1. What is this privacy policy about?

The Heller Recht­san­walts AG (here­inafter also «we», «us») obtains and process­es per­son­al data relat­ing to you or also to oth­er per­sons (so-called «third par­ties»). We use the term «data» here syn­ony­mous­ly with «per­son­al data». Per­son­al data means data relat­ing to spe­cif­ic or iden­ti­fi­able per­sons (i.e. con­clu­sions about their iden­ti­ty are pos­si­ble on the basis of the data itself or with cor­re­spond­ing addi­tion­al data). «Pro­cess­ing» means any han­dling of per­son­al data, e.g. obtain­ing, stor­ing, using, adapt­ing, dis­clos­ing and deleting.

In this pri­va­cy pol­i­cy we describe what we do with your data when you vis­it our web­site www.rechtsanwalt-zuerich.ch (the «Web­site»), obtain our ser­vices or prod­ucts, oth­er­wise inter­act with us under a con­tract, com­mu­ni­cate with us or oth­er­wise deal with us. Where appro­pri­ate, we will inform you of addi­tion­al pro­cess­ing activ­i­ties not men­tioned in this pri­va­cy policy.

If you trans­mit or dis­close data about oth­er per­sons such as fam­i­ly mem­bers, work col­leagues, etc., we assume that you are autho­rised to do so and that this data is cor­rect. By sub­mit­ting data about third par­ties, you con­firm this. Please also ensure that these third par­ties are informed about this pri­va­cy pol­i­cy.
This pri­va­cy pol­i­cy is designed to meet the require­ments of the EU Gen­er­al Data Pro­tec­tion Reg­u­la­tion («GDPR»), the Swiss Data Pro­tec­tion Act («DPA») and the revised Swiss Data Pro­tec­tion Act («revDSG»). How­ev­er, whether and to what extent these laws are applic­a­ble depends on the indi­vid­ual case.

2. Who is responsible for processing your data?

Respon­si­ble for the data pro­cess­ing described in this pri­va­cy pol­i­cy is:

Heller Recht­san­walts AG
Dr Heinz Heller
Orchard road 7
PO Box 1503
8021 Zurich
info@rechtsanwalt-zuerich.ch

If you have any ques­tions about this pri­va­cy pol­i­cy or oth­er data pro­tec­tion con­cerns and/or wish to exer­cise your rights under para. 9, you can con­tact us at the above address.

3. What data do we process?

We process dif­fer­ent cat­e­gories of data about you. The main cat­e­gories are as follows:

• Tech­ni­cal data: When you use our web­site, we col­lect the IP address of your ter­mi­nal device and oth­er tech­ni­cal data to ensure the func­tion­al­i­ty and secu­ri­ty of this offer. This data also includes logs record­ing the use of our sys­tems. We gen­er­al­ly retain tech­ni­cal data for 24 months. In order to ensure the func­tion­al­i­ty of these offers, we may also assign an indi­vid­ual code to you or your end device (e.g. in the form of a cook­ie, see para. 10). The tech­ni­cal data in itself does not allow any con­clu­sions to be drawn about your iden­ti­ty. How­ev­er, in the con­text of user accounts, reg­is­tra­tions, access con­trols or the pro­cess­ing of con­tracts, they can be linked to oth­er data cat­e­gories (and thus pos­si­bly to your person).
• Com­mu­ni­ca­tion data: If you are in con­tact with us by email, tele­phone, let­ter or oth­er means of com­mu­ni­ca­tion, we col­lect the data exchanged between you and us, includ­ing your con­tact details and the bound­ary data of the com­mu­ni­ca­tion. If we want or need to estab­lish your iden­ti­ty, we col­lect data to iden­ti­fy you (e.g. a copy of an iden­ti­ty doc­u­ment). We usu­al­ly keep this data for 24 months from the last exchange with you. This peri­od may be longer where this is nec­es­sary for rea­sons of proof or to com­ply with legal or con­trac­tu­al require­ments, or for tech­ni­cal rea­sons. E‑mails in per­son­al mail­box­es and writ­ten cor­re­spon­dence are gen­er­al­ly kept for at least 10 years.
• Con­tract data: This is data that aris­es in con­nec­tion with the con­clu­sion or exe­cu­tion of a con­tract, e.g. infor­ma­tion about con­tracts and the ser­vices to be pro­vid­ed or pro­vid­ed, as well as data from the run-up to the con­clu­sion of a con­tract, the infor­ma­tion required or used for the exe­cu­tion and infor­ma­tion about reac­tions. We gen­er­al­ly col­lect this data from you, from con­trac­tu­al part­ners and from third par­ties involved in the pro­cess­ing of the con­tract, but also from third par­ty sources (e.g. providers of cred­it­wor­thi­ness data) and from pub­licly acces­si­ble sources. We gen­er­al­ly keep this data for 10 years from the last con­trac­tu­al activ­i­ty, but at least from the end of the con­tract. This peri­od may be longer if this is nec­es­sary for rea­sons of evi­dence or to com­ply with legal or con­trac­tu­al require­ments or for tech­ni­cal reasons.

