Privacy Notice

This privacy notice explains how Lieff Cabraser Heimann & Bernstein, LLP (hereinafter “LCHB” or “we”) processes your personal data when you visit our website (II.), in the context of our work with you as a client or involved party (III.), and in the context of recruitment processes (IV.).

I. Name and Contact Details of the Controller

The controller within the meaning of Article 4(7) of the GDPR is:

Lieff Cabraser Heimann & Bernstein, LLP
Frauenplatz 2
80331 Munich
Phone: +49.89.2555.2360
Fax: +49.89.2555.2359

We are not required to appoint a data protection officer.

II. Data Processing When Visiting Our Website

1. Informational Use of Our Website

When you visit our website, we only process your IP address, the pages you access, and the data automatically transmitted by your browser (browser version, language settings, etc.).

The legal basis is our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which lies in acquiring new clients and employees as well as in maintaining information security.

We store this information for a period of 14 days in socalled “log” files.

As a data processor, we use a web hosting provider for this purpose, whom we have carefully selected and bound to comply with data protection regulations.

2. Cookies

We use cookies on our website to save the language you have selected. Cookies are small text files that are stored on your computer by your browser. They can be accessed by the websites to which they are assigned.

Cookies for language selection are strictly necessary to provide the website accessed by the visitor (Section 25(2)(2) of the Telecommunications, Digital Services, and Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz)). The legal basis for processing your personal data in connection with necessary cookies is Article 6(1)(f) of the GDPR. We have a legitimate business interest in data processing. This interest lies in the proper functioning of our website.

If you do not wish to have necessary cookies set, you have the option to disable cookies via your browser settings. Please note that this may limit the functionality of our website.

III. Cooperation as a Client, Involved Party or Business Partner

To the extent you are in contact with us as a client, involved party, other business partner, or prospective client, we process your personal data. Involved parties include all persons whose data we process in the course of our legal practice without an attorney-client relationship – namely contact persons, representatives, or legal representatives of the opposing party. Other business partners include, in particular, service providers, suppliers, and other contractual partners of the firm.

1. Contact via E-Mail

To the extent that you communicate with us via e-mail, we process the personal data generated during such process. This includes, in particular, sender and recipient information, the content of the message, as well as any attachments and the data contained therein. This applies accordingly to emails from your employees.

Processing takes place

  • for clients, for the purpose of coordinating the existing engagements and fulfilling the retainer agreement, based on Article 6(1)(b) of the GDPR, and outside of exist-ing engagements, for the purpose of initiating new matters, based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which lies in acquiring new business,
  • for involved parties, based on our client’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, which arises from the respective engagement,
  • for prospective clients, based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which lies in the acquisition of new clients, and
  • for business partners, either to fulfill contractual obligations pursuant to Article 6(1)(b) of the GDPR or to initiate new contractual relationships based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which lies in the practice of law and arises more specifically from the respective engagement.

For processing, we use IT service providers based in the United States, whom we have carefully selected and bound to comply with data protection regulations. Data transfers to the United States are carried out in accordance with Article 45 of the GDPR on the basis of the European Commission’s Adequacy Decision 2023/1795 of 10 July 2023.

2. Client Management, Billing, and Accounting

To the extent that a client or business relationship exists or is being established, as well as with respect to parties involved, we process the personal data necessary for this purpose. This includes, in particular, master and contact data (name, address, phone number, email), engagementrelated data including billing and bank account information, as well as all documents we receive from clients or parties involved within the scope of the engagement.

Processing takes place

  • for clients for the
    • provision of our contractual services based on Article 6(1)(b) of the GDPR,
    • billing for our services and accounting purposes based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which lies in the receipt of legal fees, and to fulfill our statutory accounting obligations based on Article 6(1)(c) of the GDPR,
    • fulfillment of our duty to maintain records under Section 50 of the Federal Lawyers’ Act (Bundesrechtsanwaltsordnung) based on Article 6(1)(c) of the GDPR,
    • as well as, outside of existing engagements, for the purpose of initiating new matters based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which lies in the acquisition of new matters,
  • for parties involved, for the purposes of the
    • execution of the matter based on our client’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, which arises from the respective engagement,
    • fulfillment of our duty to maintain records under Section 50 of the Federal Lawyers’ Act (Bundesrechtsanwaltsordnung) based on Article 6(1)(c) of the GDPR,
  • for prospective clients, to initiate new client relationships based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which consists in acquiring new clients, and
  • for business partners for the
    • fulfillment of contractual obligations pursuant to Article 6(1)(b) of the GDPR,
    • initiating new contractual relationships based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which lies in the practice of law and arises more specifically from the respective matter, or
    • fulfillment of statutory accounting obligations based on Article 6(1)(c) of the GDPR.

For processing, we use IT service providers based in the United States, whom we have carefully selected and bound to comply with data protection regulations. Data transfers to the United States are carried out in accordance with Article 45 of the GDPR on the basis of the European Commission’s Adequacy Decision 2023/1795 of 10 July 2023.

