Privacy Policy

02Scope

This policy covers GrowAnwalt, a client-management application for law firms that tracks client matters/services, stores client documents, allows internal notes, and provides secure staff logins. It also covers data submitted by clients through data-request forms sent by their law firm, and the sharing of relevant data with the broader GrowFirma platform, described in Section 6.

03Data We Collect

• Account data: name, email, hashed password, firm details, login credentials
• Client records: client name, contact details, matter/service type, internal notes
• Client-submitted form data: personal, matter-related, or supporting information a client enters when responding to a data-request form sent by their law firm
• Documents: files uploaded by firm staff, or by clients responding to a data-request form, related to client matters
• Payment data: billing details processed via Stripe (we never store card numbers directly)
• Usage data: IP address, browser/device type, pages visited, via Google Analytics

04Purpose and Legal Basis

We confirm that GrowAnwalt does not use AI or any form of automated decision-making, including profiling, to process personal data, client documents, or data submitted via client forms. No decisions with legal or similarly significant effect are made by automated means.

05Hosting and Data Location

All GrowAnwalt data, including our MongoDB database, is hosted with Hostinger on infrastructure located within the European Union. No client, matter, or account data — including data submitted via client forms — is transferred outside the EU/EEA through our hosting infrastructure.

06Processors, Data Requests and Data Sharing

We work with the following processors, each bound by a Data Processing Agreement (DPA) under Art. 28 GDPR:

• Hostinger (hosting, EU-based servers)
• Stripe (payment processing) — may transfer limited billing data to the US under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses, recognized safeguards under Art. 46 GDPR
• Google Analytics (usage analytics) — processes anonymized usage data only after consent; Google Ireland Ltd. participates in the EU-U.S. Data Privacy Framework as an additional transfer safeguard

GrowAnwalt allows law firm Users to send data-request forms to their clients. When a client fills in such a form, they submit their data directly into GrowAnwalt. In this context, the law firm — not DatenStrom-3AG Solutions UG — acts as the data controller for that data, and is responsible for informing the client under Art. 13 GDPR before submission. GrowAnwalt and GrowFirma act only as processors for this client-submitted data.

GrowAnwalt is part of the GrowFirma platform ecosystem. Client and matter data, including data collected via client forms, is also shared with and accessible via GrowFirma, allowing participating law firms to connect via a unique ID to view and manage data and documents shared by GrowFirma users seeking legal services. This mirrors the data flow used within GrowNotar, where client requests and documents are made available to the selected service provider after submission. All such transfers occur within our EU-hosted infrastructure, with no data leaving the EU/EEA as part of this internal sharing.

07Client Communication Feature

GrowAnwalt allows firm staff to email clients directly through the platform and to send data-request forms as described in Section 6. In this context, the law firm acts as the data controller for its own client relationship, while GrowAnwalt and GrowFirma act as processors facilitating that communication and data collection.

08Data Retention

Client and account data, including data submitted via client forms, is retained for the duration of the active subscription, plus any period required by German commercial and tax law (typically 6–10 years for billing records). Firms may request deletion of client records at any time, subject to their own retention obligations as controllers.

09Data Breach Notification

In the event of a personal data breach likely to result in risk to your rights and freedoms, our Data Protection Officer will notify the competent supervisory authority within 72 hours of becoming aware of the breach, per Art. 33 GDPR, and inform affected individuals without undue delay where legally required.

10Your Rights

Under GDPR, you have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing based on legitimate interest. If you are a client who submitted data via a data-request form, please direct rights requests to the law firm that sent you the form, as they are the data controller for that data; you may also contact us at info@datenstrom-3ag.com and we will assist in routing your request. You may withdraw Google Analytics consent at any time via our cookie settings.

11Right to Lodge a Complaint

You may lodge a complaint with a supervisory authority, such as the Berliner Beauftragte für Datenschutz und Informationsfreiheit, if you believe your data has been processed unlawfully.

12Cookies

GrowAnwalt uses strictly necessary cookies for core functionality, which do not require consent under § 25(2) TTDSG. Google Analytics cookies are only activated with your explicit consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG, given via our cookie banner. Analytics cookies remain blocked until consent is given, and you may withdraw consent at any time through the cookie settings.

13Accountability and Documentation

In line with 2026 regulatory expectations for demonstrable accountability, we maintain internal Records of Processing Activities (ROPA), overseen by our Data Protection Officer, documenting how personal data — including client-submitted form data — is collected, used, and shared across GrowAnwalt and GrowFirma.

14Changes to This Policy

We may update this Privacy Policy as GrowAnwalt evolves or as legal requirements change. The latest version is always available within the platform and on our website. Continued use after changes constitutes acceptance of the updated policy.