Privacy Policy

Last updated: 10 November 2026

Summary

We are a provider of software for law firms, in-house legal departments and insolvency administration. We process personal data so that our website works, so that we can respond to your enquiries and so that we can improve our offerings.

We do not set any cookies that are not necessary for the operation of the website without your consent. You can withdraw any consent you have given at any time via the cookie settings.

1. Who is responsible for your data (controller)

Septeo Legal Solutions Deutschland GmbH

Brauerstraße 12

76135 Karlsruhe Germany

Full details of our authorised representatives and our entry in the commercial register can be found in our Legal Notice.

Our Data Protection Officer

Raphaël Buchard Dipeeo

SAS 95 avenue du Président Wilson

93100 Montreuil France

Phone: +33 9 50 39 07 50 Email: contact@dipeeo.com

You may contact our Data Protection Officer directly with any questions about data protection and regarding the exercise of your rights – in German, English or French.

2. Your rights

You have the following rights vis-à-vis us. To exercise them, an informal message to one of the contact addresses given above is sufficient. Exercising your rights is free of charge.

Supervisory authority competent for us

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany www.baden-wuerttemberg.datenschutz.de

⚠ Your right to object under Art. 21 GDPR

You have the right to object at any time to the processing of your personal data insofar as we base such processing on a legitimate interest (Art. 6(1)(f) GDPR). This requires that the objection is made on grounds relating to your particular situation.

Where we process your data for direct marketing purposes, you may object to this at any time and without giving reasons. Following such an objection, we will no longer process your data for this purpose.

You may address your objection informally to the contact details given in Section 1.

3. When you visit our website

3.1 Hosting and server log files

Our website is operated on the infrastructure of an external service provider, which provides us with computing capacity, storage space, database services, and security and maintenance services.

Each time the website is accessed, the system automatically collects data that is technically necessary to display the page to you and to ensure secure operation:

• IP address of the requesting device
• Date and time of access
• Name and URL of the file retrieved
• Amount of data transferred and notification of whether the retrieval was successful
• Browser, operating system and language used
• The previously visited page (referrer)

Purpose: Provision of the website, ensuring system security, investigating and preventing attacks, and error analysis.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in a stable, secure and functional online presence.

Storage period: The server log files are collected by our hosting provider HubSpot and are stored only for as long as is necessary to ensure the security and functionality of the website; details can be found in HubSpot's privacy notice.

We have concluded a data processing agreement pursuant to Art. 28 GDPR with our hosting provider.

3.2 Cookies and similar technologies

Cookies are small text files that are stored on your device. Local storage, session storage and tracking pixels have a comparable effect. We distinguish between two categories:

Strictly necessary cookies enable the operation of the website – for example, storing your cookie preferences, security functions and the functionality of forms. They are set without consent (Sec. 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).

All other cookies – in particular for statistics, audience measurement, personalisation and advertising – are only set with your express consent (Sec. 25(1) TDDDG). We base the subsequent processing of the data collected in this way on Art. 6(1)(a) GDPR.

You can change or completely withdraw your choice at any time via the cookie settings on our website. In addition, you can delete cookies in your browser or prevent them from being stored in the first place; in that case, you may not be able to use the website in full.

3.3 Consent management

To obtain, document and manage your consents, we use the consent tool of HubSpot (HubSpot Ireland Ltd., Dublin, Ireland). Your selection is stored for 6 months in the cookie __hs_cookie_cat_pref so that we can take it into account on future visits and demonstrate it to supervisory authorities.

Your IP address, information about your browser and device, and the time and content of your consent are processed.

Legal basis: Art. 6(1)(c) GDPR – compliance with our obligation to demonstrate consent under Art. 7(1) GDPR. Sec. 25(2) no. 2 TDDDG applies to the setting of the associated cookies.

4. When you contact us

4.1 Contact form, email, telephone and post

You can reach us via our contact form, by email, by telephone or by post. In doing so, we process the data you transmit to us:

• Contact form: the fields you have completed and your IP address in pseudonymised form
• Email: your email address and the content of your message
• Telephone: the information you provide during the call, insofar as we note it down for processing purposes
• Post: your sender details and the content of your letter

Purpose: Processing of and response to your enquiry, and any follow-up communication.

Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to the initiation or performance of a contract. In all other cases, Art. 6(1)(f) GDPR – our legitimate interest in the effective handling of your request.

Obligation to provide data: You are under no statutory or contractual obligation to provide your data. However, we cannot process your enquiry without the information marked as mandatory.

Storage period: We erase your data as soon as your enquiry has been conclusively dealt with and no statutory retention obligations prevent erasure. You may request erasure at any time.

