Privacy Policy

A General information

1 Definitions

For the purposes of this Policy, the following definitions based on Article 4 GDPR apply:

“Personal data” means any information relating to an identified or identifiable natural person. A person may be identified directly or indirectly, in particular by reference to a name, an identification number, an online identifier, location data, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. Personal data may also be contained in photographs and video or audio recordings.
“Processing” means any operation performed on personal data, whether or not by automated means. It includes, in particular, collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making data available, alignment, combination, restriction, erasure and destruction.
“Controller” means the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
“Third party” means a body other than the data subject, controller, processor and persons authorised to process personal data under the direct authority of the controller or processor.
“Processor” means a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller, in particular in accordance with the controller’s instructions.
“Consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which, by a statement or clear affirmative action, they signify agreement to the processing of personal data relating to them.

2 Controller and contact details

I am the controller responsible for the processing of your personal data within the meaning of Article 4 No. 7 GDPR:

Attorney Krzysztofa Charyton

Law firm of Krzysztof Charyton

Alt-Reinickendorf 11, 13407 Berlin

Telephone: 0176 301 06273

Email: info@kanzlei-charyton.de

Website: www.kanzlei-charyton.de

The office address is for written correspondence only. Personal visits at this address are not possible. Please contact me by phone or email.

Further information about my law firm can be found in the legal notice on my website: [Link to legal notice] — PL: Wklej ostateczny adres podstrony Impressum.

3 Contact for data protection matters

For all questions relating to data protection at the law firm, you may contact me directly using the details provided in Part A, section 2, in particular by email at info@kanzlei-charyton.de.

To learn more about this, check out our article “ Creating a Privacy Policy “.

4 Legal bases for processing

Personal data may be processed only where an appropriate legal basis applies. Depending on the circumstances, processing is based primarily on:

Article 6(1)(a) GDPR – the data subject’s consent;
Article 6(1)(b) GDPR – necessity for the performance of a contract or for taking pre-contractual steps at the data subject’s request;
Article 6(1)(c) GDPR – necessity for compliance with a legal obligation to which the controller is subject;
Article 6(1)(d) GDPR – necessity to protect the vital interests of the data subject or another natural person;
Article 6(1)(e) GDPR – necessity for the performance of a task carried out in the public interest or in the exercise of official authority;
Article 6(1)(f) GDPR – necessity for the purposes of legitimate interests pursued by the controller or a third party, except where those interests are overridden by the data subject’s interests or fundamental rights and freedoms.

The specific legal basis is identified in connection with each processing operation. Where a legal enquiry contains special categories of personal data, such as health data, an additional condition under Article 9(2) GDPR must apply. Where processing is necessary for the establishment, exercise or defence of legal claims, Article 9(2)(f) GDPR applies. Explicit consent under Article 9(2)(a) GDPR will be obtained separately where required for another purpose.

The storage of information on a user’s terminal equipment or access to information already stored on that equipment is permitted in particular on the basis of:

section 25(1) TDDDG – where the user has consented on the basis of clear and comprehensive information;
section 25(2)(1) TDDDG – where the sole purpose is to carry out the transmission of a communication over a public telecommunications network;
section 25(2)(2) TDDDG – where storage or access is strictly necessary to provide a digital service expressly requested by the user.

Any subsequent processing of personal data is assessed separately under the GDPR.

To learn more about this, check out our article “ Creating a Privacy Policy “.

5 Erasure and retention periods

For each processing operation carried out by me, I specify below how long the data are retained and when they are erased or their processing is restricted. Where no specific retention period is stated below, your personal data will be erased as soon as the purpose of, or legal basis for, their retention no longer applies and no other lawful ground for retention exists. The locations in which the service providers process data are set out in the relevant information in Parts B and C; for transfers to third countries, please see A 8.

Data may need to be retained beyond the period originally intended where this is required due to pending or anticipated litigation or other legal proceedings, or where statutory provisions require retention, in particular section 50 BRAO or section 147 AO. Statutory retention is based on Article 6(1), first sentence, point (c) GDPR. Retention necessary for the establishment, exercise or defence of legal claims is based on Article 6(1), first sentence, point (f) GDPR.

Where data become part of a lawyer’s client file, the retention period is generally six years, beginning at the end of the calendar year in which the engagement was terminated (section 50(1) BRAO). Different retention obligations, particularly those arising under tax law, may apply to individual documents. The retention period applicable to client files does not apply to every contact enquiry merely because it was addressed to a lawyer.

Once the statutory retention periods have expired and any other grounds requiring retention have ceased to apply, the data concerned will be erased. Where only continued retention is required, further processing will be restricted accordingly.