Many of the mea­sures described in this para. 3 you dis­close to us your­self (e.g. in the course of com­mu­ni­ca­tion with us, in con­nec­tion with con­tracts, when using the web­site, etc.). You are not oblig­ed to do so, sub­ject to indi­vid­ual cas­es, e.g. in the con­text of bind­ing pro­tec­tion con­cepts (legal oblig­a­tions). If you wish to con­clude con­tracts with us or claim ser­vices, you must also pro­vide us with data, in par­tic­u­lar mas­ter data, con­tract data and reg­is­tra­tion data, as part of your con­trac­tu­al oblig­a­tion under the rel­e­vant con­tract. When using our web­site, the pro­cess­ing of tech­ni­cal data is unavoid­able. If you wish to gain access to cer­tain sys­tems, you must pro­vide us with reg­is­tra­tion data.

4. For what purposes do we process your data?

First and fore­most, we process your data in con­nec­tion with the pro­vi­sion of our ser­vices, com­mu­ni­ca­tion with you and the con­clu­sion, admin­is­tra­tion and pro­cess­ing of con­trac­tu­al rela­tion­ships with our cus­tomers and oth­er busi­ness part­ners as well as the oper­a­tion of our web­site. We then process your data for mar­ket­ing pur­pos­es and to main­tain rela­tion­ships, e.g. to send our cus­tomers and oth­er con­trac­tu­al part­ners per­son­alised adver­tis­ing about our prod­ucts and ser­vices. This may take the form of newslet­ters and oth­er reg­u­lar con­tacts (elec­tron­i­cal­ly, by post, by tele­phone), via oth­er chan­nels for which we have con­tact infor­ma­tion from you, but also as part of indi­vid­ual mar­ket­ing cam­paigns (e.g. events etc.) and may also include free ser­vices (e.g. invi­ta­tions etc.). You can refuse such con­tacts at any time (see at the end of this para. 4) or refuse or revoke your con­sent to be con­tact­ed for adver­tis­ing purposes.

We may also process your data for oth­er pur­pos­es inso­far as this is per­mit­ted by law and we have a legit­i­mate inter­est in the cor­re­spond­ing data pro­cess­ing (e.g. mar­ket and opin­ion research, offer­ing and fur­ther devel­op­ing our ser­vices, guar­an­tee­ing our oper­a­tion, in par­tic­u­lar of the IT and our web­site, and assert­ing legal claims).

We may use cer­tain of your per­son­al attrib­ut­es for the pur­pos­es set out in this para. 4, if we want to deter­mine pref­er­ence data, but also to deter­mine abuse and secu­ri­ty risks, to car­ry out sta­tis­ti­cal eval­u­a­tions or for oper­a­tional plan­ning pur­pos­es. For the same pur­pos­es, we can also cre­ate pro­files, i.e. we can com­bine behav­iour­al and pref­er­ence data, but also mas­ter and con­tract data and tech­ni­cal data assigned to you, in order to bet­ter under­stand you as a per­son with your dif­fer­ent inter­ests and oth­er characteristics.

