Notes on data processing

Notes on data processing

1. Data Controller

Data controller for data processing in the context of our professional services is:

Gleiss Große Schrell und Partner mbB (hereinafter referred to as: Gleiss & Große)
Leitzstraße 45
70469 Stuttgart
Germany

email: office@gleiss-grosse.com
phone: +49 (0)711 993110
fax: +49 (0)711 99311200

2. Data Protection Officer:

The responsible data protection officer of Gleiss & Große can be reached at the above referenced address, for the attention of the Data Protection Officer, or via: datenschutz@gleiss-grosse.com.

3. Collection and storage of personal data as well as nature and purpose of the processing

In case you engage our professional services, we shall collect the following information:

  • salutation, first name, surname, of the client(s), or the respective contact person in the case of a mandate by a company,
  • email address,
  • mailing address,
  • telephone number (landline and/or mobile),
  • further information, necessary for the assertion and defence of your rights within the scope of the mandate, in case of applications for industrial property rights this includes in particular the information of the owner which is to be published in the official registers of industrial property rights or databases; in the case of applications for technical industrial property rights it also includes in particular the first names, surnames and addresses of the inventors involved.

This data is collected,

  • for identification as client;
  • for appropriate legal advice and representation;
  • for filing intellectual property rights both nationally and internationally;
  • for correspondence;
  • for invoicing;
  • to properly address enquiries to applicants/inventors;
  • to process potential liability claims and in case potential claims against the client have to be asserted;

The data processing is carried out per your inquiry and is required according to Art. 6 I (b) GDPR for the stated purposes, for properly handling the mandate and for the mutual fulfilment of obligations arising from the mandate agreement. In addition, data processing for the aforementioned purposes is also based on Art. 6 I (f) GDPR, this applies in particular insofar as the transfer of personal data, e.g. the contact data of contact persons when mandated by companies, is not carried out by the data subject(s) itself/themselves. Data processing on this basis is also carried out for properly handling the mandate and for the fulfilment of obligations under the mandate agreement, as well as for safeguarding the legitimate interests of the mandating company (e.g. to enable short-term queries to the inventors involved).

Personal data collected by us for handling the mandate will, in principle, be stored until the end of the statutory retention period for lawyers (6 years after the end of the calendar year in which the mandate was terminated) and deleted thereafter, unless we are required by Art. 6 I (c) GDPR under statutory retention or documentation obligations based on tax laws and/or commercial law (deriving e.g. from HGB, StGB or AO) to store the data for a longer period, or in case you have consented to storage for a longer period in accordance with Art. 6 I (a) GDPR. In individual cases, it may also happen that the data is stored until the end of the statutory periods of limitation (30 years) in order to safeguard our legitimate interests.

Insofar as the relevant personal data has not been obtained from the data subject itself, e.g. where contact persons or inventors have been named by company-clients, we assume that the individual data subjects have been made aware of these notes on data processing, or, at the very least, their essential content.

4. Transfer of data to third parties

Your personal data will not be transferred to third parties for purposes other than those listed below.

a) Within the scope of the GDPR

To the extent necessary in accordance with Art. 6 I (b), (f) GDPR for proper handling of the mandate, your personal data will be passed on to third parties. This includes in particular disclosure to the opposing party in legal proceedings, representatives of the opposing party (in particular their lawyers), courts and other public authorities for the purpose of correspondence as well as to justify, assert or defend your rights, as well as to service providers, e.g. for processing of international payments. The submitted data may only be used by theses third parties for the purposes stated.

In the course of filing industrial property rights, personal data is also processed by the competent national and European offices (e.g. DPMA and EUIPO) and courts (e.g. Federal Patent Court). Details on the type, scope and purpose of data processing and your rights in this context can be found in the data protection declarations of the

German Patent and Trademark Office, which is available here,

and the EUIPO, which is available here.

We would like to stress, that there is no provision for erasure or limitation for storage in relation to personal data processed in the official registers and in the public information services of the offices and courts (e.g. patent gazette, patent specifications, trademark gazettes), as the information recorded there is of permanent interest to the public.

The attorney-client privilege remains unaffected. Regarding personal data subject to the attorney-client privilege, such data will only be passed on to third parties after consultation with the client.

b) Outside the scope of the GDPR

For the proper and appropriate handling of your mandate and for adequately safeguarding your legal interests, it may be necessary to transfer personal data obtained in the course of the attorney-client relationship to courts, offices or foreign lawyers in a third country (i.e. a country outside the scope of the GDPR) or to an international organisation (e.g. WIPO or EPO).

