Lawyer for start-ups – IT contracts, trade marks & GDPR

Which legal building blocks digital start-ups really need before launch and growth

Quick start: what is your matter about?

Your contact: Jean Paul P. Bohne, LL.M., MM

Partner, certified specialist lawyer for copyright and media law and for IT law (Fachanwalt für Urheber- und Medienrecht, Fachanwalt für IT-Recht).

Send start-up enquiry

What happens after your enquiry?

After your enquiry, we will get back to you within 24 hours on working days. The first contact is free of charge. You will receive an explicit notice before any costs arise.

1. A short description is enough. Describe your business model, phase and planned launch. Pitch, contracts and trade mark ideas are helpful.
2. Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
3. Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.

Typical cases from our practice

The following scenarios are abstracted and simplified. Which solution holds up always depends on the specific facts and the contractual situation.

What you will have at the end

In which situations start-up advice makes particular economic sense

What matters is rarely a single law. What matters are the moments when product, trade mark, data, external contributors and sales are all in motion at the same time.

Name, trade mark and public launch

You want to become visible with a new name, an app, a platform or a software product. Then trade mark law, trade mark registration, domain law and, for distinctive interfaces, design law should be considered together before the first major boost in visibility.

External developers, agencies and freelancers

The product is technically ready, but source code, designs, texts or documentation are only partly allocated by contract. Then IT contracts, copyright law and, for confidential projects, the non-disclosure agreement become business-critical.

Website, software as a service and platform operation

Before go-live, general terms and conditions (AGB), terms of use, service descriptions, liability logic and the external data protection side must work together properly. This applies to classic websites as well as software as a service, apps, creator models and marketplaces.

Investor review, enterprise deal and growth

As soon as investors, strategic partners or larger customers carry out reviews, the chain of title, contracts, security organisation, data processing, open source software and access structures become visible. This is precisely when it becomes clear whether founding momentum has already been translated into a robust legal structure.

Practical risk of the early phase

It rarely becomes expensive because of a single section of a law. It becomes expensive when product, trade mark, website, tracking, developer contracts and responsibilities stand side by side at different levels of maturity and must all be tightened up at the same time under time pressure.

Which legal building blocks should really be in place before the launch

Not every detail has to be finished before the first major roll-out. However, some building blocks should be robust, because otherwise they immediately set back sales, due diligence or later product decisions.

Signs, domain and market presence

Check early whether company name, product name, domain and visible design fit together. For in-depth questions, at ITMR the main next steps are trade mark law, registering a trade mark, domain law and design law. For a first basic orientation, the article What is a trade mark and what are its advantages? (in German) also helps.

Product contract, chain of title and exploitability

What matters are clear rules on scope of services, acceptance, changes, liability, support, exit and rights of use. At this level, IT law, IT contract / software contract, drafting terms and conditions (AGB) and, for content or code questions, copyright law are the main supports. For further reading, see Contract drafting in IT law (in German).

Data, data protection and new digital regulation

Anyone processing user, employee or business data needs a robust line on transparency, roles, legal bases, tracking, technical and organisational measures and service provider chains. Depending on the business model, the main areas here are data protection law, data law, artificial intelligence and cybersecurity.

Sales, claims and operational external communication

Growth often fails less because of the product than because of exaggerated statements, vague service promises or inconsistent documents. At this level, marketing law, product advertising, competition law and, for e-mail sequences, the Newsletter Marketing Check are the obvious next steps.

Official working aids for the first preliminary check

Helpful resources are the guidance of the Deutsches Patent- und Markenamt (German Patent and Trade Mark Office) on trade mark searches (opens in a new tab), the official information of the German Patent and Trade Mark Office on examination and registration (opens in a new tab), the search of the European Union Intellectual Property Office (opens in a new tab), the official text of the General Data Protection Regulation (opens in a new tab), Regulation (EU) 2024/1689 on artificial intelligence (opens in a new tab) and the Data Act (opens in a new tab).

What should be clarified first – depending on the start-up's phase

Not every question is equally urgent on day one. What matters is which risks are already business-critical at each stage and which points must necessarily be in place before visibility or negotiation.

For data- and AI-driven start-ups, the classic early-phase logic is often no longer sufficient

Anyone who works with user or business data, uses automated functions or builds on platform and cloud structures must organise roles, data flows, contract architecture and governance properly earlier than many founding teams expect. This is precisely why start-up advice should not stop at the privacy policy and terms and conditions here.

Which further topics at ITMR really take you further afterwards

A strong start-up page does not win by repeating every neighbouring area in full. What matters is that it opens the right follow-up page in the right problem context.

Name, product designation and protection strategy

When conflicts between signs, scope of protection, domains or distinctive interfaces become economically relevant, the way leads to trade mark law, registering a trade mark, domain law and design law.

