Privacy Policy

This policy explains which personal data is processed when you visit koellnadvogada.com, contact the firm or book a consultation, for what purpose, on what legal basis, and what your rights are. It follows the EU General Data Protection Regulation (GDPR, in German DSGVO), the German Federal Data Protection Act (BDSG) and the German act on data protection in digital services (TDDDG).

Last updated: October 2026. If the language versions differ, the German version prevails.

1. Controller

Sandra Helena Koelln
Rechtsanwältin and Advogada
Eichelhäherstraße 46
81249 München, Germany
Phone: +49 15566 359635
Email: sandra@koellnadvogada.com

For any data protection question, please contact the controller directly using the details above. The other legally required details are in the Imprint.

As a lawyer, Sandra Koelln is bound by professional secrecy (Section 43a(2) of the German Federal Lawyers' Act, BRAO, and Section 203 of the German Criminal Code, StGB). Everything you tell us is treated confidentially.

2. Overview

This website is built to collect as little data as possible:

• The website has no database of its own and no login area, and it uses no advertising, remarketing or profiling.
• Google Analytics is only loaded if you accept it in the cookie banner. Without your consent, no connection is made to Google.
• Fonts and images are served from the website's own domain, with no connection to Google Fonts or other third-party networks.
• The contact form uses neither reCAPTCHA nor any other external spam protection service.
• There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

3. Hosting and delivery of the website

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (privacy policy). Vercel delivers the pages through a global server network and runs the server functions (sending the contact form, online booking).

On every visit, technical data sent by your browser is processed automatically and recorded in server log files:

• IP address
• date and time of access
• page requested and referring page (referrer)
• browser type and version, operating system
• status code and amount of data transferred

This data is needed to display the website, keep it stable and secure (for example, protection against attacks and abusive automated access) and fix errors. It is not combined with other data sources, is stored only briefly and is deleted automatically. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).

We have a data processing agreement with Vercel (Art. 28 GDPR). Transfers to the USA are based on Vercel's certification under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR) and on the European Commission's standard contractual clauses (Art. 46 GDPR).

4. Cookies and storage on your device

Under Section 25 TDDDG, we may only store or read information on your device without consent where this is strictly necessary to provide a service you have requested. Everything else requires your consent. This website uses:

You can change or withdraw your choice at any time using the Cookie settings link in the footer of every page. When you withdraw consent, the Google Analytics cookies are deleted. You can also block or delete cookies in your browser settings.

To show the website in your language, the server reads the language preference your browser sends with each request. Nothing is stored for this.

5. Google Analytics (only with consent)

If you click Accept in the cookie banner, we use Google Analytics 4 to understand how the website is used and to improve it. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Before you consent, the Google script is not loaded at all. Once you consent, Google processes usage data such as pages visited, length and time of the visit, referring page, device type and browser, approximate region and interactions (for example, button clicks), linked to a pseudonymous identifier stored in the _ga cookies. According to Google, Google Analytics 4 does not store IP addresses. Advertising features (ad signals, personalisation, remarketing) are always switched off, and the private booking page is not measured.

Legal basis: your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG), which you can withdraw at any time with effect for the future using the Cookie settings link in the footer. Data linked to the identifier is deleted after 14 months at the latest.

We have a data processing agreement with Google (Art. 28 GDPR). Data may be transferred to Google LLC in the USA. Transfers are based on Google's certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and on standard contractual clauses (Art. 46 GDPR). More information in Google's privacy policy.

6. Contact

Contact form

When you submit the form, we process your name, email address, phone number (optional) and message. The data is sent encrypted to our server and forwarded as an email to the firm's mailbox (Microsoft 365, see below). The website keeps no copy in a database. To stop spam, the form uses an invisible field, without third-party services.

Purpose: answering your enquiry. Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns a mandate or consultation, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering incoming messages).

Email and phone

If you write to us or call, we process the data you provide (for example, name, contact details and the content of your message) to deal with your request, on the same legal bases as the contact form. Emails are stored in the firm's mailbox on Microsoft 365.

WhatsApp

The WhatsApp buttons first open a message box on the website. What you type there stays in your browser and is not sent to our server. When you click send, WhatsApp opens (app or WhatsApp Web) with the message already filled in. It is only transmitted when you send it there.

From that point on, the service is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, which processes the data under its privacy policy. Messages are end-to-end encrypted, but WhatsApp processes metadata (such as phone number and time) and may transfer it to Meta Platforms, Inc. in the USA (certified under the EU-U.S. Data Privacy Framework). Legal basis: Art. 6(1)(b) or (f) GDPR. Using WhatsApp is optional: you can always reach us by email or phone instead.

