info-mannheim@rae-mauser.de   |     info-kuenzelsau@rae-mauser.de                  +49 621 80397-0   |   +49 7940 9831-0

Dara protection

General Data Protection Regulation in accordance with Art. 13 and 14 DS-GVO (GDPR), as of November 28th, 2018

Name and Contact details of the person responsible
Thomas Mauser Rechtsanwälte, Mallaustraße 58, 68219 Mannheim, Germany and Benzstraße 7, 74653 Künzelsau, Germany (branch office) hereafter “Law Office”
Owner: Thomas Mauser

Contact details of Data Protection Officer
Rechtsanwältin Annett Feuchter-Schulz
Benzstraße 7
74653 Künzelsau
Tel.: +49 7940 9831-0
E-Mail: datenschutz@rae-mauser.de

Purposes and legal bases of processing Personal Data
Processing purposes are contractual performance and assertion, exertion or defence of contractual legal claims of clients according to Art. 6 Section 1b) DS-GVO (GDPR) and assertion, exertion or defence of statutory legal claims of clients, receivable management and reporting to credit insurers according to Art. 6 Section 1f) DS-GVO (GDPR).

Categories of processed Personal Data
Personal Data, Address, Communication Data, Identification Numbers, Role, Claim Data, Credit History Data, Bank Data, Asset Information, Memos and Recordings of Debtors, Third-Party Debtors, Clients, Further Participants.

Recipient Categories of Personal Data
Supervisory Authorities, Credit Agencies, Banks, Public Authorities, Coaches, Data Destroyers, Detective Agencies, Third-Party Debtors, Print Service Provider, Courts, Bailiffs, Creditors, Information-and Research Service Provider, Insolvency Administrator, IT Service Provider, Cooperation Partner for International Debt Collection, Credit Insurer, Police, Lawyers, Register of Debt Counselling, Collateral Giver, Public Prosecutors, Contract Lawyer Offices, Deliverer, Other Parties to the Proceedings.

Transmission in a Third Country
Relevant for assertion of outstanding debts is the loacation of debtors as well. Only if a debtor is abroad, the Law Office will assign foreign collecting partner with collection of the debts. If debtors location is outside EU (Third Country), the transmission of Personal Data will be made without that an appropriate decision of the Committee is needed according to Art. 49 § 1 Subparagraph 1e) DS-GVO (GDPR).

Storage Period
Criterias determiniation of storage periods are the existence of termination of assignment demands, end of processing as well as retention periods and relevant deadlines for defence of legal claims (f.e. for appeal). Personal Data will be limited after 3 years after termination of processing and deleted after 10 years due to complete expiration of all assigned demands or withdrawal of clients. Deadlines start respectively at the end of the year in which the processing ended. Records of conversations will be deleted after 30 days of recording.

Legitimate interest of processing according to Art. 6 Section 1f) DS-GVO (GDPR)
The processing of Personal Data of debtors and clients persist in assertion, exertion or defence of legal claims of creditors. They comprise for the purpose of debt collection in particular in data based analyses and improvement of processes. The legitimate interest of client for such processing comprises significantly in a reasonable assertion of own demands subject to mitigate damage. Interest of debtors, not wanting to assert a claim against themselves by opposing lawyers will not be acknowledged as interest.

The processing of data of debtors for the purpose of reporting to a credit insurer will be made for information for Third Parties about negative payment experiences with the person concerned in order to preserve this Third Party from economic disadvantages. Transmission of information to credit insurers can occur if clients assign insured debts for collection.

Rights of the Data Subject
Parties concerned have the right to request information (According Art. 15 DS-GVO (GDPR)), demand the correction (Art. 16 DS-GVO (GDPR)) demand erasure (Art. 17 DS-GVO (GDPR)) demand the restriction of the processing (Art. 18 DS-GVO (GPDR)), data portability (Art. 20 DS-GVO (GDPR)) and contradiction (Art. 21 DS-GVO (GDPR)) of their personal data. Parties concerned can revoke issued approval at any time. Exercising of those rights can be restricted by assertion, exertion or defence of legal rights.

Data Protection Authority
Affected persons have a right of appeal at the responsible Data protection authority:

State representative for Data Protection and freedom of information, Postfach 10 29 32, 70025 Stuttgart, Germany.
https://www.baden-wuerttemberg.datenschutz.de/

Sources of Personal Data
Supervisory Authorities, Credit Agencies, Authorities, Parties concerned, Detective Agencies, Third-Party Debtors, Print Service Provider, Courts, Bailiffs, Creditors, Information-and Research Service Provider, Insolvency Administrator, Internet, Cooperation Partner for International Debt Collection, Police, Lawyers, Register, Debt Counselling, Collateral Givers, Public Prosecutors, Contract Law Offices, Deliverer, Other Parties to the proceedings.

