Se rendre au contenu

Legal information

Privacy notice

1. Who is responsible2. What data I process and why3. Who receives your data4. Data abroad5. How long I keep data6. Cookies and website statistics7. How I protect your data8. Your rights9. Changes to this notice10. Visitors and contacts in the EU or EEA

Last updated: 2 November 2026

This notice explains how I handle personal data when you visit ondemandlegal.ch, contact me, work with me, or are mentioned in documents I work on. I keep it short and in plain language. If anything is unclear, please ask me.

1. Who is responsible

Todd Wharton, trading as Wharton On Demand Legal (sole proprietorship), Theodorsgraben 10, 4058 Basel, Switzerland. Email: twharton@ondemandlegal.ch. Telephone: +41 79 250 7895.

In this notice, “I” and “me” mean Todd Wharton.

2. What data I process and why

Website visits. When you visit my website, my hosting provider processes technical data such as your IP address, browser type, the pages you view and the time of your visit. This is needed to deliver the website and keep it secure. In addition, I measure how the website is used in two ways: with a statistics tool run by my website provider that sets no cookies, and, only if you click “I agree” on the cookie banner, with Google Analytics. Details are in section 6.

Enquiries. When you write to me or use the contact form, I process your name, email address and, if you give them, your telephone number, company and message. I use them to reply and, if we decide to work together, to set up the engagement. Please do not include confidential information in the contact form. The contact form is protected against spam by Google reCAPTCHA (see sections 3, 4 and 6).

Clients. For the companies I work for, I process the names, roles and contact details of the people I deal with, engagement and billing details, and our correspondence. I use them to provide my services, run conflict checks, invoice, keep accounting records required by law, and protect my legal position if a dispute arises.

People mentioned in client documents. Contracts and correspondence I review often contain names, roles and contact details of other people, for example a counterparty’s staff. I receive this data from my client and use it only to provide my services to that client.

Business contacts. I keep the contact details of people I meet through my work and networks, such as chambers of commerce and LinkedIn, to stay in touch. You can ask me to stop at any time.

Testimonials. With the person’s written consent, I publish a client’s name, role, company and recommendation on my website and on LinkedIn. You can ask me to remove it at any time by writing to twharton@ondemandlegal.ch.

I do not sell personal data, I do not use it for advertising, and I make no automated decisions about anyone.

3. Who receives your data

I share personal data only where needed for the purposes above:

  • Website hosting and visitor statistics: Odoo S.A., Belgium, which hosts my website and its contact form and runs the visitor statistics tool mentioned above.
  • Spam protection on the contact form: Google (reCAPTCHA), acting on my behalf. See sections 4 and 6.
  • Website visit measurement: Google, only if you click “I agree” on the cookie banner (Google Analytics). See sections 4 and 6.
  • Email, calendar, file storage and video calls: Proton AG, Switzerland. I use Proton Meet for video calls unless you prefer another platform.
  • Your own platforms: if you ask me to use your video platform (for example Microsoft Teams), your e-signature platform or your systems, your provider’s terms apply to that use.
  • Others where necessary: Swiss counsel you engage directly, with your consent; my professional advisers and insurer, who are bound by confidentiality; my Swiss bank, for payments; and courts or authorities where the law requires.

4. Data abroad

Some of my providers store data outside Switzerland:

  • Odoo: France and Belgium, with backups in France, the Netherlands, Sweden and Canada.
  • Proton: Switzerland, Germany and Norway.
  • Google (Google Analytics, only with your consent): the United States and other countries where Google operates. Google LLC is certified under the Swiss-US Data Privacy Framework; where that does not apply, Google relies on standard contractual clauses.
  • Google (reCAPTCHA on the contact page): the United States and other countries where Google operates, under the same safeguards as for Google Analytics.

Odoo’s and Proton’s countries listed above are recognised by the Swiss Federal Council as providing adequate data protection. If I ever use a provider in a country without that recognition, I will rely on safeguards recognised under Swiss law, such as standard contractual clauses, or on a legal exception.

