Privacy Policy.

The controller for the processing of personal data described in this Privacy Policy is:

MÜLLER PAPARIS AG
Bahnhofstrasse 44
8001 Zürich
Switzerland

Phone: +41 43 244 70 20
Email: office@muellerpaparis.ch

Privacy inquiries can be sent to the above email address with the subject «Datenschutz» (Privacy).

This Privacy Policy informs how MÜLLER PAPARIS AG processes personal data when individuals:

• use our website and the content offered thereon;
• use the public digital assistant («MP Concierge»);
• submit an inquiry, fill out a form, or schedule an appointment;
• provide documents via a designated secure channel;
• subscribe to newsletters, legal updates, invitations, or other communications;
• use downloads, templates, checklists, or interactive tools;
• apply for a job; or
• otherwise communicate with us in connection with our digital offerings.

For the processing of personal data within the scope of a lawyer-client mandate, supplementary information and contractual provisions may apply. The lawyer's professional secrecy remains reserved.

«Personal data» means any information relating to an identified or identifiable natural person. «Processing» comprises any handling of personal data, in particular the collection, recording, storage, use, modification, disclosure, archiving, and deletion.

We process personal data in accordance with Swiss data protection law, in particular the Federal Act on Data Protection («DSG») and the Data Protection Ordinance («DSV»). Where applicable in individual cases, we additionally take into account the General Data Protection Regulation of the European Union («GDPR»).

We process personal data in particular:

• for the provision, security, and improvement of our website and digital services;
• for processing enquiries and conducting pre-contractual measures;
• for appointment scheduling and communication;
• for checking potential conflicts of interest and for compliance with legal and professional obligations;
• for the provision of requested services and the execution of a mandate;
• for the delivery of expressly subscribed information;
• for safeguarding legitimate interests, such as IT security, fraud prevention, quality assurance, and legal enforcement;
• based on consent, insofar as such is required or obtained by us; or
• for the fulfilment of legal obligations.

Any given consent can be revoked at any time with future effect. The lawfulness of processing already carried out remains unaffected.

Depending on how you use our services, we may process the following categories of personal data in particular:

4.1 Technical and Usage Data

This includes in particular IP address, date and time, accessed page or file, referrer URL, browser type, operating system, device category, language, approximate region, session and event data, as well as technical error and security information.

4.2 Contact and Master Data

This includes in particular name, company, function, postal address, email address, telephone number, preferred language, and communication preferences.

4.3 Enquiry and Case Data

This includes the situation described by you, involved persons or companies, affected legal fields, known deadlines, desired consultation, correspondence, and other information that you voluntarily transmit to us.

4.4 Communication and Assistant Data

This includes inputs and responses in MP Concierge, selected topics, a summary generated by the assistant, technical session data, and information you share for contact or appointment scheduling.

4.5 Document and File Data

This includes uploaded files, file names, file type, file size, technical metadata, and the contents of the documents, insofar as a secure upload function is expressly provided and used.

4.6 Newsletter and Event Data

This includes email address, name, language, interests, time of subscription and unsubscription, proof of consent, delivery status, bounces, and complaints.

4.7 Application Data

This includes personal details, contact information, curriculum vitae, certificates, qualifications, references, correspondence, and other information submitted during the application process.

Please do not submit unnecessary particularly sensitive personal data, access credentials, or confidential documents via publicly accessible website forms or the public MP Concierge. For sensitive documents, exclusively use a secure transmission method designated by us.

When accessing our website, technically required data is processed automatically. This data is necessary to deliver the website, ensure its stability and security, analyse errors, and prevent abusive access.

Our website is hosted by Vercel Inc., San Francisco, USA, and delivered through its global content delivery network. Technical access data may be processed in the USA; a data processing agreement with recognised standard contractual clauses is in place with Vercel.

Server logs are generally retained for a maximum of 30 days. In the event of a security incident, concrete suspicion of abuse, or for securing evidence, affected logs may be retained longer.

