Privacy Policy.

Rechtsanwalt Dr. Björn Bronger
36 rue Adolphe Fischer
L-1520 Luxembourg
Luxembourg

E: mail@bronger.lu
M: +49 174 6116616

The appointment of a data protection officer is not required. For any questions concerning data protection, please contact the above address directly.

Each time the site is accessed, your browser automatically transmits data which are stored in server log files:

IP address of the accessing device
date and time of access
name and URL of the file retrieved
volume of data transferred and confirmation of successful retrieval
website from which the access originates (referrer URL)
browser used, including version, and operating system

Purpose: delivering the site, ensuring operational security, and preventing and investigating attacks.
Legal basis: Art. 6(1)(f) GDPR. My legitimate interest lies in the technically sound and secure operation of the website.
Retention: erasure after 30 days at the latest, unless a security incident requires longer retention in an individual case.

These data are not combined with other sources and are not analysed for statistical purposes.

The website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Processing takes place on servers within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place.

This website sets no cookies and stores no data in your browser, neither in local storage nor in session storage. The cookie preferences panel serves information purposes only.

The fonts used are held locally on the server and delivered from there. No connection is made to Google Fonts or comparable third-party services. No third-party content is embedded: no maps, no videos, no social media plugins.

On the contact page you may download my contact details as a business card in .vcf format. This is a static file delivered directly from this server. The download is not recorded separately.

Email, telephone, messenger: if you contact me by email, telephone or messenger, I process the data you provide in order to deal with your enquiry. Emails are also recorded by my contact management system; I keep messages and summaries of calls there too (see “Clients and business contacts”).

Legal basis: Art. 6(1)(b) GDPR where contact serves the initiation or performance of a mandate; otherwise Art. 6(1)(f) GDPR (interest in responding to enquiries).
Retention: until your enquiry has been dealt with conclusively. Where a mandate is involved, the retention periods under professional and tax law apply, in particular § 50 BRAO (six years after termination of the engagement) and the commercial and tax law periods of up to ten years.

The WhatsApp and Telegram buttons are plain links. No content from those services is loaded and no data are transmitted to them merely by opening this page. Only when you click such a link does the respective application open; from that point the privacy terms of that provider apply.

Contact form: the contact page offers a form for writing to me. The data processed are the entries you make: salutation, first name, last name, email address and phone number, together with the content of your message. Only the message is required; of the email address and the phone number at least one must be given so that I can reply. The salutation, first and last name and the second means of contact are optional. An email address is required to sign up for the Insights; a phone number is not sufficient for that purpose.

Your enquiry is forwarded to me by email. Only if this forwarding fails is it additionally written to a log file on the server, so that it is not lost. If you provided an email address, you will also receive an automatic acknowledgement.

To guard against automated submissions, the form contains a field that is invisible to you and retrieves a time-stamped check token from my server when it loads; in addition, the time taken to complete the form is evaluated, and the number of enquiries per connection within a given period is capped. For this purpose your IP address is processed solely in pseudonymised form (as a hash value); this value is deleted after ten minutes. So that the same message cannot be delivered en masse, I also store an irreversible check value (hash value) of the message text for seven days. A check value of the same kind is derived from your email address and stored for 24 hours, so that each address receives at most one acknowledgement per day. No captcha service or other third party is involved.

I also determine from your IP address the country from which the enquiry was sent, and record the language setting that your browser sends with every page request anyway. The country is determined exclusively on my own server; your IP address is neither stored nor passed on to third parties for this purpose. Country and language appear in the notification sent to me. Country data: IP Geolocation by DB-IP (licensed under CC BY 4.0). The database runs on my own server; no data are sent to DB-IP.

Legal basis: Art. 6(1)(b) GDPR where the contact serves to initiate or perform an engagement; otherwise Art. 6(1)(f) GDPR. My legitimate interest lies in answering your enquiries and protecting the form against misuse. Country and language help me to place an enquiry even before my first reply: whether a cross-border matter is likely, which language to reply in and at what time of day I can sensibly reach you. They also help me to spot clusters of abusive submissions and to see which countries enquiries come from, so that I can align my services and languages accordingly. Only the country is determined, no more precise location, and no profiling takes place. You may object to this processing at any time (Art. 21 GDPR).
Retention: until your matter has been dealt with conclusively. Entries in the log file are deleted automatically after 90 days at the latest. Where an engagement results, the professional and tax retention periods above apply accordingly.

The notification and the acknowledgement are dispatched via Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, on servers within the European Union; for details see the “Newsletter” section.

The newsletter checkbox is optional and independent of your enquiry being dealt with. If you tick it, the “Newsletter” section also applies.

To receive the newsletter I require your email address. In addition, the language version through which you subscribed is stored so that you receive mailings in the appropriate language. I also record your subscription in my contact management system (see “Clients and business contacts”); where I know your name, I pass it to Brevo so that you are addressed personally.

Subscription uses the double opt-in procedure: after you sign up you receive an email containing a confirmation link. The subscription only takes effect once that link is used. As evidence of consent, the time of sign-up and of confirmation and the IP address used are stored.

Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time, for example via the unsubscribe link at the end of each message or informally by email to mail@bronger.lu.

The dispatch service provider is Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Brevo processes the data solely on my behalf on servers within the European Union; a data processing agreement pursuant to Art. 28 GDPR is in place.

