Privacy policy.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Philipp Seiler & Filip Siebert GbR
Partners: Philipp Seiler, Filip Siebert
Erika-Mann-Straße 23
80636 Munich, Germany
Email: info@seiler-siebert.com

2. General information on data processing

2.1 Scope of the processing of personal data

As a rule, we process our users' personal data only to the extent necessary to provide a functional website and our content and services. Personal data is regularly processed only with the user's consent or where a legal basis permits the processing.

2.2 Legal bases

Where we obtain consent for processing operations involving personal data, Art. 6(1)(a) GDPR is the legal basis. For the processing of personal data that is necessary for the performance of a contract, Art. 6(1)(b) GDPR is the legal basis; this also applies to pre-contractual enquiries. Where processing is necessary to comply with a legal obligation, Art. 6(1)(c) GDPR is the legal basis. For processing carried out to protect legitimate interests, Art. 6(1)(f) GDPR is the legal basis.

2.3 Data deletion and storage period

The data subject's personal data is deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also take place beyond that if required by statutory retention periods (e.g. commercial and tax retention obligations, generally 6 or 10 years).

3. Provision of the website and creation of log files

3.1 Description and scope of the data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected: IP address, date and time of the request, content of the request (specific page), access status/HTTP status code, amount of data transferred, the website from which the request originates (referrer URL), browser, operating system and its interface, language and version of the browser software.

This data is stored in the log files of our hosting provider. This data is not stored together with other personal data of the user.

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel delivers the website via a worldwide server network; data is also transferred to the USA in the process. Vercel is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). A data processing agreement under Art. 28 GDPR is in place with Vercel.

3.2 Legal basis

The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR.

3.3 Purpose and storage period

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer and to ensure the stability and security of the website. Vercel stores the log files only for as long as necessary for these purposes and then deletes them.

4. Cookies and tracking

This website does not use cookies or any analytics, tracking or marketing tools. No information is stored on or read from your device. Fonts and all other files are delivered exclusively through our hosting provider; no third-party content is embedded.

5. Contacting us

5.1 Contact form

If you send us enquiries via the contact form, the information from the enquiry form, including the contact details you provide there, is stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass this data on without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where this was requested.

The data from the contact form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing it no longer applies (e.g. after your enquiry has been fully handled). Mandatory statutory provisions, in particular retention periods, remain unaffected.

To send the contact form we use the service Web3Forms (web3forms.com), whose operator is based in India. When you submit the form, your entries are transmitted to Web3Forms and forwarded from there to us by email; to protect against spam, Web3Forms checks submissions automatically. Web3Forms stores submissions on Amazon Web Services servers and deletes them after three years at the latest. There is no European Commission adequacy decision for India; the transfer is based on the standard contractual clauses (Art. 46(2)(c) GDPR) as part of Web3Forms' data processing agreement. The legal basis for spam protection is our legitimate interest in the secure operation of the form (Art. 6(1)(f) GDPR).

5.2 Contacting us by email

When you contact us by email, the personal data transmitted is stored automatically. This data, transmitted on a voluntary basis, is stored for the purpose of processing your message or contacting you. It is not passed on to third parties.

To receive and send emails, including messages from the contact form, we use the mailbox of our domain provider STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. The data is processed on servers in Germany. A data processing agreement under Art. 28 GDPR is in place with STRATO.

6. Rights of the data subject

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent given (Art. 7(3) GDPR) with effect for the future
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

The data protection supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

7. Data security

When you visit our website, we use the widely adopted SSL/TLS method (Transport Layer Security) with the highest level of encryption supported by your browser. In addition, we use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties.

8. Currency and amendment of this privacy policy

This privacy policy is currently valid and is dated 27 September 2026. Further development of our website and services, or changes in statutory or regulatory requirements, may make it necessary to amend this privacy policy.

9. Data protection officer

Under § 38 BDSG, a data protection officer generally only has to be appointed if, as a rule, at least 20 people are constantly engaged in the automated processing of personal data, or if extensive processing of special categories of personal data or processing that requires a data protection impact assessment takes place. As things currently stand, this is not expected to be the case at Philipp Seiler & Filip Siebert GbR.