Privacy Policy

The following information contains details about the processing of personal data of users of our website. We treat the personal data you transmit when using our website and services confidentially and in accordance with statutory data protection regulations and this privacy policy. Below, we would like to inform you in detail about which of your personal data we collect, for what purposes it is used, with whom it is shared, and what control and information rights you may have.

A. Controller and Contact

The controllers for this website are LEXCHANGE LAW PartGmbB, Attorneys-at-Law Maxim Letski and Dr. Eduard Hofert, Lange Reihe 29, 20099 Hamburg (hereinafter referred to as "LEXCHANGE" or "we"). If you have any questions about this privacy policy or about the collection, processing or use of your personal data, you can contact us by email at hello@lexchange.io.

B. Definitions

  • Personal Data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier.
  • Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • Controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Third Party is any natural or legal person, public authority, agency or other body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data; this also includes other legal entities belonging to the group.
  • Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
  • Consent refers to any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

C. Data Processing When Using Our Website for Informational Purposes

If you visit our website for informational purposes only, without providing personal data via the contact forms, only the internet connection data transmitted by your browser to our servers will be processed. Additionally, cookies or other tracking technologies may be used in accordance with Section E.

The processing activities on our website are briefly outlined below. Detailed information can be found in the respective sections further down. The internet connection data mentioned includes information on:

  • Your IP address
  • Your device (type, name, ID)
  • Your browser (type/version)
  • Your operating system (including language settings)
  • Date and time of your requests
  • The content of your requests
  • Your screen resolution
  • Your Internet Service Provider
  • Websites from which your system accesses our website (referrer URL)
  • Websites accessed by your system via our website.

This information is processed to enable you to use our website (e.g., by adapting our website to your device's needs) and to create comprehensive demographic data for anonymized statistics on the use of our website. This data is not merged with other data sources.

The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as we require the automatically collected data for the effective provision of our website, and Art. 6 para. 1 sentence 1 lit. f GDPR, as the storage serves our legitimate interest in ensuring the stability and security of the website.

D. Data Processing When Using Our Services

On our website, we offer additional services (e.g., contact, newsletter) for which we request personal data from you, such as your name or email address, and potentially other personal information. Required information is always marked as mandatory fields. Without this information, we may not be able to provide you with the desired service or answer any inquiries you may have. Below, we provide an overview of the related processing operations and legal bases.

1. Contact and Appointment Bookings

If you contact us via the contact form, email, or phone to describe your request, your personal data will be stored and processed by us. This also applies if you use the appointment booking function (video conferences) on our website. This includes your name, your position in the company, your email address, and any other information you provide to process your request. This personal data is stored and used exclusively for conducting the video conference, responding to your request, or for contacting you and the associated technical administration. The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as it is necessary for the performance of a contract or pre-contractual measures.

2. Video Conferences

We use third-party video conferencing tools to conduct video and audio conferences, webinars, and other types of video and audio meetings. The following data categories are processed: (a) inventory data (e.g., names, addresses), (b) contact data (e.g., email address, phone numbers), (c) content data (e.g., text input, photos, videos), (d) meta/communication data (e.g., device information, IP addresses).

The purpose of processing is the setup and execution of online meetings and video conferences. Processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. b GDPR or in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR, based on our legitimate interests in efficient and secure communication with our communication partners.

We have concluded a data processing agreement with the providers of the video conferencing solution in accordance with Art. 28 GDPR. To ensure an adequate level of protection for any data transfers to the USA or other third countries, the EU Standard Contractual Clauses apply.

Unless compelling legal provisions (particularly retention periods) prevent it, your personal data will be irrevocably deleted no later than two years after the final processing of your legal request.

E. Use of Cookies and Other Analytics Technologies

1. Cookies

This website uses cookies. Cookies are small text files that are stored on your device. These text files can be read by these websites and help to identify you when you revisit a website. Some cookies are used to store preferences and are deleted after the end of the browser session, i.e., after closing the browser, known as session cookies. Other cookies are used to better adapt the website to user needs and remain on the device, known as permanent or persistent cookies. Below, we explain which cookies we use and how you can object to their use.

We use our own cookies that enable user-friendly use of our website, for example, by storing your settings. In addition, we use cookies to evaluate the use of our website. We base this data processing on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

We also work with other service providers who help us improve our website or offer additional functionalities. Such service providers may use their own cookies. Further information on this can be found in the following sections.