6 Data security

I use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. In doing so, I consider the state of the art, the implementation costs, as well as the nature, scope, context, and purposes of the processing and the varying likelihood and severity of the risks to the rights and freedoms of the data subjects. My security measures are adapted in line with technological developments.

My website uses SSL/TLS encryption (HTTPS) to protect the transmission of personal data between your browser and the website.

When communicating via email, complete protection against unauthorized access cannot be guaranteed for every transmission method. For particularly confidential documents, you can discuss a suitable transmission method with me. Further information on the available communication options is available upon request using the contact details in section A 2.

7. Cooperation with data processors

I use external service providers for the operation of my website and electronic communication, particularly in the areas of hosting, website infrastructure, form processing, consent management, email, IT and telecommunications.

Insofar as these service providers process personal data on my behalf, their engagement is based on a data processing agreement pursuant to Article 28 GDPR. The service providers may only process personal data according to my documented instructions and within the scope of the agreed purposes.

When selecting and integrating external service providers, data protection requirements and attorney-client privilege are taken into account.

8 Conditions for the transfer of personal data to third countries

As part of the processing operations described below, personal data may be transferred or disclosed to recipients outside the European Economic Area (EEA), i.e., in third countries. The legal basis for this processing is Article 6 of the GDPR, as specified in the respective section; for transfers to third countries, the requirements of Articles 44 et seq. of the GDPR must also be met. I will inform you about the specific details below at the relevant points.

The European Commission has certified certain third countries as having a level of data protection essentially equivalent to the European standard through so-called adequacy decisions. In this case, data transfers can take place under the conditions of Article 45 GDPR. Information on adequacy decisions can be found on the European Commission's website at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

Other third countries may not have a consistently comparable level of data protection. Where no applicable adequacy decision exists, suitable safeguards pursuant to Article 46 GDPR may be considered, such as the European Commission's Standard Contractual Clauses with any necessary supplementary measures. The 2021 Standard Contractual Clauses for transfers to third countries are available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.

When transferring data to US companies based on the EU-US Data Privacy Framework, it must be verified whether the specific recipient is currently certified and whether the transfer in question is covered by the certification. A mere branch of a provider in the US is not sufficient for this purpose.

Please contact me using the contact details in A 2 if you would like more information or a copy of the guarantees I have put in place for a transfer.

9 Automated decision-making including profiling

Automated decision-making, including profiling as defined in Article 22(1) and (4) of the GDPR, does not take place.

10. Provision of personal data

For purely informational use of my website, there is generally no legal or contractual obligation to actively provide me with personal data. However, the connection data required for technical access is processed when a page is requested.

Contacting me is voluntary. If you do not provide the necessary information, I may only be able to process your request to a limited extent or not at all. Required fields in the contact form are marked accordingly. If you wish to retain my services, further information may be required for initiating and carrying out the engagement, as well as for fulfilling legal obligations; I will inform you about this separately in connection with your engagement.

11. Legal obligation to transmit certain data

I may be subject to a specific legal or statutory obligation to provide lawfully processed personal data to third parties, in particular public authorities. The legal basis for this is Article 6(1)(c) GDPR. Legally protected confidentiality, in particular attorney-client privilege, will be respected.

12 Your rights

You can assert your rights regarding your processed personal data against me at any time using the contact details provided in section A 2. Subject to the legal requirements, you have the right to:
• In accordance with Article 15 of the GDPR, you have the right to request information about your data that I process. In particular, you can request information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients, the planned storage period or the relevant criteria for this, the existence of rights to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, and the origin of your data, provided that it was not collected from you. The right of access also includes the legally required information about automated decision-making, including profiling, and a copy of the personal data.
• In accordance with Article 16 GDPR, to request the immediate rectification of inaccurate or the completion of incomplete personal data stored by me.
• In accordance with Article 17 GDPR, you have the right to request the erasure of your data stored by me, unless a legal exception applies, in particular where processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims.
• In accordance with Article 18 GDPR, you have the right to request the restriction of the processing of your data. This is particularly relevant if you contest the accuracy of the data, if processing is unlawful and you request restriction instead of erasure, if I no longer need the data but you require it for legal claims, or if a decision regarding an objection pursuant to Article 21(1) GDPR is still pending.
• In accordance with Article 20 of the GDPR, you have the right to receive the personal data you have provided to me in a structured, commonly used and machine-readable format, or to have it transmitted to another controller, insofar as the processing is carried out by automated means and is based on consent or a contract. Direct transmission will take place where technically feasible and the rights and freedoms of other persons are not adversely affected.
• In accordance with Article 7(3) GDPR, you may withdraw your consent at any time with effect for the future. The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected. Processing based solely on this consent will cease for the future.

