Last updated: November 2026
1. Controller
Rechtsanwältin Maral Noruzi, Noruzi Law, Bavariaring 25, 80336 Munich, Germany, email: mail@noruzi-law.eu, phone: +49 89 244185620.
No data protection officer is legally required. Please send any privacy questions to the address above.
2. Principles
We process personal data only where necessary to provide this website, answer your inquiries or carry out a mandate. Legal bases are in particular Art. 6(1)(b) GDPR (contract and pre-contractual steps), (c) (legal obligations) and (f) (legitimate interests).
As a lawyer, Maral Noruzi is bound by professional secrecy (Section 43a(2) BRAO, Section 203 German Criminal Code). This also applies to the firm's staff.
3. Hosting and server logs
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany; the servers are located in Germany. When you open a page, Strato processes technically necessary data such as IP address, date and time, page requested, browser and operating system in server log files in order to deliver the website securely and reliably (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Strato under Art. 28 GDPR. More: www.strato.de/datenschutz.
4. Cookies
This website sets no cookies and uses no third-party tracking or advertising technologies.
5. Fonts (Google Fonts)
For consistent display, we load fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your browser connects to Google's servers and your IP address is transmitted to Google. Transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR (consistent, appealing presentation). More: policies.google.com/privacy.
6. Contact form, email and phone
When you contact us via the contact form, by email or phone, we process your details (e.g. name, contact details, matter) to handle your inquiry (Art. 6(1)(b) or (f) GDPR). Inquiries sent via the contact form (name, email, optionally phone and company, practice area, message) are sent as an email via our hosting provider Strato to the firm's mailbox and stored there; they are not stored in a database. Our mailbox is operated by Microsoft (Microsoft 365, Microsoft Ireland Operations Limited, Dublin, Ireland). Inquiries are deleted once handled, unless a mandate follows. To prevent abuse, your IP address is stored in hashed form for up to one hour. Answers in the first checks are not stored; the result is only transmitted if you then send an inquiry.
Unencrypted email is not fully protected in transit. Please send particularly sensitive documents via a secure channel by arrangement.
7. Online appointment booking (Microsoft Bookings)
For appointments we link to Microsoft Bookings (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). The calendar is not embedded; data is only transmitted once you follow the link and book there. We process your details (e.g. name, email, phone number, preferred time) to arrange the appointment (Art. 6(1)(b) GDPR). Transfer to the USA is possible; Microsoft is certified under the EU-US Data Privacy Framework. More: privacy.microsoft.com.
8. Mandates and retention
Within a mandate we process the data required for advice and representation, including towards courts, authorities and opposing parties. We keep data only as long as necessary for the purpose or required by statutory retention periods (in particular Section 50 BRAO: case files six years; tax and commercial periods up to ten years).
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future. The right of access may be limited by professional secrecy.
You may lodge a complaint with a supervisory authority. The competent authority is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
10. Changes
We update this policy when the website or legal requirements change. The version published here applies.