Your data will not be disclosed to third parties unless this is necessary to process your enquiry or you have given your consent. An exception is the conversion matching with Google Ads (see section 6).

4.2 Newsletter

You can subscribe to our email newsletter, which we use to inform you about products, events and news.

Subscription procedure: We use the double opt-in procedure. After you subscribe, you will receive a confirmation email. We will only add you to the mailing list once you have confirmed.

Data processed: Your email address, any other data provided in the subscription form and – as proof of consent – your IP address and the time of subscription and confirmation.

Legal basis: Art. 6(1)(a) GDPR (your consent); for logging the subscription process, additionally Art. 6(1)(c) GDPR.

Withdrawal: You can unsubscribe from the newsletter at any time – via the unsubscribe link in every newsletter email or by sending us a message. After you unsubscribe, we will remove your data from the mailing list. We retain subscription data as proof of the original consent until any claims have become time-barred.

Performance measurement: Our newsletters are sent via HubSpot (HubSpot Ireland Ltd., Dublin, Ireland). The newsletters contain a tracking pixel and personalised links. This enables us to record whether and when a newsletter was opened and which links were clicked, and to assign this information to your contact record in our CRM. We use this to improve our newsletters and tailor them to your interests. The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG), which you give when subscribing to the newsletter. Performance measurement can only be withdrawn separately by unsubscribing from the newsletter. A transfer to the USA is possible (EU-US Data Privacy Framework, standard contractual clauses).

Marketing to existing customers: If you have provided us with your email address in connection with the purchase of goods or services, we reserve the right to send you information about similar offerings of our own. The legal basis is Sec. 7(3) UWG in conjunction with Art. 6(1)(f) GDPR. You may object to this use at any time without incurring any costs other than the transmission costs; we will inform you of this right when your address is collected and in every email.

4.3 Registration for online training sessions and webinars

Registration is required to participate in our online training sessions. For this purpose, we collect your name, your contact details (email address and, where applicable, telephone number) and the information required to hold the session.

Purpose: Management of your access, delivery of the training session, communication regarding the event and provision of participant materials.

Legal basis: Art. 6(1)(b) GDPR – performance of the user relationship entered into with you. Insofar as you additionally provide information voluntarily or we contact you for marketing purposes, we base this on your consent (Art. 6(1)(a) GDPR).

You can view, amend or have your registration data deleted at any time.

4.4 AI-powered chat function ("Sales Avatar")

On our website, we offer an AI-powered chat function through which you can ask questions about our products and services.

Data processed: Your text or voice input and the responses generated by the system (conversation transcript), as well as technical connection data (IP address, browser type and version, operating system, date and time of access).

Purpose: Answering your enquiries, ensuring system security, and quality assurance and traceability of interactions.

Legal basis: Art. 6(1)(b) GDPR insofar as the communication relates to the initiation of a contract; otherwise Art. 6(1)(f) GDPR – our legitimate interest in efficient customer communication.

Automated decision-making: No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The responses of the chat function do not produce legal effects concerning you or similarly significantly affect you.

Please note: Do not enter any sensitive data or confidential client or case information in the chat. Beyond the connection data mentioned, we do not collect any information about you unless you provide it yourself.

Loading of the chat function: On the German-language product pages for Advoware, Legal Twin Smart Legal Research and Legal Twin Contract Insights, the chat function is loaded when the page is opened, even if you do not start a chat. In this process, your IP address, information about your browser and the page accessed are transmitted to the servers of VidLab7 GmbH, and a greeting video is retrieved from there. The legal basis for loading is Art. 6(1)(f) GDPR. Our legitimate interest lies in offering you the chat function directly.

Service provider used and storage period: The chat function is provided by VidLab7 GmbH (Moonscale), Rosental 7, 80331 Munich, Germany, as our processor; we have concluded an agreement with it pursuant to Art. 28 GDPR. Processing takes place on servers in the EU. The conversation transcripts are deleted after 30 days.

5. When you apply for a job with us

You can apply to us via our online application portal, by email or by post. To advertise vacancies and manage incoming applications, we use the software of Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany, with which we have concluded a data processing agreement.

Data processed: Your identification and contact data, information on your education and professional background, your application documents (cover letter, CV, certificates and references) and usage data of the application portal.

Purpose: Management of your application, assessment of your suitability for the advertised position, communication with you and – with your consent – approaching you about alternative positions.