Right to object pursuant to Article 21 GDPR
Insofar as the processing is based on Article 6(1)(e) or (f) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data. This also applies to profiling based on these provisions. Please inform me of the reasons for your objection in this case.
In the event of such an objection, I will no longer process the personal data in question unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.
If personal data is processed for direct marketing purposes, you can object to this processing at any time without having to provide specific reasons. This also applies to profiling insofar as it is related to such direct marketing. After an objection, the data in question will no longer be processed for these purposes.

Right to lodge a complaint and competent supervisory authority
Pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. This applies in particular to an authority in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The following data protection supervisory authority is responsible for my law firm:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59-61, 10555 Berlin
Email: mailbox@datenschutz-berlin.de
Contact: https://www.datenschutz-berlin.de/ueber-uns/kontakt/
Exercising your rights is generally free of charge. Legal restrictions, in particular those protecting the rights of other persons and legally protected secrets, remain unaffected.

13 Changes to the Privacy Policy

In light of ongoing developments in data protection law and technological or organizational changes, I regularly review this privacy policy to determine if it needs to be updated or supplemented. I will inform you of any changes on my website www.kanzlei-charyton.de. This privacy policy is dated September 22, 2026.

B. Visiting websites

1. Explanation of the function and hosting

Information about my law firm and the services I offer can be found at www.kanzlei-charyton.de , including its subpages, hereinafter collectively referred to as the "Website". When you visit my Website, your personal data may be processed.

The content of my website is hosted by the following provider:

Wix.com Ltd.
5 Yunitsman St.
Tel Aviv
Israel

Representative in the European Union pursuant to Article 27 GDPR:

Wix Online Platforms Limited
1 Grant's Row
Dublin 2, D02HX96
Ireland

Provider's privacy policy:
https://de.wix.com/about/privacy

The processing of personal data may take place in particular in data centers in Israel, Ireland, the United States of America, South Korea and Taiwan, and possibly in other countries, insofar as this is necessary for the provision of the services.

For data transfers to Israel and South Korea, the European Commission has issued adequacy decisions pursuant to Article 45 of the GDPR. For transfers to the United States, Wix may rely on the EU-US Data Privacy Framework, provided the recipient is appropriately certified. For transfers to third countries for which no adequacy decision exists, Wix uses, in particular, the European Commission's Standard Contractual Clauses pursuant to Article 46(2)(c) of the GDPR, as well as supplementary technical, contractual, and organizational safeguards.

Insofar as the hosting provider acts on my behalf, the requirements for data processing described in section A 7 apply. The purpose, data categories, legal bases, and storage period of website processing are set out in the following sections.

2. Processed personal data

When you use my website for purely informational purposes, the data required for the technical retrieval, provision, and security of the website is processed. This may include, in particular, the following technical access data:

IP address of the accessing device,
accessed page or URL and activities on the website,
Previously visited page or referrer URL and exit page,
Date and time of access,
Type, language and version of the web browser used,
Operating system, device type and screen resolution,
Language settings and keyboard settings,
Internet service providers,
Approximate location information derived from the IP address.

Contact form: When you use my contact form, I process the information you submit. This includes:

First name and last name,
E-mail address,
Telephone number, if voluntarily provided,
Please indicate whether you require support as an employee, employer, company, or start-up.
the selected topic
the description of your request that you entered,
Confirmation of the privacy policy.

In connection with the submission of the form, technical accompanying data may also be processed, in particular the time of submission, the form or page URL, IP address or network identifiers, device and browser information, as well as data required for the detection and prevention of spam and abusive entries.

The contact form is provided via Wix Forms. The submitted form data is stored in the "Forms & Submissions" section of my Wix account. I may also receive an automated email notification from Wix upon receipt of a new inquiry.

Inquiries via email or telephone: If you contact me via email or telephone, your inquiry and the resulting personal data will be processed. This includes, in particular, your contact and sender details, the time of communication, and the information you provide regarding your request.

3. Purpose and legal basis of data processing

I process the aforementioned personal data in accordance with the provisions of the GDPR and other applicable data protection regulations, and only to the extent necessary. Insofar as the processing is based on Article 6(1)(f) GDPR, the stated purposes also constitute my legitimate interests.

The processing of connection data required for accessing my website serves to deliver it. The log data serves to ensure the functionality and quality of the website, in particular the stability and security of the connection, troubleshooting, and the detection and prevention of unauthorized access. The legal basis for this is Article 6(1)(f) GDPR.