Microsoft 365

The firm's email, calendar and video calls run on Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. We have a data processing agreement with Microsoft (Art. 28 GDPR). Microsoft stores and processes EU customer data within the EU (EU Data Boundary). Any transfers to the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and standard contractual clauses (Art. 46 GDPR).

7. Online booking of consultations

Online booking is on a private page that can only be reached through a link the firm sends individually. The page is not indexed by search engines and is not measured by Google Analytics.

Data processed

Name, email address, phone number, postal address, the reason for the consultation as you describe it, the chosen date and time, language and time zone. Payment data (card) is entered directly in Stripe's form and never reaches the firm.

How it works

• When you confirm a time, a provisional reservation with a Microsoft Teams meeting link is created in the firm's calendar (Microsoft 365).
• Payment takes place in Stripe's embedded form. The details you provide, including the reason for the consultation, are recorded in the payment session so the payment can be matched to the appointment.
• Once payment succeeds, the appointment is confirmed and you receive the invitation with the Teams link by email. Stripe may send you a payment receipt.
• If payment is not completed, the payment session expires after 30 minutes and the provisional reservation is deleted automatically.

Stripe

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. In the payment step, Stripe loads its own script and sets the cookies listed in section 4 to prevent fraud. For fraud prevention and to meet legal obligations (for example, anti-money laundering), Stripe also acts as an independent controller. Data may be transferred to Stripe, Inc. in the USA. Transfers are based on Stripe's certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and on standard contractual clauses (Art. 46 GDPR). More information in Stripe's privacy policy.

Microsoft Teams

The consultation takes place by video call on Microsoft Teams. When you join, Microsoft processes connection data (such as IP address and device), the name you enter and, during the call, audio and video. Consultations are not recorded.

Legal basis

Legal basis: Art. 6(1)(b) GDPR (contract and pre-contractual steps) and, for keeping accounting and tax records, Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

Withdrawal and cancellation

If you use the form on the Withdrawal & cancellation page, we process your name, e-mail address, the date of the consultation and any notes you enter, as well as the date and time of submission. This data is sent by e-mail (Microsoft 365) to you, as an acknowledgement of receipt, and to the law firm, which locates the corresponding payment in Stripe in order to refund it. Legal basis: Art. 6(1)(c) GDPR in conjunction with Sections 355 and 356a of the German Civil Code (BGB) and, for the refund, Art. 6(1)(b) GDPR. The records are kept for the statutory periods (section 10).

8. Links to social networks and other websites

The website uses no social media plugins and no embedded third-party content (videos, maps, posts). Facebook, Instagram, LinkedIn, WhatsApp, videos mentioned in the blog and other websites appear only as ordinary links. No data is sent to these platforms while you browse here. That only happens if you click a link, and then the platform's own privacy policy applies.

If you visit the firm's profiles on Facebook, Instagram or LinkedIn, the platform processes your data under its own rules. For page statistics, Meta Platforms Ireland Limited (Facebook and Instagram) and LinkedIn Ireland Unlimited Company are joint controllers with us (Art. 26 GDPR). You can send requests about this data directly to them.

9. Encryption

The entire website is transmitted over an encrypted connection (HTTPS/TLS). You can recognise the secure connection by the padlock in your browser's address bar.

10. How long we keep data

We keep personal data only for as long as each purpose requires. Messages and enquiries that do not lead to a mandate are deleted once the matter is closed. If a mandate follows, the statutory retention periods apply, in particular Section 50 BRAO (case files: 6 years after the mandate ends) and Sections 147 AO and 257 HGB (accounting and tax records: up to 10 years). The periods for the technical services are described in the sections above.

11. Your rights

Under the GDPR you have the following rights regarding your personal data:

• access (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• withdrawal of consent at any time, with effect for the future (Art. 7(3))

To exercise these rights, simply email sandra@koellnadvogada.com. These rights may be restricted where data is subject to the lawyer's professional secrecy (Section 29 BDSG).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data unless there are compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims.

Right to lodge a complaint (Art. 77 GDPR): you can complain to a data protection supervisory authority. The authority responsible for the firm is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

12. Providing data

You are not obliged to provide personal data. Without the details marked as required, however, we cannot answer your enquiry or confirm a booking.

13. Changes to this policy

We update this policy when the website, the services used or the law change. The version published on this page always applies.