Obligation of Provision of Personal Data
There are no contractual or statutory obligations of debtors to provide data to Thomas Mauser Rechtsanwälte. A statutory obligation of provision on persist within enforcement measures according to § 802c ZPO (Financial Status Disclosure) to the bailiff. A major consequence for failure to provide information can be enforcement detention according § 802g ZPO.

Cookies
We use Cookies on our website. These are small files that your browser automatically creates and that are stored on your device in a folder for this purpose. The Cookies enable us to learn how the website is used. We apply session Cookies. They will be automatically deleted at the end of your Browser session. Through session Cookies we can detect if you have visited individual pages of our website before. We also use Cookies which will remain on your device until you delete them manually. Those Cookies enable us to recognize you when visiting our website again. Current Browsers are accepting Cookies automatically. You can monitor, restrict or prevent the placement of Cookies. Most Browsers can be configured so that Cookies will be deleted automatically after ending every Browser session. The full deactivation of Cookies can cause restricted features on our website. The collected and processed data through Cookies are for the previous stated purposes to protect our justified interests as well as Third Parties according Art. 6 Section 1 S. 1 lit. f DS-GVO (GDPR).

Google Analytics
For the appealing design, analysis and continuous optimization of our website we use the service of Google Analytics. Provider of the web analysis service is Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics is using Cookies. These are small files that your Browser automatically creates and that are stored on your device in a folder for this purpose and able an analysis of the use of the website. The generated information of usage of our website will be transferred to a Google Server in USA and stored there. The placement of Cookies for website analysis occurs on basis of Art. 6 Section 1 lit. f DS-GVO (GDPR). You can restrict the placement of Cookies. This can cause restricted features on our website. Furthermore you can prevent the collection and the subsequent processing of Data by Google (incl. your IP address) through Cookies. For this you have to download and install a Browser-Plug-in: https://tools.google.com/dlpage/gaoptout?hl=de. Further information for the handling of user Data at Google Analytics can be found in the Privacy Statement of Google: https://support.google.com/analytics/answer/6004245?hl=de..

Automated Decision incl. Profiling
Our Law Office does not use automated decisions incl. profiling with legal effect towards affected persons.

Note about possible phone calls
Telephone calls can be recorded for training purposes. If you don’t agree to it, please inform us at the beginning of the call. Recordings are deleted as specified in “storage periods”.

Data protection information on cyber security

1. Purposes and Legal Bases for Processing Personal Data

As part of the cybersecurity strategy and to secure our systems and information, particularly for detecting and responding to cyber threats, security incident detection and analysis are conducted with the support of an external Security Operations Center (SOC). The SOC is tasked with identifying, assessing, and responding to cybersecurity threats by monitoring log data and system events from the IT infrastructure of the law firm and affiliated companies.

In this context, all log data used to identify potential attack scenarios from IT systems and infrastructures monitored by the law firm are automatically transmitted to the SOC service provider.

The purpose of processing is to ensure information security pursuant to Art. 6(1)(f) GDPR.

2. Categories of Processed Personal Data

The following categories of personal data may be affected:

  • Employees of the law firm using monitored systems
  • System administrators and privileged users subject to enhanced monitoring
  • External service providers or contractors with authorized access
  • Business partners and suppliers whose data may appear in file or message metadata
  • Clients/delinquent clients or third parties, in rare cases where personal references appear in monitored content or file identifiers

The collected information consists of technical data. Such metadata may, under certain circumstances, contain personal data, such as:

  • Usernames and account identifiers
  • IP and MAC addresses
  • Device and system identifiers
  • Login timestamps and authentication results
  • Email metadata (e.g., subject lines, addresses)
  • File names, paths, and metadata of attachments
  • URLs, web access logs, and activity traces
  • Location data (e.g., derived from endpoint usage or VPN)

3. Categories of Recipients of Personal Data

The SOC service provider is the recipient of the data, with its analysts having access to the information. The service is centrally provided by:

EOS Technology Solutions GmbH • Steindamm 71 • 20099 Hamburg.

4. Transfer to a Third Country

No transfer to a third country takes place.

5. Storage Duration

The technical data are stored for 12 months and then deleted.

6. Rights of Data Subjects

Data subjects have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection (Art. 21 GDPR) regarding their personal data. Data subjects may revoke any consent given for processing at any time. The exercise of these rights may be limited by the assertion, exercise, or defense of legal claims.

7. Data Protection Authority

Data subjects have the right to lodge a complaint with the competent data protection authority:

Landesbeauftragte für den Datenschutz und die Informationsfreiheit, Postfach 10 29 32, 70025 Stuttgart.

https://www.baden-wuerttemberg.datenschutz.de/

8. Sources of Personal Data

Log data

9. Obligation to Provide Personal Data

There are no contractual or legal obligations for data subjects to provide data to the law firm.

10. Automated Decision-Making, Including Profiling

The law firm does not use automated decision-making, including profiling, with legal effects on data subjects.

Status: April 2025