Legal basis: Art. 6(1)(b) GDPR in conjunction with Sec. 26(1) BDSG (implementation of pre-contractual measures). Insofar as we require your data after the conclusion of the procedure to defend against legal claims – for example in connection with the German General Act on Equal Treatment (AGG) – we base this on Art. 6(1)(f) GDPR.

Special categories of personal data: We only process information such as a severe disability insofar as this is permitted under Sec. 26(3) BDSG or you have given your express consent. Please do not send us any sensitive data that is not required for your application.

Storage period:

• After the conclusion of the procedure, we delete your documents after six months.
• If you have agreed to be included in our talent pool, we delete them after two years. You may withdraw this consent at any time.
• If your application results in employment, we transfer the data to your personnel file.

Obligation to provide data: The data marked as mandatory must be provided so that we can review your application. Without this information, we cannot consider you in the application process.

Further information: Personio privacy policy

6. If you are a customer, prospective customer, partner or supplier

In the course of our business relationships, we process personal data of our customers, prospective customers, suppliers and partners.

Data processed: Contact and communication data, contract and billing data, payment data, project- or contract-related information and information you provide to us voluntarily.

Purpose: Initiation, performance and administration of the contractual relationship, communication, support, invoicing, marketing and ensuring IT security.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (compliance with obligations under commercial and tax law) and Art. 6(1)(f) GDPR (our legitimate interest in efficient business processes and in direct marketing to existing customers).

Obligation to provide data: The provision of the necessary data is required to establish and perform the contractual relationship. Without it, we cannot conclude or perform the contract.

Conversion matching with Google Ads: We connect our marketing automation system (HubSpot) to Google Ads via the Google Ads Data Manager in order to measure the effectiveness of our advertising and to improve our campaigns. When a contact reaches a certain stage in our sales process (lead, MQL, SQL, opportunity) or is classified as not qualified, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, retrieves the following data from HubSpot via an interface that we have authorised: email address, telephone number (where available), Google Click ID (only for contacts who came to us via a Google ad), time of the conversion and the stage reached. Google normalises the email address and telephone number and converts them into hash values using a hash function (SHA-256) in order to attribute the conversion to an ad click.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in measuring and improving the effectiveness of our advertising. You can object to this processing by contacting us using the details in section 1 (see also section 2). A transfer to the USA is possible (EU-US Data Privacy Framework, standard contractual clauses).

We do not transmit any other contact data or the content of your enquiries for this purpose. Google may compare the hash values with data from Google accounts. The recipient is Google Ireland Ltd. You can manage your ad settings with Google at adssettings.google.com. Our own retention periods are set out in section 9. No automated decision-making within the meaning of Art. 22 GDPR takes place (see section 13).

7. Recipients of your data

We only disclose personal data if there is a legal basis for doing so: because it is necessary for the performance of a contract, because we are legally obliged to do so (for example, vis-à-vis tax authorities), because there is a legitimate interest pursuant to Art. 6(1)(f) GDPR or because you have given your consent (Art. 6(1)(a) GDPR).

Categories of recipients include in particular:

Where we use service providers as processors, we do so exclusively on the basis of a contract pursuant to Art. 28 GDPR. In the case of joint controllership, we conclude an arrangement pursuant to Art. 26 GDPR.

8. Transfers to third countries

Some of the service providers we use process data outside the EU or the EEA – predominantly in the USA. A level of data protection equivalent to that in Europe is not always ensured there; in particular, public authorities may under certain circumstances access data without effective legal remedies being available to you.

A transfer only takes place if one of the following safeguards applies:

1. Adequacy decision of the European Commission – for example, the EU-US Data Privacy Framework, provided that the respective provider is actively certified (Art. 45 GDPR).
2. EU standard contractual clauses together with supplementary measures (Art. 46(2)(c) GDPR).
3. Your explicit consent pursuant to Art. 49(1)(a) GDPR, after we have informed you of the possible risks.

The overview in Section 10 indicates for each service whether a transfer to a third country takes place and on which safeguard we base it. On request, we will provide you with further information and a copy of the safeguards agreed.

9. How long we store your data

When you merely visit the website, we store your data only for the duration of your visit and within the log file periods mentioned above.

When you actively use the website – for example, by contacting us – we store your data for as long as we need it to deal with your request. Beyond that, we retain it for as long as necessary for the establishment, exercise or defence of legal claims. Under Sec. 195 BGB, the regular limitation period is three years, calculated from the end of the year in which the claim arose. In special cases provided for by law, longer periods of up to 30 years apply (Sec. 199(3) and (4) BGB).

Statutory retention obligations take precedence over erasure. They arise in particular from Secs. 238 and 257 HGB and Sec. 147 AO and generally amount to six to ten years. For the duration of the retention period, we restrict processing to this purpose.

