Instagram Linkedin
Log in
Take The Free Test
Book A Free Consultation

Privacy Policy

Privacy Policy

1. Controller and contact

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

VISALABS – Daniel Dirmeier, Attorney at Law (Rechtsanwalt), sole proprietor Sportplatzstraße 12 92421 Schwandorf Germany

Email: info@visalabs.de Phone: +49 152 2800 4682

We have not appointed a data protection officer, as the legal requirements for doing so are not met. If you have any questions about data protection, please contact us at the address above.

This English version is provided for convenience. In the event of any discrepancy, the German version prevails.

2. General information

Personal data is any information relating to an identified or identifiable person. We process it only to the extent necessary to operate this website, respond to your enquiries or provide our legal services.

Legal bases. We base our processing on:

  • Art. 6(1)(a) GDPR – your consent
  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual steps, such as preparing a client engagement
  • Art. 6(1)(c) GDPR – legal obligations, such as tax and professional record-keeping requirements
  • Art. 6(1)(f) GDPR – legitimate interests, such as the secure and efficient operation of this website

Where you share special categories of personal data with us in the course of a client matter (e.g. information on health or religious beliefs), we process it under Art. 9(2)(a) or (f) GDPR.

Storing and accessing information on your device is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Attorney confidentiality. As an attorney, the controller is bound by professional secrecy (Section 43a(2) of the German Federal Lawyers’ Act (BRAO), Section 203 of the German Criminal Code (StGB)). We treat all information that becomes known to us in the course of a client matter or its preparation as confidential. Service providers who may have access to such data are bound to confidentiality under Section 43e BRAO.

Security. This website uses a TLS-encrypted connection. You can recognise it by the padlock icon and “https://” in your browser’s address bar.

3. Hosting and server log files

This website is hosted by Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. We have concluded a data processing agreement with Strato under Art. 28 GDPR.

When you visit this website, the following data is automatically recorded in server log files: IP address, date and time of access, page requested, referrer URL, browser type and version, and operating system.

This processing serves to deliver the website, keep it stable and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after no more than 14 days unless they are needed to investigate a security incident.

To speed up loading times, we store pages in a cache on our own server. No personal data is transferred to third parties in this process.

We use technically necessary cookies without which the shopping cart, customer account, language selection and security features would not work. The legal basis is Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(b) or (f) GDPR.

All other services that set cookies or transfer data to third parties are loaded only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

To manage your consent, we use Real Cookie Banner (devowl.io GmbH, Tannet 12, 94539 Grafling, Germany). The plugin runs entirely on our own server; no data is transferred to the manufacturer. It stores a random ID and your choices in a cookie. To document your consent, we log its content, the time it was given, your shortened IP address and your browser type on our server (Art. 6(1)(c) GDPR). The cookie is valid for up to 12 months.

You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link at the bottom of each page.

5. Free self-assessment test

Our self-assessment test lets you check, free of charge and without obligation, which residence title or whether naturalisation may be an option for you.

We process your answers to the test questions (e.g. length of stay, qualifications, language skills), your email address and, if you provide them, your name and phone number.

We send your result to you by email. With your consent, we will contact you about your result. The legal basis is Art. 6(1)(a) and (b) GDPR (pre-contractual steps).

To protect against automated submissions (spam), we briefly process your IP address and use a technical security token. The legal basis is Art. 6(1)(f) GDPR. The IP address is deleted after no more than 24 hours.

The test result is an automated, non-binding initial assessment. It has no legal effect and is not an automated decision within the meaning of Art. 22 GDPR. We delete test data after 12 months unless it leads to a client engagement.

6. Free initial consultation – appointment booking

To book a free initial consultation, we redirect you to the appointment booking page of Google Calendar, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

There you enter your name, email address and, where applicable, your phone number and a short description of your matter. Google also processes technical data such as your IP address. The appointment is saved in our calendar and you receive a confirmation by email.

The legal basis is Art. 6(1)(b) GDPR. We have concluded a data processing agreement with Google. Data may be transferred to the USA; such transfers are based on the EU-US Data Privacy Framework, under which Google is certified.