We use cookies and similar technologies to:

• provide technically necessary functions;
• save your privacy and language settings;
• statistically evaluate the use of our website; and
• with your consent, analyse user-friendliness.

Technically necessary technologies may be used insofar as they are required for secure and functional operation. Google Analytics and Microsoft Clarity are only activated after you have consented to the corresponding category.

You can make your selection in the cookie banner during your first visit and change or revoke it at any time later via “Cookie Settings” in the footer of the website. The rejection of non-necessary technologies does not affect the basic use of the website.

We generally store proof of your selection for up to three years from the last setting. Browsers can additionally block or delete cookies, which may restrict individual functions.

With your consent, we use Google Analytics 4, a web analytics service from Google. For users in Switzerland, Google Ireland Limited is regularly the contractual partner; technical services may be provided by Google LLC and other companies or processors.

Google Analytics can process the following data in particular:

• pages accessed and navigation paths;
• time, duration, and frequency of visits;
• interactions and defined events;
• referrer information;
• browser, device, and operating system data;
• a pseudonymous identifier; and
• an approximate geographical region derived from the IP address.

Our intended configuration:

• Activation exclusively after consent;
• No advertising functions and no remarketing;
• No linkage with Google Ads;
• Google Signals deactivated;
• No transmission of directly identifiable information;
• No collection of form content, chat content, or documents;
• Retention period for user-related event data: 14 months.

You can revoke your consent at any time via "Cookie Settings".

With your explicit consent, we use Microsoft Clarity, a service from Microsoft, to understand how publicly accessible pages are used and where user guidance can be improved.

In particular, Clarity can process clicks, scroll movements, mouse or touch movements, page changes, display and device data, technical diagnostic data, and a reconstructed representation of usage sessions.

The following protection requirements apply to our website:

• Clarity is only activated after valid consent;
• Input fields and sensitive page elements are strictly masked;
• Contact forms, MP Concierge, upload areas, and client portal are not recorded;
• Form content, chat content, documents, names, email addresses, and case details may not be transmitted;
• Personal values may not appear in URLs or analysis events.

Regular session recordings are usually retained for 30 days; selected sessions and heatmaps can remain available for up to 13 months.

All fonts used on the website are hosted locally on our own website infrastructure. Loading our pages does not establish any connection to font providers such as Google Fonts.

The AI check gives companies an initial legal assessment of their AI use. For this purpose we process the information provided in the questionnaire, such as company, industry, size, AI services used and data categories, as well as a website where provided.

For the evaluation we use the OpenAI API as a business service in a configuration in which inputs and outputs are not released for training the general models. Please do not enter any sensitive personal data or trade secrets in the AI check.

If you subsequently request a consultation, we process your contact details to respond to your request; dispatch is handled by our email provider Resend.

When you fill out a form, we process the information you provide, as well as technical metadata, to:

• to receive and allocate your inquiry;
• to ascertain the urgency and the substantive area of responsibility;
• to determine a suitable contact person;
• to examine a potential conflict of interest;
• to communicate with you; and
• to prepare a mandate relationship, if applicable.

An automatic acknowledgment of receipt does not imply that a mandate has been established, nor that we monitor a deadline. A mandate is only established after our express confirmation.

Inquiries that do not lead to a mandate will generally be deleted or anonymized no later than twelve months after the conclusion of communication.

12.1 Function and Purpose

The MP Concierge assists visitors in structuring a legal concern, identifying relevant issues and potential urgency, creating a summary, and preparing the next contact or booking step.

The MP Concierge does not provide binding legal advice, does not make a conclusive legal assessment, and does not replace an examination by a lawyer.

12.2 Processed Data

• Your text inputs and selected answers;
• the responses and summaries generated by the system;
• a technical session identifier and timestamps;
• voluntarily provided contact and appointment data;
• technical security and quality data.

12.3 AI Service Used

For language processing, we use the OpenAI API as a business service. The API is used in a configuration where inputs and outputs are not shared for training general OpenAI models.

