Privacy Policy

This is a courtesy translation. In case of doubt, the German version of this text applies.

For a law firm, the protection of your data is not a side issue. This policy describes which data is generated when you visit this website and when you book an appointment online, what it is used for and how long it remains stored.

1. Controller

Mag. Florian HÖLLWARTH, MBL, Rechtsanwalt (lawyer)
Garnisongasse 11/1, 1090 Vienna
Telephone: +43 1 361 3163
Email: office@ra-hoellwarth.at

Further details can be found in the Impressum (legal notice).

2. Lawyer’s duty of confidentiality

Everything you communicate in the course of a consultation, or in the run-up to one, is subject to the anwaltliche Verschwiegenheitspflicht (lawyer’s duty of confidentiality). It goes beyond the protection afforded by data protection law and applies without any time limit. It is not restricted by this privacy policy.

3. Visiting the website

When a page is called up, the web server logs technically necessary data: IP address, date and time, the address called up, the volume of data transferred, the status code, the referring page and the browser identifier. These logs serve the operation and the security of the server.

Storage period: 14 days, after which they are deleted automatically.
Legal basis: legitimate interest in secure operation (Art. 6 Abs. 1 lit. f GDPR (DSGVO)).

4. Cookies and audience measurement

Without your consent, this website sets no cookies and loads no analytics tool of a third-party provider. Irrespective of your consent, we count page views with software that we operate ourselves — without cookies and without an identifier on your device. The two are described separately below.

a) Google Analytics — only with your consent. With your consent we use Google Analytics 4 in order to understand which pages are read. Only then is the script loaded from Google, cookies are set and data is transferred to Google: shortened IP address, pages called up, time spent, approximate location, device and browser. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is solely your consent (Art. 6 Abs. 1 lit. a GDPR, § 165 Abs. 3 TKG 2021). It is voluntary; without it the website is available to you in full.

Storage period at Google: event-related data is deleted after 2 months, user-related data after 14 months. Aggregated evaluations remain unaffected by this.

Withdrawal at any time: withdraw consent and decide again. The withdrawal takes effect for the future; the data collected up to that point remains unaffected.

b) Audience measurement without cookies — on our own server. In order to recognise which content is read, we count page views with the software Umami. It runs on a server in France which we have operated for this purpose — that is, within the European Union. No cookies are set. During the counting itself, nothing is stored on your device; the only access to your device is the check whether you have objected to the counting. There is no transfer to Google, Meta or any other provider.

Your IP address is processed in this connection, but not stored. It is used only temporarily, in order to form from it, together with a random value that changes daily, a checksum that cannot be reversed — so that two page views on the same day can be counted as one visit — and in order to determine your country by means of a local database. For this too, your IP address does not leave our server.

What is stored: per visit the browser, operating system, device type, screen size, language, country, region and city; per page view the path of the page, the page title, the referring page and the time. Query strings — everything after a question mark in the address — are cut off before the data reaches our server. The IP address and the full browser identifier are not stored.

In addition, we record when one of the few buttons on this page is used — for example “Book an initial consultation”, “Call”, “WhatsApp” or “24/7 emergency number” — in each case with a note of where on the page it is placed (for example the header area or the footer area). Only the action is recorded, never a topic, an area of law or a concern. An objection declared by you and the “Do Not Track” signal also prevent this recording; the same storage period of 24 months applies to it.

This data is pseudonymised, not anonymous: a link to you can in theory be established. We therefore treat it as personal data. The legal basis is our legitimate interest in designing this website to meet actual needs (Art. 6 Abs. 1 lit. f GDPR). No consent is required for this: nothing is stored on your device during the counting, and the only access to your device — the check whether you have objected — serves solely to give effect to your objection. An objection is stored, and then exclusively locally in your browser, only if you declare it yourself. Storage period: 24 months; older records are deleted by a nightly process. The longer period makes it possible to compare with the same period in the previous year.

