How I handle your data

Controller and contact details

I am the controller responsible for the data processing described in this notice, unless stated otherwise in a specific case. Questions or concerns about data protection can be directed to me at:

Collection and processing of personal data

I process personal data directly from you (for instance, through my enquiry form), from clients and their staff, business partners, authorities, courts or arbitral tribunals, or from other third parties involved in a mandate (such as an opposing party or a client's business partner), or that I collect through the operation of my website. Where legally permitted, I may supplement this with data from publicly available sources, where this is needed for a specific matter (for example, a conflict check or an active mandate).

The personal data I handle may include, depending on the situation:

If a mandate follows from your enquiry, this may also include:

Why I process your data, and the legal grounds

Depending on the situation, I process personal data for the purposes below and, where required, on the corresponding legal basis:

Performing a contract — I process data where necessary to enter into and carry out contracts with clients and business partners — in particular to deliver legal services, and to engage suppliers and subcontractors — and to meet the legal duties that arise from doing so. If you are an employee of a client or business partner, my processing may affect you in that capacity.

Meeting legal duties — I process data as needed to comply with legal or regulatory requirements that apply to me, including keeping records that demonstrate such compliance.

Pursuing legitimate interests — Where necessary to protect my own legitimate interests, those of a third party, or a legitimate public interest, I process data for purposes such as:

Your consent — Where you have given consent for a specific purpose — for instance, taking pre-contractual steps you requested through my enquiry form, or your decision to load that form from HubSpot's servers — I rely on and act within that consent, unless another legal basis applies and is required. You can withdraw consent at any time, though this does not affect the lawfulness of processing carried out beforehand.

Your data is not used by me for marketing, and I do not sell, rent, or otherwise pass it to third parties for their marketing purposes. Nor do I use it for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Cookies, tracking and related technologies

My website relies on cookies and comparable technologies for a single purpose: to let the enquiry form supplied by HubSpot, Inc. and its European affiliate (“HubSpot”) work properly. The site carries no analytics and no tracking script: it does not gauge visit statistics, build profiles of individual visitors, support third-party advertising, or enable retargeting. Opening a page of this site sets no cookies at all and contacts no third party — and the enquiry form itself is not loaded either, unless you ask for it.

The typefaces used on this site are served from the site itself. No fonts are requested from Google or any other third-party provider, so loading a page does not disclose your IP address to a font host.

The full inventory is short. Opening a page stores nothing on your device. If you choose to load the enquiry form, HubSpot sets its own cookies under its servers' domain (js-eu1.hsforms.net), for the purpose of operating and securing the form; those cookies are governed by HubSpot's privacy notice rather than this one, and their retention periods are set by HubSpot. The form also carries a Google reCAPTCHA check, which guards it against automated submissions and which Google operates under its own terms. The only item this website itself stores is the record of your choice, held in your browser's local storage under the name “ml-cookie-consent”. It contains nothing but that choice and the date you made it, it is never transmitted to me, and it remains until you withdraw it or clear your browser's storage.

You may review, block or remove cookies at any time through your browser settings, though doing so may limit the functionality of the enquiry form or the site generally.

Because nothing non-essential is set when you open a page, this site shows no cookie banner. The one choice that does arise is presented where it actually matters: when you open the enquiry form, I explain what loading it involves and load nothing until you click to proceed. You can withdraw that consent, or give it in advance, at any time via the cookie settings link in the site footer — withdrawing is as easy as giving, and takes effect immediately.

Who else receives your data

The following recipients process data on my behalf or as independent processors under their own terms:

Separately, I may pass on data to courts, tribunals, authorities or regulators where a legal duty or court order requires it.

If a mandate follows your enquiry, the recipient categories set out in the applicable engagement terms may also apply. I do not sell your data, and none of HubSpot, Google or Vercel is permitted to use it for their own marketing.

Transfers of personal data abroad

My enquiry form runs on HubSpot's EU-hosted infrastructure and e-mail runs through Google Workspace. This website's typefaces are served from the website itself, so opening a page discloses nothing to a font host. Even so, HubSpot, Inc., Google LLC and Vercel Inc. are all headquartered in the United States, so data may, in certain circumstances, be processed by or accessible to group entities or infrastructure outside Switzerland and the EU/EEA, including in the USA, depending on the specific service and how it is configured at the time.

When data goes to a country without an adequate level of data protection, I take steps to keep this within the bounds of applicable law. This may rest on one of the following grounds:

Beyond these grounds, I rely on the contractual protections my providers offer — in particular, the European Commission's standard contractual clauses or an equivalent transfer mechanism. If you would like more detail on the safeguards that apply, you can reach me using the details in Section 1.

How long data is kept

Enquiries that do not lead to a mandate are kept only for as long as needed to respond to you and consider whether to take on the matter. My HubSpot account automatically and permanently removes inactive contact records after 90 days of inactivity. If a mandate does follow, the resulting file is kept for the period required under applicable professional and statutory record-keeping rules — typically up to ten years under Swiss law — after which it is deleted or anonymized. Server and platform logs are kept only briefly, for security and operational purposes. Any video surveillance footage recorded at my office premises is likewise retained only briefly and deleted automatically, unless retention is needed in connection with a specific incident.

Keeping your data secure

I apply reasonable technical and organizational measures to protect your data against unauthorized access or misuse — among them, IT and network security tools, access restrictions, encryption of stored and transmitted data, and pseudonymization where appropriate.

Your rights as a data subject

To the extent applicable law provides for it (including the GDPR, where relevant), you may request access to your data, ask for corrections or deletion, seek to restrict or object to its processing, and request a copy in a portable format for transfer elsewhere. That said, I may need to rely on statutory limits to these rights — for instance where I am legally required to keep or process certain data, where I have an overriding interest I am entitled to invoke, where confidentiality obligations bind me, or where the data is needed to pursue a claim. If exercising a right would involve a cost to you, I will tell you in advance. Section 3 above already explains how to withdraw consent.

To exercise these rights, I will generally need to confirm your identity (for example, through identification documents, if this cannot otherwise be established). You can reach me for this purpose using the details in Section 1.

You are also entitled to pursue your rights in court, or to lodge a complaint with the competent authority — in Switzerland, the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

What is expected of you

To establish and carry out a business relationship, and to fulfil the related contractual obligations, you need to provide me with certain personal data (you are not normally under a legal duty to do so). Without it, I generally cannot enter into or perform a contract with you, or with the person or entity you represent. Likewise, some technical information (such as your IP address) is required simply to use the website.

If you share someone else's personal data with me — a colleague's, for instance — please make sure they know about this notice, and only do so if you are entitled to and the data is accurate.

The internet is an open environment and cannot be considered fully secure. I therefore ask that you take this into account when sharing information with me. To the extent the law allows, I do not accept liability for the security of data you send me electronically (by e-mail or otherwise), or for any resulting loss. If security is a concern for a particular matter, please let me know and we can use another channel.

Updates to this notice

I may update this notice at any time, without advance notice. The version published on my website (michaliklaw.com) is the one that applies.