Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Dr. Lang & Kollegen Rechtsanwaltsgesellschaft mbH
Maximilianstraße 2
80539 Munich
Germany

Represented by Attorney Prof. (GTU/Georgia) Dr. phil. Dipl. sc. pol. Stephan J. Lang
Phone: +49 89 2429 0672
Email: kontakt@georgian-business-consulting.com

Georgian Business Consulting is a business division of Dr. Lang & Kollegen Rechtsanwaltsgesellschaft mbH.

Attorney-Client Privilege

As a law firm, we are bound by a duty of confidentiality (§ 43a para. 2 BRAO, § 2 BORA, § 203 StGB). This duty takes precedence over third-party claims for disclosure and information under data protection law. Insofar as we would provide information that would allow conclusions to be drawn about a client relationship or client-related data, we are entitled and obligated to refuse such disclosure (§ 29 para. 1 sentence 2 BDSG).

Principles of Processing

We process personal data only to the extent necessary to provide a functional website as well as our content and services, or if you have given your consent.

Legal Bases are, depending on the purpose:

Art. 6 para. 1 lit. a GDPR in the case of consent.
Art. 6 para. 1 lit. b GDPR for the initiation, establishment, and execution of a mandate or contractual relationship.
Art. 6 para. 1 lit. c GDPR for the fulfillment of legal obligations, in particular professional, commercial, and tax law retention obligations as well as money laundering law obligations.
Art. 6 para. 1 lit. f GDPR to protect legitimate interests, in particular the secure and stable operation of this website.

We process special categories of personal data within the meaning of Art. 9 GDPR only insofar as this is necessary for the establishment, exercise, or defense of legal claims (Art. 9 para. 2 lit. f GDPR) or if you have given your express consent (Art. 9 para. 2 lit. a GDPR).

Hosting and Server Log Files

This website is operated by an external service provider. The provider processes the data generated when the website is accessed on our behalf on the basis of an order processing contract pursuant to Art. 28 GDPR.

Provider: [Enter name and address of the hosting provider]

Each time the website is accessed, the server automatically collects information transmitted by your browser. These are:

Browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, amount of data transferred, notification of successful retrieval, and the IP address.

Processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the technically error-free presentation, optimization, and security of the website. This data is not merged with other data sources. The log files are deleted after seven days at the latest, unless they are required to clarify a specific security incident.

Encryption

For security reasons, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser begins with https://. When encryption is activated, the data you transmit to us cannot be read by third parties.

Cookies and Local Storage

This website only uses technically necessary cookies. They serve the operation of the website, caching, and security, and do not allow for an analysis of your usage behavior or recognition across websites.

The legal basis is § 25 para. 2 no. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR. Consent is not required for these cookies.

You can set your browser so that you are informed about the setting of cookies, allow cookies only in individual cases, or exclude them generally. If cookies are deactivated, the functionality of this website may be limited.

Caching

To speed up delivery, we use server-side caching technology. In this process, fully generated pages are temporarily stored and delivered immediately upon a new request. No personal evaluation takes place. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in the fast and resource-efficient provision of the website.

Fonts

This website uses locally stored fonts. The font files are loaded exclusively from our own server. No connection to servers of Google or other providers takes place, and no data is transmitted to third parties.

Contacting us by Email, Telephone, or Fax

If you contact us by email, telephone, or fax, we process the data you provide to handle your request.

The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as your request serves the initiation or execution of a mandate; otherwise, Art. 6 para. 1 lit. f GDPR based on our legitimate interest in processing the inquiries addressed to us.

Note: The transmission of unencrypted emails takes place via open networks. Complete confidentiality cannot be guaranteed. For the transmission of confidential documents, we will provide you with a secure transmission path upon request.

Contact Form

We process information transmitted via the contact form, including the contact details you provide there, to process your inquiry and in the event of follow-up questions. We do not pass this data on without your consent.

The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as your request serves the initiation of a mandate, otherwise Art. 6 para. 1 lit. f GDPR.

The data remains with us until you request deletion, revoke your consent, or the purpose no longer applies. Mandatory legal provisions, in particular retention periods, remain unaffected.

Contact Widget and Messenger

[Retain only if the Chaty widget is actually used:] A contact widget is integrated on this website, through which you can reach us directly by telephone or via the WhatsApp messenger service. The widget itself is delivered from our server; no data is transmitted to third parties when the website is merely accessed.

