Privacy Policy

The data controller within the meaning of the GDPR is:

Compound Law Tech UG (haftungsbeschränkt)
Neue Roßstraße 20
10179 Berlin
Germany

Represented by: Marko Bradic, Mohit Tilwani, Julian Jantze (Managing Directors)

Email: contact@compoundlaw.tech

We process personal data based on the following legal grounds:

• Art. 6 (1) (a) GDPR (Consent): You have given consent for one or more specific purposes. Consent can be withdrawn at any time with effect for the future.
• Art. 6 (1) (b) GDPR (Contract Performance): Processing is necessary for the performance of a contract or pre-contractual measures.
• Art. 6 (1) (c) GDPR (Legal Obligation): Processing is necessary for compliance with a legal obligation to which we are subject (e.g., professional or tax law obligations).
• Art. 6 (1) (f) GDPR (Legitimate Interests): Processing is necessary for the purposes of legitimate interests pursued by us or a third party, unless overridden by your interests or fundamental rights.

Some of the service providers we use are based outside the European Economic Area (EEA). When we transfer personal data to third countries, we ensure appropriate safeguards are in place:

Adequacy Decision: For some countries, the European Commission has determined that an adequate level of data protection exists (e.g., for the United Kingdom, Switzerland). For the USA, this applies under the EU-U.S. Data Privacy Framework for certified companies.

Standard Contractual Clauses: With service providers in other third countries, we have agreed on the Standard Contractual Clauses approved by the EU Commission pursuant to Art. 46 (2) (c) GDPR.

Further information on the service providers used and the respective safeguards can be found in the relevant sections of this Privacy Policy.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. After that, the data is deleted unless longer retention is required by law.

Statutory Retention Obligations: Under German commercial and tax law, we are required to retain certain business documents for 6 or 10 years (§ 147 AO, § 257 HGB).

Our website is hosted and delivered via Cloudflare Pages.

Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA

Data Processed: When accessing our website, information is automatically collected and stored in server log files: IP address, date and time of request, time zone difference to GMT, content of request (specific page), access status/HTTP status code, data volume transferred, referring website, browser, operating system, and language.

Purpose: Technical provision of the website, ensuring security and stability, defense against attacks.

Legal Basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and stable website operation).

Retention Period: Server log files are deleted after a maximum of 14 days.

Third Country Transfer: Cloudflare is certified under the EU-U.S. Data Privacy Framework. Additionally, Standard Contractual Clauses have been agreed.

Further Information: Cloudflare Privacy Policy

Our website does not use tracking or marketing cookies and no analytics tools.

Data Processed: Your acknowledgement of the cookie notice is stored in your browser's local storage. It is not transmitted to us.

Purpose: Not showing the cookie notice again on every visit.

Legal Basis: § 25 (2) No. 2 TDDDG; Art. 6 (1) (f) GDPR (legitimate interest in providing a functional website).

Retention Period: Until you clear your browser storage.

When you contact us by email, we process the data you provide to handle your inquiry.

Data Processed: Name, email address, phone number (if provided), company, message content.

Purpose: Processing your inquiry, contacting you, potentially initiating a business relationship.

Legal Basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in responding to inquiries).

Retention Period: We delete the data after final processing of your inquiry, unless statutory retention obligations apply or a business relationship is established.

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You can request information about your personal data we process.
• Right to Rectification (Art. 16 GDPR): You can request correction of inaccurate or completion of incomplete data.
• Right to Erasure (Art. 17 GDPR): You can request deletion of your data under certain conditions.
• Right to Restriction (Art. 18 GDPR): You can request restriction of processing under certain conditions.
• Right to Data Portability (Art. 20 GDPR): You can request to receive the data you provided in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to processing of your data based on Art. 6 (1) (f) GDPR.
• Right to Withdraw Consent (Art. 7 (3) GDPR): You can withdraw any consent given at any time with effect for the future.

To exercise your rights, please contact: contact@compoundlaw.tech

You have the right to lodge a complaint with a data protection supervisory authority about our processing of personal data (Art. 77 GDPR).

The supervisory authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
www.datenschutz-berlin.de

We do not use automated decision-making including profiling pursuant to Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

We reserve the right to amend this Privacy Policy to adapt it to changed legal situations or changes to our services or data processing. The current version is always available on our website.

Last updated: October 2026