Privacy Policy

We, UHY Wahlen & Mannsky PartGmbB, take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this Privacy Policy.

The use of our website is generally possible without providing personal data. Insofar as personal data (in particular, name, address, or email addresses) is collected on our pages, this is always done on a voluntary basis, where possible.

1. Name and Address of the Controller

The Controller, as defined by the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection provisions, is:

UHY Wahlen & Mannsky PartGmbB
Walther-von-Cronberg-Platz 13
60594 Frankfurt am Main

Phone: +49 69 660 593 79 – 0
Email: info@uhy-wm.com
Website: www.uhy-wm.com

2. Contact Information of the Data Protection Officer

Email: info@uhy-wm.com (or for application-related matters: karriere@uhy-wm.com)
By mail to the headquarters address in Frankfurt am Main, with the note “Data Protection.”

3. Hosting and Technical Provision (Commissioned Data Processing)

We use the services of ALL-INKL.COM – Neue Medien Münnich, owned by René Münnich, Hauptstraße 68, 02742 Friedersdorf (Germany), for the hosting and technical operation of this website.
ALL-INKL processes personal data on our behalf (including server log files, IP addresses, and metadata) for the purpose of ensuring the secure and efficient operation of the website.
The legal basis is Art. 6(1)(f) of the GDPR (legitimate interest in the secure, stable, and efficient provision of the website).
A data processing agreement (DPA) is in place with ALL-INKL in accordance with Art. 28 GDPR.

4. No Use of Cookies, Trackers, or Analytics

We explicitly state that our website does not use cookies. Likewise, this website does not employ any tracking technologies or web analytics services. We therefore do not collect any data about your user behavior on our website.

5. Collection and Processing of Personal Data

We collect and process personal data only to the extent necessary to provide a functional website and to deliver our content and services. Personal data is processed regularly only with the user’s consent, unless obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.

5.1. 5.1. Data Processing When Visiting Our Website

Each time our website is accessed, our system automatically collects information and stores it in server log files. This includes data such as IP address, date and time of access, URL/filename, HTTP status code, amount of data transferred, referrer URL, and browser/operating system information.

This data is processed to ensure the operation, security, and error analysis of the website.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests lie in the technical provision, defense against attempted attacks, and troubleshooting.

Storage Period: 14 days, after which the data is deleted or anonymized. Longer storage only occurs on an ad-hoc basis (e.g., to investigate security incidents) and is promptly deleted thereafter.

5.2. General Inquiries via Email

If you contact us via email, the personal data you transmit (e.g., your name, your email address, and the content of your message) will be stored for the purpose of processing your inquiry.

Data processing for the purpose of establishing contact is based on your voluntarily given consent pursuant to Art. 6(1)(a) GDPR, or on Art. 6(1)(b) GDPR if your inquiry is related to the initiation or execution of a contractual relationship.

We will not share this data with third parties without your consent. We will delete the data collected in this context once storage is no longer necessary, or we will restrict processing if statutory retention obligations exist.

Storage Period: Correspondence is deleted 12 months after the communication is concluded, provided no statutory retention obligations prevent it. Business letters may be subject to retention periods of up to 6 or 10 years according to § 257 HGB (German Commercial Code) / § 147 AO (German Tax Code).

5.3. Application Process and Email Applications

We process personal data from applicants for the purpose of conducting the application process and assessing their suitability for open positions at our law firm.

Categories of Data Processed

As part of the application process, we process the following information in particular that you provide to us (e.g., via email to karriere@uhy-wm.com):

  • Personal Information: First and last name, address, date of birth, nationality.
  • Contact information: email address, phone number, cell phone number.
  • Application materials: cover letter, resume, transcripts, proof of qualifications, references.
  • Verfahrensbezogene Angaben: Gewünschter Standort (Frankfurt am Main, Köln), Gehaltsvorstellung, Kündigungsfristen bzw. frühestmöglicher Eintrittstermin sowie Notizen aus Vorstellungsgesprächen.

Special Categories of Personal Data (Art. 9 GDPR): To the extent that you voluntarily provide special categories of personal data in your application materials (such as health data, information regarding a severe disability, or religious affiliation listed on certificates), such data will be processed pursuant to Article 9(2)(b) of the GDPR for the purpose of exercising rights and fulfilling obligations under labor law.

