Privacy Policy.

Protecting your data matters to me, both as a matter of professional conduct and of data protection law. This policy sets out which data are processed when you visit this website, for what purpose and on what legal basis.

This website operates without tracking, without analytics services and without advertising networks. It sets no cookies.

1. Controller

Rechtsanwalt Dr. Björn Bronger
36 rue Adolphe Fischer
L-1520 Luxembourg
Luxembourg

E: mail@bronger.de
M: +49 174 6116616

The appointment of a data protection officer is not required. For any questions concerning data protection, please contact the above address directly.

2. Your rights

You have the right to obtain information about the data stored about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR) and to object to processing (Art. 21 GDPR).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before withdrawal remains unaffected.

You further have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent at my place of establishment is:

Commission nationale pour la protection des données (CNPD)
15, boulevard du Jazz
L-4370 Belvaux
Luxembourg

Irrespective of this, you may contact the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

3. Visiting the website

Each time the site is accessed, your browser automatically transmits data which are stored in server log files:

IP address of the accessing device
date and time of access
name and URL of the file retrieved
volume of data transferred and confirmation of successful retrieval
website from which the access originates (referrer URL)
browser used, including version, and operating system

Purpose: delivering the site, ensuring operational security, and preventing and investigating attacks.
Legal basis: Art. 6(1)(f) GDPR. My legitimate interest lies in the technically sound and secure operation of the website.
Retention: erasure after 30 days at the latest, unless a security incident requires longer retention in an individual case.

These data are not combined with other sources and are not analysed for statistical purposes.

The website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Processing takes place on servers within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place.

4. Getting in touch

If you contact me by email, telephone or messenger, I process the data you provide in order to deal with your enquiry.

Legal basis: Art. 6(1)(b) GDPR where contact serves the initiation or performance of a mandate; otherwise Art. 6(1)(f) GDPR (interest in responding to enquiries).
Retention: until your enquiry has been dealt with conclusively. Where a mandate is involved, the retention periods under professional and tax law apply, in particular § 50 BRAO (six years after termination of the engagement) and the commercial and tax law periods of up to ten years.

The WhatsApp and Telegram buttons are plain links. No content from those services is loaded and no data are transmitted to them merely by opening this page. Only when you click such a link does the respective application open; from that point the privacy terms of that provider apply.

5. Contact form

The contact page offers a form for writing to me. The data processed are the entries you make: your name, the means of contact you choose (email address or phone number) and the content of your message. Mandatory fields are marked as such; any further details are optional.

Your enquiry is first written to a log file on the server and then forwarded to me by email. This intermediate storage ensures that your enquiry is not lost if dispatch should temporarily fail. If you provided an email address, you will also receive an automatic acknowledgement.

To guard against automated submissions, the form contains a field that is invisible to you, the time taken to complete the form is evaluated, and the number of enquiries per connection within a given period is capped. For this purpose your IP address is processed solely as a non-reversible check value (hash); this value is deleted once the ten minutes have elapsed. No captcha service or other third party is involved.

Legal basis: Art. 6(1)(b) GDPR where the contact serves to initiate or perform an engagement; otherwise Art. 6(1)(f) GDPR. My legitimate interest lies in answering enquiries and in protecting the form against misuse.
Storage period: until your matter has been dealt with conclusively. The log file is deleted at regular intervals. Where an engagement results, the professional and tax retention periods under section 4 apply accordingly.

The notification and the acknowledgement are dispatched via Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, on servers within the European Union; for details see section 6.

The newsletter checkbox is optional and independent of your enquiry being dealt with. If you tick it, section 6 applies in addition.

6. Newsletter

To receive the newsletter I require your email address. In addition, the language version through which you subscribed is stored so that you receive mailings in the appropriate language.

Subscription uses the double opt-in procedure: after you sign up you receive an email containing a confirmation link. The subscription only takes effect once that link is used. As evidence of consent, the time of sign-up and of confirmation and the IP address used are stored.

Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time, for example via the unsubscribe link at the end of each message or informally by email to mail@bronger.de.

The dispatch service provider is Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Brevo processes the data solely on my behalf on servers within the European Union; a data processing agreement pursuant to Art. 28 GDPR is in place.

Dispatch is evaluated statistically, for instance as regards delivery, opens and clicks. This evaluation serves the technical monitoring of dispatch and the improvement of the newsletter's content. The data are not combined with any further data. You may object to this measurement at any time; unsubscribing from the newsletter also constitutes an objection.

Retention: after you unsubscribe, your email address is erased or, where necessary to prevent future mailings, placed on a suppression list. Records evidencing consent are retained until the expiry of any applicable limitation periods.

7. Digital business card

On the contact page you may download my contact details as a business card in .vcf format. This is a static file delivered directly from this server. The download is not recorded separately; section 3 applies.

8. Cookies, local storage, fonts

This website sets no cookies and stores no data in your browser, neither in local storage nor in session storage. The cookie preferences panel serves information purposes only.

The fonts used are held locally on the server and delivered from there. No connection is made to Google Fonts or comparable third-party services. No third-party content is embedded: no maps, no videos, no social media plugins.

9. Links to social media profiles

The references to LinkedIn, Instagram, YouTube, WhatsApp and Telegram are plain links. No data are transmitted to those providers when this website is opened. Only when you click a link do you leave this website; the respective provider is then responsible for the processing that follows.

10. Recipients of the data

The providers used are Hostinger International Ltd. (hosting, section 3) and Brevo GmbH (newsletter dispatch, section 6). Beyond this, I disclose your data only where you have consented, where disclosure is necessary to perform a contract, where a legal obligation exists, or where disclosure is necessary to establish, exercise or defend legal claims.

11. Transfers to third countries

The service providers used process the data on servers within the European Union. Where access from a third country occurs in an individual case, it is safeguarded by the European Commission's standard contractual clauses.

12. Professional confidentiality

As a lawyer I am bound by professional confidentiality (§ 43a(2) BRAO, § 2 BORA). Data relating to a mandate are processed exclusively within the scope of that duty and disclosed to third parties only where you release me from confidentiality or where a statutory duty of disclosure exists.

13. Data security

This website is delivered exclusively over an encrypted connection (TLS). Beyond this, I employ technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration. These measures are kept under review in line with technical developments.

14. Changes to this policy

This privacy policy will be adjusted as changes to the website or to the legal position require. The version available here applies in each case.

Last updated: 20 September 2026