Privacy policy

The contact and controller responsible for the processing of your personal data when visiting this website within the meaning of the EU General Data Protection Regulation (GDPR) is: Rechtsanwalt Benyamin H. K. Tanis Blücherstraße 14, 24105 Kiel, Germany Phone: +49 431 389 88 222 Email: mwst@ra-tanis.de

For any questions relating to data protection in connection with our services or the use of our website, you may also contact our data protection officer at any time. The officer can be reached at the postal address above and at the email address above (please mark: “z. Hd. Datenschutzbeauftragter”).

Whenever you use our website, we collect the access data that your browser automatically transmits in order to enable you to visit the site. The access data include, in particular:

• IP address of the requesting device
• date and time of the request
• URL of the page accessed and of the referring page
• information about the browser and operating system used
• online identifiers (e.g. device identifiers, session IDs)

The technical provision of this website and the associated backend services (in particular database, authentication and file storage for uploaded documents) is performed via the “Lovable Cloud” platform of Lovable, Inc., 2261 Market Street, San Francisco, CA 94114, USA, which acts as a processor on our behalf in this respect. The sub‑processors used include, in particular, Supabase, Inc. (San Francisco, CA, USA) as operator of the backend infrastructure (database, authentication, storage) as well as Amazon Web Services EMEA SARL (Luxembourg) with data centres in Frankfurt am Main, Germany, as the operator of the underlying data centre infrastructure. The application is furthermore delivered via the Cloudflare content delivery network (see section 4).

The legal basis is our legitimate interest in the secure, stable and performant operation of the portal (Art. 6(1)(f) GDPR) and – where necessary for the application process – the performance of the contract or pre‑contractual measures (Art. 6(1)(b) GDPR). Where hosting involves transfers to third countries (in particular the USA), we rely – where applicable – on an adequacy decision of the European Commission (EU‑US Data Privacy Framework) and, in addition, on EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

For the secure and fast delivery of the website and for protection against undesired access (e.g. DDoS attacks) we use Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as a processor. Cloudflare acts as a content delivery network (CDN) and web application firewall. When you access our pages, technical connection data – in particular IP address, browser type and version, and request timestamp – are transmitted to and processed by Cloudflare.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR) and – where based on a contract – the performance of that contract (Art. 6(1)(b) GDPR). For transfers to Cloudflare in third countries we rely on EU standard contractual clauses and further appropriate safeguards within the meaning of Art. 44 et seq. GDPR.

The sending and receiving of emails (including any confirmation and status emails triggered by the portal and sent to the email address you have provided) is handled via the email mailboxes of our provider ALL‑INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, which acts as a processor on our behalf in this respect. The server location is Germany. No separate external service provider is used for the delivery of transactional emails.

In this context we process the connection and content data required for email traffic (in particular sender, recipient, subject, content and timestamps). The legal basis is Art. 6(1)(b) GDPR insofar as the communication serves to initiate or perform a client or contractual relationship, and otherwise our legitimate interest in efficient communication (Art. 6(1)(f) GDPR). Further information is available in the ALL‑INKL.COM privacy policy at https://all-inkl.com/datenschutzerklaerung/.

You have various options to contact us – for example by telephone, email or via our online forms. In this context we process your information (in particular name, contact details, content of the enquiry) solely for the purpose of communicating with you and for the initiation, review or performance of a lawyer‑client relationship.

The legal basis is Art. 6(1)(b) GDPR insofar as processing is necessary to answer your enquiry or to initiate or perform a contract. Otherwise, the processing is based on our legitimate interest in properly handling enquiries (Art. 6(1)(f) GDPR).

When you submit an application for a status document for your pleasure craft through this portal, we process the data that you voluntarily provide to us. This includes, in particular:

• applicant and contact data (name, address, telephone number, email address)
• proof of identity (e.g. photo ID, evidence of authority to represent)
• boat data (HIN/CIN, boat type, length, year built, if applicable name and flag)
• uploaded documents (e.g. purchase contract, invoice, declaration of conformity, further evidence)
• information on the intended use of the requested status document

To prepare the lawyer's review, we use AI‑supported systems that automatically check the information and documents you have submitted for formal completeness and plausibility (AI pre‑check). The result of the pre‑check is shown to you immediately and serves solely to prepare the final legal assessment. Legally binding decisions are not made automatically by the AI; the final assessment is always performed by a lawyer.

In addition, customer enquiries may be handled with the support of AI tools in order to answer recurring questions about the procedure or the required documents. Here too, the AI does not replace individual legal advice; a lawyer steps in for legally relevant or complex matters.

In order to provide these AI‑supported functions, we transmit the data required for the respective request (in particular text inputs and contents of uploaded documents) to a technical service provider which bundles access to various AI models and acts as a processor on our behalf within the meaning of Art. 28 GDPR (Lovable, Inc., 2261 Market Street, San Francisco, CA 94114, USA – “Lovable AI Gateway”). Lovable in turn engages sub‑processors through which requests are delivered to the respective AI models. Currently, models from the following providers may be used, in particular: Google Ireland Limited (models of the “Gemini” family), Gordon House, Barrow Street, Dublin 4, Ireland; OpenAI Ireland Ltd. (models of the “GPT” family), 1st Floor, The Liffey Trust Centre, 117‑126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; and Anthropic Ireland, Limited (models of the “Claude” family), 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Processing may also take place on servers of the respective parent companies or affiliated entities in the USA. For this transfer to a third country, we rely – where applicable – on an adequacy decision of the European Commission (EU‑US Data Privacy Framework) and, in addition, on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

According to information provided by the providers used, customer data transmitted via their productive interfaces (API) are, as a rule, not used for the training or further development of the AI models. We endeavour to select and configure the models used in such a way that these commitments apply; however, we cannot assume any guarantee going beyond the respective commitments of the providers.

