Privacy policy

Thank you for your interest in the practice of Katharina Lenz. Data protection has a particularly high priority for me. The use of the Internet pages of the practice Katharina Lenz is possible without any indication of personal data. However, if a data subject wants to use special services of my practice via my website, processing of personal data could become necessary. If processing of personal data is necessary and if there is no legal basis for such processing, I will generally obtain the consent of the data subject.

The processing of personal data, such as the name, address, e-mail address, or telephone number of a data subject shall always be in line with the General Data Protection Regulation, and in accordance with the country-specific data protection regulations applicable to the practice Katharina Lenz. By means of this data protection declaration, I would like to inform the public about the nature, scope and purpose of the personal data collected, used and processed by me. Furthermore, data subjects are informed about their rights by means of this data protection declaration.

As the controller, the practice Katharina Lenz has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. Nevertheless, Internet-based data transmissions can always be vulnerable to security risks, so that absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to me by alternative means, for example by telephone.

1. Definitions

The data protection declaration of the practice Katharina Lenz is based on the terms used by the European Data Protection Supervisor when adopting the General Data Protection Regulation (GDPR). The privacy statement should be easy to read and understand for the public as well as for my clients and business partners. To ensure this, I would like to explain in advance the terminology used.

I use the following terms, among others, in this Privacy Policy:

2. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions with data protection character is:


Katharina Lenz

Klingsorstraße 7

12167 Berlin

Tel.: 03093671704



3. Collection of general data and information

The website of the Praxis Katharina Lenz collects a series of general data and information with each call-up of the website by a data subject or automated system. This general data and information is stored in the log files of the server. The following data may be collected: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system accesses our website (so-called referrer), (4) the sub-websites that are accessed via an accessing system on our website, (5) the date and time of an access to the website, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system and (8) other similar data and information that serve to avert danger in the event of attacks on our information technology systems.

When using these general data and information, the practice Katharina Lenz does not draw any conclusions about the data subject. Rather, this information is needed (1) to deliver the content of my website correctly, (2) to optimize the content of my website and the advertising for it, (3) to ensure the long-term functionality of my information technology systems and the technology of my website, and (4) to provide law enforcement authorities with the information necessary for prosecution in the event of a cyber-attack. Therefore, the Praxis Katharina Lenz analyzes anonymously collected data and information on one hand, and on the other hand, with the aim of increasing the data protection and data security of my enterprise, to ensure an optimal level of protection for the personal data I process. The anonymous data of the server log files are stored separately from any personal data provided by a data subject.

4. Routine erasure and blocking of personal data.

The controller processes and stores personal data of the data subject only for the period necessary to achieve the purpose of storage or where provided for by the European Directives and Regulations or other legislator in laws or regulations to which the controller is subject.

If the storage purpose ceases to apply or if a storage period prescribed by the European Directive and Regulation Maker or another competent legislator expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.

5. Rights of the data subject

6. Legal basis of the processing

Art. 6 I lit. a DS-GVO serves my practice as the legal basis for processing operations in which I obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as is the case, for example, with processing operations that are necessary for a delivery of goods or the provision of another service or consideration, the processing is based on Art. 6 I lit. b DS-GVO. The same applies to such processing operations that are necessary for the implementation of pre-contractual measures, for example in cases of inquiries about our products or services. If my practice is subject to a legal obligation by which a processing of personal data becomes necessary, such as for compliance with tax obligations, the processing is based on Art. 6 I lit. c DS-GVO. In rare cases, the processing of personal data might become necessary to protect vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were to be injured on our premises and as a result his or her name, age, health insurance data or other vital information had to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6 I lit. d DS-GVO. Finally, processing operations could be based on Art. 6 I lit. f DS-GVO. Processing operations that are not covered by any of the aforementioned legal bases are based on this legal basis if the processing is necessary to protect a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject are not overridden. Such processing operations are permitted to us in particular because they were specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (Recital 47, Sentence 2 DS-GVO).

7. Legitimate interests in the processing pursued by the controller or a third party.

If the processing of personal data is based on Article 6 I lit. f DS-GVO, our legitimate interest is the conduct of my business for the benefit of the well-being of all my employees.

8. Duration for which the personal data are stored.

The criterion for the duration of the storage of personal data is the respective statutory retention period. After expiry of the period, the corresponding data will be routinely deleted, provided that they are no longer required for the performance of the contract or the initiation of the contract.

9. Legal or contractual provisions for the provision of personal data; necessity for the conclusion of the contract; obligation of the data subject to provide the personal data; possible consequences of non-provision.

I inform you that the provision of personal data is partly required by law (e.g. tax regulations) or may also result from contractual regulations (e.g. information on the contractual partner). Sometimes it may be necessary for the conclusion of a contract that a data subject provides me with personal data that must subsequently be processed by me. For example, the data subject is obliged to provide us with personal data if my practice concludes a contract with him or her. Failure to provide the personal data would mean that the contract with the data subject could not be concluded. Before providing personal data by the data subject, the data subject must contact me. I will inform the data subject on a case-by-case basis whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and what the consequences of not providing the personal data would be.

10. Existence of automated decision-making

As a responsible company, we do not use automated decision-making or profiling.

This data protection declaration was created by the data protection declaration generator of the German Privacy Society, which generates sample data protection declarations , in cooperation with the data protection lawyers of the law firm WILDE BEUGER SOLMECKE | Rechtsanwälte.