Privacy Policy

Last updated: November 2026

1. Controller
The controller for the processing of personal data on this website and in our practice is Hargrove Real Assets LLP, Hamburg office, Borselstraße 16, 22765 Hamburg, Germany, phone +49 (0)40 228 6611 40, email info@hargrove.eu.
We have not appointed a data protection officer because the statutory requirements are not met (Article 37 GDPR, section 38 BDSG). Please send any data protection questions to info@hargrove.eu.

2. Visiting this website
When you visit our website, our hosting provider [name, address; servers in Germany] automatically processes the data your browser sends: IP address, date and time, page requested, amount of data transferred, referring page, browser and operating system. We need this data to deliver the website and keep it secure (Article 6(1)(f) GDPR). Server log files are deleted after [seven] days unless needed to investigate a security incident. We have a data processing agreement with the hosting provider (Article 28 GDPR).

3. Cookies, fonts and links
We use only strictly necessary cookies, in particular a session cookie for the Client Login. These cookies are strictly necessary for the service you request (section 25(2) no. 2 TDDDG; Article 6(1)(b) and (f) GDPR). We use no analytics, marketing or tracking tools. Fonts and videos are loaded from our own server; visiting the website transmits no data to third parties. Our website contains a simple link to our LinkedIn company page. No data is sent to LinkedIn unless you click the link, in which case LinkedIn’s privacy policy applies.

4. Contacting us
If you contact us by email, phone or fax, we process the information you provide (name, contact details, content of your enquiry) to respond. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns an engagement, and otherwise Article 6(1)(f) GDPR. Please do not send us confidential information until we have confirmed that we can act for you.

5. Client Login
We provide a protected area for registered clients. For this we process your access data (name, email address, password stored in encrypted form), log-in times and the documents provided there (Article 6(1)(b) GDPR). We delete the access data when access ends.

6. Client engagements
In the course of an engagement we process personal data of our clients, their representatives and third parties (such as counterparties, authorities and other advisers) to the extent necessary: for conflict checks, identification under the German Anti-Money Laundering Act (GwG), conducting the engagement, and billing and accounting. The legal bases are Article 6(1)(b) GDPR (engagement contract), Article 6(1)(c) GDPR (legal obligations, in particular under the BRAO, GwG, HGB and AO) and Article 6(1)(f) GDPR (legitimate interests, for example for third-party data). We process special categories of personal data only where necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR). All client data is subject to lawyers’ professional secrecy (section 43a(2) BRAO, section 203 StGB). We do not separately inform individuals whose data we receive from third parties in the course of an engagement where the data is subject to professional secrecy (Article 14(5)(d) GDPR).

7. Applications
We process application documents to conduct the recruitment process (Article 6(1)(b) GDPR). Once the process ends, we delete them after six months unless you have consented to longer storage (Article 6(1)(a) GDPR) or you are employed. We keep them for six months to defend any claims under the German General Equal Treatment Act (Article 6(1)(f) GDPR).

8. Email updates and the German Infrastructure Bulletin
We occasionally send clients and contacts information on legal developments and our German Infrastructure Bulletin, based on your consent (Article 6(1)(a) GDPR) or, for existing clients and where the law permits, our legitimate interest in informing you about related topics (Article 6(1)(f) GDPR, section 7(3) UWG). You can object or withdraw your consent at any time, for example by email to info@hargrove.eu. We do not track opens or clicks.

9. Recipients and processors
We disclose personal data only where necessary for the purposes above or required by law, for example to courts, authorities, counterparties and their advisers, to law firms abroad instructed with your agreement, and to our tax advisers and auditors. We use technical service providers (for example for hosting, IT support and Microsoft 365) as processors (Article 28 GDPR); they are bound to confidentiality (section 43e BRAO). We do not sell personal data.

10. Transfers outside the EEA
We transfer personal data outside the European Economic Area only where necessary for an engagement, for example a cross-border transaction (Article 49(1)(b), (c) or (e) GDPR), on the basis of an adequacy decision of the European Commission (Article 45 GDPR), or subject to appropriate safeguards such as standard contractual clauses (Article 46 GDPR).

11. Retention
We keep personal data only as long as needed for the relevant purpose. We keep client files for six years after the end of the calendar year in which the engagement ends (section 50 BRAO), anti-money-laundering records for five years after the business relationship ends (section 8(4) GwG) and records relevant for tax and commercial law for up to ten years (section 147 AO, section 257 HGB).

12. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR) and data portability (Article 20 GDPR). You may withdraw consent at any time with effect for the future (Article 7(3) GDPR).
Right to object: where we process data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Article 21 GDPR). You may object to the use of your data for direct marketing at any time without giving reasons. The right of access does not apply where information is subject to lawyers’ professional secrecy (section 29(1) sentence 2 BDSG). You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR), for example the authority responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, mailbox@datenschutz.hamburg.de.

13. No automated decision-making
We do not make decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

14. Changes
We update this policy when our processing or the law changes. The version published here applies.
In the event of any discrepancy, the German version prevails.