1. Controller
The controller responsible for data processing on this website is:
Andreas Müller, Rechtsanwalt (attorney at law)
Pettenkoferstraße 24, 80336 München, Germany
Phone: +49 89 122 840 62
E-mail: mueller@strafrecht-mueller.com
No data protection officer has been appointed, as there is no legal obligation to do so (Section 38 BDSG).
2. Hosting
This website is operated on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The servers are located in data centres in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and reliably.
3. Server log files
When you access the website, your browser automatically transmits technical information that the server logs for a short time:
- IP address
- date and time of access
- page or file accessed
- browser type and version, operating system
- referrer URL (the previously visited page)
The data serve exclusively to ensure trouble-free operation and to defend against attacks. They are not combined with other data sources and are deleted as soon as they are no longer needed for this purpose. The legal basis is Art. 6(1)(f) GDPR.
4. Contact form, e-mail and phone
If you contact us via the contact form, by e-mail or by phone, we process your details (name, e-mail address, phone number if provided, your message) to handle your enquiry and to prepare a possible client relationship.
The data entered in the contact form are sent directly to the law office by e-mail. They are not stored in a database on the web server. Before the enquiry is sent, you confirm your e-mail address with a six-digit code that we send to this address. This ensures that the subsequent confirmation of receipt, which contains your message, is sent only to you. The code is kept only in the server’s working memory as a hash value and is discarded after 10 minutes at the latest. If you use the English version of the website, the code and the confirmation are sent in English.
To protect against automated submissions, the form contains a field invisible to you and measures the time between loading and sending. In addition, we limit the number of requests per IP address; for this purpose the IP address is kept only in working memory, not stored, and discarded after 25 hours at the latest. In addition, before the code is sent your browser solves a small, invisible computing task (ALTCHA) that makes mass submissions by programs harder; it is issued and checked by our own server. No data are transferred to third parties and no cookies are set.
All enquiries are subject to the lawyer’s duty of confidentiality (Section 43a(2) BRAO) – even if no client relationship follows. Insofar as your details concern criminal offences or criminal allegations (Art. 10 GDPR), we process them solely to assess and protect your interests.
The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at a client relationship, otherwise Art. 6(1)(f) GDPR. If no client relationship is established, we delete your enquiry once it has been dealt with and no statutory retention obligations apply. In the case of a client relationship, the professional retention periods for the client file apply (Section 50 BRAO).
5. Online power of attorney
On a separate page (available in German only), clients can grant their power of attorney electronically. We process name, date of birth, address, e-mail address, phone number if provided, details of the proceedings, your declarations (e.g. regarding legal expenses insurance) and the image of your signature.
Before you sign, we send a six-digit code to your e-mail address to ensure that the documents are sent only to you. The code is kept exclusively in the server’s working memory, only as a hash value and never in plain text, and is discarded after 10 minutes at the latest.
From your details, the server creates a PDF with the time of signing and a checksum and sends it by e-mail to you and to the law office. Nothing is stored on the web server; the documents are then located only in the two mailboxes. Your IP address is not included in the PDF.
The legal basis is Art. 6(1)(b) GDPR (client contract); we process details of criminal allegations pursuant to Art. 10 GDPR solely to protect your legal interests. The retention periods for the client file apply (Section 50 BRAO).
6. Withdrawal function
On the page “Vertrag widerrufen” (available in German only) you can withdraw from a contract concluded online (Section 356a BGB). We process your name, your e-mail address, the date of the contract and a file reference, if any. The declaration is sent to the law office by e-mail; you immediately receive a confirmation of receipt with its content, date and time. Nothing is stored on the web server. To prevent abuse, your browser solves the same invisible computing task as for the contact form before sending.
The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a BGB.
7. Google Maps (only after consent)
In the “Offices” section you can display maps from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The maps are only loaded when you click “Load map”. Before that, no connection to Google is established. After the click, your browser transmits data to Google, in particular your IP address, and Google may use cookies or similar technologies on your device. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR).
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The consent applies only to the respective page view and is not stored. If you reload the page, the maps are no longer displayed. You can withdraw your consent at any time with effect for the future by reloading the page.
The “Plan route” links lead to Google Maps. A connection to Google is only established when you click such a link.
Further information: Google’s privacy policy.
8. Fonts, cookies and tracking
The fonts used (Playfair Display and Source Sans 3) are hosted locally on our server. No connection to Google Fonts or other third parties is established when a page is loaded.
This website sets no cookies and uses no analytics, tracking or advertising services.
9. SSL/TLS encryption
This website uses TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser’s address bar.
10. Your rights
You have the following rights regarding your personal data:
- access (Art. 15 GDPR)
- rectification (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
- withdrawal of consent with effect for the future (Art. 7(3) GDPR)
The rights of access and erasure may be restricted insofar as the lawyer’s duty of confidentiality towards third parties or statutory retention obligations prevent them.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
Last updated: September 2026