I do not enter names, contact details or other details that identify you, your counterparties or your matter into AI tools. AI providers therefore do not receive your personal data from me.

5. How long I keep data

  • Enquiries that do not lead to an engagement: 12 months after our last contact.
  • Client files (engagement letter, advice, key correspondence): ten years after the engagement ends.
  • Invoices and accounting records: ten years, as Swiss law requires.
  • Website statistics: Google Analytics data is kept for up to 14 months after your last visit.

After that, I delete the data or make it anonymous, unless the law requires me to keep it longer.

6. Cookies and website statistics

Cookies that are always set. My website sets a few cookies that it needs to work: your language, your time zone, your display setting and your cookie choice (technical names: frontend_lang, tz, color_scheme, website_cookies_bar and cids). A further technical cookie (session_id) is set if you use a function that needs it. These cookies do not identify you and are not used for advertising.

Google Analytics, only if you agree. If you click “I agree” on the cookie banner, my website loads Google Analytics, a tool from Google, which sets cookies (_ga and _ga_YLVJQTHBQ6) and receives information about your visit, such as the pages you view, how long you stay, your approximate location, your device and browser, and how you reached my site. I use this to understand which parts of my website are useful and to improve it. Google does not store your full IP address in Google Analytics. If you click “Only essentials”, or ignore the banner, Google Analytics is not loaded and Google receives no analytics information from my website about your visit. The contact page is the one exception, described next.

Spam protection on the contact page. The contact page loads Google reCAPTCHA, which checks in the background that the form is being filled in by a person and not by a bot. To do this, reCAPTCHA receives technical data about your visit, such as your IP address and browser details, and uses a technical cookie (_GRECAPTCHA). It is used for the contact form whichever choice you make on the cookie banner, because it is a security function. Google acts on my behalf in doing this.

Visitor statistics from my website provider. My website also uses a statistics tool (Plausible) that Odoo runs for its customers. It counts visits and page views without setting any cookie. It is active for all visitors, whichever choice you make on the cookie banner.

Changing your mind. You can withdraw your choice at any time by deleting this website’s cookies in your browser settings; the cookie banner then appears again. You can also block cookies in your browser. A longer technical list is on the Cookie Policy page.

I use Google Search Console and Bing Webmaster Tools to see general statistics about how my website appears in search results. These services do not receive information about your visit from my website.

7. How I protect your data

Confidentiality is central to my work. Everything clients share with me is kept strictly confidential under my General Terms of Engagement. In practice:

  • Swiss-based secure provider. I use Proton, a Swiss company known for its encryption, for email, file storage and video calls (Proton Meet by default).
  • Encrypted email and files on request. Emails between Proton users are end-to-end encrypted. For other recipients, I can send password-protected, encrypted emails and secure file links instead of attachments.
  • Your systems if you prefer. If your company wants me to use its own email, platform or document system, I will.
  • Careful use of AI. I never enter information that could identify you, your counterparties or your matter into AI tools, and I use them only with settings that prevent training on my inputs.
  • Protected devices. My computers and phone are encrypted and protected by strong passwords and two-factor authentication.

8. Your rights

You can ask me what personal data I hold about you, and ask me to correct or delete it or to stop using it. In some cases you can also receive your data in a common electronic format. To do so, write to twharton@ondemandlegal.ch. I may need to confirm your identity.

I may refuse or limit a request where the law allows, for example where I must keep data by law or where my confidentiality duties to a client prevent disclosure.

If you are not satisfied with my reply, you can contact the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.

9. Changes to this notice

I may update this notice. The current version is always on this page, with the date it was last updated.

10. Visitors and contacts in the EU or EEA

Where the EU General Data Protection Regulation (GDPR) applies, I process your data to perform a contract or take steps before one, to meet legal obligations, for my legitimate interests in running and protecting my business, or with your consent. You have the rights described in the GDPR, including the right to lodge a complaint with the data protection authority in your country.