In both cas­es, we pay atten­tion to the pro­por­tion­al­i­ty and reli­a­bil­i­ty of the results and take mea­sures against mis­use of these pro­files or pro­fil­ing. If these can have legal effects or sig­nif­i­cant dis­ad­van­tages for you, we gen­er­al­ly pro­vide for a man­u­al review.

5. On what basis do we process your data?

Inso­far as you have giv­en us con­sent to process your data for cer­tain pur­pos­es (e.g. reg­is­tra­tion to receive newslet­ters or con­sent to oth­er reg­u­lar con­tacts, con­sent to auto­mat­ed data pro­cess­ing, where applic­a­ble), we process your data with­in the scope of and based on this con­sent, inso­far as we have no oth­er legal basis and we require such a basis. Con­sent that has been giv­en can be revoked at any time, but this has no effect on data pro­cess­ing that has already tak­en place (see also para. 9).

Where we do not ask for your con­sent to process your per­son­al data, we base the pro­cess­ing of your per­son­al data on the fact that the pro­cess­ing is nec­es­sary for the ini­ti­a­tion or per­for­mance of a con­tract with you (or the enti­ty you rep­re­sent) or that we or third par­ties have a legit­i­mate inter­est in doing so, in par­tic­u­lar in order to ful­fil the oblig­a­tions set out in para. 4 above and relat­ed objec­tives described above and to be able to take appro­pri­ate action. Our legit­i­mate inter­ests also include com­pli­ance with legal reg­u­la­tions, inso­far as this is not already recog­nised as a legal basis by the respec­tive applic­a­ble data pro­tec­tion law (e.g. in the case of the GDPR, the law in the EEA and in Switzer­land). How­ev­er, this also includes the mar­ket­ing of our prod­ucts and ser­vices, the inter­est in bet­ter under­stand­ing our mar­kets and in man­ag­ing and fur­ther devel­op­ing our com­pa­ny, includ­ing oper­a­tions, safe­ly and efficiently.

6. Who do we disclose your data to?

In con­nec­tion with our con­tracts, the web­site, our ser­vices and prod­ucts, our legal oblig­a­tions or oth­er­wise in order to pro­tect our legit­i­mate inter­ests and the oth­er inter­ests set out in para. 4. we also trans­fer your per­son­al data to third par­ties, in par­tic­u­lar to the fol­low­ing cat­e­gories of recipients:

• Ser­vice providers: We work with ser­vice providers in Switzer­land and abroad who process data about you on our behalf or in joint respon­si­bil­i­ty with us or who receive data about you from us in their own respon­si­bil­i­ty (see para. 10).
• Con­trac­tu­al part­ners includ­ing cus­tomers: This ini­tial­ly refers to cus­tomers and oth­er con­trac­tu­al part­ners of ours, because this data trans­fer results from these con­tracts. For exam­ple, they receive reg­is­tra­tion data on issued and redeemed vouch­ers, invi­ta­tions, etc. If you work for such a con­trac­tu­al part­ner your­self, we may also trans­fer data about you to them in this con­text. The recip­i­ents also include con­trac­tu­al part­ners with whom we cooperate.
• Author­i­ties: We may pass on per­son­al data to offices, courts and oth­er author­i­ties in Switzer­land and abroad if we are legal­ly oblig­ed or enti­tled to do so or if this appears nec­es­sary to pro­tect our inter­ests. The author­i­ties process data about you that they receive from us on their own responsibility.
• Oth­er per­sons: This refers to oth­er cas­es where the inclu­sion of third par­ties aris­es from the pur­pos­es pur­suant to para. 4 results.

