MABEL LAW · LEGAL
Privacy policy
How we process personal data when you visit our website, contact us or apply for a role. Including information about hosting with Kinsta and your rights.
Controller & privacy contact
This privacy policy explains the processing of personal data when you visit our website, contact us or apply for a role. The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Mabel LawLawyer Lena Kleene
Marie-Curie-Straße 2
22941 Bargteheide
Germany
Telephone: +49 (0) 4532 999 32 90
Email: datenschutz@mabel-law.de
You can contact us at the email address above with privacy questions or to exercise your rights. Additional information on processing in connection with a specific matter will be provided when you instruct us.
Hosting with Kinsta
For hosting, we use Kinsta Inc., 8605 Santa Monica Blvd #92581, West Hollywood, CA 90069, USA. Kinsta provides the infrastructure for delivering, securing and technically managing the website and processes personal data as a processor under a data processing agreement pursuant to Article 28 GDPR.
Hosting also includes security and delivery services provided by subprocessors, including Cloudflare. Recipients of technical access data are Kinsta and the subprocessors used for the relevant service. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is in providing a secure, reliable and efficient website.
Processing outside the European Union or the European Economic Area, particularly in the USA, also occurs during technical log analysis. It therefore does not depend solely on the web server's location. Kinsta's data processing terms provide for the European Commission's standard contractual clauses for the relevant transfers to third countries (Article 46(2)(c) GDPR).
Details of the safeguards and recipients can be found in Kinsta's data processing terms and the list of subprocessors. You can also request a copy of the relevant safeguards through our privacy contact.
Access data & technical security
When a page is accessed, technical data is processed, including the IP address, date and time, requested page or file, server response status, volume of data transferred, and browser and operating system information. The previously visited page may also be included if the browser transmits it as a referrer.
This processing enables delivery of the website, detection of attacks, and analysis of errors and usage levels. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are secure operation and the resolution of technical problems.
Kinsta transfers access data, including IP addresses, to its technical analytics infrastructure. According to Kinsta, this data is stored in the analytics dataset for up to 30 days and then deleted automatically. Technical analysis also includes hosting performance and usage metrics. Kinsta provides further details under Storage of files, databases and access data.
Other security and error logs are retained only for as long as necessary to resolve errors, investigate a specific security incident, or establish or defend legal claims. Existing statutory retention obligations remain unaffected.
Website search
The website search and office search process search terms, place names and entered postcodes directly in your browser. These entries are not sent by the search function to a search service or to us and are not stored permanently. No access to your device's location is requested for this purpose.
When you open a search result, the destination page loads in the same way as any other page visit. This generates the technical access data described above.
Contact & enquiries about legal services
When you contact us by email, telephone or post, we process your contact details, the content of your enquiry and any documents supplied. This allows us to respond, agree further steps and, for enquiries about legal services, assess a possible engagement and conflicts of interest.
For an enquiry about a possible or existing contract of your own, the legal basis is Article 6(1)(b) GDPR. For general enquiries, or where you act as a contact person for a company or institution, we rely on Article 6(1)(f) GDPR. Our legitimate interest is in handling enquiries appropriately and conducting business communications. Legally required checks are based on Article 6(1)(c) GDPR in conjunction with the applicable professional obligations.
Where sensitive information, such as health data, is necessary to establish, exercise or defend legal claims, Article 9(2)(f) GDPR also applies. When first contacting us, please provide only the information needed for an initial assessment. If required, we will agree a suitable way to send confidential documents with you.
Enquiry data is deleted once processing is complete and no retention obligations or legitimate reasons for further storage apply. Such reasons may include documenting a conflict check and enforcing or defending claims. If we are instructed, the relevant professional and tax law retention obligations also apply.
Providing information with an enquiry is generally voluntary. However, without sufficient contact details and information about the facts, we may be unable to respond or assess an engagement. An email link opens your email application; your message is transmitted to us only when you send it from there.
Job applications
If you apply for a role at Mabel Law, we process the contact details, qualifications and career information you provide, together with your application documents and communications during the selection process. The purpose is to decide whether to establish an employment relationship. The legal basis is section 26(1) BDSG, supplemented where necessary by Article 6(1)(b) GDPR.
Access is granted to the people involved in the recruitment process and the service providers needed for communication. We process special categories of personal data only where an appropriate legal basis exists, particularly section 26(3) BDSG in conjunction with Article 9(2)(b) GDPR.
After the process is complete, application data is deleted once it is no longer needed for the decision or for any necessary establishment or defence of claims. Any further retention required for this purpose is based on Article 6(1)(f) GDPR. If you are hired, the necessary data is transferred to personnel administration. Longer retention for other roles requires a separate basis, particularly your consent, which you may withdraw.
Submitting your application is voluntary. Without the information needed for selection, we cannot assess your application properly.
Recipients & disclosure
Within the firm, access is restricted to people who need the data for their tasks. Hosting, IT operations and communications service providers may process data to the extent necessary to provide their services. Where they act as processors, they are engaged under Article 28 GDPR.
Disclosure to other recipients, such as authorities or courts, takes place only where permitted by a legal obligation, another legal basis or your consent. Professional confidentiality and the requirements of the specific matter must be observed. Transfers to third countries associated with website hosting are explained in the “Hosting with Kinsta” section.
External links & social networks
Our links to LinkedIn, Instagram and other external websites are ordinary links. The social media logos are locally embedded image files. Simply displaying the links does not load a social media plugin.
Your browser connects to the relevant provider only when you open an external link. That provider's privacy notice governs its processing of data. If you are signed in to a social network, the provider may associate the visit with your account.
Your rights
Subject to the applicable legal conditions, you have the following rights:
- Access to your personal data and information about its processing (Article 15 GDPR).
- Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).
- Erasure, provided that no statutory exceptions, such as retention obligations, apply (Article 17 GDPR).
- Restriction of processing in the cases provided for by law (Article 18 GDPR).
- Data portability, where automated processing is based on consent or a contract (Article 20 GDPR).
- Withdrawal of consent at any time with effect for the future; this does not affect the lawfulness of processing before withdrawal (Article 7(3) GDPR).
In connection with the website functions described here, we do not make decisions based solely on automated processing that have legal or similarly significant effects within the meaning of Article 22 GDPR.
Complaints to the supervisory authority
If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with a data protection supervisory authority (Article 77 GDPR), particularly in the place of your habitual residence, place of work or the alleged infringement. The authority responsible for our firm's registered office is:
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)Holstenstraße 98
24103 Kiel
Telephone: 0431 / 988-1200
Email: mail@datenschutzzentrum.de
Website: www.datenschutzzentrum.de
Date of this policy
Last updated: 1 November 2026. We amend this privacy policy when the processing of personal data or legal requirements change.