA 10532 (“we”, “us”).

When you visit the website, we only use necessary cookies, i.e. cookies that are technically necessary for the display of the website.

2. Contact form

If you send us data via the contact form, we process it for the purpose of transmission and content processing (see the following section).

3. Contact and client advice

Purposes of processing

When processing contacts and advising clients, we process personal data relating to the mandate (“mandate data”) for various purposes, for example in order to be able to advise our clients and/or for operational reasons. This includes in particular

  • advising clients and processing the respective mandate;
  • responding to inquiries outside of other types of mandates;
  • carrying out other activities related to our business for marketing and branding purposes, e.g. webinars;
  • compliance with our obligations under applicable laws and regulatory requirements (e.g., conflict and know-your-customer checks);
  • operational purposes (e.g., record keeping, bookkeeping, accounting and tax compliance);
  • and/or compliance with certain legal obligations (e.g., disclosure obligations and compliance with court orders).

Data subjects

Depending on the individual case, we process personal data of various data subjects, including

  • Clients and their respective mandate holders, representatives and employees;
  • counterparties or contractual partners of our clients and their respective mandate holders, representatives and employees;
  • other advisors, consultants and freelancers involved in the mandate and their respective mandate holders, representatives and employees;
  • third parties, such as court personnel, witnesses and other natural persons involved in the mandate;
  • and/or other third parties, in particular if they have contacted us.

Categories of personal data

The types of personal data we process depend on the contact made, the mandate and the possible course of negotiations or legal proceedings. The mandate data usually concerns contact information of the relevant contact persons or information about the position or behavior of persons who are relevant in relation to the mandate.

Data sources

Personal data is predominantly transmitted to us by our clients via contact forms or in other ways and contains the information we need to act for our clients in our capacity as legal advisors. In certain cases, however, we also obtain client data from other sources (e.g. for “know-your-customer” checks), such as public directories and databases, court and public records. In some cases, we also receive personal data from third parties familiar with the matter in question. 

Legal basis

Our processing of personal data is generally based on our legitimate interest in providing our (legal advice) services to our clients and the legitimate interests of our clients in receiving legal advice and representation from us.In addition, we have a legitimate interest in processing client data in order to fulfill certain tasks in connection with the operation of our law firm, for example maintaining our client relationships, accounting and for tax purposes. We also have a legitimate interest in processing inquiries sent to us via the contact form (the legal basis for this processing is Art. 6 (1) (f) GDPR). If the client relationship exists with the data subject themselves, we also process the client data relating to this person for the purpose of fulfilling the contract (legal basis for processing in such cases is Art. 6 para. 1 lit. b) GDPR).

In addition, we process client data in order to fulfill our legal obligations in accordance with the applicable laws (legal basis for processing in such cases is Art. 6 para. 1 lit. c) GDPR).

Special categories of personal data

In individual cases and depending on the mandate, it is possible that we may also process “special categories of personal data” within the meaning of Art. 9 para. 1 GDPR (e.g. health data) and personal data relating to criminal convictions and offenses or related security measures within the meaning of Art. 10 GDPR. We only process such data if absolutely necessary and on the following bases

  • your consent (Art. 9 para. 2 lit. a) GDPR),
  • in the context of labor and social security law purposes (Art. 9 para. 2 lit. b) GDPR),
  • in connection with personal data published by the data subject (Art. 9 para. 2 lit. e) GDPR)
  • for the establishment, exercise or defense of legal claims (Art. 9 para. 2 lit. f) GDPR)
  • for reasons of public interest in connection with a legal provision (Art. 9 para. 2 lit. g-j) GDPR, Art. 10 GDPR).

4. Use of Artificial Intelligence

In the course of providing our services, we may use Artificial Intelligence (“AI”), including generative AI based on transformer models as well as AI-supported agents. The use of AI may serve, in particular, to provide our services efficiently, to research, structure and summarize information, to maintain and curate our knowledge management, as well as for quality assurance and the optimization of internal work processes.

 

We always use AI in accordance with the applicable legal requirements (including professional secrecy and data-protection requirements regarding the confidential treatment of client data). Your personal data and any client data is not used to train AI models. AI output is always reviewed and assumed responsibility for by a human.

 

Processing is based on legitimate interest pursuant to Art. 6(1)(f) GDPR, given our interest in the efficient provision and further development of our legal advisory services. To the extent that the processing takes place in the context of a client relationship, the legal bases specified in Section 3 of this Privacy Notice may also apply.

 
5. Limitation of data processing

In all cases in which we process personal data, we limit this processing to the minimum necessary to achieve the respective processing purpose. This also means that we delete or anonymize data as soon as it is no longer required to achieve the respective processing purpose, unless there is a legal basis for further storage, e.g. a statutory (e.g. tax law) retention obligation.

6. Sharing of data

When providing our website and administering our client activities (e.g. invoicing, use of cloud solutions), we sometimes work with service providers (e.g. web hosts, cloud solution providers) who process your data on our behalf and exclusively in accordance with our instructions. We only work with trustworthy service providers on the basis of order processing contracts (Art. 28 GDPR) in order to guarantee the best possible protection of your data.

With regard to our website, this includes in particular the company RAIDBOXES GmbH based in Germany. Data processing outside the European Union does not take place in this respect.

In addition, where necessary, we share client data with service providers who are subject to their own professional confidentiality obligations, such as tax advisors. We have informed such service providers of the protection of client data under criminal law through client confidentiality.

7. Data processing in countries outside the European Union / European Economic Area

Insofar as we process personal data outside the EU or the EEA, we ensure, to the extent required by law, that a high level of protection of your personal data is guaranteed at all times by means of suitable guarantees.

8. Your rights

You have the following rights with regard to the processing of your personal data:

  • Right of access (Art. 15 GDPR);
  • the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR);
  • the right to object to processing (Art. 21 GDPR);
  • and the right to data portability (Art. 20 GDPR).

If processing is based on your consent, you can withdraw this at any time. In this case, we will only continue to process your data if there is another legal basis for doing so. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

You also have the right to lodge a complaint with a competent supervisory authority regarding the processing of your data.

You can make such a complaint, for example, to State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, P.O. Box 20 04 44, 40102 Düsseldorf, tel.: 0211/38424-0, e-mail: poststelle@ldi.nrw.de.

[08/2026]