Protecting your personal data is particularly important to us – not least because of our professional duty of confidentiality as lawyers. Below we inform you, in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), about which personal data we process when you visit this website and when you contact us.
1. Controller
Rechtsanwalt Dzevdet Fetahi LL.M.
Gleißbühlstraße 7, 90402 Nuremberg, Germany
Telephone: +49 911 8019262-7 · Fax: +49 911 8019262-8
Email: info@kanzlei-fetahi.de
You can contact us at any time using these details with questions about data protection or to exercise your rights.
2. Overview and legal bases
We process personal data only insofar as this is necessary to provide a functioning website, to answer your enquiries or to handle a client mandate. The legal bases are in particular: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligations, e.g. retention duties), Art. 6(1)(f) GDPR (legitimate interests) and Section 25(1) and (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) for cookies. Special categories of data and data relating to criminal offences are processed in the context of a mandate on the basis of Art. 9(2)(f) and Art. 10 GDPR, insofar as this is necessary for the establishment, exercise or defence of legal claims.
This website does not use analytics or tracking services, advertising cookies, social media plug-ins or externally loaded fonts. All content is delivered from our own web server – with the exception of the spam protection Cloudflare Turnstile on the contact page (see section 5).
3. Hosting and server log files
This website is operated by an external hosting provider with whom we have concluded a data processing agreement pursuant to Art. 28 GDPR. Each time the website is accessed, the web server automatically records information transmitted by your browser (IP address, date and time, page or file accessed, amount of data transferred, HTTP status code, referrer URL, browser and operating system). This serves to deliver the website and to ensure its stability and security (Art. 6(1)(f) GDPR). The log files are deleted automatically after a short period unless they are required to investigate a specific security incident.
4. Cookies and consent management
We only use technically necessary cookies: the session cookie of the content management system Joomla (deleted when the browser is closed) and the cookie “cookieconsent_status”, which stores your choice in the cookie banner for 12 months. Legal basis: Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.
When you first visit, we ask for your consent to optional cookies and external services via a cookie banner. We currently do not use any optional cookies. To document consent (Art. 7(1) GDPR), we log your choice with date, time and a session identifier; your IP address is not stored. You can change or withdraw your decision at any time via the “Cookie settings” button at the bottom left of every page.
5. Contact form and spam protection
When you send us an enquiry via the contact form, we process the data you enter (required: name, email address, subject and message; optional: telephone number and area of law) solely to handle your enquiry. The data is transmitted in encrypted form (TLS), forwarded to the law office by email and not stored in a database on the website. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by ticking the checkbox, and – if your enquiry concerns a potential mandate – Art. 6(1)(b) GDPR. You can withdraw your consent at any time with effect for the future, e.g. by email.
Spam protection (Cloudflare Turnstile): To protect the contact form against automated requests, we use Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the contact page is loaded, a script from Cloudflare checks on the basis of technical characteristics whether the input comes from a human. In particular, your IP address and information about your browser and device are transmitted to Cloudflare. According to Cloudflare, Turnstile does not set tracking cookies and does not use the data for advertising. Legal basis: our legitimate interest in protecting our website against misuse (Art. 6(1)(f) GDPR) and Section 25(2) no. 2 TDDDG. Cloudflare is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the European Commission’s adequacy decision (Art. 45 GDPR). More information: Cloudflare privacy policy.
6. Contact by email, phone, fax or post
If you contact us by email, telephone, fax or post, we process your details to handle your request (Art. 6(1)(b) GDPR if your request relates to a mandate, otherwise Art. 6(1)(f) GDPR). Unencrypted emails can be read by third parties in transit; please let us know if you would like encrypted communication.
7. Data processing in the client relationship
If a mandate is concluded, we process the data required to handle it – in particular contact and identification data, information on the facts of the case, data of opponents and other parties, correspondence, court and authority documents and billing data (Art. 6(1)(b) and (c), Art. 9(2)(f) and Art. 10 GDPR). All information is subject to the lawyer’s duty of confidentiality (Section 43a(2) BRAO, Section 2 BORA, Section 203 German Criminal Code). Information obligations towards third parties whose data we receive in a mandate generally do not apply where this would disclose confidential information (Art. 14(5)(d) GDPR in conjunction with Section 29(1) German Federal Data Protection Act).
8. External links and Google Maps
Our website contains links to external websites. When you click on them, you leave our website; the operators of the linked pages are solely responsible for data processing there. The contact page contains a simple link to Google Maps for route planning – no map is embedded. Data is only transmitted to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) when you click the link.
9. Recipients and transfers to third countries
Data is only passed on where legally permitted or necessary to handle your request. Recipients may be our hosting and email providers, Cloudflare (spam protection) and IT service providers (as processors under Art. 28 GDPR) and, in the context of a mandate, courts, public prosecutors, authorities, opponents and their representatives, experts, legal expenses insurers and tax advisers. Apart from Cloudflare Turnstile (USA, EU-U.S. Data Privacy Framework), data is not transferred to countries outside the EU/EEA unless this is necessary in an individual case to handle a mandate with an international element (Art. 49(1)(b), (c) or (e) GDPR).
10. Storage period
- Enquiries without a mandate: deleted once the enquiry has been dealt with and no retention obligations apply
- Client files: six years after the end of the mandate (Section 50(1) BRAO)
- Invoices and accounting records: up to ten years (Section 147 German Fiscal Code, Section 257 German Commercial Code)
- Server log files: short-term, see section 3
- Consent records (cookie banner): for the validity of the consent plus the limitation period for possible claims
11. Your rights
Subject to the statutory provisions, you have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3) GDPR). The right of access may be restricted where information is subject to the lawyer’s duty of confidentiality (Section 29(1) BDSG). An informal message to the contact details above is sufficient.
12. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
13. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
14. Data security
This website uses TLS encryption. We implement technical and organisational measures to protect your data against loss, manipulation and unauthorised access (Art. 32 GDPR). No automated decision-making, including profiling (Art. 22 GDPR), takes place. Providing your data is neither legally nor contractually required; without the required details in the contact form, however, we cannot process your enquiry via the form – you can also reach us by phone.
15. Changes to this privacy policy
Last updated: October 2026. We will update this privacy policy whenever the data processing on this website or the legal situation changes.
This English version is provided for convenience. In case of doubt, the German version (Datenschutzerklärung) shall prevail.