The processing of contact form data and information from email or telephone inquiries is carried out to process and respond to your request and for any related follow-up questions. If the inquiry relates to the initiation or execution of a client relationship with you, the legal basis is Article 6(1)(b) GDPR. For other inquiries, Article 6(1)(f) GDPR applies; my legitimate interest lies in the proper communication and processing of the concerns addressed to my law firm.

Where processing is required by law, it is based on Article 6(1)(c) GDPR. If a request contains special categories of personal data, the conditions of Article 9 GDPR described in section A 4 also apply.

If the processing requires storing information on your device or accessing information already present there, this process is additionally assessed according to Section 25 Paragraph 1 or 2 of the German Telemedia Act (TDDDG). Details regarding the use of cookies and similar technologies are described in Section B 6.

4. Duration of data processing

Your personal data will only be processed for as long as is necessary to achieve the above-mentioned purposes or as long as there are legal or other permissible reasons for retention.

There is no uniform retention period for the technical access and log data processed by Wix that applies to all data categories. Wix stores this data only as long as necessary for the provision and security of the services, the prevention of misuse and fraud, compliance with legal obligations, or the protection of legitimate interests, in accordance with the respective processing purpose.

In the event of a specific security incident, the data required for its investigation may be retained until the necessary clarification, securing of evidence or legal proceedings have been completed.

The data you submit via the contact form, email or other means of contact will be deleted as soon as your request has been fully processed and its further storage is no longer necessary, unless there are legal retention obligations or other permissible reasons for retention.

If an inquiry does not lead to the establishment of a client relationship, the data stored for this purpose is generally deleted no later than six months after the inquiry has been fully processed. If the data becomes part of a client file, the retention periods described in section A 5 also apply.

Additional copies of the data transmitted via the contact form in the "Forms & Submissions" section of the Wix account, as well as corresponding notifications in the email mailbox provided via IONOS, will also be deleted no later than six months after the final processing of the request, unless further storage is required or legally mandated.

Form submissions classified as spam by Wix Forms are generally stored in the spam folder for 30 days and then automatically deleted.

The data processors I have engaged store personal data in accordance with the respective order and the applicable legal and contractual requirements. Regarding the usage and storage duration of cookies, as well as the documentation of granted or refused consent, please refer to section B 6. Otherwise, the information under section A 5 applies.

5 Transfer of personal data and legal bases

The following recipients or categories of recipients may be granted access to personal data to the extent necessary:

Service providers for the operation of my website and the processing of the data stored or transmitted through it, in particular hosting, IT security, technical support, and form, email, and consent management services. Insofar as these providers act under my instructions, the requirements for commissioned data processing pursuant to Article 28 GDPR apply. The legal basis for the underlying processing is set out in section B 3.
Government agencies and authorities, insofar as the transfer is necessary for compliance with a legal obligation. The legal basis is Article 6(1)(c) GDPR.
In individual cases, recipients to whom transmission is necessary for the assertion, exercise, or defense of legal claims may be disclosed. These may include, in particular, courts, authorities, parties to proceedings, legal advisors, and the professional liability insurer HDI Versicherung AG, HDI-Platz 1, 30659 Hannover. The legal basis is Article 6(1)(f) GDPR. Attorney-client privilege is respected.

In addition to the hosting provider mentioned under B 1, the following service providers are used:

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

IONOS provides the business email infrastructure and manages the domain. As part of email communication, sender and recipient data, communication content, attachments, sending and receiving times, and technical connection data may be processed. This processing generally takes place in Germany or within the European Union. If further subcontractors are used, the data protection regulations agreed upon with IONOS apply.

Usercentrics GmbH
Sendlinger Straße 7
80331 Munich
Germany

Usercentrics is used to manage cookie and consent settings. This may involve processing, in particular, granted or rejected consent, the date and time of the decision, device and browser information, and the IP address. This processing generally takes place in Germany or within the European Union.

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

The contact form uses the reCAPTCHA function integrated into Wix Forms to protect against automated entries, spam, and misuse. This may involve processing IP address, device and browser information, date and time of access, and information about website usage.

The processing is based on Article 6(1)(f) GDPR. My legitimate interest lies in protecting the website and the contact form from abusive or automated access.

Processing by Google may also take place outside the European Economic Area, particularly in the USA. Where personal data is transferred to third countries, the conditions described in section A 8 apply. This may – depending on the recipient and their current certification – be based in particular on an adequacy decision or the standard contractual clauses of the European Commission.

