Legal
Privacy Policy
This is a courtesy translation. The German version is authoritative: Datenschutzerklärung.
Information on the processing of personal data when visiting this website under Articles 13 and 14 of the General Data Protection Regulation (GDPR).
1. Controller
The controller for data processing within the meaning of the GDPR is:
- Company
- Peschel & Partner Rechtsanwälte KG
- Address
- Karmeliterplatz 1/2, 1020 Vienna, Austria
- Phone
- +43 1 391 96 00
- office@peschel.at
2. Attorney confidentiality
As a law firm, the controller is subject to the statutory duty of confidentiality under section 9 Rechtsanwaltsordnung (RAO, Austrian Attorneys Act). This duty of confidentiality applies in addition to data protection obligations and protects all information entrusted in connection with a mandate or the initiation of a mandate. When processing personal data, technical and organisational measures are taken that account for the particular sensitivity of legal data.
3. General information on data processing
Personal data is processed only where this is necessary to provide a functioning website and the content and services offered. Processing regularly takes place only with the consent of the user (Art. 6(1)(a) GDPR), for the initiation or performance of a mandate (Art. 6(1)(b) GDPR), for compliance with legal obligations (Art. 6(1)(c) GDPR), or on the basis of legitimate interests (Art. 6(1)(f) GDPR).
4. Provision of the website and server log files
Each time this website is accessed, the hosting provider automatically collects data and information from the computer system of the accessing device. In particular, the following data is collected:
- IP address of the user
- Date and time of access
- URL accessed and HTTP status code
- Volume of data transferred
- Referrer (previously visited page)
- Browser used, including version
- Operating system used
Purpose: provision of the website, ensuring technically error-free operation, evaluation of system security and stability, and defence against attacks.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and stable online offering).
Storage period: a maximum of 14 days in the server log files, after which they are automatically deleted. This data is not combined with other data sources.
5. Hosting
This website is hosted by:
- Provider
- easyname GmbH
- Address
- Canettistraße 5/10, 1100 Vienna, Austria
- Server location
- Austria / EU
- Hosting provider's privacy policy
- www.easyname.at/de/datenschutz
On behalf of the controller, the hosting provider processes all data arising from the operation of the website (in particular access data, server logs, and website content). A data processing agreement under Art. 28 GDPR is in place with the hosting provider. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable hosting).
6. SSL/TLS encryption
For security reasons and to protect the transmission of personal data, this website uses SSL or TLS encryption. An encrypted connection can be recognised by the "https://" prefix in the browser's address bar.
7. Initial assessment and contact
Users can contact the law firm via the forms for the initial assessment and for general contact, as well as by email to office@peschel.at. Depending on the form, the following data is collected in particular:
- Name
- Email address
- Phone number (if provided)
- Details of the matter (for example the provider concerned, an approximate amount)
- any documents you upload (for example a loan or rental agreement as PDF or photo)
- Time of submission
- IP address of the sender (technically required for spam protection)
Purpose: legal initial assessment of the claims described, processing of the enquiry, initiation of a mandate.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at the request of the enquiring person).
Recipient: Peschel & Partner Rechtsanwälte KG.
Storage period: enquiries, including uploaded documents, that do not lead to a mandate are deleted as soon as they are no longer required for processing, at the latest seven years after submission. If a mandate is granted, the retention obligations applicable to legal mandates apply, in particular section 132 Bundesabgabenordnung (BAO, Federal Fiscal Code) and the professional retention rules under the RAO.
Law firm CRM for loan fee enquiries: enquiries in the loan fees case group are additionally managed in the law firm's customer relationship system Pipedrive, operated by Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia. The transfer into this system is automated via the Zapier service of Zapier, Inc., 548 Market St #62411, San Francisco, CA 94104, USA. The form details listed above, including any uploaded documents, are transmitted. Both providers act as processors under Art. 28 GDPR; the legal basis is again Art. 6(1)(b) GDPR. Zapier is based in the USA and has certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR).
