1. Background 

Keller Lehmann Attorneys-at-Law Ltd (CHE-196.224.972), with registered office in Lucerne (hereinafter also “we”, “us”), provides legal services of all kinds, in particular litigation services subject to the attorneys’ monopoly, carried out by attorneys registered in Switzerland. In addition, Keller Lehmann Attorneys-at-Law Ltd provides consulting services for conflict resolution, in particular for the planning, avoidance and settlement of conflict situations. Within the scope of our activities, we process personal data, in particular relating to our clients, opposing parties, courts, authorities, related persons, employees, associations, website visitors, event participants, newsletter recipients as well as other bodies and, in each case, their contact persons and employees (hereinafter also “you”). For personal data that we process in connection with employment relationships with Keller Lehmann Attorneys-at-Law Ltd, we have a separate Privacy Policy. With this Privacy Policy we inform you about all data processing within the meaning of the Federal Act on Data Protection (SR 235.1; FADP) and/or in accordance with the EU General Data Protection Regulation (No. 2016/679; EU GDPR), insofar as it is applicable.

2. Controller 

The controller responsible for the processing of personal data is Keller Lehmann Attorneys-at-Law Ltd (CHE-196.224.972), Kellerstrasse 36, 6005 Lucerne (Telephone: +41 41 360 74 04 / E-mail: info@kl-law.ch).

3. Purposes of processing 

If you use our services, visit our website www.kl-law.ch or otherwise deal with us, we may process various categories of your personal data. The processing of such personal data may in particular be carried out for the following purposes: 

• Communication: We process personal data so that we can communicate with you as well as with third parties, such as parties to proceedings, courts or authorities, by e-mail, telephone, letter or otherwise (e.g. to respond to enquiries, in the course of legal advice and representation as well as contract initiation or performance). For this purpose, we process in particular the content of communications, your contact details as well as the metadata of communications. Certain means of communication may involve data security risks (e.g. e-mail, video conferences). If you wish to take special security measures in this respect, it is your responsibility to inform us accordingly. If we need or wish to verify your identity, we collect additional data (e.g. a copy of an identity document).
•  Initiation and conclusion of contracts: With a view to concluding a contract, in particular a mandate relationship, with you or your principal or employer, which also includes the review of any potential conflicts of interest, we may process in particular your name, contact details, powers of attorney, consent declarations, information about third parties (e.g. contact persons, information about family members as well as opposing parties), contract contents, creditworthiness data and any other data that you provide to us or that we collect from public sources or from third parties (e.g. commercial register, sanctions lists, media, legal expenses insurers or from the internet).
• Administration and performance of contracts: We process personal data so that we can comply with our contractual obligations towards our clients and other contractual partners (e.g. suppliers, service providers, correspondent law firms, project partners) and, in particular, provide and enforce the contractual services. This also includes data processing for the conduct of mandates (e.g. legal advice and representation of our clients before courts and authorities and the related correspondence) as well as data processing for the enforcement of contracts (debt collection, court proceedings, etc.), bookkeeping and, where permitted, public communication. For this purpose, we process in particular the data that we have received or collected in the course of initiating, concluding and performing the contract, as well as data that we create in the course of our contractual services or that we collect from third parties (e.g. courts, authorities, opposing parties, medical service providers, media, detectives or from the internet) or from public sources. Such data may include, in particular, records of discussions and consultations, notes, internal and external correspondence, contractual documents, documents that we prepare and receive in the context of proceedings before courts and authorities (e.g. statements of claim, appeal and complaint submissions, judgments and decisions), background information about you, opposing parties or other persons as well as other mandate-related information, performance records, invoices and financial and payment information.
• Information: We process personal data in order to provide our clients, contractual partners and other interested persons with information about events, changes in the law, news about our law firm or similar. This can take place, for example, in the form of newsletters and other regular contacts (electronically, by post, by telephone). For this purpose, we process in particular the content of communications, your contact details as well as the metadata of communications. You can refuse such communication at any time and/or refuse or withdraw consent to such communication.
• Operation of our website: In order to operate our website securely and stably, we collect technical data, such as IP address, information about the operating system and settings of your end device, the region, the access URL, the time and the type of use. For cookies and similar technologies see Section 8. 
• Improvement of our services: In order to continuously improve our website and other electronic offerings, as well as our other services, we collect data about your preferences, for example by analyzing how you interact with our social media profiles. We also process direct or indirect feedback from you as well as feedback on our services, including in the context of mandate relationships or in the context of public statements made by you.
• Security: We process personal data to ensure and continuously improve the appropriate security of our IT and our other infrastructure. This includes, for example, the monitoring and control of electronic access to our IT systems as well as physical access to our premises, analyses and tests of our IT infrastructures, system and error checks and the creation of security backups.
• Compliance, risk management and corporate governance: We process personal data to comply with applicable laws (e.g. combating money laundering, tax law and professional obligations), self-regulations, industry standards, our “Corporate Governance” as well as for internal and external investigations in which we are a (procedural) party (e.g. by a criminal prosecution or supervisory authority or a mandated private body). Furthermore, we process personal data in the context of risk management (e.g. to protect against unlawful activities) and corporate management.
• Job applications: If you apply to us for a position, we process the relevant data for the purpose of reviewing the application, carrying out the application process and, in the case of successful applications, preparing and concluding a corresponding contract. In addition to your contact details and the information from the relevant communication, we process in particular the data contained in your application documents and the data that we can additionally obtain about you, e.g. from professional social networks, the internet, the media and from references, if you consent to us obtaining references. Data processing in connection with the employment relationship is the subject of a separate Privacy Policy.
• Other purposes: Other purposes include, for example, training and educational purposes as well as administrative purposes (e.g. accounting). In addition, we may process personal data for the organization, implementation and follow-up of events, in particular participant lists and the content of presentations and discussions, but also image and audio recordings created during such events. The safeguarding of other legitimate interests is also among the other purposes, which cannot be exhaustively listed.