(1)       Where the following countries are concerned, an adequacy decision of the European Commission pursuant to Art. 45 GDPR applies:

  • Andorra
  • Argentina
  • Faroe Islands
  • Guernsey
  • Isle of Man
  • Israel (insofar as an automated processing takes place)
  • Jersey
  • Canada (where processing by Canadian organisations takes place in the course of a commercial activity)
  • New Zealand
  • Uruguay
  • Switzerland
  • USA (insofar as the transfer is made to one of the organisations listed in the following Privacy Shield list of the US Department of Commerce).

A list of the countries for which such a decision has been taken is available at the following Internet address: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en. The respective adequacy decisions of the European Commission are also linked there. The list is continuously updated.

(2)       For countries other than those mentioned above and the international organisations WIPO and EPO, no adequacy decision of the European Commission has yet been made. In case of transfers to or from these countries or international organisations or in case of transfers to third parties in the countries mentioned under (1) that are not covered by the European Commission’s adequacy decisions – this applies, for example, in the case of transfers of personal data to authorities and courts in the USA that are not covered by the EU-US Privacy Shield Agreement – the following applies to the transfer of personal data:

a) In case of transfer within the framework of a pre-trial discovery under US law, the transfer is based on Art. 6 I (f) GDPR. In this case, personal data will be transmitted in pseudonymised form wherever possible. Insofar as open transmission is necessary, we shall endeavour to obtain the consent of the parties concerned.

b) In case of an application for industrial property rights, the transfer of personal data (in particular the names of the inventors involved) will be conducted

(i)        on the basis of the mandate/patent attorney contract concluded with you, pursuant to Art. 49 I (i) (b) GDPR, insofar as we were mandated directly by the inventor(s) involved;

(ii)       on the basis of the mandate/patent attorney agreement in the interest of the party concerned pursuant to Art. 49 I (i) (c) GDPR, in particular to safeguard the personal right of the inventor/inventors involved, a right which is recognised virtually worldwide pursuant to Art. 4ter PC;

(iii)      on the basis of Art. 49 I (i) (g) GDPR, insofar as the personal data transferred is already contained in registers which according to Union or Member State law are intended to provide information to the public and which are open to consultation either by the public in general or by any person who can demonstrate a legitimate interest;

(iv)      on the basis of Art. 49 I (i) € GDPR, insofar as this is necessary for the assertion, exercise or defence of legal claims of the client(s), in particular insofar as the name of the holder or inventor must be indicated in accordance with the respective national legal provisions for the proper filing of an application for industrial property rights.

5. Rights of the data subjects

Data subjects have the right:

  • To withdraw their consent to us at any time pursuant to Art. 7 III GDPR. This means that we may no longer continue the data processing based on this consent in the future, however we would like to point out that the processing remains permissible even after consent has been withdrawn, insofar as other grounds in relation to the lawfulness of processing apply, such as Art. 6 I (f) GDPR.
  • Of access to their personal data processed by us and the following information: the purpose of the processing, the categories of personal data concerned, the categories of recipients to whom their personal data has been or will be disclosed, the envisaged period for which the personal data will be stored, the existence of a right to request rectification, erasure, restriction of processing or objection, the existence of a right of to lodge a complaint with a supervisory authority, where the personal data are not collected from the data subjects, any available information as to their source, the existence of automated decision-making, including profiling and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subjects, pursuant to Art. 15 GDPR.
  • In accordance with Art. 16 GDPR, to immediately request the correction of incorrect or incomplete personal data stored by us.
  • In accordance with Art. 17 GDPR, to demand the erasure of personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
  • In accordance with Art. 18 GDPR, to demand restriction of processing of their personal data if the accuracy of the personal data is contested by the data subject, if the processing is unlawful and the data subject refuses erasure and we no longer need the data, but they are required by the data subject for the establishment, exercise or defence of legal claims or data subjects have objected to processing pursuant to Art. 21 GDPR.
  • Pursuant to Art. 20 DSGVO, to receive the personal data provided to us by the data subject(s) in a structured, commonly used and machine-readable format or to have the personal data transmitted directly to another controller.
  • Pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority. As a rule for this purpose, it is possible to lodge the complaint with the supervisory authority of the data subject’s habitual residence or place of work or location of our office.

6. Right of objection

Where personal data is processed on the basis of legitimate interests in accordance with Art. 6 I (f) GDPR, data subjects have the right to object to the processing of their personal data in accordance with Art. 21 GDPR if there are grounds for doing so relating to their particular situation.

To exercise the right of objection, an e-mail to datenschutz@gleiss-grosse.com or a written message to the above mentioned mail address shall be sufficient.