You can configure your browser to inform you about the setting of cookies, allow cookies only in individual cases, restrict the acceptance of cookies to certain cases, or generally exclude them, as well as activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.

Any use of cookies that is not strictly technically necessary constitutes data processing that only takes place with your explicit and active consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

2. Company Profiles on Social Media

Our presence on social networks allows us to connect with you outside of our website. Below, we inform you about what data is processed when you visit our company profile.

We maintain a company profile on the LinkedIn platform, a service offered by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. We use the LinkedIn profile to present our company and connect with potential employees.

You can contact us via our LinkedIn profile. For this purpose, we process the available profile data (e.g., job title, company name, industry, education, professional experience, skills, contact options, photo) and the content of your message to handle your inquiry. The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, provided that the communication serves the purpose of fulfilling a contract or carrying out pre-contractual measures. In other cases, data processing is based on your consent according to Art. 6 para. 1 sentence 1 lit. a GDPR. If you submit an application to us via LinkedIn, your name, contact details, qualifications, and other data contained in the application will be processed for the purpose of evaluating and potentially conducting a recruitment process. For this purpose, the application documents may be forwarded internally to the responsible and decision-making employees. Data processing is based on Section 26 para. 1 BDSG. Additional voluntary information is processed based on Art. 6 para. 1 sentence 1 lit. a GDPR. After the recruitment process is completed, the data will be deleted no later than six months, unless the data is required for the employment relationship.

Furthermore, you can share, "like," or comment on our posts. We process information about these interactions and your profile data. The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. We have a legitimate interest in understanding the response to our posts and communicating with users.

In addition, we directly contact LinkedIn users if the information in their profile has piqued our interest. For this purpose, we process the available profile data. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. We have a legitimate interest in connecting with other users via LinkedIn.

When you visit our LinkedIn profile, personal data may be processed by LinkedIn. We have no influence over this data processing. The purpose and scope of data processing by LinkedIn, as well as the related rights and settings options for protecting users' privacy, can be found in LinkedIn's Privacy Policy (https://www.linkedin.com/legal/privacy-policy?trk=uno-reg-guest-home-privacy-policy).

3. Use of Matomo

On this website, we use the web analytics service Matomo to analyze and review our website's usage. The statistics obtained allow us to improve our offerings and make them more interesting for you as a user.

We operate Matomo in a version that does not require cookies. Therefore, no Matomo cookies are stored on your computer for web analysis purposes. For website usage analysis, your IP address and information such as timestamps, visited web pages, and your language settings are collected. We process the information collected in this way on our server.‍‍

This website uses Matomo with the "AnonymizeIP" extension. This shortens IP addresses before further processing, thereby excluding direct personal identifiability. The IP address transmitted by your browser via Matomo is not merged with other data we collect.

The legal basis for this data processing is Art. 6(1) sentence 1 lit. f GDPR.

You can prevent Matomo from being used by unchecking the following box and activating the opt-out plug-in: [Matomo iFrame]. In this case, an opt-out cookie will be stored in your browser, which prevents Matomo from storing usage data. If you delete your cookies, the Matomo opt-out cookie will also be deleted, meaning you will have to opt out again when you revisit our site.

Matomo is an open-source project. You can find information on data protection from the third-party provider at https://matomo.org/privacy-policy.

F. Data Processing for Applications

If you wish to join our team and apply for a position with us, we process your personal data as follows:

1. Scope of Data Processing

As part of the application process, we process the following data categories:

  • Private Contact and Identification Data: e.g., last name, first name, academic title, gender, email address, postal address, and phone number;
  • Data on professional qualifications, e.g., school and vocational qualifications, language skills, your place of study or training, and certificates;
  • CV as well as the data contained therein;
  • Other Data, which you provide as part of your application.

2. Disclosure Within the Company

Application documents are sent to the contact person named in the job advertisement and internally forwarded to other partners and employees responsible for the application process.

3. Purpose of Data Processing

We process application data exclusively for the purpose of carrying out the application procedure.

4. Legal Basis for Data Processing

The legal basis for processing is Section 26 (1) BDSG and Art. 6 (1) sentence 1 lit. b GDPR. If we receive personal data during the application process that is not required for the application procedure, we will not process it.

