1 Responsible persons and content of this Privacy Policy

Petra Rihar and Isabelle Thouvenin are the operators of the website www.rihar-thouvenin.ch (“website“) as well as your contractual partners in client relationships. Unless otherwise specified, we are responsible for the data processing listed in this Privacy Policy.

In order to know what personal data we collect from you and for what purposes we use it, please take note of the following information. Regarding data protection, we are primarily guided by the legal requirements of Swiss data protection law, in particular the Swiss Federal Act on Data Protection (“FADP“), as well as the EU General Data Protection Regulation (“GDPR“), the provisions of which may be applicable in individual cases.

2 Contact person for data protection

If you have any questions about data protection or would like to exercise your rights, please contact our data protection contact by sending an email to the following address: rihar@rihar-thouvenin.ch or thouvenin@rihar-thouvenin.ch 

Alternatively, you can use the following address:

RIHAR & THOUVENIN DISPUTE RESOLUTION
Dufourstrasse 22
8008 Zurich
Switzerland

3 When you visit our website (log file data)

When you visit our website, the servers of our hosting provider store each access in a log file for a maximum period of 12 months. The following data is collected and stored by us until it is automatically deleted:

• the IP address of the requesting computer
• the date and time of access
• the name and URL of the retrieved file
• the website from which the access was made, with the search term used, if applicable
• the operating system of your device and the browser you are using (including type, version and language setting)
• Device type in case of access by mobile phones
• the city or region from which the access was made, and
• The name of your Internet access provider

This data is processed for the purpose of enabling the use of our website, ensuring system security and stability in the long term, as well as for error and performance analysis. It also allows us to optimize our website.

In the event of an attack on the network infrastructure of the website or in the event of suspicion of other unauthorized or abusive use of the website, the IP address and the other data will be evaluated for clarification and defense and, if necessary, used in the context of criminal proceedings for identification and for civil and criminal proceedings against the users concerned.

For the purposes described above, we have a legitimate interest in data processing within the meaning of art. 6 (1) (f) GDPR.

4 Use of one of our contact options

If you contact us via our contact addresses and channels (e.g., by email or telephone), your personal data will be processed. The data that you have provided to us will be processed, e.g., the name of your company, your name, your function, your email address or telephone number and your enquiry.

We process this data exclusively to respond to your enquiry in the best possible way. The legal basis for this data processing is our legitimate interest within the meaning of art. 6 (1) (f) GDPR in the best possible response to your enquiry or, if your enquiry relates to the establishment or performance of a client relationship, the performance of a contract within the meaning of art. 6 (1) (b) GDPR.

5 Intellectual property rights

We own or license all intellectual property rights on our websites, such as the copyrights in the content such as text (except as expressly provided otherwise) and pictures or embedded softwares and the rights to our trademark and logo.

You may download and print the information contained on our websites but you may not amend the information or remove part of it and you must state the source of the information as coming from our websites. If you provide the information to other persons, you must subject them to these Terms of Use.

6 Applications

You can apply to us spontaneously or in response to a specific job advertisement via an email address. We process the following data:

• Name
• Surname
• Email address
• Cover letter
• Curriculum Vitae (CV)
• Certificates and diplomas

We will use this and any other information you voluntarily provide to us to assess and process your application. Applications from unsuccessful candidates will be deleted at the end of the application process unless you have expressly consented to a longer retention period, or we are not legally obliged to retain them for a longer period. The legal basis for the review of your application and the handling of the application process is the implementation of pre-contractual measures within the meaning of art. 6 (1) (b) GDPR.

7 Processing in the context of an attorney-client relationship

We process personal data in the context of your client relationship with us. Among other things, we process the following data:

• Your contact information (e.g., name, address, telephone number, email address)
• Information about the company for which you are contacting us and your role within the company
• Billing & Payment Information
• Identification and background information you provide to us
• Information you provide to us in order to deal with your case
• More information you provide to us.

We process this data in the context of the provision of our services to interact with you, to process your case in the best possible way for you, to communicate with you, to bill for the services provided, as well as to administer the client relationship with you. When opening a mandate and providing services, we may also obtain information about you from other sources, for example by consulting publicly available sources to update your information. In addition, we process the data when opening a mandate to carry out money laundering, conflict and reputation checks.