8. Spam and bot protection: Cloudflare Turnstile
To protect the forms against automated input and spam, the Turnstile service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, is used. Turnstile analyses browser behaviour (for example mouse and keyboard interactions, browser fingerprint, movement patterns) to distinguish human users from bots. The personal data processed in this context includes in particular the IP address and technical browser information.
Purpose: defence against automated input, protection against misuse of the forms.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in forms free of abuse).
Third-country transfer: Cloudflare is headquartered in the USA. A transfer of data to the USA cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR).
9. Cookies
This website uses cookies and comparable technologies (in particular local storage) only to the extent required for technical operation or to which the user has expressly consented. A detailed list of the cookies used can be found in the Cookie Policy.
Technically necessary cookies are set without consent on the basis of Art. 6(1)(f) GDPR and section 165(3) Telekommunikationsgesetz 2021 (TKG 2021, Austrian Telecommunications Act). They are essential for the operation of the website.
Optional cookies (statistics, marketing) are set exclusively after express consent given via the cookie banner. Legal basis: Art. 6(1)(a) GDPR and section 165(3) TKG 2021. Consent is stored in local storage under the key cc_consent and can be withdrawn at any time, with effect for the future, via the cookie settings.
10. Web analytics: Google Analytics 4
This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and comparable technologies that enable a pseudonymised analysis of website usage.
Purpose: evaluation of website usage, improvement of content and structure, reach measurement.
Data processed: IP address, URLs accessed, time spent, referrer, device and browser data, pseudonymous client ID.
Legal basis: Art. 6(1)(a) GDPR and section 165(3) TKG 2021 (consent). The Google tag is loaded in Consent Mode v2: before consent is given, analytics storage (analytics_storage) is set to "denied" and no cookies or identifying features are stored. In this state, Google receives only cookieless, aggregated signals. Cookies and pseudonymous analysis only take place after consent has been given in the cookie banner.
Third-country transfer: Google may transfer data to the USA. Google is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR).
Withdrawal: at any time via the cookie settings.
11. Marketing: Google Ads and Microsoft Advertising
This website uses Google Ads (conversion tracking and remarketing), an advertising service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads sets cookies that can record clicks on advertisements and subsequent actions on the website (such as submitting a form).
Purpose: measuring the effectiveness of advertisements, delivering relevant advertising, excluding users who have already converted.
Data processed: click and conversion data, pseudonymous cookie identifiers, IP address, technical browser and device data.
Legal basis: Art. 6(1)(a) GDPR and section 165(3) TKG 2021 (consent). The Google tag is loaded in Consent Mode v2: before consent is given, the advertising and storage signals (ad_storage, ad_user_data, ad_personalization) are set to "denied", no advertising cookies are set, and no personal data is transmitted to Google. Cookies and conversion measurement only take place after consent has been given in the cookie banner.
Enhanced conversions: if you have consented to marketing cookies, the email address you enter is irreversibly hashed (SHA-256) in your browser when the contact form or the initial assessment is submitted successfully, and is transmitted to Google only in this hashed form. Google uses the hash solely to attribute a conversion to a preceding ad click; Google cannot derive your plain-text address from it. Without consent to marketing cookies, no such transmission takes place.
Third-country transfer: EU-US Data Privacy Framework (Art. 45 GDPR).
Withdrawal: at any time via the cookie settings.
Microsoft Advertising (Universal Event Tracking): this website also uses Microsoft Advertising, an advertising service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The UET tag measures whether a visit or an action on the website (submitting the initial assessment or the contact form, clicking a phone or email link) originates from an ad in Microsoft Search (Bing). The same rules apply as for the Google tag: before consent is given, the storage signal is set to "denied" and no advertising cookies are set; cookies and conversion measurement only begin once consent has been given in the cookie banner (Art. 6(1)(a) GDPR, section 165(3) TKG 2021). When the initial assessment or the contact form is submitted successfully, and again only with your consent, the email address you enter and, if provided, your phone number are irreversibly hashed (SHA-256) in your browser and transmitted to Microsoft only in this hashed form. Third-country transfer: EU-US Data Privacy Framework (Art. 45 GDPR). Withdrawal at any time via the cookie settings; the cookies used are listed in the cookie policy.