Wix Forms and Wix Automations are provided by the hosting provider already mentioned in section B 1 and do not represent an additional, independent service provider.

Upon engagement, I will provide you with additional information about the recipients required for this purpose, such as courts, authorities, and parties to the proceedings. For the requirements for transferring data to third countries, please see section A 8. Beyond the cases described above, data may also be transferred based on your consent pursuant to Article 6(1)(a) GDPR.

6. Use of cookies, plugins and other services

Cookies are small files that are assigned to and stored on your device by the browser you are using, and through which certain information is transmitted to the entity that sets the cookie. Similar technologies can, in particular, use local browser storage or read information from the device.

Cookies can contain data that allows the device being used to be recognized or that stores information about certain settings. Whether the data can be associated with a person depends in particular on the stored identifiers and their linking with other information. Cookies themselves are not executable programs.

A distinction is made between session cookies, which are generally deleted at the end of the session, and persistent cookies, which remain stored beyond the individual session until their validity expires or until they are deleted.

According to the current technical configuration, the following categories of cookies and similar technologies are used on my website:

Technically required technologies: These are provided by Wix and the consent management system used and serve in particular to ensure the secure and functional provision of the website, the detection of attacks and abusive access, session management, the display of content, the security of the contact form and the storage of your cookie selection.
Analytics technologies: With your explicit consent, Wix Analytics may be used to analyze website usage, pages visited, technical errors, and the overall functionality of the website. This may include processing device and browser information, usage data, truncated or full IP addresses, and the time and duration of page views.

Advertising, targeting, or sharing cookies are not used according to the current configuration. In particular, no meta pixel and no separate Google Analytics account are integrated.

To protect the contact form from automated entries, spam, and misuse, a CAPTCHA security feature integrated into Wix Forms is also used. Further information can be found under section B 5 and in the cookie settings.

A current overview of the cookies and similar technologies actually used, including details on their name, provider, purpose, category, and storage duration, is part of the consent management system. You can access this overview at any time via the "Cookie Settings" button or icon available on the website.

The legal basis for storage or access that is absolutely necessary to provide you with the expressly requested website and its basic functions is Section 25 Paragraph 2 No. 2 of the German Telemedia Act (TDDDG). The associated processing of personal data, where applicable, is based on Article 6 Paragraph 1 Sentence 1 Letter f of the GDPR. My legitimate interest lies in the secure, stable, and functional provision of the website.

Non-essential storage or access will only occur with your active consent in accordance with Section 25 Paragraph 1 of the German Telemedia Act (TMG). Insofar as personal data is processed in this context, Article 6 Paragraph 1 Sentence 1 Letter a of the GDPR serves as the legal basis. You can withdraw your consent at any time with effect for the future. The lawfulness of the processing carried out before the withdrawal remains unaffected.

b Cookie information and consent management

I use a consent management platform from: to manage cookie settings and consents.

Usercentrics GmbH
Sendlinger Straße

C Data Privacy Statement Social Media

I. General

I maintain publicly accessible profiles on social media. Your visit to these profiles triggers various data processing operations. Below, I provide an overview of which of your personal data is collected, used, and stored when you visit these profiles or contact me.

Personal data is information that can be associated with you as a specific individual, such as your name, age, address, photos, email addresses, or IP addresses. Furthermore, I would like to inform you about your rights regarding the processing of your personal data. You are not obligated to provide me with personal data. However, this may be necessary for certain functions and for responding to inquiries; without the required information, these options may not be available or may be limited.

These guidelines apply to my law firm-related appearances on Instagram and Facebook, as well as to the professional or law firm-related use of my personal LinkedIn profile:

Instagram: [profile name and full link] — PL: Wpisz nazwę i pełny link do profilu.

Facebook: [page name and full link] — PL: Wpisz nazwę i pełny link; potwierdź, czy to strona Facebook, czy profile osobisty.

LinkedIn: [profile name and full link] — PL: Wpisz link do swojego osobistego profilu.

When you visit these platforms, personal data is collected, used, and stored not only by me but also by the operators of the respective social networks. This can happen even if you do not have a profile on the network yourself. The specific data processing operations and their scope vary depending on the platform operator and are not fully transparent to me.

For details on the collection and storage of your data, as well as the type, scope and purposes of its use by the respective operator, please refer to their privacy policy:

• Facebook is operated in the European region by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy policy: https://www.facebook.com/privacy/policy/.

• Instagram is also operated in Europe by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy policy: https://privacycenter.instagram.com/policy/.

