Privacy Policy

This is a courtesy translation. The German-language version is legally binding.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Elias Reiche
trading under the business name "Law Flow"
Neu Hohenvier 9
16928 Groß Pankow
Email: info@law-flow.de

No data protection officer has been appointed, because the conditions of § 38 BDSG (German Federal Data Protection Act) are not met.

2. General information on data processing

As a rule, we process personal data of our users and prospective clients only to the extent necessary to provide a functioning website and our content and services. Personal data means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

This website is deliberately built to minimise data. It uses no cookies for analytics or marketing purposes, embeds no external fonts, analytics or tracking services, and loads no content from third-party servers without your consent. Section 3 explains local storage and consent management in more detail.

The internal editorial area at /admin is intended solely for the operator of the website; when it is opened, the editing software used there may send a status request to GitHub servers.

3. Cookies, local storage and consent management

The first time you open the website, you are shown a notice about cookies and external services. To save the choice you make there, we create an entry in your browser's local storage (localStorage, key "lawflow_consent_v1"). This entry is technically necessary so that the notice does not reappear on every page view; it contains no identifier that would allow you to be recognised beyond this website. The legal basis is § 25(2) no. 2 TDDDG (strictly necessary storage) in conjunction with Art. 6(1)(f) GDPR.

Non-essential external services, in particular the embedded appointment booking via Google Calendar (section 7), are loaded only after you have given your express consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). As long as you give no consent or choose "Essential only", no such services are activated. You can change or withdraw your choice at any time via the "Cookie settings" link in the page footer; withdrawal takes effect for the future.

4. Hosting and server log files

This website is hosted by an external service provider (host). When you open the website, the host automatically collects and stores information transmitted by your browser in what are known as server log files. These are usually:

• anonymised or truncated IP address of the accessing device,
• date and time of access,
• name and URL of the file retrieved,
• volume of data transferred and notification of successful retrieval,
• browser type and operating system used,
• referrer URL (the previously visited page).

This data is processed to ensure a smooth connection, convenient use of the website, evaluation of system security and stability, and for administrative purposes. The legal basis is our legitimate interest in the technically faultless presentation and the security of the website (Art. 6(1)(f) GDPR).

The hosting provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The website is delivered via its globally distributed network, usually from a location near you. Insofar as the hosting provider processes personal data on our behalf in doing so, a data processing agreement pursuant to Art. 28 GDPR is in place (Cloudflare Data Processing Addendum).

Transfers of personal data to the USA cannot be ruled out in this context. Cloudflare bases such transfers on the European Commission's standard contractual clauses and is also certified under the EU-US Data Privacy Framework. For details of the data processing by Cloudflare, please see the privacy policy at https://www.cloudflare.com/en-gb/privacypolicy/.

5. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string "https://" in your browser's address bar. When encryption is active, the data you send us cannot be read by third parties.

6. Contacting us

If you contact us by email or telephone, the details you provide (for example your name, email address and telephone number, as well as the content of your enquiry) are processed in order to handle the enquiry and in case of follow-up questions.

The legal basis is Art. 6(1)(b) GDPR where your enquiry serves to initiate or perform a contract, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). The data is deleted as soon as it is no longer needed for the purpose for which it was collected and no statutory retention obligations prevent deletion.

7. Appointment booking / initial consultation (Google Calendar)

To arrange a free initial consultation, we use the appointment booking function ("appointment schedule") of Google Calendar, a Google Workspace service. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The booking page is embedded on this website in a frame (iframe). It is loaded only after you have consented to external services via the cookie notice (§ 25(1) TDDDG, Art. 6(1)(a) GDPR); when you use it, Google may set its own cookies. Without consent, no content is loaded from Google; booking an appointment then remains possible via an external link to the booking page.

If you book an appointment there, Google processes the details you provide (in particular your name, email address, preferred appointment and any further information you give) as well as technical connection data in order to complete the booking, enter the appointment in our calendar and send confirmation and reminder emails. The legal basis is Art. 6(1)(b) GDPR (taking steps prior to entering into a contract at your request) and our legitimate interest in efficient scheduling (Art. 6(1)(f) GDPR). To that extent, Google processes this data on our behalf, on the basis of the Google Workspace Data Processing Amendment (Art. 28 GDPR).

Transfers of personal data to the USA cannot be ruled out in this context. Google bases such transfers on the European Commission's standard contractual clauses; Google LLC is also certified under the EU-US Data Privacy Framework. For details of the data processing by Google, please see the privacy policy at https://policies.google.com/privacy.

8. External links (including LinkedIn)

Our website contains links to external services, in particular to the controller's LinkedIn profile (LinkedIn Ireland Unlimited Company). These links are plain references; there is no embedding and no automatic data retrieval. The respective provider processes your data only once you actively click the link and open the external page. The respective provider is responsible for the data processing that takes place there, and its privacy terms apply.

9. Data processing in the course of consulting and implementation services

When initiating, concluding and performing consulting, configuration and implementation contracts with our business clients, we process personal data of contact persons (for example name, business contact details, role, communication content, contract and billing data).

The legal basis is Art. 6(1)(b) GDPR (initiating and performing a contract), Art. 6(1)(c) GDPR (compliance with legal obligations, in particular under commercial and tax law) and Art. 6(1)(f) GDPR (legitimate interest in the proper handling of the business relationship).