Dispatch is evaluated statistically, for instance as regards delivery, opens and clicks. This evaluation serves the technical monitoring of dispatch and the improvement of the newsletter’s content. I do not combine this evaluation with any further data. You may object to this measurement at any time; unsubscribing from the newsletter also constitutes an objection.

Retention: after you unsubscribe, your email address is erased or, where necessary to prevent future mailings, placed on a suppression list. Records evidencing consent are retained until the expiry of any applicable limitation periods.

I process data of clients and prospective clients, of their staff and advisers, and of other people with whom I am in professional contact. For this I use a contact management system.

Data: such as name, role and organisation, contact details, information on the mandate (such as subject matter, status and time spent) and – where required to provide the services – information on personal and professional circumstances and further information that you give me or that is publicly accessible.
Source: you, your organisation or people who make the introduction, and publicly accessible sources, such as websites, registers and professional networks.

Email, calendar and messages: from emails to and from my business mailbox and from my business calendar the system automatically takes information such as sender, recipients, subject, time and appointments. From these it creates entries in the contact history and reminders, for instance when a reply is outstanding. When I write to you by WhatsApp, SMS or another messenger, I record in the contact history that I did so and when – where relevant with a short note on its content and on the next steps agreed – and set a reminder where a reply is outstanding. The same applies when you write to me or reply through one of these channels. My business WhatsApp account is connected to my contact management system through the WhatsApp Business Platform. For chats with numbers already held there, the system stores both sides’ messages in the contact history; it does not store messages or contacts relating to other numbers.

AI assistance: AI-based software supports me with drafts, summaries and keeping the data up to date; it is given access to the data required for the task in hand. No automated decision-making within the meaning of Art. 22 GDPR takes place.

Invitations, updates and greetings: I also use your contact details to send you invitations, updates and greetings. You may object to this at any time; a short reply is enough.

Purpose: handling and administering mandates, checks required by professional rules such as the conflict check, billing, and maintaining the business relationship.
Legal basis: Art. 6(1)(b) GDPR where you are or wish to become my client; Art. 6(1)(c) GDPR where obligations under professional, commercial or tax law or rules on the prevention of money laundering apply; Art. 6(1)(a) GDPR where you have consented; otherwise Art. 6(1)(f) GDPR. My legitimate interest lies in keeping my professional contacts in good order and developing my practice, in reliably following up open points, and in efficient office organisation, including with technical support.
Retention: for as long as necessary for the purposes stated, in particular for the duration of the business relationship. Thereafter I delete the data unless statutory retention obligations apply or I need them to establish, exercise or defend legal claims. Data relating to a mandate are retained in accordance with the periods under professional and tax law (see “Getting in touch and contact form”). Information needed to prevent future mailings or recording is kept for as long as necessary.

For a mandate I need the information required to handle it and to carry out the checks required by professional rules; without it I cannot accept the mandate.

For online meetings I use a video conferencing service. The data processed are the participants’ names and email addresses, the time and duration and, during the meeting, video, audio and chat. I make recordings only with the consent of all participants (Art. 6(1)(a) GDPR) and delete them once they are no longer needed for their purpose. If you invite me via another platform, its terms apply.

Legal basis: Art. 6(1)(b) GDPR where the meeting serves a mandate or its initiation; otherwise Art. 6(1)(f) GDPR. My legitimate interest lies in straightforward coordination without travel.

The references to LinkedIn, Instagram, YouTube, WhatsApp and Telegram are plain links. No data are transmitted to those providers when this website is opened. Only when you click a link do you leave this website; the respective provider is then responsible for the processing that follows.

I use service providers, in particular for hosting, email and calendar, document and task management, video conferencing, contact management, messenger integration, email dispatch, time recording, backups and AI-based assistance. They receive only the data needed for their service.

Beyond this, I disclose your data only where you have consented, where disclosure is necessary to perform a contract or for a mandate – for instance to courts, authorities, the other side or further advisers –, where a legal obligation exists, or where disclosure is necessary to establish, exercise or defend legal claims. For billing and accounting, tax advisers and banks receive the information required, where necessary.

Some service providers are based outside the European Union, in particular in the United States, or also process data there; data may therefore be transferred to third countries. Such transfers rely on an adequacy decision of the European Commission (Art. 45 GDPR), such as the one on the EU-US Data Privacy Framework, or on appropriate safeguards, in particular the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). A copy of the safeguards is available on request.

As a lawyer I am bound by professional confidentiality (§ 43a(2) BRAO, § 2 BORA). Data relating to a mandate are processed exclusively within the scope of that duty and disclosed to third parties only where handling the mandate requires it, where you release me from confidentiality or where a statutory duty of disclosure exists. I select service providers carefully.

This website is delivered exclusively over an encrypted connection (TLS). My contact management system is accessible only after sign-in with a second factor; backups are encrypted. Beyond this, I employ technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration. These measures are kept under review in line with technical developments.

You have the right to obtain information about the data stored about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR) and to object to processing (Art. 21 GDPR).

You may object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation. You may object at any time, without giving reasons, to the use of your data for invitations, updates and greetings.

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before withdrawal remains unaffected.

You further have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent at my place of establishment is:

Commission nationale pour la protection des données (CNPD)
15, boulevard du Jazz
L-4370 Belvaux
Luxembourg

Irrespective of this, you may contact the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

This privacy policy will be adjusted as changes to the website, to the way I work or to the legal position require. The version available here applies in each case.