All these cat­e­gories of recip­i­ents may in turn involve third par­ties, so that your data may also become acces­si­ble to them. We can restrict pro­cess­ing by cer­tain third par­ties (e.g. IT providers), but not by oth­er third par­ties (e.g. author­i­ties, banks, etc.).

7. How long do we process your data?

We process your data for as long as our pro­cess­ing pur­pos­es, the statu­to­ry reten­tion peri­ods and our legit­i­mate inter­ests in pro­cess­ing for doc­u­men­ta­tion and evi­dence pur­pos­es or prac­ti­cal rea­sons require or stor­age is tech­ni­cal­ly nec­es­sary. Fur­ther infor­ma­tion on the respec­tive stor­age and pro­cess­ing dura­tion can be found under the indi­vid­ual data cat­e­gories in para. 3 or for the cook­ie cat­e­gories in para. 10. If there are no legal or con­trac­tu­al oblig­a­tions to the con­trary, we will delete or anonymise your data after the stor­age or pro­cess­ing peri­od has expired as part of our nor­mal processes.

Doc­u­men­ta­tion and evi­dence pur­pos­es include our inter­est in doc­u­ment­ing process­es, inter­ac­tions and oth­er facts in case of legal claims, dis­crep­an­cies, IT and infra­struc­ture secu­ri­ty pur­pos­es and evi­dence of good cor­po­rate gov­er­nance and com­pli­ance. Reten­tion may be tech­ni­cal­ly nec­es­sary if cer­tain data can­not be sep­a­rat­ed from oth­er data and we there­fore need to retain it with them (e.g. in the case of back­ups or doc­u­ment man­age­ment systems).

8. How do we protect your data?

We take appro­pri­ate tech­ni­cal and organ­i­sa­tion­al secu­ri­ty mea­sures to main­tain the con­fi­den­tial­i­ty, integri­ty and avail­abil­i­ty of your data, to pro­tect it against unau­tho­rised or unlaw­ful pro­cess­ing and to pro­tect against the risks of loss, acci­den­tal alter­ation, unau­tho­rised dis­clo­sure or access.

9. What rights do you have?

Applic­a­ble data pro­tec­tion law grants you the right to object to or request restric­tion of the pro­cess­ing of your data in cer­tain cir­cum­stances, in par­tic­u­lar that for direct mar­ket­ing pur­pos­es, direct mar­ket­ing pro­fil­ing and oth­er legit­i­mate pro­cess­ing inter­ests.
To help you con­trol the pro­cess­ing of your per­son­al data, you also have the fol­low­ing rights in con­nec­tion with our data pro­cess­ing, depend­ing on the applic­a­ble data pro­tec­tion law:

• The right to request infor­ma­tion from us as to whether and what data we process from you
• The right to have us cor­rect data if it is inaccurate
• The right to request the dele­tion of data
• The right to request that we pro­vide cer­tain per­son­al data in a com­mon­ly used elec­tron­ic for­mat or trans­fer it to anoth­er controller
• The right to with­draw con­sent inso­far as our pro­cess­ing is based on your consent
• The right to obtain, on request, fur­ther infor­ma­tion nec­es­sary for the exer­cise of these rights

If you wish to exer­cise any of the above rights against us, please con­tact us in writ­ing; you will find our con­tact details in para. 2. In order for us to be able to exclude mis­use, we must nor­mal­ly iden­ti­fy you (e.g. with a copy of your iden­ti­ty card, if this is not oth­er­wise pos­si­ble).
Please note that con­di­tions, excep­tions or restric­tions apply to these rights under applic­a­ble data pro­tec­tion law (e.g. to pro­tect third par­ties or trade secrets). We will inform you accord­ing­ly if necessary.

10. Do we use online tracking?

We do not use any online track­ing tech­niques on our website.

11. Can this privacy policy be changed?

This Pri­va­cy Pol­i­cy does not form part of any con­tract with you. We may amend this pri­va­cy pol­i­cy at any time. The ver­sion pub­lished on this web­site is the cur­rent version.

Last updat­ed: August 2023