For the above-mentioned processing, we use Microsoft 365 and various applications contained therein (e.g., Word, PowerPoint, Excel, Outlook Teams, OneDrive and SharePoint) of Microsoft Corporation (“Microsoft“). If we grant you direct access to Microsoft 365, you will also process the following data:

• IP address used to access
• Access data (e.g., username, data in the context of the so-called multi-factor authentication)
• Master data (e.g., surname, first name, contact details, profile pictures)
• Metadata of usage (e.g., time of access, date, type of access, details of the data/files/documents accessed and all activities related to use)

According to Microsoft, in this case, the data is primarily stored on servers in Switzerland. For this data processing, we have concluded a data processing agreement with Microsoft and agreed on extensive technical and organizational measures that correspond to the current state of the art in IT security, as well as the EU standard contractual clauses (with further measures) with Microsoft. Microsoft is committed to adhering to and maintaining professional secrecy.

In connection with the use of Microsoft 365, Microsoft also processes certain data as an independent controller. Please note that we have no influence on Microsoft’s data processing. For more information about Microsoft’s data processing, please refer to their privacy policy.

The legal basis for the processing of personal data for the aforementioned purposes lies in the implementation of pre-contractual measures and the fulfilment of a contract within the meaning of art. 6 (1) (b) GDPR, in the fulfilment of legal obligations in accordance with art. 6 (1) (c) GDPR as well as in our legitimate interest in the goal-oriented and efficient management of the mandate within the meaning of art. 6 (1) (f) GDPR.

8 Processing during videoconferencing

To conduct telephone/video conferences, online meetings and webinars (“Teams Meeting“), we use Microsoft Teams from Microsoft. When using Microsoft Teams, various data is processed. As part of a Teams Meeting, the following data can be processed:

• Information about the user (e.g., display name, email address, profile picture, preferred language)
• Metadata of the Teams Meeting (e.g., date, time, meeting ID, phone numbers, location, text, audio, and video)
• Authentication data, log files and log data
• Content of the Teams Meeting as well as data when using the chat function
• Information about incoming and outgoing phone numbers, country name, start and end times, if you dial into the Teams Meeting by phone

If we record Teams Meetings, we’ll let you know in advance and ask for your consent where necessary.

The legal basis for the processing of personal data is the implementation of pre-contractual measures and the fulfilment of a contract within the meaning of art. 6 (1) (b) GDPR, provided that the Teams Meetings takes place within the framework of the client relationship. Outside of the client relationship, the legal basis is our legitimate interest within the meaning of art. 6 (1) (f) GDPR to answer your enquiry in the best possible way.

9 Centralized data storage and marketing

9.1 Central data storage

We will store and link the data described in this privacy policy, in particular your personal data, your contact details and the data relating to the mandate, in a central database if it is possible to make a clear assignment to you. This allows us to manage your information effectively, respond to your requests and provide you with the services you require. The legal basis for this processing is our legitimate interest within the meaning of art. 6 (1) (f) GDPR in the efficient management of data. The legal basis for this processing is our legitimate interest within the meaning of art. 6 (1) (f) GDPR in the use of third-party services.

9.2 Newsletter

If you have registered for our email newsletter, we collect the following data, with mandatory information marked accordingly (e.g. with an asterisk):

• Email address
• Name and surname

By registering, you consent to the processing of this data to receive news from us about our firm, our offers and related products and services. We will use your data to send emails until you withdraw your consent. You can opt-out at any time using the unsubscribe link in all our marketing emails.

10 Google Maps

On our website, we use Google Maps API (Application Programming Interface, “Google Maps“) from Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) or Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) (“Google“) for the visual presentation of geographic information (location plans). By using Google Maps, information about the use of our website, including your IP address, is transmitted to a Google server in the USA and stored there.

The integration of Google Maps allows us to visualize our location. This option constitutes our legitimate interest within the meaning of art. 6 (1) (f) GDPR.

It is possible to deactivate the Google Maps service and prevent data transfer to Google if you deactivate JavaScript in your browser. However, we would like to point out that in this case you will not be able to use the map display.

You can find more information about the collection, processing and use of your data by Google as well as your rights in this regard in the privacy policy by Google, and the additional terms for Google Maps or Google Earth.

11 Social media

On our website you will find the link to our presence on LinkedIn of Linkedin Unlimited Company, Wilton Place, Dublin 2, Ireland.

If you click on the LinkedIn icon, you will automatically be redirected to our profiles on LinkedIn. This establishes a direct connection between your browser and LinkedIn’s server. As a result, LinkedIn receives the information that you have visited our website with your IP address and clicked on the link.

