Privacy Policy

Last updated: 1 January 2026

1. Introduction

Xalvoro Rechtsanwaltsgesellschaft mbH ("Xalvoro", "we", "our", "us") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website at xalvoro.cfd or engage with our architecture & space planning services.

We comply with the General Data Protection Regulation (GDPR) (EU) 2020/679, the UK Data Protection Act 2018, and the German Federal Data Protection Act (BDSG).

2. Data Controller

The data controller responsible for your personal data is:
Xalvoro Rechtsanwaltsgesellschaft mbH
Unter den Linden 45, Berlin
Email: [email protected]
Phone: +49 30 9876 5432

3. Information We Collect

3.1 Information You Provide

We may collect personal data that you voluntarily provide when you:

Submit an enquiry through our contact form or consultation wizard
Engage us for architecture & space planning services
Subscribe to our legal insights newsletter
Communicate with us via email, phone, or WhatsApp
Attend our events or webinars

This may include: name, email address, phone number, company name, job title, matter description, jurisdiction, budget range, and any other information you choose to provide.

3.2 Information Collected Automatically

When you visit our website, we may automatically collect: IP address, browser type and version, operating system, referring URL, pages viewed, time and date of visit, and device identifiers. This data is collected through cookies and similar technologies as described in our Cookie Policy.

3.3 Client Matter Information

When you engage Xalvoro for legal services, we process additional information necessary for the provision of expert guidance, including corporate documents, financial information, correspondence, and other materials related to your inquiry. This processing is governed by our engagement letter and professional confidentiality obligations.

4. How We Use Your Data

We use your personal data for the following purposes:

To respond to your enquiries and provide requested information about our services
To deliver architecture & space planning services under engagement agreements
To manage client relationships and communicate about ongoing matters
To comply with legal and regulatory obligations including anti-money laundering checks
To improve our website and services through analytics
To send legal updates and newsletters (with your consent)
To manage conflicts of interest checks required by professional conduct rules

5. Legal Basis for Processing

We process your personal data on the following legal bases:

Contract: Processing necessary for the performance of legal services engagements
Legitimate interests: Responding to enquiries, improving our services, and business development
Legal obligation: Compliance with anti-money laundering, tax, and professional conduct requirements
Consent: Marketing communications and non-essential cookies

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected. Client matter files are retained for a minimum of 10 years following matter closure, in accordance with German professional conduct rules. Enquiry data from non-clients is retained for 3 years. Analytics data is retained for 26 months.

7. Your Rights

Under GDPR, you have the following rights:

Right of access to your personal data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten") where applicable
Right to restrict processing
Right to data portability
Right to object to processing based on legitimate interests
Right to withdraw consent at any time
Right to lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Data Sharing

We do not sell your personal data. We may share data with: correspondent law firms (with your consent or as necessary for your matter), IT service providers under data processing agreements, regulatory authorities when required by law, and professional indemnity insurers. All third-party processors are bound by GDPR-compliant data processing agreements.

9. International Transfers

Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission and adequacy decisions where applicable.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including ISO 27001-certified information security management, encryption of data in transit and at rest, access controls, and regular security audits.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

12. Contact

For privacy-related enquiries, contact our Data Protection Officer at [email protected] or write to: Xalvoro Rechtsanwaltsgesellschaft mbH, Unter den Linden 45, Berlin.