5. Storage Duration

If an employment relationship is established, we will continue to process the application data for the purposes of the employment relationship. Detailed information on this can be found in the data protection information for employees. If no employment relationship is established, we generally store the application data for six months from the date of rejection. Afterwards, the application documents will be deleted.

G. Disclosure of Personal Data to Third Parties

The following categories of recipients, who are generally processors, may receive access to your personal data:

  • Service providers for the operation of our website and the processing of data stored or transmitted by the systems (e.g., for data center services, IT security, usage analysis). The legal basis for the disclosure is then Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR, unless they are processors;
  • Government bodies/authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the disclosure is then Art. 6 para. 1 sentence 1 lit. c GDPR;
  • Persons engaged for the operation of our business (e.g., auditors, banks, insurance companies, legal advisors, supervisory authorities, parties involved in company acquisitions or the formation of joint ventures). The legal basis for the disclosure is then Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR.

H. Transfer of Personal Data to Third Countries

Within the scope mentioned above, it is possible that we transfer your personal data to other countries (including countries outside the EEA, so-called third countries) where different data protection standards may apply than in your place of residence.

Please note that data processed in other countries may be subject to foreign laws and accessible to local governments, courts, and law enforcement and supervisory authorities. However, when transferring your personal data to third countries, we will take appropriate measures to adequately secure your data.

When transferring data to third countries, the transfer is generally protected by the application of the so-called EU Standard Contractual Clauses. You can obtain corresponding evidence or further details by email to the aforementioned address.

I. Data Security

We have appropriate, state-of-the-art security measures in place to protect your data from loss, misuse, and alteration. For example, our security policies and privacy statements are regularly reviewed and improved as needed. Furthermore, only authorized employees have access to personal data. Although we cannot guarantee that data loss, misuse, or alteration will never occur, we do everything in our power to prevent it.

Please note that data transmission over the internet is never completely secure. We cannot guarantee the security of data entered on our website during transmission over the internet. This is done at your own risk.

For security reasons and to protect the transmission of confidential content, such as inquiries you send to us as website operators, our website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address bar of your browser changes from "http://" to "https://" and by the padlock symbol in your browser's address bar. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

J. Storage Periods

Our goal is to process your personal data to the minimum extent possible. Therefore, we will only store your personal data for as long as necessary to fulfill the purpose for which it was originally collected or, if applicable, for as long as longer storage is legally required or justified.

K. Your Rights

You have the following data subject rights:

  • Right of access: You have the right to request information about and access to your personal data and/or copies of this data. This includes information about the purpose of use, the category of data used, its recipients and authorized users, and, if possible, the planned duration of data storage or, if this is not possible, the criteria for determining this duration.
  • Rectification, blocking, erasure: You have the right to request the rectification, erasure, or restriction of the processing of your personal data if its use is impermissible under data protection law. This is particularly the case if (i) the data is incomplete or incorrect, (ii) it is no longer necessary for the purposes for which it was collected, (iii) the consent on which the processing was based has been withdrawn, or (iv) you have successfully exercised a right to object to data processing; in cases where data is processed by third parties, we will forward your requests for rectification, erasure, or restriction of processing to these third parties, unless this proves impossible or involves disproportionate effort;
  • Refusal/Withdrawal of your consent: Many data processing operations are only possible with your explicit consent. You have the right to refuse your consent or to withdraw any consent already given at any time, without affecting the lawfulness of data processing carried out before the withdrawal.
  • Automated decision-making including profiling: You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you;
  • Data portability: You have the right to receive data that you have provided to us, or to have it transmitted to a third party, in a common structured, machine-readable format. However, the right to request direct transmission to another controller only exists where technically feasible.
  • Right to lodge a complaint with the competent supervisory authority: If you believe that your rights have been violated as a result of processing your personal data not in compliance with data protection regulations, you have the right to lodge a complaint with the competent supervisory authority.
  • Right to object: You have the right to object to the processing of your personal data at any time if we process your personal data for direct marketing purposes or if we process your personal data to pursue our legitimate interests and there are grounds arising from your particular situation.

You may (i) exercise the aforementioned rights, (ii) ask questions, or (iii) lodge a complaint against our processing of your personal data by contacting us as specified above under Section A.

L. Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy as our website is updated. Please visit this website regularly and review the current Privacy Policy. This Privacy Policy was last updated on January 27, 2026.

‍‍