Privacy Policy

Last updated: September 16, 2026

1. Controller

Oscar Rojas
Alt-Mariendorf 50
12107 Berlin, Germany
Email: contact@klarlaw.de

2. What we collect and why

When you submit our contact form, we process the data you provide: your name, email address, phone number, city, the category of your legal need, how urgent it is, your optional description of what happened, and any document you choose to upload. We use this data to understand your request and connect you with a suitable English-speaking German lawyer (Art. 6(1)(b) GDPR — steps prior to entering into a contract, taken at your request).

Your description and uploaded documents may reveal sensitive information — for example about alleged criminal offences. We process such details only because you choose to share them with us for the purpose of finding you a lawyer (Art. 9(2)(a) GDPR — explicit consent expressed by submitting them). Share only what you're comfortable with; a rough idea of your situation is enough.

3. Email verification

After you submit the form, we email you a 6-digit verification code, which you enter on the page where you submitted. We only begin processing your case once your email address is confirmed this way. This protects you from someone submitting a request in your name, and us from processing data of people who never asked (Art. 6(1)(f) GDPR — legitimate interest in verified requests).

3a. Automated pre-assessment (AI)

After you confirm your email, an AI system (Claude, operated via Amazon Web Services and processed within the European Union) writes a short summary of your request and assesses how clearly the situation is described, so lawyers can review cases efficiently (Art. 6(1)(b) and 6(1)(f) GDPR). The AI never receives your name, email address, or phone number, and your data is not used to train AI models. This assessment alone never rejects your request: if it flags a request as unclear, a human reviews it before any decision, and every update email we send lets you reply to request human review (Art. 22(3) GDPR safeguards).

4. Who we share it with

We share your request — including your description and any uploaded document — with the independent lawyer(s) we match you with, so they can assess and take on your case. We do not sell your data, and we do not share it with anyone else except our technical service providers (hosting, email delivery) bound by data processing agreements (Art. 28 GDPR).

5. Hosting and log files

Our web server processes technical data (IP address, timestamps, requested pages, browser information) in server logs to provide the site securely and detect abuse (Art. 6(1)(f) GDPR). Log files are retained for a maximum of 30 days unless needed as evidence of an attack.

6. Cookies and analytics

We use only strictly necessary cookies: a CSRF protection cookie that secures the form against forged submissions. We use no advertising or tracking cookies, so no consent banner is required.

For aggregate visitor statistics we use Plausible Analytics (data policy), a privacy-friendly, EU-based service that uses no cookies and stores no personal data — we see counts like page views and referrers, never individuals (Art. 6(1)(f) GDPR). Analytics is not loaded on any page that handles your case data.

6a. Marketing emails (only if you ask)

If you opt in, we email you occasional tips on other legal problems in Germany, and offers from our partners. You can unsubscribe at any time.

7. How long we keep your data

If you never confirm your email address, your request is deleted after 30 days. Confirmed requests are kept while your matching is active and deleted 12 months after your case is closed, unless statutory retention duties (§ 147 AO, § 257 HGB) require longer storage of individual records. You can request earlier deletion at any time.

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise any right, email contact@klarlaw.de. You also have the right to lodge a complaint with a supervisory authority — for Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit.

9. Lawyers we write to by post

To invite lawyers to join Klarlaw, we write to some of them once, by post. For this we process a lawyer's name and academic title, firm, office address, practice area, bar association, and a note of where their firm says it works in English. We take these details from public sources, such as the legal notice (Impressum) on the firm's website, and name the source in the letter. We process them only to send that one letter, based on our legitimate interest in direct marketing (Art. 6(1)(f) GDPR). We don't email or call lawyers for this, and we don't share these details with anyone.

We delete these details six months after the letter, or straight away if the lawyer objects. To keep our promise of a single letter, and to respect an objection, we keep only a one-way hash of the name and postcode, and of the firm and postcode. It can't be turned back into those details, but it lets us recognise the same lawyer or firm if they come up again. Lawyers can object at any time by writing to contact@klarlaw.de (Art. 21(2) GDPR); the other rights in section 8 apply as well.

10. Changes

We will update this policy when our processing changes and indicate the date of the latest revision above.