Notes on data processing
1. Data Controller
Data controller for data processing in the context of our professional services is:
Gleiss Große Schrell und Partner mbB (hereinafter referred to as: Gleiss & Große)
phone: +49 (0)711 993110
fax: +49 (0)711 99311200
2. Data Protection Officer:
The responsible data protection officer of Gleiss & Große can be reached at the above referenced address, for the attention of the Data Protection Officer, or via: email@example.com.
3. Collection and storage of personal data as well as nature and purpose of the processing
In case you engage our professional services, we shall collect the following information:
This data is collected,
The data processing is carried out per your inquiry and is required according to Art. 6 I (b) GDPR for the stated purposes, for properly handling the mandate and for the mutual fulfilment of obligations arising from the mandate agreement. In addition, data processing for the aforementioned purposes is also based on Art. 6 I (f) GDPR, this applies in particular insofar as the transfer of personal data, e.g. the contact data of contact persons when mandated by companies, is not carried out by the data subject(s) itself/themselves. Data processing on this basis is also carried out for properly handling the mandate and for the fulfilment of obligations under the mandate agreement, as well as for safeguarding the legitimate interests of the mandating company (e.g. to enable short-term queries to the inventors involved).
Personal data collected by us for handling the mandate will, in principle, be stored until the end of the statutory retention period for lawyers (6 years after the end of the calendar year in which the mandate was terminated) and deleted thereafter, unless we are required by Art. 6 I (c) GDPR under statutory retention or documentation obligations based on tax laws and/or commercial law (deriving e.g. from HGB, StGB or AO) to store the data for a longer period, or in case you have consented to storage for a longer period in accordance with Art. 6 I (a) GDPR. In individual cases, it may also happen that the data is stored until the end of the statutory periods of limitation (30 years) in order to safeguard our legitimate interests.
Insofar as the relevant personal data has not been obtained from the data subject itself, e.g. where contact persons or inventors have been named by company-clients, we assume that the individual data subjects have been made aware of these notes on data processing, or, at the very least, their essential content.
4. Transfer of data to third parties
Your personal data will not be transferred to third parties for purposes other than those listed below.
a) Within the scope of the GDPR
To the extent necessary in accordance with Art. 6 I (b), (f) GDPR for proper handling of the mandate, your personal data will be passed on to third parties. This includes in particular disclosure to the opposing party in legal proceedings, representatives of the opposing party (in particular their lawyers), courts and other public authorities for the purpose of correspondence as well as to justify, assert or defend your rights, as well as to service providers, e.g. for processing of international payments. The submitted data may only be used by theses third parties for the purposes stated.
In the course of filing industrial property rights, personal data is also processed by the competent national and European offices (e.g. DPMA and EUIPO) and courts (e.g. Federal Patent Court). Details on the type, scope and purpose of data processing and your rights in this context can be found in the data protection declarations of the
German Patent and Trademark Office, which is available here,
and the EUIPO, which is available here.
We would like to stress, that there is no provision for erasure or limitation for storage in relation to personal data processed in the official registers and in the public information services of the offices and courts (e.g. patent gazette, patent specifications, trademark gazettes), as the information recorded there is of permanent interest to the public.
The attorney-client privilege remains unaffected. Regarding personal data subject to the attorney-client privilege, such data will only be passed on to third parties after consultation with the client.
b) Outside the scope of the GDPR
For the proper and appropriate handling of your mandate and for adequately safeguarding your legal interests, it may be necessary to transfer personal data obtained in the course of the attorney-client relationship to courts, offices or foreign lawyers in a third country (i.e. a country outside the scope of the GDPR) or to an international organisation (e.g. WIPO or EPO).
(1) Where the following countries are concerned, an adequacy decision of the European Commission pursuant to Art. 45 GDPR applies:
A list of the countries for which such a decision has been taken is available at the following Internet address: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en. The respective adequacy decisions of the European Commission are also linked there. The list is continuously updated.
(2) For countries other than those mentioned above and the international organisations WIPO and EPO, no adequacy decision of the European Commission has yet been made. In case of transfers to or from these countries or international organisations or in case of transfers to third parties in the countries mentioned under (1) that are not covered by the European Commission’s adequacy decisions – this applies, for example, in the case of transfers of personal data to authorities and courts in the USA that are not covered by the EU-US Privacy Shield Agreement – the following applies to the transfer of personal data:
a) In case of transfer within the framework of a pre-trial discovery under US law, the transfer is based on Art. 6 I (f) GDPR. In this case, personal data will be transmitted in pseudonymised form wherever possible. Insofar as open transmission is necessary, we shall endeavour to obtain the consent of the parties concerned.
b) In case of an application for industrial property rights, the transfer of personal data (in particular the names of the inventors involved) will be conducted
(i) on the basis of the mandate/patent attorney contract concluded with you, pursuant to Art. 49 I (i) (b) GDPR, insofar as we were mandated directly by the inventor(s) involved;
(ii) on the basis of the mandate/patent attorney agreement in the interest of the party concerned pursuant to Art. 49 I (i) (c) GDPR, in particular to safeguard the personal right of the inventor/inventors involved, a right which is recognised virtually worldwide pursuant to Art. 4ter PC;
(iii) on the basis of Art. 49 I (i) (g) GDPR, insofar as the personal data transferred is already contained in registers which according to Union or Member State law are intended to provide information to the public and which are open to consultation either by the public in general or by any person who can demonstrate a legitimate interest;
(iv) on the basis of Art. 49 I (i) € GDPR, insofar as this is necessary for the assertion, exercise or defence of legal claims of the client(s), in particular insofar as the name of the holder or inventor must be indicated in accordance with the respective national legal provisions for the proper filing of an application for industrial property rights.
5. Rights of the data subjects
Data subjects have the right:
6. Right of objection
Where personal data is processed on the basis of legitimate interests in accordance with Art. 6 I (f) GDPR, data subjects have the right to object to the processing of their personal data in accordance with Art. 21 GDPR if there are grounds for doing so relating to their particular situation.
To exercise the right of objection, an e-mail to firstname.lastname@example.org or a written message to the above mentioned mail address shall be sufficient.