Representation throughout Germany—both out of court and in court.
+49 6821 4017138contact@lmcs.legalClient portal
Free initial assessment

Privacy policy

Privacy Policy

LMCS LEGAL Law Firm Andreas M. Michaeli · Effective date: 8 November 2026

This privacy policy explains which personal data is processed when you visit lmcs.legal or use the contact facilities provided there, why the processing takes place and which rights you have.

1. Controller

The controller responsible for processing personal data on this website is:

LMCS LEGAL Law Firm Andreas M. Michaeli
Sole practitioner
Am Ochsenwald 5
66539 Neunkirchen
Germany
Email: contact@lmcs.legal
Telephone: +49 6821 4017138
Website: https://lmcs.legal

No data protection officer has been appointed.

2. Scope and principles

This policy applies to the German and English versions of lmcs.legal. The website is operated by zeitstein (Kevin Stein) on behalf of the law firm. This is based on a data processing agreement under Article 28 GDPR. zeitstein processes technical data as a processor. The law firm remains responsible for the purposes and means of processing.

We process personal data only where this is necessary for the relevant purpose, permitted by law or based on your consent. We do not use automated decision-making, including profiling.

3. Hosting and technical delivery

The website is delivered through a cloud server operated by zeitstein at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre. Hetzner is engaged as a sub-processor for this location, which is certified under ISO/IEC 27001. In live operation, lmcs.legal points directly to this server. No content delivery network or third-party proxy is placed in front of it. The website is delivered over HTTPS.

Technical connection data is processed for secure operation and troubleshooting. The logs and retention periods are described in section 4.

4. Server, security and backup logs

For each request, technical data may include the IP address, requested address, time, HTTP method, status code, amount of data transferred, duration and browser identifier. The logs differ as follows:

  • Proxy log: full IP address, host, address including parameters, time, method, status, data volume, duration and browser identifier; no referrer is stored.

  • Website web-server log: shortened IP address, host, address without parameters, time, method, status, data volume, response time and browser identifier; only critical errors are recorded.

  • Firewall: rejected connections, including IP addresses.

  • Server logins and attack protection (SSH and fail2ban): IP address and time of login or defence events. These logs do not concern the substantive use of the website.

Logs are generally deleted no later than seven days after collection. Daily server backups retain seven versions; log data may therefore remain in backups for up to a further seven days. Additional images may occasionally be created before manual maintenance and are deleted no later than seven days later.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are secure operation, troubleshooting, defence against attacks and maintaining website availability.

5. Contact and callback forms

5.1 Loading only after activation

The enquiry form is available on the “Initial assessment” page and on the English enquiry page. The employment-law and accident-compensation pages link to it. The callback form is available on the German and English home pages. Before you click “Open form”, your browser does not connect to Renostar. Only after the click is the form loaded in a frame by a dedicated website script. Without JavaScript, a button opens the form at Renostar in a new window.

When the form is loaded, Renostar receives the browser connection data required for the connection, in particular the IP address and browser identifier. Only the lmcs.legal domain is provided as the referrer; the specific page visited and additional parameters are not sent to Renostar. The website does not read form entries or pre-fill fields. The frame cannot redirect the website, but it may open new windows for its own notices or links.

5.2 Data requested

The forms are provided by Renostar GmbH & Co. KG, Am Neubergsweg 8, 63868 Großwallstadt, Germany. The enquiry form generally requires the area of law, surname, telephone number or email address, and the enquiry. Enquiries concerning employment law or termination may require additional termination-related information. The callback form requires the area of law, surname and telephone number. All other information is voluntary. File uploads are not provided.

The forms process your information to handle your enquiry or callback request and to contact you. If you provide an email address in the enquiry form, Renostar automatically sends a receipt containing fixed wording. The receipt does not reproduce your entries.

5.3 Consent and special categories of personal data

Form data is processed on the basis of your consent under Article 6(1)(a) GDPR. The consent wording in the German-language forms reads, in translation: “I consent to the personal data I enter being processed to handle my enquiry or callback request and to contact me. I am aware that I may withdraw this consent at any time with effect for the future.” The enquiry form adds: “Insofar as I provide special categories of personal data in the free text, in particular health data, my consent expressly also extends to their processing for the purpose of handling my enquiry.”

The free-text field “enquiry” may be used to provide special categories of personal data, such as health data, or information concerning criminal offences. If you submit such information, your consent expressly also covers the processing of those special categories under Article 9(2)(a) GDPR, insofar as this is necessary. Please provide only information needed for your enquiry.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You may withdraw consent by contacting contact@lmcs.legal. If you do not consent or withdraw consent, the enquiry or callback request may not be capable of being handled.

5.4 Recipients and retention

The forms are processed in the Renostar Legal Cloud. According to the current information, Schwarz Digits Cloud GmbH & Co. KG, Am Campus 1, 74177 Bad Friedrichshall, Germany, is involved in platform operation and hosting. The law firm receives the information required to handle the contact. Based on the current arrangement, data of clients and prospective clients, in particular form and client-portal data and documents, is not transferred to the US support providers named in the technical documents. This is not a blanket statement that Renostar performs no other technical processing in third countries for other services; the configuration described here is decisive for the website data.

Enquiries and callback requests that do not lead to a mandate are deleted after handling is completed, unless a statutory retention obligation or legitimate reason requires longer retention. If a mandate is established, the statutory and professional retention and limitation periods for the client file apply. Processing and retention within the Renostar Legal Cloud are also governed by the agreements between the law firm and Renostar.