If you click on the LinkedIn icon while you are logged into your LinkedIn user account, the content of our website can be linked to your profile so that LinkedIn can assign your visit to our website directly to your account. If you want to prevent this, you should log out before clicking on the icon. In any case, a connection between your access to our website and your user account takes place when you log in to LinkedIn after clicking on the icon. LinkedIn is responsible for the associated data processing under data protection law. Therefore, please refer to the information on LinkedIn’s website.

The legal basis for any processing attributed to us is our legitimate interest within the meaning of art. 6 (1) (f) GDPR in the use and advertising of our social media presence.

12 Disclosure of data to third parties

Without the support of other companies, we would not be able to provide our services in the desired form and efficiently. In order to be able to use the services of these other companies, it is also necessary to disclose your personal data to a certain extent. Such disclosure takes place, in particular, insofar as this is necessary for the performance of the client relationship. The legal basis for these transfers is the performance of the contract within the meaning of art. 6 (1) (b) GDPR.

The data will also be passed on to selected service providers and only to the extent necessary for the provision of the service. Various third-party service providers are already explicitly mentioned in this Privacy Policy. These are, for example, IT service providers (such as providers of software solutions) or advertising agencies. The legal basis for this data transfer is our legitimate interest within the meaning of art. 6 (1) (f) GDPR in the procurement of third-party services.

In addition, your data may be passed on, to courts, counterparties, authorities or correspondent lawyers, if this is necessary for the performance of the client relationship, if we are legally obliged to do so or if this is necessary to safeguard our rights, in particular to enforce claims arising from the relationship with you. Data may also be shared if another firm intends to acquire our firm or any part of it and such disclosure is necessary to conduct due diligence or to complete the transaction. Our legitimate interest within the meaning of art. 6 (1) (f) GDPR in safeguarding our rights and complying with our obligations or selling our law firm forms the legal basis for this data transfer.

13 Transfer of personal data abroad

We are entitled to transfer your personal data to third parties abroad if this is necessary to carry out the data processing specified in this Privacy Policy. Of course, the legal requirements on the disclosure of personal data to third parties are complied with. If the country in question does not have an adequate level of data protection, we ensure that your data is adequately protected by these companies by means of contractual arrangements.

14 Retention periods

We only store personal data for as long as it is necessary to carry out the processing described in this Privacy Policy within the scope of our legitimate interest. In the case of contract data, storage is prescribed by statutory retention obligations. Requirements that oblige us to retain data result from the provisions on accounting and tax regulations. According to these regulations, business communications, concluded contracts and accounting documents must be retained for up to 10 years. The data will be deleted or anonymized as soon as there is no longer any obligation to retain it and there is no longer a legitimate interest in storing it.

15 Data security

We use appropriate technical and organizational security measures to protect your personal data stored by us against loss and unlawful processing, in particular unauthorized access by third parties. Our employees and service providers are bound by us to maintain confidentiality and privacy. They will only have access to personal data to the extent necessary to perform their duties.

Our security measures are continuously adapted in line with technological developments. However, the transmission of information via the Internet and electronic means of communication always involves certain security risks and we cannot guarantee the security of information transmitted in this way.

16 Your rights

Provided that the legal requirements are met, you as a data subject have the following rights:

• Right of access: You have the right to request access to your personal data stored by us at any time, free of charge, when we process it. This gives you the opportunity to verify which personal data we process about you and that we use it in accordance with applicable data protection regulations.
• Right to rectification: You have the right to have inaccurate or incomplete personal data rectified and to be informed of the rectification. In this case, we will inform the recipients of the data concerned about the adjustments made, unless this is impossible or involves disproportionate effort.
• Right to erasure: You have the right to have your personal data erased under certain circumstances. In individual cases, in particular in the case of statutory retention obligations, the right to deletion may be excluded. In this case, if the conditions are met, the deletion may be replaced by a blocking of the data.
• Right to restriction of processing: You have the right to request that the processing of your personal data be restricted.
• Right to data portability: You have the right to receive from us personal data that you have provided to us free of charge in a readable format.
• Right to object: You can object to data processing at any time.
• Right of revocation: In principle, you have the right to revoke your consent at any time. However, processing activities based on your consent in the past do not become unlawful as a result of your revocation.
• Right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority, e.g., against the way in which your personal data is processed.

To exercise these rights, please use the contact options under Section 2.

Updated: September 2024