Recipients: The server is provided by Contabo GmbH (Munich, Germany) in a data centre in France; the software is operated by an IT service provider engaged by us as a processor. There is no transfer to a third country.

Your right to object (Art. 21 GDPR): You can object to this counting at any time. The objection takes effect immediately, but applies only to this device and this browser: switch off counting on this device. If you delete your browser’s website data, the objection is deleted with it and must be declared again; an objection covering all of your devices is possible via the contact details given in the Impressum. If your browser sends the “Do Not Track” signal, we likewise do not count you.

Unchanged: no embedded fonts from third-party providers, no embedded map, no video embedding and no social media plugins.

Your choice between light and dark display, your decision about the measurement and any objection you have declared are stored exclusively in your browser and are not transmitted.

5. Online appointment booking

If you book a consultation appointment, the following details are collected:

First name and surname
Email address
Telephone number (voluntary)
Subject of the meeting (voluntary, a keyword is enough)
the appointment chosen and the form of consultation chosen
your two declarations regarding the right of withdrawal

This data is processed in order to carry out the consultation appointment: appointment management, confirmation, reminder, invoicing and, in the case of an online appointment, provision of the video access.

Legal basis: performance of the consultation contract or pre-contractual measures (Art. 6 Abs. 1 lit. b GDPR), and, as regards the invoice, a legal obligation (Art. 6 Abs. 1 lit. c GDPR).

Stating the subject is voluntary. It helps with the preparation, but it is not necessary for the booking. Please do not set out any details here, only a keyword; everything further we discuss at the appointment.

6. Video call

For online appointments, a video call is set up via Zoom (Zoom Communications, Inc.). In this connection your name, your email address and the appointment and its duration are transmitted to Zoom so that the session can be created and the access link generated. During the call, Zoom additionally processes technical connection data as well as video and audio.

The calls are not recorded. The legal basis is the performance of the consultation contract (Art. 6 Abs. 1 lit. b GDPR).

7. Email dispatch

Confirmations, reminders and invoices are sent via the service Brevo (Brevo SAS, Paris, France). In this connection the recipient address and the content of the message are processed. A data processing agreement is in place.

Dispatch logs are deleted automatically after 14 days.

8. Google reviews

On the page with the ratings, reviews from the Google Business Profile are displayed. The texts are retrieved and cached on the server side; no connection between your browser and Google arises in the process.

The reviewers’ profile pictures are deliberately not displayed. They would have had to be loaded from a Google server and would in the process have transmitted your IP address to Google. Instead, the first letter of the name appears there. There is therefore at no time a connection between your browser and Google.

9. Getting in touch

If you get in touch by email, telephone or WhatsApp, your details are processed in order to deal with your matter. There is deliberately no contact form on this website.

The WhatsApp link takes you to WhatsApp; from that point on the provider’s terms apply. No WhatsApp element is embedded in this website.

10. Storage period

Server logs	14 days
Email dispatch logs	14 days
Appointment and client data	for as long as required for the consultation, thereafter in accordance with the statutory retention periods
Invoices and receipts	seven years (Bundesabgabenordnung, Unternehmensgesetzbuch)

11. Recipients

A transfer takes place only in so far as it is necessary for the purposes mentioned:

Hosting: Contabo GmbH, Munich (server location Germany)
Email dispatch: Brevo SAS, France
Video call: Zoom Communications, Inc.
Audience measurement (only with your consent): Google Ireland Limited, Ireland

No disclosure for advertising purposes takes place. Your data is not sold.

12. Your rights

You have the right of access, to rectification, to erasure, to restriction of processing, to data portability and to object. To exercise them, please contact office@ra-hoellwarth.at.

These rights reach their limit where statutory retention obligations or the lawyer’s duty of confidentiality stand in the way.

You are also free to lodge a complaint with the Datenschutzbehörde (Austrian Data Protection Authority) (Barichgasse 40 bis 42, 1030 Vienna, www.dsb.gv.at).

13. Changes

This policy will be adapted as soon as the processing changes, for example through the introduction of an online payment or of audience measurement.