Last updated: 3 July 2026
GPA | LAW, Rue du 31-Décembre 47, 1211 Geneva, Switzerland (info@gpa.law) is responsible for the personal data described in this notice. We process personal data in accordance with the Swiss Federal Act on Data Protection (nFADP, in force since 1 September 2023) and, where we process data of individuals located in the EU or EEA, the EU General Data Protection Regulation (GDPR).
Data we collect and why
Website visits. Our hosting and content-delivery provider automatically logs technical access data each time you visit (IP address, browser type, pages visited, date and time). We use this solely to ensure the security and proper functioning of the website. Legal basis: legitimate interest (Art. 6 nFADP; Art. 6(1)(f) GDPR). Retention: 30 days.
Cookies. We use strictly necessary browser storage to remember your cookie preference. We do not use analytics, advertising, or other tracking cookies. For full details, please refer to our Cookie Policy.
Contact and mandates. When you contact us or engage our services, we process the personal data you provide (name, contact details, and matter-related information) to respond to your inquiry and provide our services. Legal basis: contract performance, legal obligation, or legitimate interest, depending on context (Art. 6 nFADP; Art. 6(1)(b), (c) and (f) GDPR).
Who we share your data with
We may share your personal data with IT and cloud service providers acting on our instructions (including our website hosting and backend providers), with courts, authorities, opposing parties, and other participants in a mandate, and with other third parties where required by law or where you have consented.
International transfers
Client and mandate data is stored in Switzerland. Our website is served through a content-delivery network (Cloudflare) and its content is hosted on Supabase. The website loads fonts from Google Fonts, which transmits your IP address to Google. These services may process data on servers outside Switzerland or the EEA, including in the United States. Where such transfers occur, or where a mandate requires a transfer, we ensure an appropriate level of protection through standard contractual clauses or, in the case of Google, its certification under the EU-US Data Privacy Framework.
Security and retention
We apply appropriate technical and organisational measures to protect your data. Client and mandate data is stored on servers in Switzerland (LawDesk / SmartIT Services AG and Microsoft 365). We keep your data only as long as necessary: server logs: 30 days; mandate files: 10 years.
Your rights
You have the right to access, correct, delete, or restrict the processing of your personal data, to receive it in a portable format, to object to its processing, and to withdraw any consent at any time without affecting prior processing. These rights are subject to applicable legal exceptions. To exercise them, write to us at info@gpa.law; we will respond within one month. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch, or, if you are in the EU or EEA, with your local data protection authority (http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm).
Changes to this notice
We may update this notice at any time. The current version is always available on our website, identifiable by the date shown at the top.
Contact
For data protection requests, please write to us at info@gpa.law.