• LinkedIn is offered to users in the European Economic Area by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy. Additional information for Europe: https://www.linkedin.com/legal/privacy/eu.

The platform operators may process, in particular, technical data, device information, usage activity, and information from cookies. Depending on the service and settings, this data may be linked to an existing user account and used to provide the platform, for statistical analysis, and to personalize content and advertising. The providers' processing for their own purposes is distinct from my own processing and any jointly managed processing operations.

II. Information on the collection of personal data

1. Responsible person and contact

I, lawyer Krzysztofa Charyton, law firm Krzysztofa Charyton, Alt-Reinickendorf 11, 13407 Berlin, telephone 0176 301 06273, email info@kanzlei-charyton.de, am responsible for the processing described here by my law firm within the meaning of Art. 4 No. 7 GDPR.

For data protection inquiries, please contact me directly. The above address is for written correspondence only; personal visits are not possible there. Please contact me by phone or email.

2. Attendance at performances and usage statistics

When you visit or interact with my social media presences, I may be shown profile information that is accessible in accordance with your respective settings. This includes, in particular, your displayed name, profile picture, other visible profile information, as well as information about reactions, comments and other interactions. I receive this information directly from you or through the platform on which you provide it.

I process this data to present my legal practice, communicate with interested parties and maintain the information I provide. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing information about my services and facilitating appropriate professional exchange. Separate information set out below regarding contact enquiries applies to specific enquiries concerning legal representation.

a Facebook

I operate a Facebook Page for my law firm. If you visit or follow this Page or interact with its content, I may—depending on your privacy settings—be shown, in particular, your name, profile picture, reactions, comments, shared content and messages.

As the operator of the Facebook Page, I receive aggregated usage statistics from Meta, known as Page Insights. These may include, in particular, information about the reach of the Page and individual posts, views of the Page and its posts, interactions with published content, as well as aggregated demographic and geographical information about visitors and followers.

I use these statistics exclusively to assess the reach and relevance of the information I provide and to develop the content in line with users’ needs. I have no access to the individual data that Meta processes to compile these aggregated statistics and does not provide directly to me.

I and Meta Platforms Ireland Limited are joint controllers pursuant to Art. 26 GDPR for the processing of Insights data covered by the Page Insights Controller Addendum. The respective responsibilities for fulfilling data protection obligations are governed by the Page Insights Controller Addendum. In particular, Meta is responsible for providing essential information about the processing of Insights data and handling data subject requests covered by the agreement.

The Page Insights Controller Addendum is available at:

https://www.facebook.com/legal/terms/page_controller_addendum

My processing in connection with Page statistics is based on Art. 6(1), sentence 1, point (f) GDPR. My legitimate interest lies in understanding the reach of the information I provide and developing the published content appropriately.

When you visit Facebook, Meta may use cookies and comparable technologies, process usage information and create interest-based profiles. This may also occur if you are not logged into Facebook or do not have a Facebook account. I have no influence over the nature, scope or duration of this independent processing by Meta. Further information is available in Meta’s privacy notices linked under C 1.

b Instagram

I operate a professional Instagram account for my law firm. If you visit or follow my Instagram profile or interact with published content, I may—depending on your settings—be shown, in particular, your username, profile picture, comments, reactions, shared content and messages.

Through the Instagram Insights feature, Meta provides me with aggregated statistics concerning the use of my profile and content. These may include, in particular, information about profile and content views, reach, impressions, interactions with posts, Stories and Reels, changes in follower numbers, as well as aggregated information concerning the locations, age groups and activity times of the users reached.

I use this information exclusively to assess the reach and relevance of the information I provide and to develop my content in line with users’ needs. As a general rule, I receive only the aggregated analyses provided by Meta and have no access to the individual user data that Meta processes to produce these statistics.

I and Meta Platforms Ireland Limited are joint controllers pursuant to Art. 26 GDPR for the creation and provision of Instagram Insights data covered by the relevant Controller Addendum. Details of the allocation of responsibilities are set out in the Controller Addendum provided by Meta:

https://www.facebook.com/legal/terms/page_controller_addendum

My processing of the Instagram statistics provided is based on Art. 6(1), sentence 1, point (f) GDPR. My legitimate interest lies in assessing how the information I provide is received and tailoring the published content to users’ actual information interests.

Meta’s privacy notices linked under C 1 apply to any additional independent processing of personal data carried out by Meta.

c LinkedIn Profile

I use my personal LinkedIn profile for professional purposes and in connection with my legal practice. If you visit or follow my profile, send me a connection request or interact with my posts, I may—depending on your settings and the features provided by LinkedIn—be shown, in particular, your name, profile picture, professional profile information, reactions, comments, messages and other interactions.

