Privacy Notice
Version dated 9 September 2026
Language precedence: This English version is provided for convenience only. In the event of any inconsistency or discrepancy between the German and English versions, the German version shall prevail.
1. General Information
Data protection and the protection of personal data are of particular importance to Hoeger, Stellrecht & Partner Patentanwälte mbB (HS&P). We treat personal data confidentially and in accordance with applicable data protection legislation and this Privacy Notice. Where we engage service providers as processors, we enter into the data processing agreements required by law. This concerns the data of all categories of data subjects, in particular clients, applicants, candidates, contact persons and prospective clients.
As a general rule, the HS&P websites may be used without directly providing personal data. However, where a data subject uses specific services offered by our firm through our website or by other means, the processing of personal data may become necessary. Where consent is required for processing, we obtain such consent in accordance with the applicable legal requirements.
The processing of personal data, such as a data subject’s name, address, email address or telephone number, is carried out in accordance with the General Data Protection Regulation (GDPR) and the other data protection provisions applicable to HS&P. This Privacy Notice provides information on the nature, scope, purposes and legal bases of processing and on the rights of data subjects.
As controller, HS&P has implemented technical and organisational measures to ensure an appropriate level of protection for the personal data processed. Nevertheless, security risks cannot be completely excluded, particularly in the case of internet-based data transmissions. Personal data may therefore also be provided to us by alternative means of communication, for example by telephone or post.
2. Name and Address of the Controller
The controller within the meaning of the GDPR and other applicable data protection legislation is:
Hoeger, Stellrecht & Partner Patentanwälte mbB
Uhlandstraße 14c
70182 Stuttgart
Germany
Tel.: +49 711 21190-0
Email: patent@hoeger-stellrecht.de
Website: www.hoeger-stellrecht.de
3. Name and Address of the Data Protection Officer
The controller’s Data Protection Officer is:
Gregor Kurz
Hoeger, Stellrecht & Partner Patentanwälte mbB
Uhlandstraße 14c
70182 Stuttgart
Germany
Tel.: +49 711 21190-78
Email: datenschutz@hoeger-stellrecht.de
Website: www.hoeger-stellrecht.de
Any data subject may contact our Data Protection Officer directly at any time with questions or suggestions concerning data protection.
4. Cookies and Analytics Tools
Our websites may use cookies and comparable technologies. Strictly necessary cookies or access to information stored in terminal equipment are used on the basis of section 25(2) of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG), provided that the conditions set out therein are met. Where personal data is processed in this context, such processing is carried out in particular on the basis of Article 6(1)(f) GDPR; our legitimate interest lies in providing our websites in a technically faultless, secure and user-friendly manner.
Where optional analytics technologies or other technologies that are not strictly necessary are used, information is stored in terminal equipment or accessed only with consent in accordance with section 25(1) TDDDG. Where personal data is processed in this context, the processing is based on Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future using the settings provided for this purpose on the website.
Where Google Analytics is used after consent has been given, we use the Google Analytics web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to analyse the use of our websites. According to Google, individual IP addresses are not logged or stored for access from the EU; IP address data is used to derive approximate location information and is then deleted. Processing by Google affiliates or service providers, including outside the EEA, cannot be ruled out. Transfers to third countries are carried out in accordance with Articles 44 et seq. GDPR, in particular on the basis of an adequacy decision, where applicable, or appropriate safeguards.
5. Collection of General Data and Information
Each time our websites are accessed, general technical data and information may be collected and stored in server log files. This may include, in particular, browser type and version, operating system, referrer URL, subpages accessed, date and time of access, IP address, internet service provider and comparable technical information.
This data is required in particular to deliver the content of our websites correctly, to ensure the functionality and security of our information technology systems, and to detect and, where appropriate, investigate attacks on our systems. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable provision of our websites and IT systems. Where continued storage is no longer necessary and there are no statutory or other legitimate grounds preventing this, the data is deleted or anonymised.
Recipients of this data may include IT and hosting service providers engaged by us, where this is necessary for the operation, maintenance and security of our websites. Where they act as processors, they are contractually bound in accordance with Article 28 GDPR.
6. Routine Erasure and Restriction of Personal Data
We process and store personal data only for as long as is necessary for the respective processing purposes or as long as statutory, professional or other permissible grounds justify continued storage. Once the purpose of storage ceases to apply and there are no conflicting retention obligations or legitimate interests, the data is erased in accordance with the applicable legal provisions or, where erasure is not possible or permissible, its processing is restricted.