12.4 Confidentiality and Secure Use

Please do not enter passwords, access data, comprehensive health data, criminal records, bank data, complete identity documents, or other non-essential confidential information into the public assistant. Assistant sessions that are not transmitted will generally be deleted or anonymized no later than 30 days.

To the extent that we provide a secure upload function, we process the transmitted documents and metadata to carry out the requested preliminary review, conflict check, mandate initiation, or mandate processing. Files may be automatically checked for malware, file type, and technical integrity.

If no mandate is established, uploaded documents will generally be deleted no later than 30 days after the conclusion of the inquiry, unless there are legal, professional, or evidence preservation reasons for longer retention.

For appointment management and communication, we may use services from Microsoft 365, particularly Outlook, Exchange Online, Microsoft Bookings, Teams, and SharePoint.

Microsoft services are provided by Microsoft Ireland Operations Limited and other Microsoft companies. Data may be processed outside of Switzerland.

15.1 Registration

For newsletters, legal updates, and invitations, we process, in particular, your email address, and, if applicable, your name, company, language, and selected areas of interest. Registration is generally confirmed via a double opt-in procedure.

15.2 Resend Dispatch Service

For technical dispatch, we use Resend, a service from Plus Five Five, Inc., San Francisco, USA. We generally do not use personal opening or click tracking for newsletters.

15.3 Unsubscription

You can unsubscribe from newsletters at any time via the unsubscribe link in each message or by email to office@muellerpaparis.ch.

Downloads and interactive tools may be provided without registration or, for individual offerings, after providing contact details. Results from checks, calculators, and planners serve solely for initial orientation. They are not automatically assigned to a client file and are not used for personalized advertising.

If you apply via our website or by email, we process your data to review the application and to carry out the selection process. In the absence of employment, we generally delete application documents no later than six months after the conclusion of the process. With your consent, we may retain documents for a possible future vacancy for up to 24 months.

Our website may contain links to external websites, professional sources, social networks, or map services. Active embeds of external content, insofar as they are not technically necessary, are loaded only after your consent or conscious activation.

Personal data may be disclosed to the following categories of recipients to the necessary extent:

• authorised employees and recruited specialists within the law firm;
• IT, hosting, cloud, security, communication, form, scheduling, CRM, analysis, and AI service providers;
• professional advisors, auditors, and insurers;
• Courts, authorities, opposing parties, and other parties involved in proceedings;
• Cooperation partners or foreign correspondent law firms;
• Other recipients with your consent or due to a legal obligation.

Recipients may be located in Switzerland, the European Economic Area, the United Kingdom, the USA, or other countries. If a recipient is located in a country without a recognized adequate level of data protection, we base the disclosure particularly on recognized standard data protection clauses.

We take appropriate technical and organizational measures to protect personal data from loss, unauthorized access, alteration, disclosure, and misuse. These include, in particular, encrypted data transmission, role-based access rights and multi-factor authentication, logging of security-relevant processes, backup and recovery procedures, as well as confidentiality obligations and training.

Attorneys are subject to professional secrecy without time limit. We take this obligation into account when selecting and configuring digital services.

We retain personal data only as long as necessary for the respective purpose or if there are legal, contractual, professional, or evidentiary reasons.

Within the framework of the applicable law, you may particularly:

• request information about the processing of your personal data;
• have inaccurate data corrected;
• request the release or transfer of certain data;
• request the deletion or destruction of data;
• object to a processing or request its restriction;
• revoke a consent with future effect; and
• lodge a complaint with the competent data protection authority.

Please address inquiries to:

MÜLLER PAPARIS AG
Subject: Data Protection
Bahnhofstrasse 44, 8001 Zürich
office@muellerpaparis.ch

The competent Swiss data protection authority is:

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Feldeggweg 1, 3003 Bern, Schweiz

We may adapt this Privacy Policy if our data processing operations, digital offerings, or the legal situation change. The version published on this website at the time shall apply. Material changes will be indicated in an appropriate manner.