10. Services on our website

What applies to all services listed

To spare you from reading the same information thirty times, we summarise here what applies to all of the services listed below:

• Consent and withdrawal: Services whose legal basis is consent are only loaded after you have given your consent. The script of our website platform HubSpot is an exception. It is loaded when a page is opened and does not set any cookies without your consent. In this process, a page request is transmitted to HubSpot’s servers (IP address, page URL, time, browser and device information such as language and screen size). The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest lies in a rough measurement of the reach of our website and in the demonstrable operation of the consent procedure. You can withdraw any consent given at any time with effect for the future via the cookie settings. Sec. 25 TDDDG additionally applies to the storage of information on your device and access to it.
•  
• Data processing: We have concluded agreements pursuant to Art. 28 GDPR with providers that act as processors on our behalf.
•  
• Linking to user accounts: If you are logged in to an account with the respective provider (Google, Meta, LinkedIn, Microsoft), the provider may associate the data collected with your profile there. To prevent this, log out of the respective service before visiting our website. In the case of Google Analytics, this takes place via the “Google signals” function: If you have consented to the “Advertising” category and personalised advertising is enabled in your Google account, Google may link data about your visit with your Google account, for example for cross-device analyses and advertising audiences. You can view and delete the related data in your Google account under “My Activity”.
•  
• Typical data categories: Unless otherwise stated, the services process your IP address, browser and device information, the time and duration of your visit, the pages accessed and your interactions with the website.
•  

10.1 Operation and delivery of the website

When these services are used, your IP address is transmitted to the servers of the respective provider when the resources are retrieved. This is technically necessary so that the content can be delivered to your browser. To our knowledge, the CDN services do not set cookies.

10.2 Analytics and audience measurement

We use these services exclusively on the basis of your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG).

You can also prevent Google Analytics by using the browser add-on for deactivation. Option to object for Hotjar: Do Not Track

10.3 Advertising and performance measurement

We also use these services exclusively with your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). They create pseudonymous user profiles and enable personalised advertising.

We process the data of these services jointly with the respective provider insofar as the provider evaluates it for its own purposes. Arrangements pursuant to Art. 26 GDPR are in place for this joint processing. The respective provider alone is responsible for any further processing under its own responsibility; in this respect, please contact the provider directly to exercise your data subject rights.

Your options to object:

• Google: Ad settings
• Meta: Ad preferences
• LinkedIn: Manage advertising preferences
• Across providers: youronlinechoices.eu
•  

10.4 Providers' privacy policies

10.5 decareto Privacy Widget

To create and maintain this privacy notice, we use the Privacy Widget of decareto GmbH, Mittelweg 144, 20148 Hamburg, Germany. For delivery, decareto uses the content delivery network bunny.net of BunnyWay d.o.o. (Slovenia, EU).

Your IP address and browser information are processed. The service does not set cookies or store log files.

Legal basis: Art. 6(1)(c) GDPR – compliance with our information obligations under Art. 12 et seq. GDPR. For the use of bunny.net, decareto relies on its legitimate interest in error-free delivery.

11. Our social media profiles

We maintain profiles on social networks in order to communicate with customers, prospective customers and the public:

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in contemporary public relations. Insofar as consent is required, Art. 6(1)(a) GDPR.

When you visit our profiles, the networks process your data under their own responsibility, including for market research and advertising purposes. We are joint controllers with the respective operator for the page insights that the networks provide to us in anonymised form (Art. 26 GDPR). We have no influence on any further processing by the operators.

To assert your data subject rights vis-à-vis the networks, please contact the respective operator directly, as only the operator has full access to your data stored there. You may also contact us; we will then forward your request.

If you do not want the operators to collect data about your visit to our profiles, log out of your account before visiting, delete existing cookies or use appropriate browser extensions.

12. Data security

We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. Transmission on our website is encrypted using TLS. You can recognise an encrypted connection by the padlock symbol in your browser's address bar. We continuously adapt our measures to technological developments.

Please note that transmission by unencrypted email may be subject to security vulnerabilities. For confidential information, we can provide a secure means of transmission on request.

13. No automated decision-making

We do not use your data for automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR that produces legal effects concerning you or similarly significantly affects you.

The pseudonymous user profiles created in the context of advertising services (see Section 10.3) serve exclusively to display relevant advertising and have no such effect.

14. Changes to this privacy policy

We will amend this privacy policy if the legal situation, our services or the nature of the data processing change. The version published on this page applies in each case. In the event of material changes affecting your consent, we will obtain your consent again.