7. Rights of the Data Subject
Subject to the applicable legal requirements, data subjects have, in particular, the rights of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and objection (Article 21 GDPR). Processing based on consent may be withdrawn at any time with effect for the future, without affecting the lawfulness of processing carried out prior to the withdrawal.
Where we process personal data on the basis of Article 6(1)(f) GDPR, an objection may be made on grounds relating to the data subject’s particular situation. An objection may be made at any time to the processing of personal data for direct marketing purposes.
To exercise these rights, and with any questions or complaints concerning the processing of personal data, data subjects may contact our Data Protection Officer. Data subjects also have the right to lodge a complaint with a competent data protection supervisory authority.
8. Data Protection in Relation to Applications and the Recruitment Process
We process applicants’ personal data for the purpose of conducting the recruitment process. Processing may also take place electronically, for example where application documents are submitted by email. Access is limited to persons who are involved in the recruitment process or require the data for that purpose.
If no employment or other working relationship is established, the application data will be erased after expiry of the periods required for the recruitment process and any legal defence, unless consent has been given for longer storage and no statutory or legitimate grounds prevent erasure. A legitimate interest in continued storage for a limited period may exist in particular for the establishment, exercise or defence of legal claims.
The legal basis for processing in the recruitment process is, in particular, section 26(1), first sentence, of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). Where continued storage after completion of the recruitment process is necessary for the establishment, exercise or defence of legal claims, it is based on Article 6(1)(f) GDPR. Storage beyond that period, for example for consideration in future recruitment processes, takes place only on the basis of corresponding consent pursuant to Article 6(1)(a) GDPR.
9. Legal Bases for Processing
Where we obtain consent for a specific processing purpose, Article 6(1)(a) GDPR is the legal basis for the processing. Where processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject’s request prior to entering into a contract, the processing is based on Article 6(1)(b) GDPR. Where processing is necessary for compliance with a legal obligation, it is based on Article 6(1)(c) GDPR.
Where processing is necessary for the purposes of the legitimate interests pursued by HS&P, a client or another third party, and those interests are not overridden by the interests or fundamental rights and freedoms of the data subject, the processing is based on Article 6(1)(f) GDPR. The relevant legitimate interests are described in more detail in this Privacy Notice where applicable.
10. Duration of Storage of Personal Data
The storage period is determined by the respective processing purpose and the applicable statutory and professional retention and limitation periods. Once the purpose ceases to apply and the relevant periods have expired, the data is erased or, where erasure is not possible or permissible, its processing is restricted. The information in section 19 applies additionally to client engagement and procedural data.
11. Provision of Personal Data Outside a Client Engagement
The provision of personal data may be required by law or contract, or may be necessary for entering into and performing a contract. If required information is not provided, this may mean that an enquiry cannot be processed, a contract cannot be concluded or a service cannot be provided. Where there is no statutory or contractual obligation and the data is not required for the respective purpose, there is no obligation to provide it. Section 18 applies additionally to client engagements.
12. Automated Decision-Making
We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning data subjects or similarly significantly affect them (Article 22 GDPR).
13. Data Protection in Relation to Enquiries, the Establishment of a Client Engagement and Existing Client Engagements
13.1 Data Subjects and Categories of Data
These provisions apply to current and prospective clients and to other persons whose data is processed in connection with an enquiry concerning a possible client engagement or an existing client engagement. Such persons may include, in particular, contact persons, employees, members of corporate bodies, inventors, applicants, holders of intellectual property rights, licensors and licensees, opposing parties and their representatives, witnesses, experts and other parties to proceedings.
Depending on the individual case, we process in particular master data and contact data, communications and correspondence data, information concerning a person or organisation, identification data and data relating to powers of attorney, invoicing and payment data, technical and legal information concerning inventions and intellectual property rights, file references, deadlines, procedural and litigation data, and other information provided to us in connection with an enquiry or the handling of a client engagement, or lawfully obtained by us from publicly accessible sources, registers, authorities, courts, patent and trade mark offices, foreign or associate counsel, or other parties to proceedings.
13.2 Purposes and Legal Bases When Establishing a Client Engagement
Before a client engagement is established, we process personal data in order to handle the enquiry, communicate, assess whether and on what terms we can act, identify the prospective client and, where appropriate, other parties, perform conflict checks, assess statutory or professional restrictions on accepting instructions, comply with anti-money laundering or other identification and verification obligations, and prepare fee agreements, powers of attorney and client engagement documents.
