Privacy
1. Controller
Sandro Schmidt, sole proprietorship, trading as „Khartus“, c/o FlexDienst – #21184, Kurt-Schumacher-Straße 76, 67663 Kaiserslautern, Germany. E-Mail: sandro.schmidt814@gmail.com. No data protection officer is appointed; the conditions of § 38 BDSG are not met.
2. Two levels
For the law firm’s own data — contract, account, billing — Khartus is the controller. For the contents of case files Khartus is a processor only; the law firm is the controller. Data subjects address their rights to the firm.
3. Server log data
IP address, time, path, status code, volume and browser identifier. Purpose: delivery, security. Legal basis: Art. 6(1)(f) GDPR. Deleted after seven days at the latest.
4. Cookies
One strictly necessary session cookie. No analytics, no advertising, no cross-site tracking, no embedded third-party content.
5. Account and contract
Name, address, contact details, hashed password, login times, number and state of case files. Legal basis: Art. 6(1)(b) and (c) GDPR. Invoices are retained for ten years under § 147 AO.
6. Recipients
Hetzner Online GmbH (servers, Falkenstein, Germany); tax advisors and tax authorities. Case contents are processed by Anthropic PBC (USA) on behalf of the law firm, based on the EU Standard Contractual Clauses, after names have been replaced by short codes.
7. Your rights
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21). Any consent may be withdrawn at any time without giving reasons and without disadvantage.
8. Right to complain
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz — or the authority at your place of residence or work.
9. No automated decisions
No automated decision-making within the meaning of Art. 22 GDPR. The software produces drafts for review; every decision is made by the law firm.