LinkedIn may provide me with information about visits to my profile. Depending on the visitor’s settings and my respective LinkedIn account plan, this may include individual profile information or only aggregated information about profile visits.

LinkedIn also provides statistics concerning my published posts and audience. These may include, in particular, information about the impressions, reach and interactions of individual posts, changes in follower numbers, as well as aggregated information regarding professional roles, industries, locations, seniority levels, companies or company sizes.

Where I use this information, I do so exclusively to assess the reach and relevance of my professional content and to develop the information I provide appropriately. The legal basis is Art. 6(1), sentence 1, point (f) GDPR. My legitimate interest lies in professional networking, professional exchange and tailoring the information I provide to users’ needs.

The account used is a personal LinkedIn profile and not a LinkedIn Company Page operated by me. The joint controllership agreement for Page Insights applicable to LinkedIn Pages therefore does not apply solely because I use this personal profile.

LinkedIn’s privacy notices linked under C 1 apply to LinkedIn’s independent processing of personal data.

3. Contacting others via social networks

If you use my social media presences to contact me, for example by publishing your own posts, reacting to one of my posts or sending private messages, I process the information you provide for the purpose of handling your message and communicating with you. This includes your displayed name, any contact details and profile information made accessible by you, the content of your message and information relating to the relevant interaction.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry concerns entering into or performing a legal services engagement with you. In all other cases, processing is based on Art. 6(1)(f) GDPR; my legitimate interest lies in responding to enquiries addressed to me and facilitating professional exchange. Where specific processing is based on separately obtained consent, Art. 6(1)(a) GDPR applies. Merely contacting me is not treated as blanket consent to all forms of processing.

If your message contains special categories of personal data, the requirements set out under A 4 also apply. Please do not disclose confidential information relating to a legal matter in public comments. You may also contact me independently of social media by telephone or email.

3 a Contact via WhatsApp Business

My website contains a button or link that allows you to start a conversation directly with my WhatsApp Business account.

The link leads to the WhatsApp Business account of Rechtsanwaltskanzlei Krzysztofa Charyton at the following telephone number:

+49 176 30106273

It is a standard external link to the WhatsApp service in the following format:

https://wa.me/4917630106273

Certain buttons may additionally transfer a pre-written message to WhatsApp, which you can edit before sending. This message is not sent automatically. You decide whether to send it and what content to include.

No WhatsApp widget or other code provided by WhatsApp or Meta is embedded on my website. Therefore, until you click the link, no WhatsApp content is loaded and no data is transmitted to WhatsApp merely as a result of the WhatsApp button being displayed.

When you click the link, you leave my website and access the WhatsApp service. Any subsequent processing is carried out by WhatsApp Ireland Limited or the respective company responsible under the WhatsApp Terms. In particular, your telephone number, profile name and profile picture, the content of your message, transmitted attachments, as well as technical usage, connection and device data may be processed.

According to WhatsApp, personal messages and calls are generally protected by end-to-end encryption. Regardless of this, WhatsApp may process technical communication data and metadata. Data may also be stored on the devices involved, in backups or in accordance with WhatsApp’s settings and terms. Processing may also take place in third countries, particularly the United States. For further information regarding the requirements applicable to transfers to third countries, please also refer to A 8.

Further information is available in WhatsApp’s Privacy Policy and WhatsApp Business Terms:

https://www.whatsapp.com/legal/privacy-policy-eea

https://www.whatsapp.com/legal/business-terms

I process the information you transmit via WhatsApp to respond to your enquiry and, where applicable, to take steps towards entering into or performing a legal services engagement. The legal basis is Art. 6(1), sentence 1, point (b) GDPR insofar as your enquiry concerns entering into or performing such an engagement. For general enquiries, processing is based on Art. 6(1), sentence 1, point (f) GDPR. My legitimate interest lies in efficiently handling incoming contact enquiries.

Please do not send particularly sensitive information or extensive documents relating to a legal matter via WhatsApp unless a suitable and secure means of transmission has been agreed in advance. For detailed descriptions and documents, please use the direct contact methods provided on my website or an individually agreed means of transmission.

Messages and copies of enquiries stored by me that do not result in a legal services engagement will be deleted no later than six months after the enquiry has been conclusively handled, unless statutory retention obligations, the establishment or defence of legal claims, or other permissible grounds for retention require otherwise.

If an enquiry results in a legal services engagement, the information required to handle the matter may be transferred to the relevant client file. The retention periods specified under A 5 also apply to this data. Any further storage by WhatsApp is governed by the platform operator’s terms and deletion policies.