4. Source of the data 

We obtain the personal data that we process: 

• from you: The majority of the data we process is provided to us by you (or your end device) yourself (e.g. in connection with our services, the use of our website, or communication with us). You are not obliged to provide your data, except in individual cases (e.g. due to legal obligations). However, if you wish to enter into contracts with us or use our services, you must provide us with certain data. The use of our website is also not possible without data processing.
• If you provide us with data about other persons (e.g. family members, representatives, other related persons, opposing parties or other third parties), we assume that you are authorized to do so and that these data are correct, and that you have ensured that these persons are informed about this disclosure, insofar as a legal information obligation applies (e.g. by bringing this Privacy Policy to their attention beforehand).
• from third parties: We may also obtain data from publicly accessible sources or receive it from (i) authorities, (ii) your employer or principal, who is either in a business relationship with us or otherwise has dealings with us, as well as from (iii) other third parties (e.g. clients, opposing parties, legal expenses insurers, members of medical and health professions, contractual partners, internet analytics service providers). This includes in particular the data that we process in the course of initiating, concluding and performing contracts as well as data from correspondence and meetings with third parties, but also all other categories of data pursuant to Section 3.

5. Disclosure of data 

With regard to personal data and other information that we receive in the context of a mandate relationship, we are subject to professional secrecy vis-à-vis our clients pursuant to Art. 13 FMLA and Art. 321 Criminal Code. Subject to professional secrecy, we disclose your personal data in particular to the categories of recipients listed below. Where necessary, we obtain your consent for this or have our supervisory authority release us from our professional duty of confidentiality.