12. Media videos: YouTube only after your click
Some pages embed TV reports as YouTube videos. When the page loads, no connection to YouTube is established; you only see a locally stored preview image. Only when you click the preview does your browser load the video in YouTube's extended privacy mode (domain youtube-nocookie.com), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
With that click, technically required data is transmitted to Google, in particular your IP address, browser information and the page you are visiting; Google may use cookies or similar technologies and may transfer data to the USA (Google LLC is certified under the EU-US Data Privacy Framework). The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, section 165(3) TKG 2021); without the click, no data flows to Google. If JavaScript is disabled, the click opens the video page directly on YouTube instead. Details in Google's privacy policy.
13. Fonts
This website uses the fonts Familjen Grotesk and Atkinson Hyperlegible Next. The font files are provided locally on the hosting provider's server. There is no connection to external font services (in particular not to Google Fonts).
14. Recipients and processors
Personal data is generally not disclosed to third parties. A transfer only takes place if:
- the data subject has expressly consented (Art. 6(1)(a) GDPR),
- disclosure is necessary for the performance of a mandate or for pre-contractual measures (Art. 6(1)(b) GDPR),
- a legal obligation exists (Art. 6(1)(c) GDPR),
- disclosure is necessary in the course of legal work (for example to courts, authorities or opposing representatives).
Processors within the meaning of Art. 28 GDPR include in particular the hosting provider, the provider of the spam protection service and, for loan fee enquiries, the providers of the law firm CRM and the transfer service (see items 5, 7 and 8).
15. Storage period
Personal data is stored only for as long as necessary for the respective purpose or for as long as a statutory retention obligation applies. Once the purpose no longer applies or the retention obligation has expired, the data is deleted or anonymised. Relevant retention periods include in particular the seven-year retention obligation under section 132 Bundesabgabenordnung and the professional retention obligations under the RAO.
16. Rights of the data subject
Under the GDPR, every data subject has the following rights:
- Right of access (Art. 15 GDPR): confirmation as to whether personal data is being processed, together with information about that data and a copy of the data.
- Right to rectification (Art. 16 GDPR): prompt rectification of inaccurate personal data or completion of incomplete personal data.
- Right to erasure (Art. 17 GDPR): prompt erasure of personal data, provided no statutory retention obligations apply.
- Right to restriction of processing (Art. 18 GDPR): restriction of the processing of personal data.
- Right to data portability (Art. 20 GDPR): receipt of personal data in a structured, commonly used and machine-readable format, or transmission to another controller.
- Right to object (Art. 21 GDPR): the right to object at any time to the processing of personal data carried out on the basis of Art. 6(1)(e) or (f) GDPR.
- Right to withdraw consent (Art. 7(3) GDPR): withdrawal at any time, with effect for the future. The lawfulness of processing carried out prior to the withdrawal is not affected by the withdrawal.
An informal message to the contact details given under item 1 above is sufficient to exercise these rights.
17. Right to lodge a complaint with the supervisory authority
Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority. The competent supervisory authority in Austria is:
- Authority
- Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
- Address
- Barichgasse 40-42, 1030 Vienna, Austria
- Web
- www.dsb.gv.at
18. Automated decision-making
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
19. Data security
Appropriate technical and organisational measures are taken under Art. 32 GDPR to protect personal data against accidental or deliberate manipulation, loss, destruction, or access by unauthorised persons.
20. Currency and amendment of this privacy policy
This privacy policy is current as of 24.07.2026. An amendment may become necessary as the website develops further or due to changed legal requirements. The current version of this privacy policy is available on the website at any time.