The legal basis is the performance of pre‑contractual measures or of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in efficient handling (Art. 6(1)(f) GDPR). No solely automated decision‑making within the meaning of Art. 22 GDPR takes place; the final substantive review and decision is always the responsibility of a lawyer.

For payment processing we use Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) as our payment service provider. Payment data (e.g. credit card number, expiry date, CVC) are transmitted exclusively via TLS encryption and are collected and processed directly by Stripe. We ourselves do not store complete payment card information.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Providing the payment data is necessary for concluding and performing the contract. Further information on data processing by Stripe is available at stripe.com/privacy. We retain transaction confirmations for up to 10 years in order to comply with tax and commercial retention obligations.

As part of the client relationship we process the customer and contract data provided by you (in particular name, address, contact details, boat data, uploaded documents and correspondence). The purpose is to provide the agreed legal services (including review of the Union goods status, issuance of the status document and – under our representation guarantee – out‑of‑court representation vis‑à‑vis customs authorities) as well as to comply with retention obligations and to defend legal claims.

The legal bases are Art. 6(1)(b) GDPR (contract / pre‑contractual measures) and Art. 6(1)(c) GDPR (legal obligations, in particular under the German Federal Lawyers' Act (BRAO), the Commercial Code (HGB) and the Fiscal Code (AO)).

When you instruct us, we transfer the data required for providing the service to the processors used (in particular hosting and cloud providers, Cloudflare as CDN, Stripe for payment processing and IT service providers). Data are not transferred to third parties beyond the purpose of the contract. Where processors are located within the EEA/EU, the transfer takes place under the GDPR. Services in third countries are only used if appropriate safeguards pursuant to Art. 44 et seq. GDPR – in particular EU standard contractual clauses – are in place.

Our website uses technically necessary cookies that are required for operation (e.g. to store your language preferences or to maintain a session during the application process). A cookie is a small text file stored by the browser on your device. Cookies are not used to run programs or to load malware onto your device. The legal basis for the use of technically necessary cookies is our legitimate interest in a functional and user‑friendly service (Art. 6(1)(f) GDPR) and – where necessary for the application process – the performance of a contract (Art. 6(1)(b) GDPR).

In addition, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to statistically measure and evaluate the use of our website. Google Analytics uses cookies and similar technologies to record the frequency of use, the pages accessed and the origin of visitors (e.g. via UTM parameters) in pseudonymised form. The information generated by the cookie about your use of this website is usually transmitted to and stored on a Google server. Your IP address is shortened (anonymised) by Google before it is linked with the website data. The transmitted data is used by Google to compile reports on website activity for us and to provide other services related to the use of the website.

The legal basis for the use of Google Analytics and for storing or reading the required information on your device is solely your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). Google Analytics is only loaded after you have explicitly agreed in the cookie banner; without consent, no analytics cookies are set and no data is transmitted to Google. Your decision is stored locally in your browser (storage key "cookie-consent") and you can withdraw it at any time with effect for the future in the "Cookie settings & consent" section at the end of this page. Insofar as data are transferred to the USA, we rely on the European Commission's adequacy decision (EU‑US Data Privacy Framework) and, in addition, on EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR. We have concluded a data processing agreement with Google (Art. 28 GDPR).

You can prevent tracking by Google Analytics by disabling JavaScript in your browser or by installing a browser add‑on that prevents the execution of analytics code. Google also offers a browser add‑on to disable Google Analytics, which you can download from https://tools.google.com/dlpage/gaoptout. Further information on data processing by Google can be found in Google's privacy policy at https://policies.google.com/privacy.

As a rule, we only disclose the data we have collected if:

• the disclosure is necessary under Art. 6(1)(f) GDPR for the establishment, exercise or defence of legal claims and no overriding legitimate interest of yours prevents it,
• we are legally obliged to disclose the data under Art. 6(1)(c) GDPR (e.g. to customs or tax authorities),
• the disclosure is necessary under Art. 6(1)(b) GDPR for initiating or performing a contractual relationship with you, or
• you have expressly consented to the disclosure (Art. 6(1)(a) GDPR).

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. In detail, the following applies:

• Application data and documents submitted as part of the application (including the related correspondence and the issued status document) are stored for a period of 10 years. This period is based on the professional, commercial and tax retention obligations (in particular § 50 BRAO, § 257 HGB, § 147 AO) and at the same time ensures that we can provide you with the status document again if required (e.g. in the event of subsequent checks by customs authorities).
• Server log files are anonymised or deleted after 7 days at the latest.
• Payment and invoicing data are retained for up to 10 years in order to comply with tax and commercial retention obligations.
• Other communication (e.g. informal enquiries without a mandate relation) is deleted as soon as it is no longer required to answer your enquiry and no statutory retention obligations prevent deletion.

All data transmitted between your device and our website is transmitted exclusively in encrypted form using state‑of‑the‑art encryption protocols (TLS/SSL). You can recognise this, among other things, by the padlock symbol in your browser bar and by the “https://” in the address bar. We also take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against accidental or intentional manipulation, loss, destruction, unauthorised access, alteration or disclosure. Our security measures are continuously adapted in line with technological developments.

You have the following rights against us with regard to the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR), in particular against processing based on Art. 6(1)(f) GDPR
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). The authority responsible for us is the Independent State Centre for Data Protection Schleswig‑Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to reflect changes to our services. The current version is always available on this page.

Last updated: August 2026.