Lawyer Ruben Hoffmann

Privacy Policy

1. Controller

Ruben Hoffmann, Rechtsanwalt (attorney-at-law) Insel 16, 79098 Freiburg, Germany Email: rahoffmann@posteo.de Phone: +49 176 593 122 34

2. Hosting and Server Log Files

This website is delivered via Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). When you visit the site, Cloudflare automatically processes on my behalf the information your browser transmits: IP address, date and time of access, page requested, amount of data transferred, browser type and version, operating system and the referring page. To defend against attacks, Cloudflare may set strictly necessary cookies (e.g. __cf_bm); these do not require consent under Section 25(2) no. 2 TDDDG.

The processing serves to deliver the website, ensure system security and stability, and prevent abuse. The legal basis is Art. 6(1)(f) GDPR. A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). Cloudflare retains log data only briefly. Further information: www.cloudflare.com/privacypolicy.

The fonts used on this website are served locally from my hosting. No connection is made to Google Fonts or any other font provider.

3. Contact by Email or Phone

If you contact me by email or phone, I process the data you provide (name, contact details, content of your enquiry) in order to handle the enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). The data is deleted once the enquiry has been fully dealt with and no retention obligations apply; if a mandate results, the retention periods under Section 5 apply.

4. Digital Assistant and Online Appointment Booking (JUPUS)

I use the application “JUPUS” provided by JUPUS GmbH, Hohenzollernring 89–93, 50672 Cologne, Germany, to provide a digital assistant that collects information and documents during initial contact and client intake, gathers further case-specific information, and creates the corresponding files in my case management system. JUPUS also provides the online appointment booking, which is loaded on this website in an embedded window from app.jupus.de.

The data concerned is your contact data such as name, address, email address and phone number, any further data you enter in JUPUS, and, for appointment booking, the selected appointment. The place and time of your use of JUPUS are also processed. Your data is not passed on to any other third parties; all data processing in connection with JUPUS takes place exclusively in Germany. I have concluded a data processing agreement with JUPUS under Art. 28 GDPR that ensures the security of the processing of your personal data. I have furthermore bound JUPUS to all professional confidentiality obligations that apply to me as an attorney (Section 43e BRAO).

The legal basis for the use of JUPUS is Art. 6(1)(b) GDPR. By providing a digital assistant to collect the information I need to assess a potential mandate with you, and by processing the data entered for that purpose, I fulfil a pre-contractual obligation towards you. Storage on your device that is technically necessary for the assistant and the booking tool to function does not require consent under Section 25(2) no. 2 TDDDG.

5. Collection and Storage of Personal Data on Taking a Mandate

When taking on a mandate or when contact persons are designated, I collect the following personal data:

  • Name
  • Email address
  • Postal address
  • Phone number(s)
  • The information and documents required to handle the mandate

This data is collected for the following purposes:

  • Identification as a client and for communication
  • Provision of appropriate legal advice and representation
  • Correspondence
  • Invoicing
  • Handling liability claims and legal disputes

Processing is carried out pursuant to Art. 6(1)(b) GDPR on the basis of your request and is necessary for the proper execution of the mandate and for fulfilling contractual obligations. Where special categories of personal data (Art. 9 GDPR, e.g. health data or information on origin) are required for the mandate, I process them on the basis of Art. 9(2)(f) GDPR for the establishment, exercise or defence of legal claims.

The data collected is deleted after the statutory retention period has expired. I retain case files for six years after the end of the calendar year in which the mandate ended (Section 50(1) BRAO); tax and commercial law retention obligations under Section 147 AO and Section 257 HGB may require longer storage of individual documents. Longer storage also takes place where you have consented to it.

6. Transfer of Data to Third Parties

Personal data is only transferred to third parties where this is necessary for the execution of the mandate pursuant to Art. 6(1)(b) GDPR — in particular to opposing parties, their representatives, courts, authorities and experts. Attorney-client privilege is maintained; confidential information is only shared with your consent. In addition, I use service providers for practice organisation, bookkeeping and IT who act as processors under Art. 28 GDPR, bound by my instructions and by the duty of confidentiality under Section 43e BRAO.

7. Google Ads Conversion Tracking

I use Google Ads, an online advertising programme of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), and use conversion tracking in this context — only if you have consented to this via the cookie banner.

If you reach this website via a Google ad and give your consent, Google sets a conversion tracking cookie (valid for 90 days). If you then perform a specific action on the website — such as completing an online enquiry via the digital assistant, opening the appointment booking or tapping the phone number — Google and I can recognise that you reached the website via the ad. In doing so, the Google Click ID (GCLID), time, page visited and your IP address are transmitted to Google. I receive only statistical evaluations from Google (number of conversions, associated campaign and ad), but no information that could identify you personally. The content of your enquiry to me is not transmitted to Google.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future by changing your selection via the “Cookie settings” link in the footer of the website. Without consent, the Google tag is not loaded and no cookie is set; the website can be used without restriction.

Google may also process the data on servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). Further information on data protection at Google: policies.google.com/privacy. You can additionally disable personalised advertising at adssettings.google.com.

This website uses only the strictly necessary storage technologies named in Sections 2 and 4 and — after your consent — the conversion cookie described in Section 7. On your first visit, a banner asks for your decision. I store your choice in your browser’s local storage (key consent) for twelve months so that the banner does not reappear on every visit. This storage does not require consent under Section 25(2) no. 2 TDDDG. Consent management is operated by me; no external consent service provider is involved.

9. Your Rights

You have the right to:

  • Withdraw your consent at any time pursuant to Art. 7(3) GDPR
  • Request information about your personal data processed by me pursuant to Art. 15 GDPR
  • Demand immediate correction of inaccurate or completion of incomplete data pursuant to Art. 16 GDPR
  • Request deletion of your data stored by me pursuant to Art. 17 GDPR, insofar as no retention obligations apply
  • Request restriction of processing of your personal data pursuant to Art. 18 GDPR
  • Receive your personal data in a structured, commonly used, machine-readable format pursuant to Art. 20 GDPR
  • Lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

The supervisory authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de. Attorney-client privilege (Section 43a(2) BRAO) may restrict the rights to information and erasure in individual cases (Section 29(1) BDSG).

10. Right to Object

You have the right to object to the processing of your personal data pursuant to Art. 21 GDPR where such processing is based on legitimate interests (Art. 6(1)(f) GDPR).

Please direct your objection to: rahoffmann@posteo.de

11. Version

This privacy policy is dated August 2026. I will update it whenever the legal situation or the services used change.