Only when you actively click on the WhatsApp contact will you be redirected to WhatsApp. From this point on, the privacy policy of the provider WhatsApp Ireland Limited applies. In this process, data, in particular your telephone number and communication metadata, may also be processed outside the European Union. We have no influence on this processing.

For the transmission of mandate-related or confidential information, WhatsApp is not suitable for reasons of attorney-client privilege. Please use the telephone, mail, or a secure transmission path agreed upon with us for this purpose.

Processing within the Framework of a Mandate

If a mandate relationship is established, we process the data required for processing. This includes inventory and contact data, information on the facts of the case, third-party documents, and billing data.

Legal bases are Art. 6 para. 1 lit. b GDPR for the execution of the mandate, Art. 6 para. 1 lit. c GDPR for the fulfillment of legal obligations, in particular under the Money Laundering Act, and Art. 9 para. 2 lit. f GDPR, insofar as special categories of personal data are affected.

Recipients of Data

Your data will only be passed on insofar as this is necessary for the execution of the mandate, required by law, or covered by your consent. Recipients may include, in particular:

Courts, authorities, and parties to the proceedings.
Attorneys, tax consultants, and notaries in Germany and abroad with whom we cooperate.
Technical service providers who act for us as processors pursuant to Art. 28 GDPR, for example for hosting, email, and IT support.
Insurance companies, banks, and authorities, insofar as this is necessary for processing.

Transfer to Georgia and Other Third Countries

A significant part of our activity consists of cooperation with attorneys, tax consultants, banks, and authorities in Georgia. Insofar as it is necessary to process your request, we transmit data to these entities.

Georgia is a third country within the meaning of the GDPR. An adequacy decision by the European Commission pursuant to Art. 45 GDPR does not exist for Georgia. The level of data protection there does not, therefore, automatically correspond to that of the European Union; in particular, legal remedies against access by state authorities may be limited.

A transfer therefore only takes place if it is necessary for the fulfillment of the contract concluded with you or for the implementation of pre-contractual measures (Art. 49 para. 1 sentence 1 lit. b GDPR), is necessary for the establishment, exercise, or defense of legal claims (Art. 49 para. 1 sentence 1 lit. e GDPR), or if you have expressly consented after being informed of the existing risks (Art. 49 para. 1 sentence 1 lit. a GDPR).

As far as possible, we additionally conclude the standard contractual clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR with the entities involved. We will inform you about the guarantees provided in individual cases upon request.

Storage Duration

We process and store your data only as long as it is necessary for the fulfillment of the respective purpose or as long as legal retention obligations exist.

For mandate documents, the professional legal retention period of six years applies after the end of the calendar year in which the mandate was terminated (§ 50 BRAO). In addition, there are commercial and tax law retention periods of six or ten years (§ 257 HGB, § 147 AO). After these periods have expired, the data will be deleted or the documents destroyed.

Your Rights

You have the following rights against us regarding the personal data concerning you:

Access pursuant to Art. 15 GDPR as to whether and which data we process.
Rectification of incorrect or completion of incomplete data pursuant to Art. 16 GDPR.
Erasure pursuant to Art. 17 GDPR, provided that no retention obligation prevents this.
Restriction of processing pursuant to Art. 18 GDPR.
Data portability pursuant to Art. 20 GDPR.
Objection to processing pursuant to Art. 21 GDPR.
Withdrawal of consent pursuant to Art. 7 para. 3 GDPR with effect for the future.

An informal notification to the address mentioned above is sufficient for exercise. These rights may be restricted insofar as their fulfillment would violate our duty of attorney-client confidentiality.

Right to Object

If the processing of your data is based on Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that outweigh your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Right to Lodge a Complaint with the Supervisory Authority

Without prejudice to other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your place of residence, your place of work, or the place of the alleged infringement.

The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach
www.lda.bayern.de

Data Protection Officer

[Variant A, if no data protection officer is appointed:] We are not obligated to appoint a data protection officer. If you have any questions about data protection, please contact the controller named above.

[Variant B, if appointed: Enter name and contact details of the data protection officer.]

No Automated Decision-Making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

Changes to this Privacy Policy

We adapt this privacy policy as soon as changes to our processing activities or the legal situation require it. The version available on this page applies in each case.

As of: October 2026