4.1 Purpose of processing We process personal data for various processing purposes, depending on whether you are in contact with us as a client, supplier, interested party, employee, service provider, specialist or applicant, or working with us. Users' personal data is usually collected directly by SBA when using the website or using our service and client relationship. However, personal data can also be collected indirectly, such as in the case of correspondence with third parties (e.g. counterparties, authorities, courts, etc.) or by further obtaining additional information from publicly available third-party data sources (e.g. social media, creditworthiness checks, etc.). In particular, SBA processes personal data for the following purposes: - initiation, conclusion and fulfilment of contractual obligations, in particular in the context of providing legal services, but also to other contractual partners (e.g. suppliers, service providers); - contacting and communicating with clients and third parties, as well as processing inquiries (e.g. for applications and media inquiries); review and implementation of application processes; - use of services provided by assistants (in particular consulted law firms and experts in Germany and abroad); - compliance with legal and regulatory obligations, in particular obligations to comply with regulatory obligations applicable to lawyers; - provision of the website offering, including using cookies from other technologies to ensure the functionality of the website and improve our website offering; - ensuring our operations, in particular IT, our websites and other platforms, as well as measures for IT, building and plant security and protecting our employees and other people and values entrusted to us; - advertising and marketing, preparation, implementation and follow-up of events and events; - prevention and investigation of crimes and other misconduct; - enforcement and defense of claims, defense of legal claims, legal disputes, lawsuits, combating abusive conduct; - sound corporate governance and development; - company activities in accordance with the articles of association, activities that lie within the scope of fulfilling our corporate purpose; - other purposes such as training and education purposes, administrative purposes;4.2 Categories of recipients We indicate the category of recipients to whom personal data may be disclosed depending on the respective activity. These are: - Web hosting providers, webmasters, IT service providers (if used), social media services (if used), as well as content management system providers - Other third parties who provide services and services - Public and judicial authorities, auditors, regulators, law enforcement agencies, or government agencies (as required or required by laws, regulations, as part of a code of conduct, or by these authorities or bodies) - Counterparties, as well as their legal representatives and other persons involved (guarantors, financiers, respondents, experts, etc.) in actual or potential proceedings - Trustees, service providers to fulfill legal or tax obligations - insurance companies and banks - acquirers or interested parties to acquire divisions, companies or other parts of SBA.4.3 Data transmission and transfer In particular, in all countries in which SBA is represented by group companies, subsidiaries or other branches and representatives, as well as in countries in which SBA service providers process their data, data processing may take place by or as a result of SBA's activity. If data is transferred to countries that do not guarantee adequate protection, SBA ensures adequate protection of the disclosed data. The following applies to the disclosure of personal data abroad: EU countries: adequate level of data protection. USA: The USA does not currently guarantee an adequate level of data protection. The European Commission has decided that the USA ensures an adequate level of protection for personal data (hereinafter “adequacy decision”). However, the Swiss Federal Council has not yet passed such a resolution, so that there is currently no adequacy decision within the meaning of the DSG (as of 08/2023). To ensure appropriate data protection, we generally base data transmission on guarantees (standard data protection clauses in accordance with Art. 16 para. 2 lit. d DSG) or exceptions (express consent of the data subject in accordance with Art. 17 para. 1 lit. a DSG or the disclosure is directly related to the conclusion or execution of a contract between the person responsible and the data subjects in accordance with Art. 17 para. 1 lit. b point 1 DSG). We reserve the right to make the transfer on the basis of an exception in accordance with Art. 17 para. 1 lit. b point 2 DSG or Art. 17 para. 1 lit. d-f DSG.