The legal basis is Article 6(1)(b) GDPR where processing is necessary in order to take steps at the data subject’s request prior to entering into a contract or to prepare a contract with the data subject. Where the prospective client is a legal entity or another organisation, or where data relating to other persons is concerned, processing is generally based on Article 6(1)(f) GDPR. Our legitimate interests lie in properly handling the enquiry, assessing and initiating the client engagement, avoiding conflicts of interest, and safeguarding our rights and professional obligations. Where statutory obligations apply, Article 6(1)(c) GDPR is the legal basis.
If no client engagement is established, we store the data processed in connection with the enquiry and conflict check only for as long as necessary to document the enquiry, preserve confidentiality, avoid subsequent conflicts of interest, and establish, exercise or defend legal claims. Statutory retention obligations remain unaffected.
13.3 Purposes and Legal Bases During a Client Engagement
During an existing client engagement, we process personal data for legal and technical advice; for filing, obtaining, managing, monitoring, defending and enforcing intellectual property rights; for maintaining the client file, monitoring deadlines, communications and documentation; for invoicing and payment processing; for quality assurance and risk management; and for compliance with statutory, judicial, regulatory and professional obligations.
Where the data subject is the client, processing necessary for the performance of the client engagement is based on Article 6(1)(b) GDPR. Processing for the purposes of legitimate interests, in particular quality assurance and risk management, conflict checks, and the establishment, exercise or defence of legal claims, is based on Article 6(1)(f) GDPR. Our legitimate interests lie in particular in properly handling the client engagement, protecting our clients’ legal interests, and safeguarding our own legal and professional position. Where processing is necessary for compliance with a legal obligation, Article 6(1)(c) GDPR applies.
Personal data relating to other data subjects is generally processed on the basis of Article 6(1)(f) GDPR where the processing is necessary for the proper handling of the client engagement or for protecting our clients’ legal interests and is not overridden by the interests or fundamental rights and freedoms of the data subject.
Where special categories of personal data within the meaning of Article 9(1) GDPR are processed in an individual case, this is done only where a legal basis under Article 9(2) GDPR applies, in particular where processing is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR). Personal data relating to criminal convictions and offences is processed only subject to the conditions of Article 10 GDPR and the applicable statutory provisions.
14. Representation in Court, Before Authorities and Out of Court
In the course of representation out of court, before authorities and in court, we process the personal data required for advice, the pursuit and defence of rights, and the conduct of proceedings. Where necessary for handling the client engagement or required by law, this may include disclosure to courts, patent and trade mark offices, authorities, arbitration bodies, enforcement bodies, opposing parties and their representatives, witnesses, experts, translators, foreign or associate counsel, process servers and other parties to proceedings.
In judicial and administrative proceedings, written submissions, evidence, powers of attorney, schedules, applications, decisions and other procedural documents may contain personal data. The scope of processing and categories of recipients are determined by the applicable procedural law, directions issued by the court or authority, and the legitimate interests of the client and other parties. Depending on the type of proceedings, hearings or decisions may be public or may be published in publicly accessible registers and databases; the competent bodies decide this in accordance with the applicable rules.
Depending on the individual case, the legal bases are Article 6(1)(b), (c) and (f) GDPR. Article 6(1)(f) GDPR supports, in particular, the processing of third-party data for the establishment, exercise or defence of legal claims and the proper representation of our clients’ interests. Special categories of personal data may be processed subject to the conditions of Article 9(2)(f) GDPR.
15. Recipients in Connection with Client Engagements
Where necessary for the respective purposes, personal data may be transmitted or disclosed in particular to the following categories of recipients:
• courts, patent and trade mark offices, authorities, register offices, arbitration and dispute resolution bodies, and other public bodies;
• foreign or associate counsel, foreign professionals, lawyers, patent attorneys, search professionals, translators, experts and other professional service providers;
• opposing parties, their representatives and other parties to proceedings;
• providers of IT, communications, hosting, file and deadline management, data backup, document destruction, printing, postal and courier services, and payment services; and
• insurers, in particular professional indemnity insurers, as well as financial, tax and other auditors.
