Privacy Policy
This Privacy Policy explains how Orven Legal processes personal data when you visit this website, contact us or work with us. It is based on the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, this policy also covers its requirements.
1. Controller
Orven Legal, Gëzime ShaqiriGeranienstrasse 10
8008 Zürich, Switzerland
Email: info@orven.ch
Phone: +41 76 683 11 11
Please send any questions about data protection or requests regarding your rights to the contact details above.
2. Visiting this website
When you visit this website, our hosting provider Netlify (Netlify, Inc., USA) automatically processes technical data that your browser transmits, such as your IP address, the date and time of access, the page requested, the referring website, and your browser and operating system. This data is needed to deliver the website and to keep it secure and stable. It is not used to identify you and is deleted or anonymised after a short period, unless it is needed to investigate a security incident.
This website does not use cookies, analytics or tracking tools, and it does not load fonts or other content from third parties.
3. Contacting us
When you contact us by email or phone, we process the information you provide (for example your name, contact details, company and the content of your message) to answer your enquiry and, where applicable, to prepare an engagement.
4. Clients and business contacts
When we provide services, we process the personal data needed to carry out the engagement. This includes contact details of our clients' representatives and employees, information relating to the matter, communications, and billing information. We also process the data of other business contacts, such as suppliers and partners, as far as needed for the business relationship.
Information about client matters is treated as strictly confidential.
5. Purposes and legal basis
We process personal data only for the following purposes:
- operating and securing this website
- responding to enquiries
- preparing, providing and invoicing our services
- maintaining business relationships
- complying with legal and regulatory obligations, such as retention duties
Where the GDPR applies, we rely on the performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR), and our legitimate interests in running and securing our business and communicating with you (Art. 6(1)(f) GDPR).
6. Recipients and service providers
We do not sell personal data. We share it only where needed, in particular with:
- Microsoft (Microsoft 365), which we use for email, calendar, documents and cloud storage, and other IT service providers such as our website host Netlify, who process data on our behalf
- advisers such as accountants or other external specialists, where needed for an engagement and with the client's knowledge
- authorities and courts, where we are legally required to do so
7. Transfers abroad
Some of our IT service providers, including Microsoft and Netlify, may process data outside Switzerland, in particular in the EU/EEA or the USA. Where data is transferred to a country without an adequate level of data protection, we use appropriate safeguards, such as the standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC), or a recognised certification such as the Swiss-U.S. Data Privacy Framework.
8. Retention
We keep personal data only as long as needed for the purposes described above. Enquiries that do not lead to an engagement are generally deleted after twelve months. Business records are kept for the periods required by law, generally ten years under Swiss law.
9. Data security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse.
10. Your rights
Within the limits of the applicable law, you have the right to:
- access the personal data we hold about you
- have incorrect data corrected
- have your data deleted or its processing restricted
- object to processing
- receive your data in a common electronic format
- withdraw any consent you have given, with effect for the future
To exercise these rights, please contact us using the details in section 1. We may ask for proof of identity. You also have the right to lodge a complaint with a data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).
11. Changes
We may update this Privacy Policy from time to time. The version published on this website applies.