3. Recipients

In the course of handling the respective matter, it may become necessary to disclose your personal data to third parties. These are typically:

  • The clients of the respective matter,
  • Opposing parties and their representatives,
  • Courts, and
  • Other public authorities (e.g., bailiffs).

The legal basis for the disclosure is our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which lies in the fulfillment of the respective matter and simultaneously constitutes a legitimate interest of the respective client.

4. Transfer to Third Countries

To the extent necessary for the performance of the relevant matter, we may transfer your personal data to a third country beyond the cases specified in Section III. 1., 2. This occurs regularly in the following cases:

  • When involving LCHB attorneys in the United States, provided the transfer is necessary for the establishment, exercise, or defense of legal claims pursuant to Article 49(1)(e) of the GDPR.
  • If a client or litigation funder is based in a third country, and the transfer is necessary for the establishment, exercise, or defense of legal claims pursuant to Article 49(1)(e) of the GDPR.
  • Where, in individual cases, there is otherwise a need to transfer data to a third country (for example, to obtain information from foreign authorities) and this is necessary for the establishment, exercise, or defense of legal claims pursuant to Article 49(1)(e) of the GDPR.

IV. Application Process

As part of the application process, we process the personal data you provide. This includes, in particular, your basic and contact information (name, address, phone number, email) as well as your application documents (cover letter, resume, certificates, and oth-er supporting documents).

The purpose of the processing is to decide on the establishment of an employment relationship, including the necessary communication via mail, telephone, or email. In the rare event that we did not receive your data directly from you, it originates from the Employment Agency (Agentur für Arbeit) or from recruitment agencies.

The legal basis for your application is Article 6(1)(b) of the GDPR; in the case of a proactive offer on our part, it is our legitimate interest pursuant to Article 6(1)(f) of the GDPR, which lies in the recruitment of new employees. If you provide us with person-al data that falls under a special category within the meaning of Article 9(1) of the GDPR, the legal basis for processing this data is additionally Article 88(1) of the GDPR in conjunction with Section 26(3), sentence 1 of the Federal Data Protection Act (Bundesdatenschutzgesetz).

Your data will be stored for the duration of the application process. If an employment relationship is subsequently established, it will be transferred to the personnel file. Otherwise, your data will be deleted no later than six months after receipt of the rejection notice. We destroy documents submitted by mail or in person in accordance with data protection regulations. Data will only be stored for a longer period if this is necessary to assert, exercise, or defend legal claims or to comply with statutory retention obligations.

LCHB operates internationally. For the purposes of your application and the preparation of an employment contract, your personal data may be transferred to our branches in a third country (in particular the United States). The transfer is made for the purpose of entering into a contract based on Article 49(1)(b) GDPR.

V. General

In addition to the above sections, the following applies:

1. Retention Period

Unless a specific retention period is stated in this privacy notice, we store your personal data for as long as it is necessary for the respective purpose of collection. Your personal data will then be deleted, if and to the extent statutory retention periods preclude this.

Statutory retention periods arise in particular from the Federal Lawyers’ Act (Bundesrechtsanwaltsordnung, “BRAO”), the German Commercial Code (Handelsgesetzbuch, “HGB”), and the German Fiscal Code (Abgabenordnung, “AO”). Pursuant to Section 50(1) of the BRAO and Section 257 of the HGB, the retention periods provided for therein are six years, beginning at the end of the calendar year in which the matter was terminated. Pursuant to Section 147 of the AO, retention periods of up to ten years apply to certain tax-related documents. To the extent that we process your documents to fulfill statutory retention obligations, this is done to fulfill a legal obligation based on Article 6(1)(c) of the GDPR.

2. No Obligation to Provide Your Data

Unless stated otherwise within this privacy notice, you are neither contractually nor statutorily obligated to provide your data.

3. Your Data Subject Rights

If and to the extent we process your data within the scope of the GDPR, you have the following data subject rights:

  • Right of access
    You have the right to access the personal data processed about you and to receive a copy of this data pursuant to Article 15 of the GDPR.
  • Right to rectification
    You have the right to have inaccurate personal data rectified and incomplete personal data completed in accordance with Article 16 of the GDPR.
  • Right to erasure
    You have the right to erasure of your personal data, provided the conditions of Article 17 of the GDPR are met.
  • Right to restriction of processing
    You have the right to restrict the processing of your personal data under the conditions set forth in Article 18 of the GDPR.
  • Right to object
    You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, provided that such processing is based on Article 6(1)(e) or (f) of the GDPR; this applies in particular to processing based on these provisions for the purposes of direct marketing, Article 21 of the GDPR.
  • Right to data portability
    You have a right to data portability, which means you may receive the personal data concerning you in a structured, commonly used, and machine-readable format or have it transmitted to another controller, Article 20 of the GDPR.
  • Right to withdraw consent
    You have the right to withdraw your consent to the processing of your personal data at any time with future effect, Article 7(3) of the GDPR.

4. Complaint to a Data Protection Authority

If you believe that we have violated data protection law in the processing of your personal data, you have the right to lodge a complaint with a supervisory authority of your choice. This includes the supervisory authority responsible for us:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Phone: +49 981 180093 0
Fax: +49 981 180093 800