All recipients receive data only to the extent necessary for the respective purpose. Where recipients act as processors, they are contractually bound in accordance with Article 28 GDPR. Our statutory and professional duties of confidentiality remain unaffected.
Where the engagement of service providers is subject to particular professional requirements, they are engaged only in compliance with those requirements. This applies in particular to the requirements of section 39c of the German Patent Attorney Code (Patentanwaltsordnung, PAO) concerning the selection, confidentiality obligations and use of service providers. Where a service directly serves an individual client engagement and the client’s consent is required under section 39c PAO, access to confidential information relating to the client engagement is granted only on the basis of such consent.
16. International Client Engagements and Transfers to Third Countries
In international intellectual property and contentious proceedings, it may be necessary to transfer personal data to foreign patent and trade mark offices, courts, authorities, foreign or associate counsel, translators, experts, service providers or other parties to proceedings. This may also include recipients outside the EU and the EEA.
Transfers to third countries are made only subject to the conditions of Articles 44 et seq. GDPR. Depending on the recipient and the circumstances, we base the transfer in particular on an adequacy decision of the European Commission or on appropriate safeguards under Article 46 GDPR, in particular standard contractual clauses.
Where neither an adequacy decision nor appropriate safeguards are available, a transfer may, in individual cases provided for by law, be based on a derogation under Article 49 GDPR, in particular where the transfer is necessary for the performance of a contract with the data subject, for the performance of a contract concluded in the data subject’s interest, or for the establishment, exercise or defence of legal claims. Transfers to foreign authorities, offices or courts may additionally be governed by the applicable procedural rules in those jurisdictions.
Information on the relevant suitable or appropriate safeguards used, and a copy of the relevant safeguards, may be requested, where provided for by law, by emailing datenschutz@hoeger-stellrecht.de.
17. Sources of Data Relating to Client Engagements
We regularly obtain personal data from the data subjects themselves, from clients and their employees or corporate bodies, and from instructed domestic and foreign professionals. Data may also originate from publicly accessible sources and registers, publications, patent and trade mark registers, court and authority files, and from opposing parties, parties to proceedings, witnesses or experts.
Where we do not obtain data from the data subject, the information obligations under Article 14 GDPR apply subject to the exceptions set out therein. This applies in particular where providing the information is impossible or would involve disproportionate effort, or where the personal data must remain confidential due to a statutory or professional duty of confidentiality.
18. Obligation to Provide Data in a Client Engagement
The provision of personal data may be required by law or contract, or may be necessary for entering into and performing a client engagement. Without the required information, we may be unable to complete our assessment of an enquiry, comply with statutory or professional obligations, accept instructions, or properly perform the client engagement. Apart from this, there is generally no obligation to provide information voluntarily.
19. Storage Period for Client Engagement and Procedural Data
Client engagement and procedural data is stored for the duration of the client engagement and thereafter for as long as statutory or professional retention obligations apply or the data is required to preserve confidentiality, perform conflict checks, or establish, exercise or defend legal claims.
Pursuant to section 44 PAO, client files are generally retained for six years. The period begins at the end of the calendar year in which the engagement was terminated. Other statutory retention obligations and longer permissible storage periods remain unaffected. Relevant factors may include, in particular, the nature of the documents, retention obligations under tax or commercial law, applicable limitation periods, and any circumstances suspending or interrupting those periods.
Once the purposes cease to apply and the relevant periods have expired, the data is erased or, where erasure is not possible or permissible, its processing is restricted.
20. Additional Information on Data Subject Rights in the Context of Client Engagements
Subject to the applicable legal requirements, data subjects have the rights under Articles 15 to 22 GDPR, in particular the rights of access, rectification, erasure, restriction of processing, data portability and objection. Consent may be withdrawn at any time with effect for the future. Where processing is based on Article 6(1)(f) GDPR, an objection may be made on grounds relating to the data subject’s particular situation. An objection to direct marketing may be made at any time.
Each data subject right is subject to the applicable statutory requirements and may be restricted in accordance with the GDPR and the BDSG. This applies in particular to information and access rights where statutory or professional duties of confidentiality or protected third-party rights prevent disclosure, and to the right to erasure where continued processing is necessary, in particular for the establishment, exercise or defence of legal claims. We may request suitable evidence to verify identity and authority to act.
To exercise these rights, it is sufficient to send an email to datenschutz@hoeger-stellrecht.de. Data subjects also have the right to lodge a complaint with a competent data protection supervisory authority.