Privacy Policy

Devon AG ('Devon Legal', 'we') is a law firm based in the Canton of Zurich. The responsible party for the processing described below is:

Devon AG, Brown-Boveri-Strasse 5, CH-8050 Zurich
Email info@devonlegal.ch Telephone +41 58 776 76 60

This statement informs you about how we handle personal data and about your rights. It is a unilateral information and not a contract.

We are bound by attorney-client privilege (Art. 13 Attorney Act, Art. 321 Criminal Code). It is unlimited in time, also binds our employees and assistants, and prevails over data protection laws. This means that our obligation to inform is waived (Art. 20 para. 1 lit. c Data Protection Act 'DSG') and we may refuse, restrict, or delay information requests, insofar as this is necessary to protect the privilege (Art. 26 para. 1 lit. a DSG). We only disclose mandate data if a release is present or a legal obligation exists.

Clients: Contact and identification data, information on representation and beneficial ownership, payment data, correspondence as well as all documents related to the mandate – for the examination and initiation of the mandate, legal advice and representation, record keeping, billing and accounting, as well as for asserting our own legal claims.

Other Persons Involved in the Mandate (Opposing parties and their representation, witnesses, informants, experts, organs, beneficial owners): We generally do not receive this data from the data subjects themselves, but from our clients, from procedural files, public registers, and generally accessible sources. We process it for conducting the mandate as well as for enforcing and defending claims.

Conflict Check and Compliance: Investigation of conflicts of interest (Art. 12 lit. c Attorney Act), identification of the contracting party, and determination of the beneficial owner, to the extent we are subject to the Anti-Money Laundering Act ('GwG'), as well as sanction lists screening.

Business Partners and Service Providers: Contact, contract, and payment data for processing the business relationship.

Contact Network and Events: Salutation, name, function, company, and contact data for publications, newsletters, and invitations.

Applications and Employment: Application documents, additionally the information required for salary, social security, and taxes in case of employment.

Website: see Section 7.

The processing of personal data by private individuals does not require a special legal basis under Swiss law. We comply with the principles according to Art. 6 DSG. If necessary, we rely on a justification basis under Art. 31 DSG. We obtain consent separately where the law requires it – for example, for the newsletter. You can revoke it at any time with effect for the future.

In individual cases where the European General Data Protection Regulation is applicable, we rely on Art. 6 para. 1 lit. a–c and f and on special categories Art. 9 para. 2 lit. f GDPR.

Subject to attorney-client privilege, we disclose personal data to courts, authorities, arbitration tribunals, opposing parties and their representation, insofar as this is necessary for mandate management; to associated correspondence lawyers, notaries, experts, and translation services; to banks and insurers as needed for processing; to our fiduciary and accounting service providers; and to processors (Art. 9 DSG) in areas of hosting, IT support, office software, cloud storage, email, and collaboration services, newsletter dispatch. All associated personnel are subject to attorney-client privilege as assistants (Art. 321 para. 1 Criminal Code) and are contractually obligated to confidentiality and appropriate data security.

Personal data can be disclosed abroad, specifically to associated foreign law firms, foreign courts, and authorities, as well as to processors with infrastructure abroad. In countries without adequate data protection (Annex 1 Data Protection Ordinance 'DSV'), we rely on appropriate guarantees according to Art. 16 para. 2 DSG, especially recognized standard contractual clauses, or on an exception under Art. 17 DSG, namely the enforcement of legal claims before a foreign court or authority.

When visiting our website, our hosting provider automatically collects technical information (IP address, time, page accessed, browser, operating system). We use this for the operation, optimization, and security of the website and retain it for 24 months.

We use necessary cookies required for the website operation, which are deleted when you close the browser. For reach measurement, we also use Google Analytics (Google Ireland Limited or Google LLC); a device ID and your shortened IP address may be processed, which can have personal references. You can block or delete cookies in your browser; the website may then not be fully available to you (Art. 45c lit. b Telecommunications Act).

You should not transmit confidential information about an intended mandate via the contact form, as no client relationship exists before the acceptance of the mandate.

We generally communicate via email. Unencrypted emails can be read en route. For sensitive content, we provide secure transmission upon request.

We retain personal data for as long as the purpose, legal obligations, or evidence requires – mandate files usually ten years after mandate completion (Art. 127 Code of Obligations), accounting documents ten years (Art. 958f Code of Obligations), documents according to GwG as applicable ten years (Art. 7 para. 3 GwG), application documents six months after the procedure is concluded. Thereafter, we delete, destroy, or anonymize them. Provided original documents can be returned to you at any time.

We take appropriate technical and organizational measures to protect against unauthorized access, loss, misuse, and alteration (Art. 8 DSG). However, no one can guarantee absolute security. We report data security breaches to the Federal Data Protection and Information Commissioner ('EDÖB') as required by Art. 24 DSG.

You can request information about the personal data we process (Art. 25 DSG) as well as their correction (Art. 32 Sec. 1 DSG); their deletion or destruction and the prohibition of processing or disclosure (Art. 32 Sec. 2 DSG); a disagreement note (Art. 32 Sec. 3 DSG); and request the release or transfer of data you have communicated to us and that we process automatically based on consent or contract (Art. 28 DSG). You can also report a violation to the FDPIC (Art. 49 DSG) or enforce your claims through civil law.

We handle requests promptly and generally free of charge. To protect your rights, we require proof of identity. We may refuse, restrict, or defer a request as required by attorney-client privilege, overriding third-party interests, or our own overriding interests, if the request is obviously unfounded or vexatious (Art. 26 DSG) or if retention obligations contradict deletion. We will inform you of the reason.

To the extent that the European General Data Protection Regulation is applicable, you also have the rights of restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and complaint to a supervisory authority (Art. 77). We do not make automated individual decisions.

We may adjust this declaration at any time. The version published on our website is decisive.

Devon AG
Status: August 2026