How we handle data

Last updated: 14 May 2026

1. Controller

The controller for personal data processed in connection with this website is:

Dornfeld & Partner Rechtsanwälte
Zurich, Switzerland
Email: [email protected]
Phone (DE): +49 69 757 884 210

Full registry and supervisory-authority details are set out in the Impressum.

2. Categories of personal data processed

This website is intentionally minimal. The following categories of data may be processed:

• Contact-form submissions. Your name, email address, optional phone number, optional jurisdiction, optional matter type, optional loss range, optional broker / counterparty name, and free-text message. The form does not store data on a server: submissions open your local mail client pre-populated with the information you entered. Whether the mail is sent is your decision.
• Email correspondence. When you write to us, we receive your email address, the message contents, and any attachments you provide.
• Server logs. Our web server records standard technical information for each request: IP address, request time, requested URL, HTTP referer (where provided by your browser), response status, and user-agent string. Logs are used solely for security, abuse detection, and integrity diagnostics.
• Functional cookie. A single cookie (df_lang) is set if you switch site language to remember your choice. It contains no identifier beyond en or de, expires after twelve months, and is sent only to this domain.

We do not use Google Analytics, marketing or retargeting pixels, social-network widgets, A/B testing services, heat-map / session-recording tools, or any third-party data-processors for analytics or advertising.

3. Purposes and legal bases

• Responding to enquiries. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering a contract at your request) and the equivalent provisions of the Swiss FADP.
• Performing legal services after engagement. Legal basis: Art. 6(1)(b) GDPR (performance of contract) and our professional obligations under the BGFA and cantonal rules.
• Security and integrity of the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure service).
• Compliance with legal obligations, including statutory retention obligations and conflict-checking duties. Legal basis: Art. 6(1)(c) GDPR.

4. Recipients

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Personal data may be disclosed to:

• Local counsel we instruct on your behalf in cross-border matters, only with your written authorisation.
• Courts, regulators, and counterparties where required to advance your mandate and only with your written authorisation.
• Mandatory disclosure recipients where Swiss or EU law requires disclosure (criminal investigation, court order, etc.).
• The hosting provider for this website, who processes server logs as a processor under a written agreement.

5. International transfers

This website is hosted in the European Economic Area or in Switzerland (a country with an adequacy decision under EU law and adequate protection under Swiss law). Cross-border mandates may require transfers to local counsel outside the EEA / Switzerland; in those cases we rely on contractual safeguards or your explicit consent under Art. 49 GDPR.

6. Retention

Server logs are retained for short technical periods (typically 14 days, never more than 90 days). The functional language cookie expires after twelve months. Email enquiries and mandate files are retained for the periods required by Swiss professional rules, currently ten years from the end of the mandate, subject to longer periods where applicable law mandates them.

7. Your rights

Subject to the FADP / GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erasure of data, where statutory retention does not apply;
• Restriction of processing in defined circumstances;
• Object to processing based on legitimate interests;
• Data portability for data you have provided to us;
• Withdraw consent at any time, without affecting prior lawful processing;
• Lodge a complaint with the competent supervisory authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC); in the EU your national authority.

8. Cookies

The only cookie this site sets is df_lang — a strictly functional cookie used to remember your language preference (EN or DE). It contains no identifier, is not shared with third parties, expires after twelve months, and is set only when you actively switch language. Under FADP / GDPR, strictly functional cookies do not require prior consent; nonetheless we surface a low-friction notice for transparency.

You can delete this cookie at any time through your browser's settings. No site features will break, your language preference will simply not persist between visits.

9. Security

The website is served over HTTPS with modern TLS ciphers and HTTP Strict Transport Security enabled. Production traffic passes through a CDN configured in strict-encryption mode, with origin-only certificate validation. We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction.

10. Contact for data requests

To exercise any of the rights set out above, or for any privacy question, please write to [email protected] with the subject line "Data request". We respond to verifiable requests within statutory deadlines (typically one calendar month).

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in applicable law. The "Last updated" date at the top of this page indicates when the policy was last revised. Material changes will be flagged on the homepage for a reasonable period.