Legal Basis

  • Establishment of the Employment Relationship: The primary legal basis is § 26(1), first sentence, of the BDSG in connection with Art. 6(1)(b) of the GDPR .
  • Legal Defense / Legitimate Interest: If no employment relationship is established following the completion of the selection process, we process data within the scope of Art. 6(1)(f) of the GDPR to defend against legal claims (e.g., to provide evidence in the event of any claims under the General Equal Treatment Act (AGG)).
  • Consent for the Candidate Pool: If we wish to retain your documents for future job openings on a long-term basis, we will first obtain your separate, explicit consent in accordance with Art. 6(1)(a) of the GDPR .

Confidentiality and Disclosure

Access to your application data is restricted exclusively to those individuals responsible for the specific selection process (the relevant partners, management, and employees responsible for human resources).

Note regarding the global UHY network: UHY Wahlen & Mannsky PartGmbB is a legally separate and independent member of the international network Urbach Hacker Young International Limited. Your application data will not be shared with other member firms or the Executive Office in London unless you are explicitly applying for an international network position and have given your prior consent. Your data will not be shared with external third parties or transferred to third countries outside the EU/EEA.

Security Notice Regarding the Transmission of Unencrypted Emails

Please note that data transmission via unencrypted email may be vulnerable to security breaches. Complete protection against access by third parties cannot be guaranteed when sending conventional emails over the Internet. If your email provider supports it, emails are transmitted to our servers using transport encryption (TLS/SSL). You have the option at any time to send confidential documents in encrypted form (e.g., as a password-protected ZIP archive) and to provide us with the password via a separate communication channel (e.g., by phone).

Retention Period and Deletion

  • In the event of a rejection: We will retain your application documents for a period of six months following notification of the rejection decision in order to comply with our documentation obligations under the AGG (Section 15(4) AGG in conjunction with Section 61b ArbGG). After that, the data will be deleted or destroyed in accordance with data protection regulations.
  • In the event of a hiring decision: The documents submitted will be included in the personnel file for the purpose of establishing and carrying out the employment relationship (Section 26(1) BDSG).
  • Upon inclusion in the applicant pool: If consent has been given, we will retain the documents for a maximum of 12 months. Upon expiration of this period, or if you revoke your consent beforehand, the documents will be completely deleted.

6. Your Rights as a Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights against the Controller:

  • Right of Access (Art. 15 GDPR): You can request information about whether and what personal data we have stored about you.
  • Right to Rectification (Art. 16 GDPR): You have the right to request the immediate correction of inaccurate personal data concerning you or the completion of incomplete personal data.
  • Right to Erasure (Art. 17 GDPR): You can request the deletion of your personal data stored by us, provided that the processing is not necessary for exercising the right to freedom of expression and information, for fulfilling a legal obligation, for reasons of public interest, or for establishing, exercising, or defending legal claims.
  • Right to Restriction of Processing (Art. 18 GDPR): You can request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, we no longer need the data but you require it for the establishment, exercise, or defense of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR.
  • Right to Notification (Art. 19 GDPR): If you have asserted the right to rectification, erasure, or restriction of processing against the Controller, the Controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.
  • Right to Data Portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format or to request its transmission to another controller.
  • Right to Object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR.
  • Right to Withdraw Consent (Art. 7(3) GDPR): You have the right to revoke your consent to the processing of your data at any time. As a result, we may no longer continue processing your data based on that consent in the future.
  • Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR): Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you believe that the processing of personal data relating to you infringes the GDPR.

The competent supervisory authority for the state of Hesse is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Phone: +49 611 14080, Fax: +49 611 1408900, Email: poststelle@datenschutz.hessen.de

7. Data Security

Wir setzen technische und organisatorische Sicherheitsmaßnahmen ein, um Ihre durch uns verwalteten Daten gegen zufällige oder vorsätzliche Manipulationen, Verlust, Zerstörung oder gegen den Zugriff unberechtigter Personen zu schützen. Unsere Sicherheitsmaßnahmen werden entsprechend der technologischen Entwicklung fortlaufend verbessert.

8. Updates and Changes to This Privacy Policy

This Privacy Policy is currently in effect and is valid as of September 2026.

Durch die Weiterentwicklung unserer Webseite und Angebote oder aufgrund geänderter gesetzlicher bzw. behördlicher Vorgaben kann es notwendig werden, diese Datenschutzerklärung zu ändern. Die jeweils aktuelle Datenschutzerklärung kann jederzeit auf unserer Webseite unter https://uhy-wm.de/datenschutz/ von Ihnen abgerufen und ausgedruckt werden.