After submission, Renostar may redirect the frame to the website page “What happens next”. This is an ordinary page request without entries in the address and without visitor statistics. Like any request, it may show in the proxy log for up to seven days that a form was submitted from an IP address.

5.5 Contact by email or telephone

If you contact us by email or telephone, we process the information you provide, such as your name, contact details and your matter, to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns advice or a mandate, and otherwise Article 6(1)(f) GDPR; our legitimate interest is responding to your enquiry. Section 5.4 applies accordingly to retention.

6. Friendly Captcha

After activation, both forms use Friendly Captcha for spam and abuse protection. The provider is Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany. According to the provider information, Friendly Captcha processes technical connection data, with the IP address processed only as a hash, as well as browser and device characteristics and interaction data such as mouse movements or key timing, without the content of your entries. The purpose is to detect and prevent automated or abusive form submissions.

According to the information available, Friendly Captcha does not set cookies. It does use browser session storage for the technical identifiers frc_sid, frc_sc, frc_rc and frc_sol. The stored data is deleted by the provider no later than 30 days later. Access to session storage is technically connected with loading the form. Whether and to what extent this use falls within the exception for strictly necessary access under section 25(2)(2) TDDDG depends on the actual configuration and legal assessment.

7. Visitor statistics from server logs

The website uses only server-side counting from the server logs that arise in any event. No browser analytics script is used. No cookies are set and no browser storage is read or written for these statistics.

The statistics consist of aggregated numbers of page views per page and day. The pages “What happens next” and “not found” are excluded. No visitor identifier is created and no country is evaluated. Bots may be counted in part if they provide a browser identifier. Interim figures are deleted 70 days after the end of the relevant month; monthly reports are retained for 25 months.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a data-minimised overview of reach and use and the technical improvement of the website. The statistics remain disabled if the necessary technical and legal basis is not available.

8. Analysis by search engines and AI services

The website may analyse requests by search engines and AI services from the proxy log. The analysis does not read the IP address and collects no additional data. It produces only aggregated numbers per day and page: requests by each search engine or AI service and visits from AI answers where the service identifies them in the address by the utm_source parameter. The referrer is not stored for this purpose. Fewer than five visits are aggregated.

Interim figures are deleted 70 days after the end of the relevant month; monthly reports are retained for 25 months. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is to assess technically and editorially how content is found through search engines and AI services.

9. Renostar client portal

The Renostar client portal at https://case-share.renostar.app may be used for the secure exchange of information and documents. Clients and prospective clients may use the portal; it processes the personal data and documents entered or uploaded there on behalf of the law firm.

On the German pages, an information page on the website may be shown before the portal; the English pages link directly to it. No connection to Renostar is made before the link is clicked. The link contains no additional parameters and no referrer information.

According to the current information, Schwarz Digits Cloud GmbH & Co. KG in Germany is involved in operating and hosting the Renostar Legal Cloud. Based on the current arrangement, data of clients and prospective clients is not transferred to the US support providers named in the technical documents. Portal processing is also governed by the information, agreements and retention rules of the law firm and Renostar.

10. Content, GitHub and maintenance

Texts and images in the “Legal knowledge” section are delivered from the website's own server. The website has no comments function, newsletter or other submission facility for legal knowledge. Published contributions should not contain information that makes individuals identifiable, in particular file numbers from unpublished cases.

The website source code and published contributions are managed in a private GitHub, Inc. repository in the USA. Website visitor data is not stored there. The repository may contain only the law firm's contact details. The imprint and this privacy policy are stored only on the website server.

For maintenance and technical support, zeitstein uses Claude by Anthropic. Server access is configured so that Claude cannot read logs or visitor data. On the intended technical setup, visitor data is therefore not transferred to Anthropic.

11. Cookies and other external content

The website itself does not set cookies and does not store information in the browser. Fonts are loaded from the website's own server. Apart from the Renostar forms activated after a click, the Renostar client portal and Friendly Captcha, the website does not embed external content or services.

The use of Friendly Captcha session storage is described in section 6. Renostar may provide supplementary information for its technical functions; the forms are loaded only after you activate them.

12. Retention overview

We retain personal data only for as long as necessary for the relevant purpose. The periods for technical logs are set out in section 4; the periods for server-side statistics and search-engine and AI analysis are set out in sections 7 and 8. Form enquiries and callback requests without a mandate are deleted after handling is completed unless statutory duties or legitimate reasons require otherwise. Client-file data is retained for the statutory and professional periods. Afterwards, the data is deleted or, where deletion is not possible, blocked.

13. Your rights

Subject to the statutory requirements, you have the following rights:

  • access to the personal data processed about you under Article 15 GDPR;

  • rectification of inaccurate data or completion of incomplete data under Article 16 GDPR;

  • erasure under Article 17 GDPR, unless statutory duties or other exceptions apply;

  • restriction of processing under Article 18 GDPR;

  • data portability under Article 20 GDPR where the statutory requirements are met;

  • objection to processing based on Article 6(1)(e) or (f) GDPR for reasons relating to your particular situation; you may object to direct marketing at any time;

  • withdrawal of consent with effect for the future. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise your rights, contact contact@lmcs.legal or use the postal address above. Where necessary to process your request, we may ask for an appropriate proof of identity.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. In particular, you may contact the Landesbeauftragte für Datenschutz und Informationsfreiheit Saarland at the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany. Further information is available at https://www.datenschutz.saarland.de/.

15. Changes to this privacy policy

We may update this privacy policy if the website, the services used or legal requirements change. The version published on this website is the applicable version. This policy is dated 8 November 2026.