4 Recipients and data transfers

When communication takes place via social networks or WhatsApp, the respective platform operators are involved in the processing. Where applicable, the information provided under A 7 and B 5 applies accordingly to any additional service providers and other recipients engaged by me, insofar as they actually process the relevant communication.

I currently do not use any additional external social media management tool to manage my social media presences.

Meta, WhatsApp and LinkedIn may also process personal data outside the European Economic Area, particularly in the United States. The general requirements applicable to transfers to third countries are explained under A 8. The following additional information applies to the specific services used:

Meta – Facebook and Instagram

For individuals in the European Economic Area, the entity generally responsible for Facebook and Instagram is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. In connection with the operation of these services, personal data may be transferred to other companies within the Meta group, particularly Meta Platforms, Inc. in the United States, as well as to other service providers and recipients.

For transfers to certified recipients in the United States, Meta relies—where the relevant processing is covered by the certification—on the European Commission’s adequacy decision concerning the EU–US Data Privacy Framework. Where this framework does not apply, Meta states that it relies in particular on the Standard Contractual Clauses approved by the European Commission or other transfer mechanisms permitted under Art. 44 et seq. GDPR.

Further information is available in Meta’s Privacy Policy:

https://www.facebook.com/privacy/policy/

Information about the EU–US Data Privacy Framework and the safeguards used by Meta is available at:

https://www.facebook.com/privacy/policies/data_privacy_framework/

For users in the European Economic Area, the responsible entity is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn also processes and stores personal data in the United States, particularly through LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, California 94085, USA, and with the involvement of affiliated companies and service providers.

LinkedIn relies on the EU–US Data Privacy Framework for certain transfers to the United States. According to LinkedIn, it relies in particular on the Standard Contractual Clauses approved by the European Commission for other transfers.

LinkedIn’s Privacy Policy is available at:

https://www.linkedin.com/legal/privacy-policy

Further information regarding international data transfers and the safeguards used is available at:

https://www.linkedin.com/help/linkedin/answer/a1343190

WhatsApp Business

When you contact me via WhatsApp Business, WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, is involved in the processing. WhatsApp may transfer personal data, in particular, to WhatsApp LLC and Meta Platforms, Inc. in the United States, as well as to other Meta group companies and service providers.

According to WhatsApp, transfers to WhatsApp LLC and Meta Platforms, Inc. in the United States are based—where the relevant processing is covered by the respective certification—on the EU–US Data Privacy Framework. For certain other transfers to third countries, WhatsApp relies in particular on the Standard Contractual Clauses approved by the European Commission.

Further information is available in WhatsApp’s Privacy Policy:

https://www.whatsapp.com/legal/privacy-policy-eea

Information about the transfer mechanisms applicable to WhatsApp Business is available at:

https://www.whatsapp.com/legal/business-data-transfer-addendum

Processing carried out by the platform operators for their own purposes, including their own transfers to additional recipients, is described further in their respective privacy notices. Joint controllership applies only to processing operations for which it is expressly provided and does not automatically extend to all other processing carried out by the respective providers.

III. Your rights as a data subject

As a person affected by the processing of personal data, you have the following rights, subject to the applicable statutory requirements:

Pursuant to Art. 15 GDPR, you have the right to obtain information about the processing of your personal data, including a copy of the relevant data.
Pursuant to Art. 16 GDPR, you have the right to request the prompt rectification of inaccurate personal data and the completion of incomplete data.
Pursuant to Art. 17 GDPR, you have the right to request the deletion of personal data concerning you.
Pursuant to Art. 18 GDPR, you have the right to request the restriction of the processing of your personal data.
Pursuant to Art. 20 GDPR, you have the right to receive the data concerning you that you have provided in a structured, commonly used and machine-readable format and to transmit that data to another controller, provided that the statutory requirements are met.
Pursuant to Art. 21 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. In the case of direct marketing, you have the right to object at any time without stating any specific grounds. In each case, this also applies to any related profiling; further details are provided under A 12.
Pursuant to Art. 7(3) GDPR, you have the right to withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing carried out on the basis of that consent before its withdrawal.
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The information provided under A 12 concerning complaints and the competent Berlin supervisory authority also applies here.

To exercise your rights in relation to processing carried out by me, you may contact me directly. Insofar as your request concerns processing carried out by the respective platform operator, you may also contact that operator directly. In the case of processing operations for which joint controllership applies, you may generally exercise your rights against either controller. Where necessary, I will cooperate with the respective provider and forward the request for processing.