Product contract, development and platform terms

For development projects, software as a service, licence chains, service specifications and operational documents, IT law, IT contract / software contract, drafting terms and conditions (AGB) and, for confidential projects, the non-disclosure agreement are the supports.

Data protection, tracking and data transparency

As soon as personal data, tracking, rights of access or data breaches are at issue, the further work should run via data protection law, data protection set-up and, for website front ends, via privacy policy and website review.

Data access, artificial intelligence and new product regulation

For data-based cooperations, connected products or artificial intelligence, data law, implementing the Data Act, artificial intelligence and, for governance questions, compliance take you further.

Open source software, enterprise review and technical supply chain

When third-party components, copyleft risks, licence terms or build processes requiring documentation become relevant, open source law and open source compliance belong in the preparation early on. Especially in due diligence and with larger customer contracts, this point often becomes relevant later than expected – and then all the more expensive.

Helpful articles for preparation

Anyone who wants to read up in advance will find solid follow-ups in What is a trade mark? (in German), Contract drafting in IT law (in German), ChatGPT and AI in companies (in German) and MG4 and open source (in German).

Which mistakes catch up with start-ups later in due diligence and negotiations

Many problems arise less often from a single legal mistake than from several small gaps that coincide at the wrong moment.

• The product name is used publicly before the trade mark situation, classes and domains have been seriously checked.
• External developers or agencies were paid, but the transfer of rights of use, source code, design files or documentation is not properly regulated.
• Terms and conditions, terms of use or data protection texts were copied from other business models and do not fit your own service.
• Tracking, newsletters, social media advertising and claims go live although data protection, competition law and operational approvals do not fit together.
• Open source software, third-party modules or external tools are used productively without seriously examining the licensing and documentation consequences.
• Domains, cloud access, repositories or administrator roles are in fact held by individuals or service providers rather than robustly by the company.
• The data room for investors or larger customers is only put together once the first critical query has already come in.

Particularly underestimated: registration does not replace a conflict check

Anyone who only registers a name but does not seriously check earlier rights shifts the risk into opposition, cancellation or forced rebranding. This is precisely why the trade mark question should be seriously clarified before public visibility and not only after the first campaigns.

How ITMR supports start-ups in practice

The right form of support depends less on company size than on pace, risk and team depth. For some cases, a focused early-phase check is enough; others need ongoing structural work.

Quick start before launch or investor meeting

If name, product, website, first contracts or a short-term investor meeting are coming up, a focused start via a start-up meeting (Start-up-Gespräch) or an initial consultation (Erstberatung) is often the most sensible first step.

Building up core documents robustly

If documents, chain of title and product logic are to be set up in a structured way, the concrete work streams usually run via IT contract / software contract, drafting terms and conditions (AGB), registering a trade mark and, for data-driven models, via data protection set-up.

Resolving special questions in a technically sound way

For open source software, artificial intelligence, data access, platform obligations or security questions, a precise in-depth review is often more important than a general full review. The main follow-ups here are open source compliance, artificial intelligence, data law and cybersecurity.

Ongoing support instead of repairs under time pressure

For recurring questions on contracts, data, marketing, intellectual property rights or compliance structures, an ongoing solution via the outsourced legal department or service packages is often more economical than a series of isolated individual mandates.

Jean Paul P. Bohne, LL.M., MM

IT law, trade mark law, copyright law, data protection, artificial intelligence

Particularly suitable when contracts, intellectual property rights, platform logic and data-driven product questions interlock.

Andreas Buchholz

IT law, data protection, e-commerce, litigation, start-ups

Particularly strong in product and contract logic, e-commerce structures and contentious negotiation or enforcement situations.

Dominik Skornia, LL.B.

Data protection law, IT law, data law

Particularly useful when data protection, data flows and digital contract or product questions come together in one mandate.

If the launch or review is already under way

Then what is usually needed is clear prioritisation rather than an abstract overall treatise: what must become robust immediately, what can go into the next sprint and which special subject matter must be examined in depth in a targeted way?

Continue to Close due diligence gaps before the next round and Check ongoing support for the start-up.

Key terms

Due diligence

Legal review by investors or buyers.

GDPR (DSGVO)

Datenschutz-Grundverordnung (General Data Protection Regulation, GDPR).

Chain of rights

Proof that rights of use lie fully with the company.

Rebranding

Forced change of name or trade mark.

These terms explain the language used on this page. What matters is always the specific individual case.

Provisions and reliable sources

The following statutory provisions and regulations are cited on this page.

Frequently asked questions about start-up advice

The following answers provide a sound framework for typical founder situations. What remains decisive, however, is always the business model, chain of title, data flow, product architecture and negotiating position.

Are you about to launch, sign a larger customer contract or undergo an investor review?

Then the next sensible step is usually clear prioritisation along the business model and the most visible risks rather than a blanket full review.

Continue to Discuss a specific case with ITMR and Sort out the early phase or an urgent case first.

Setting up your start-up on a sound legal footing