Please share only the information that is strictly necessary when booking. We will discuss the details of your case during the call. Further information: Google Privacy Policy.

7. Contact by email and phone

If you contact us by email or phone, we process the information you provide (name, contact details, content of your message) to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for general enquiries.

For emails, including automated emails sent by this website (e.g. order and test result emails), we use Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have concluded a data processing agreement with Google. Transfers to the USA are based on the EU-US Data Privacy Framework.

Emails are generally encrypted in transit, but not end-to-end. For particularly confidential documents, please use our upload portal (Section 9).

8. Customer account, booking and payment

Customer account. You can create a customer account. We process your name, email address, password (stored in encrypted form) and billing address. You can have your account deleted at any time; statutory retention obligations remain unaffected. The legal basis is Art. 6(1)(b) GDPR.

Booking. When you book a service, we process your order data: name, address, email address, phone number, service booked, price and payment method. This data is used to perform the contract and issue invoices (Art. 6(1)(b) and (c) GDPR).

Payment. Payments are processed by Stripe – Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (Privacy Policy). Your payment details (e.g. card number) are processed directly by Stripe; we only receive confirmation of payment.

The legal basis is Art. 6(1)(b) GDPR. Stripe acts as an independent controller for fraud prevention. Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses.

9. Client matters and document upload

In the course of a client engagement, we process the data required for your proceedings. This includes in particular identity and passport data, information on residence status, place of residence, family, education, employment, income, language skills and pension insurance, as well as correspondence with authorities.

Where necessary for the proceedings, we transfer this data to the competent immigration or naturalisation authority, to courts and to other parties involved. The legal basis is Art. 6(1)(b) and (c) GDPR and, for special categories of data, Art. 9(2)(f) GDPR.

You can upload documents via our upload portal. The transfer is encrypted and access is restricted to the persons handling your matter. The portal is provided by [ENTER PROVIDER]; we have concluded a data processing agreement with this provider.

10. Google reviews (Trustindex)

On our website we display reviews from our Google Business Profile using the Trustindex widget (Trustindex.io Kft., Hungary).

When the widget loads, content is retrieved from servers operated by Trustindex and Google (reviewers’ profile pictures). In the process, your IP address is transmitted to these providers. Google may transfer data to the USA; such transfers are based on the EU-US Data Privacy Framework.

The widget is loaded only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Further information: Trustindex Privacy Policy.

Fonts. The fonts used on this website are stored locally on our server. No connection to Google or other font providers is established when you visit the site.

Social media. Our website links to our profiles on Instagram and LinkedIn. These are simple links, not embedded plugins. Data is transferred only when you click a link and visit the respective platform, where the privacy policy of that provider applies (Meta Platforms Ireland Ltd. or LinkedIn Ireland Unlimited Company).

12. Recipients, international transfers and retention

Recipients. We share personal data only as described in this policy, where required to handle a client matter, or where required by law. Recipients may include in particular authorities and courts, our hosting provider, IT and communication service providers, payment providers and our tax advisers.

International transfers. Some service providers are based in the USA or process data there. Transfers take place only if the recipient is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR) or standard contractual clauses under Art. 46(2)(c) GDPR have been agreed.

Retention. We delete data once its purpose no longer applies and no retention obligation prevents deletion.

Data

Retention period

Server log files

up to 14 days

Self-assessment test without engagement

12 months

Enquiries without engagement

12 months after the enquiry is closed

Client files

6 years after the end of the engagement (Section 50 BRAO)

Business correspondence

6 years (Section 257 German Commercial Code (HGB), Section 147 German Fiscal Code (AO))

Invoices and accounting records

8 years (Section 147 AO)

Customer account

until you delete it

13. Your rights

You have the following rights regarding your personal data:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interests, you may object to this processing at any time on grounds relating to your particular situation.

The right of access may be restricted where information is subject to attorney confidentiality (Section 29(1) German Federal Data Protection Act (BDSG)). To exercise your rights, an email to info@visalabs.de is sufficient.

Right to lodge a complaint. You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Last updated: 13 October 2026. We will update this privacy policy whenever our data processing or the legal situation changes.