Where we access personal data on behalf of a client as part of the technical implementation (Art. 28 GDPR), we do so exclusively on the basis of a separate data processing agreement and in accordance with that client's documented instructions. Purely advisory or configuration services without access to a client's personal data generally do not constitute processing on behalf of a controller.

Access credentials, configuration files and similar confidential documents that we hand over to our clients in the course of implementation are not sent as e-mail attachments but via the password manager Bitwarden (Bitwarden, Inc., 1 N. Calle Cesar Chavez, Suite 102, Santa Barbara, CA 93103, USA), using its “Bitwarden Send” feature with a time-limited retrieval link. We use Bitwarden's EU cloud; the data is stored in data centres within the European Union. The content is end-to-end encrypted on our device and the key is contained only in the retrieval link; Bitwarden itself cannot read the content. A data processing agreement pursuant to Art. 28 GDPR is in place with Bitwarden. A transfer of metadata to the USA, for example in the course of maintenance and support, cannot be entirely ruled out; Bitwarden bases such transfers on the European Commission's Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in the secure transmission of confidential data (Art. 6(1)(f) GDPR). For details, please refer to Bitwarden's privacy policy at https://bitwarden.com/privacy/.

10. AI-assisted office organisation (Law Flow OS)

For the internal organisation of our business we use AI-based assistance systems that we operate ourselves under the name “Law Flow OS”. They sort incoming e-mails, prepare calls and meetings, maintain contacts, follow-ups and tasks, and create drafts of replies, offers and invoices. In doing so, the following data in particular is processed: name, organisation or law firm, business contact details, the content of your messages to us, appointment data and the status of the business relationship. A technical description is available in the article Law Flow OS (in German).

The assistance systems cannot send messages, publish anything, delete anything or trigger payments; the corresponding functions are technically not available to them. Every outward-facing action, in particular sending an e-mail, is taken by the controller personally after his own review.

Contacts, the sales overview, tasks, e-mails and appointments are held in Google Workspace (Google Ireland Limited, see section 7; on the basis of the Google Workspace data processing amendment under Art. 28 GDPR). The control of the assistance systems, their working notes and access to the language model run in our own account with Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg) in the Frankfurt am Main region. As language model we use Claude by Anthropic via the Amazon Bedrock service. Model requests are processed exclusively in data centres within the European Union; calls outside the EU are technically blocked in our account. Under AWS's terms, the model provider has no access to inputs and outputs, and they are not used to train models. We do not log the content of model requests. A data processing agreement pursuant to Art. 28 GDPR is in place with AWS (AWS GDPR Data Processing Addendum).

A transfer of personal data to the USA cannot be entirely ruled out with AWS either, for example in the course of maintenance and support. AWS bases such transfers on the European Commission's Standard Contractual Clauses; Amazon is also certified under the EU-US Data Privacy Framework. For details, please refer to the AWS privacy notice at https://aws.amazon.com/privacy/.

The legal basis is Art. 6(1)(b) GDPR where the processing serves to initiate or perform a contract, and otherwise our legitimate interest in efficient and traceable office organisation (Art. 6(1)(f) GDPR). You may object to this processing as set out in section 14. We do not process data from our clients' legal matters in this system; such data remains in the systems of the respective law firm (section 9).

11. Recipients and processors

Your data is passed on to third parties only where this is necessary to perform a contract, where you have consented, where a legal obligation exists or where a legitimate interest justifies it. Recipients may include our hosting provider, providers of appointment booking and communication services, Amazon Web Services as provider of the infrastructure and of access to the language model for our office organisation (section 10), Bitwarden as provider of the encrypted transmission of confidential documents (section 9) and, within the scope of tax obligations, our tax adviser and the tax authorities. With service providers that process personal data on our behalf, we conclude agreements pursuant to Art. 28 GDPR.

12. Retention period

We process and store personal data only for as long as this is necessary to achieve the respective processing purpose or as required by statutory retention periods (in particular under the German Commercial Code and the German Fiscal Code, generally six or ten years). Once the purpose no longer applies and any retention periods have expired, the data is deleted or its processing is restricted. To protect against data loss, we back up the working notes of our office organisation (section 10) every night to storage at AWS in Frankfurt that keeps each backup immutable for 35 days; a further backup is kept in Google Drive. When we delete data, for example at your request under Art. 17 GDPR, we remove it from the active data set immediately; for technical reasons it disappears from the immutable backups only when that period expires.

13. Your rights as a data subject

Under the GDPR, you have the following rights:

• right of access to the data processed (Art. 15 GDPR),
• right to rectification of inaccurate data (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing (Art. 21 GDPR),
• right to withdraw consent with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an informal message to the contact details given above is sufficient.

14. Right to object

Where we process personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to that processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

15. Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR). The supervisory authority responsible for the controller is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow
www.lda.brandenburg.de

16. No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place. The assistance systems described in section 10 merely prepare decisions; every decision affecting you is taken by the controller personally.

17. Currency and amendment of this privacy policy

This privacy policy is dated 1 October 2026. As our website and services develop, or in response to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version is available on this page at any time.