Privacy notice for the client portal
This is a reading translation. The German version is authoritative. Read the German version
Production operation: This portal accepts real enquiries. Submit documents only through the protected document upload in your account; never send passwords or bank login details here.
1. Controller
Vladislav Klokke
Migrationsberatung V.K.
164er Ring 35, 31785 Hameln, Germany
Telephone: 0152 56155460
Email: kontakt@migrationsberatung-vk.de
2. Purpose and scope
The portal is used for structured initial enquiries, email verification, password-protected access and transparent case handling. Depending on the matter, it processes in particular name, email address, language, case details, voluntary profile details, answers, tasks, released messages, explicitly selected services, document metadata, uploaded documents, and technically necessary security and access logs.
3. Legal bases
Pre-contractual enquiries and the performance of commissioned services are generally based on Article 6(1)(b) GDPR. Legal obligations are based on Article 6(1)(c) GDPR. Secure, stable operation of the portal and protection against misuse are based on Article 6(1)(f) GDPR. If a voluntarily uploaded document contains special categories of personal data, separate explicit consent under Article 9(2)(a) GDPR is obtained before transmission. Consent may be withdrawn at any time with effect for the future.
4. Recipients and operation
The public intake layer is operated on an IONOS VPS in the EU data-centre code fr/nbz in France. The agreement on processing under Article 28 GDPR with IONOS is documented in the operator's records. Local security checks, internal case handling and private document decryption take place on our own hardware. This version of the portal does not transmit data to external AI services.
5. Security measures
The connection is protected by TLS. Sensitive text fields in the portal database are encrypted by the application with AES-256-GCM; search functions use separately derived blind indexes. Documents are encrypted with a separate key and stored in quarantine before storage. The private document key stays on our own hardware. Access is restricted and security-relevant events are logged. These measures reduce risks if storage media or backups are lost; technical measures cannot completely rule out access if a running server is fully compromised.
6. Cookies and logs
The portal uses only technically necessary session and CSRF-protection cookies. Advertising or analytics cookies are not used. The upstream web server logs technically necessary connection data for operation and attack detection. Request paths, cookie values and authorization values are removed from the access log. Rotated access logs are currently kept for no more than seven days unless a security incident requires separate investigation.
7. Retention
Unconfirmed initial enquiries are scheduled for deletion after seven days. Sessions expire after eight hours. One-time codes and technical blocking data are stored only as long as necessary for access and protection against misuse. Active case and order data are retained only as long as processing, outstanding claims or legal duties require. After closure or prolonged inactivity, a documented deletion review takes place. Invoices and business records subject to statutory retention are handled separately. Backups are overwritten according to their scheduled rotation cycle.
8. Your rights
Subject to the legal conditions, you have rights of access, rectification, erasure, restriction, data portability and objection. Consent can be withdrawn for the future. In the portal you can submit requests for access, export and other privacy matters; alternatively, you can email the address above. You have the right to lodge a complaint with a data-protection supervisory authority. In particular, the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, is competent.
9. No solely automated external decision
There is no decision based solely on automated processing with legal or similarly significant effects. In this version, no letter, email, application or declaration is sent to an authority or another external recipient without the required human approval step.
10. Changes
The version displayed for each transaction is logged. Material changes are shown again before any further sensitive transmission. Dated 24 August 2026.