• Service providers: We cooperate with service providers in Switzerland and abroad who (i) process data on our behalf (e.g. as IT providers), (ii) process data jointly with us as joint controllers or (iii) process data under their own responsibility as independent controllers, which they receive from us or have collected for us. As a rule, we enter into agreements with these third parties regarding the use and protection of personal data.
• Clients and other contractual partners: This primarily refers to our clients and other contractual partners for whom a transfer of your data results from the contract (e.g. because you act for a contractual partner or because they provide services to you). This category of recipients also includes entities with which we cooperate, such as other law firms in Switzerland and abroad, as well as legal expenses insurers and medical and health personnel. The recipients generally process the data under their own responsibility as independent controllers.
• Authorities and courts: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if this is necessary for the fulfilment of our contractual obligations and in particular for the conduct of the mandate, or if we are legally obliged or entitled to do so, or if this appears necessary to safeguard our interests. These recipients process the data under their own responsibility as independent controllers.
• Opposing parties and other involved persons: Insofar as this is necessary for the fulfilment of our contractual obligations, in particular for the conduct of the mandate, we also disclose your personal data to opposing parties and other involved persons (e.g. related companies, other law firms, persons providing information or experts, etc.).
• Other persons: This refers to other cases in which the involvement of third parties arises from the purposes pursuant to Section 3. This concerns, for example, delivery recipients or payment recipients named by you, third parties in the context of representation relationships (e.g. your lawyer or your bank) or persons involved in administrative or court proceedings. We may also disclose your personal data to our supervisory authority, in particular insofar as this is necessary in individual cases for the release from our professional duty of confidentiality. In the context of communication with our competitors, industry organizations, associations and other bodies, there may also be an exchange of data relating to you.

All of these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not that of other third parties (e.g. authorities, banks, etc.).

6. Place of data processing 

As a rule, we process and store personal data in Switzerland. Depending on the case – for example via sub-processors of our service providers or in proceedings before foreign courts or authorities – the processing and storage of personal data may also take place in the European Economic Area (EEA) or, in any event potentially, in any other country in the world. 

If a recipient is located in a country without adequate data protection, we contractually oblige the recipient to ensure an adequate level of data protection. For this purpose, we use the revised standard contractual clauses of the European Commission, including the supplements necessary for Switzerland, unless the recipient is already subject to a legally recognized framework to ensure data protection. 

We may also disclose personal data to a country without adequate data protection without concluding our own contract for this purpose if we can rely on an exemption provision. An exemption may apply in particular to legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract that is in your interest requires such disclosure (e.g. if we disclose data to our correspondent law firms), if you have consented, or if obtaining your consent within a reasonable period is not possible and the disclosure is necessary to protect your life or physical integrity or that of a third party, or if it concerns data made generally accessible by you and you have not objected to their processing. We may also rely, under certain circumstances, on the exemption for data from a register provided for by law, to which we have legitimately been granted access.

7. Your rights 

In connection with our processing of data, you have certain rights. Depending on the applicable law, you may in particular request information about the processing of your personal data, have inaccurate personal data corrected, request the deletion of personal data, object to data processing, request the provision of certain personal data in a commonly used electronic format or their transfer to other controllers.

If you wish to exercise your rights vis-à-vis us, please contact us; our contact details can be found in Section 2. In order to prevent misuse, we must identify you (e.g. with a copy of an identity document, if necessary). 

Please note that these rights are subject to conditions, exceptions or restrictions. Exceptions and restrictions apply in particular due to our professional duty of confidentiality, to protect third parties or trade secrets. We reserve the right to redact copies for data protection reasons or reasons of confidentiality or to provide them only in part.

8. Use of our website 

When using our website (incl. newsletters and other digital offerings), data are generated that are stored in logs (in particular technical data). In addition, we may use cookies and similar technologies. A cookie is a small file that is transmitted between the server and your system and enables the recognition of a specific device or browser. You can set your browser so that it automatically rejects, accepts or deletes cookies. 

You can also deactivate or delete cookies in individual cases. You can find out how to manage cookies in your browser in the help menu of your browser. 

Both the technical data we collect and cookies generally do not contain personal data. However, personal data that we or third-party providers commissioned by us store about you may possibly be linked with the technical data and/or with the information stored in cookies and derived from them and thus possibly be linked to your person. 

