Information on data processing in the context of our activities as ombudspersons / lawyers of confidence

1. the name and contact details of the data controller and the company data protection officer

This privacy notice applies to data processing by:

Person responsible: OSR Attorneys at Law (hereinafter: OSR), Eugenstraße 18, D- 73033 GöppingenE-Mail:

Phone: +49 (0) 7161 / 98 77 957
Fax: +49 (0) 7161 / 98 77 956

The internal data protection officer can be reached at the aforementioned contact details of the firm.

2. collection and storage of personal data as well as the type and purpose of such data and their use

When whistleblowers contact us in the course of our activities as ombudspersons / ombudspersons of confidence, we collect personal data only insofar as these are communicated to us. Otherwise, data is processed anonymously without personal reference.

  • Salutation, first name, last name of the whistleblower or a pseudonym
  • E-mail address of the whistleblower,
  • Telephone number (landline and/or mobile)
  • If a defendant is notified, whose first name, surname

The collection of the aforementioned data shall take place,

  • to contact the whistleblower (orally, in writing or electronically), or
  • in order to enable OSR to assess the facts communicated and, if necessary, to carry out further investigations in this respect.

The data processing is carried out after the whistleblower has contacted us and is required for the aforementioned purposes in accordance with Art. 6 (1) sentence 1 lit. b, Art. 6 (1) sentence 1 lit. f or Art. 6 (1) sentence 1 lit. a DSGVO for the appropriate processing of the notified information/issue. In addition, the data processing also takes place within the framework of the fulfilment of a contract with the company/authority/organisation etc. commissioned to us in each case. (client, principal).

If we receive approval from the whistleblower to pass on data with a personal reference, we will forward this to the company/authority/organisation etc. commissioned to us and store it until expiry of the statutory retention period applicable to lawyers and then delete it (six years after the end of a calendar year after the contractual relationship with the client has ended). An exception to this applies if OSR would be obliged to store the data for a longer period due to documentation and retention periods under tax or commercial law. We shall only pass on personal data to our clients/clients if the whistleblower has given his/her prior consent in text form; otherwise, the data shall be passed on to our clients/clients in anonymous form which does not allow any indication of the identity of the whistleblower or third parties.

If the whistleblower insists on the transfer of the identity of a third party, we will transfer the personal information to our principal/client. In this case, however, the person whose personal information was transferred must be informed of the process no later than one month after the transfer to our principal/client Art. 14(3)(a) DSGVO) or one month after the principal/client has completed the investigation. In this case, the person must be informed about the following: Storage, type of data, purpose of processing, identity of the controller including the whistleblower(s).

If, after contacting an OSR attorney, the whistleblower decides that the facts reported should not be forwarded to our client, all data relating to the case will be destroyed.

3. disclosure of data to third parties

Personal data will not be transferred to third parties for purposes other than those listed below.

Insofar as this is necessary in accordance with Art. 6 Para. 1 Sentence 1 lit. b DSGVO for the processing of the information provided by a whistleblower and the whistleblower has given OSR approval in text form, OSR shall pass on the personal data to the client.

We also assure the whistleblower of confidentiality within the scope of the attorney-client privilege beyond the legal requirements of the DSGVO. If the information provided is subject to legal professional privilege, OSR will only disclose it to third parties if the whistleblower has agreed to this in advance.

4. data subject rights

Whistleblowers have the right:

  • in accordance with Art. 7 (3) DSGVO to revoke your consent once given to OSR at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future;
  • in accordance with Art. 15 DSGVO to request information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected from you, and, if applicable, meaningful information about its details;
  • In accordance with Art. 16 DSGVO, you may immediately request the correction of inaccurate or incomplete personal data stored by OSR;
  • pursuant to Art. 17 DSGVO to request the deletion of your personal data stored by OSR, unless the processing is necessary for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims;
  • to request the restriction of the processing of your personal data in accordance with Art. 18 DSGVO, insofar as the accuracy of the data is disputed, the processing is unlawful, but you object to its deletion and OSR no longer requires the data, but you need it to assert, exercise or defend legal claims or you have objected to the processing in accordance with Art. 21 DSGVO;
  • in accordance with Art. 20 DSGVO, to receive your personal data that you have provided to OSR in a structured, common and machine-readable format or to request that it be transferred to another controller;
  • complain to a supervisory authority in accordance with Art. 77 DSGVO. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or at the registered office of OSR.


5. right to object

Insofar as personal data of whistleblowers are processed on the basis of legitimate interests pursuant to Article 6 (1) sentence 1 lit. f DSGVO, they have the right to object to the processing of their personal data pursuant to Article 21 DSGVO, insofar as there are grounds for doing so that arise from their particular situation.

To exercise your right to object, please send an e-mail to