In addition, we use services of third-party providers (which may in turn use cookies) on our website, in particular to improve the functionality or content of our website or to generate statistics. At present, we may in particular use the services of the following providers, whereby their contact details and further information on the individual processing operations can be accessed in the respective Privacy Policy. On the following pages you will find explanations as to how you can configure the processing of cookies in the most common browsers. 

• Mozilla Firefox
• Google Chrome for Desktop
• Google Chrome for Mobile
• Apple Safari for Desktop
• Apple Safari for Mobile

We use persistent cookies so that you can store user settings (e.g. language). If you block cookies in whole or in part, certain functionalities (such as language selection) may no longer function. 

From a data protection law perspective, they are in part “only” processors acting on our behalf and in part controllers. Further information on this is provided in the Privacy Policy. Some of the third-party providers used by us may be located outside Switzerland. Information on the disclosure of data abroad can be found in Section 6.

9. Social Media 

We maintain pages and other online presences on social networks and other platforms operated by third parties. In this context, we may process data about you that we receive from you (e.g. if you communicate with us or comment on our content) or from the platforms (e.g. statistics). 

The providers of the platforms may analyze your use and process these data together with other data they have about you. They also process these data for their own purposes (e.g. marketing and market research purposes and to manage their platforms) and act as independent controllers for this purpose. For further information on processing by the platform operators, please refer to the Privacy Policy of the respective platforms. 

We currently use LinkedIn, whereby the identity and contact details of the platform operator can be accessed in the respective Privacy Policy: 

• Provider: LinkedIn Ireland Unlimited Company, Ireland Privacy Policy: https://www.linkedin.com/legal/privacy-policy 

We are entitled, but not obliged, to review third-party content before or after it is published on our online presences, to delete content without notice and, if necessary, to report it to the provider of the respective platform. LinkedIn is located outside Switzerland. Information on the disclosure of data abroad can be found in Section 6.

10. Applicability of the EU General Data Protection Regulation (GDPR) 

We do not assume that the EU General Data Protection Regulation (“GDPR”) is applicable in our case. However, if this is exceptionally the case for certain data processing activities, then, exclusively for the purposes of the GDPR and the data processing activities subject to it, this Section 10 shall additionally apply. 

In this case, we base the processing of your personal data in particular on the fact that 

• it is necessary, as described in Section 3, for the initiation and conclusion of contracts and their administration and enforcement (Article 6(1)(b) GDPR); 
• it is necessary to safeguard legitimate interests of us or of third parties as described in Section 3 (Article 6(1)(f) GDPR); 
• it is legally required or permitted due to our mandate or our position under the law of the EEA or of a Member State (Article 6(1)(c) GDPR) or is necessary to protect your vital interests or those of other natural persons (Article 6(1)(d) GDPR); 
• You have separately consented to the processing, e.g. via a corresponding declaration on our website (Article 6(1)(a) and Article 9(2)(a) GDPR). 

As a rule, we process your data for as long as our purposes of processing (cf. Section 3), the statutory retention periods and our legitimate interests, in particular for documentation and evidentiary purposes, require, or as long as storage is technically necessary (e.g. in the case of backups or document management systems). If no legal or contractual obligations or technical reasons prevent this, we generally delete or anonymize your data after the expiry of the storage or processing period as part of our usual processes and in accordance with our retention policy.

If you do not provide certain personal data, this may result in the related services not being able to be provided or a contract not being able to be concluded. As a rule, we indicate where the personal data requested by us are mandatory. The right set out in Section 7 to object to the processing of your data applies in particular to data processing for the purposes of direct marketing. If you are not satisfied with how we handle your rights or with data protection, please let us know (cf. contact details in Section 2). If you are located in the EEA, you also have the right to lodge a complaint with the data protection supervisory authority of your country. A list of the authorities in the EEA can be found here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

11. Amendment of the Privacy Policy and Precedence of the German Version

This Privacy Policy is not part of a contract with you. We may amend this Privacy Policy at any time. The version published on this website is the current version.

In the event of any ambiguity, inconsistency or discrepancy between different language versions, the German version of this Privacy Notice shall expressly and exclusively prevail.

Lucerne, 21 March 2026