Data Controller

The controller responsible for processing personal data in connection with this website and our services is:

If you have questions about data protection or wish to exercise your rights, you can contact us at the email address above.

Scope and Legal Framework

This privacy policy applies to our website, communications with HERA Accounts, and the processing of personal data in connection with our services.

We process personal data in accordance with applicable Swiss data protection law, particularly the Swiss Federal Act on Data Protection, FADP, and the associated Data Protection Ordinance.

Where the European General Data Protection Regulation, GDPR, applies, we also comply with its requirements. Depending on the purpose of the processing, we rely in particular on your consent, steps taken prior to entering into a contract, contractual performance, legal obligations, or overriding legitimate interests.

Personal Data We Process

Depending on the circumstances and the nature of our relationship, we may process the following categories of personal data:

• First name and last name.
• Company name and professional role.
• Postal address, email address, and telephone number.
• Information provided in contact requests and messages.
• Contractual, billing, and communication data.
• Financial, accounting, tax, or payroll information where required for an agreed engagement.
• Information concerning real estate or succession matters where required for an agreed engagement.
• Technical access data, particularly IP addresses, browser type, operating system, and the date and time of a website visit.

We generally process only the information required for the relevant purpose.

Purposes of Data Processing

We process personal data primarily for the following purposes:

• Operating, providing, and securing our website.
• Receiving and responding to contact requests.
• Preparing, entering into, and performing client engagements.
• Providing services related to fiduciary administration, accounting, taxation, real estate, advisory services, and succession planning.
• Communicating with clients and business partners.
• Issuing invoices and handling administrative matters.
• Complying with statutory retention, documentation, and disclosure obligations.
• Establishing, exercising, or defending legal claims.

We do not sell your personal data or use it to distribute a newsletter.

Contact Form and Other Communications

If you contact us through our contact form or by email, we process the information you provide to respond to your inquiry and address any related questions.

Depending on the form, this information may include your name, email address, company, telephone number, and the content of your message.

We retain this information only for as long as necessary to address your inquiry, prepare or perform an engagement, or comply with legal obligations.

Please do not use the general contact form to submit sensitive personal data, particularly health information, medical records, or details relating to patients. If such information is required for an engagement, we will agree on an appropriate and secure method of transmission.

Website Hosting Through WordPress.com

Our website is operated through WordPress.com, a service provided by Automattic and affiliated companies.

In connection with hosting and the technical operation of the website, the provider may process technical information. This includes IP addresses, device information, browser data, pages accessed, and the date and time of each visit.

This information is processed primarily to provide the website, maintain system security, detect misuse, and ensure technical functionality.

Depending on the service and technical configuration, data may also be processed outside Switzerland or the European Economic Area, particularly in the United States.

Further information about data processing by Automattic is available here:

Server Logs

When you visit our website, the hosting provider may automatically record information in server logs.

This information may include:

• IP address.
• Date and time of access.
• Pages or files accessed.
• Browser type and browser version.
• Operating system.
• Referring website, where available.

This information is used primarily to operate the website, maintain system stability, diagnose technical issues, and prevent unauthorized or abusive access.

Cookies and Similar Technologies

Our website or hosting provider may use cookies and similar technologies. Cookies are small text files stored on your device.

Essential cookies may be used to provide basic website functionality, maintain security, or save technical settings.

We do not operate a newsletter and, under our current configuration, do not independently integrate external analytics, advertising, or marketing services.

Depending on the WordPress.com subscription, platform features, and website settings, cookies, statistical functions, or consent mechanisms operated by the hosting provider may nevertheless be relevant.

Where consent is required, the relevant technologies are used only after that consent has been given.

You can configure your browser to block or delete cookies or allow them only in individual cases. This may limit the functionality of certain parts of the website.

Disclosure of Personal Data

We disclose personal data only where necessary to provide our services, operate our website, comply with legal obligations, or protect legitimate interests.

Potential recipients include:

• Hosting, IT, and communications providers.
• Providers of accounting, administrative, or business applications where these are used for a specific engagement.
• Tax authorities, social insurance institutions, or other competent authorities where disclosure is required for an engagement or by law.
• Banks, insurers, legal advisers, or other professionals where disclosure is necessary and permitted in connection with an engagement.

Service providers processing personal data on our behalf are selected in accordance with applicable legal requirements and are required to handle the data appropriately.

International Data Transfers

Personal data is generally processed in Switzerland or the European Economic Area where the services and technical systems used make this possible.

If internationally active service providers are involved, particularly WordPress.com for website hosting, personal data may also be processed in or transferred to other countries, including the United States.

Where personal data is transferred to countries without an adequate level of statutory data protection, we rely, where necessary, on appropriate safeguards, particularly recognized standard contractual clauses, or on an exception provided by law.

Confidentiality in Healthcare Engagements

When providing services to medical practices, clinics, or other healthcare organizations, confidential information may be processed depending on the nature of the engagement.

Sensitive personal data, particularly health information, is processed only where necessary for the specific engagement and where the applicable legal requirements are satisfied.

Together with our clients, we take appropriate organizational and technical measures and maintain a level of confidentiality suited to the relevant engagement.

General contact forms must not be used to submit patient information or medical records.

Data Security

We take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or unauthorized alteration.

Security measures are adjusted according to technical possibilities and the nature of the data being processed.

Information transmitted over the internet may be exposed to security risks. Complete protection against access by third parties cannot be guaranteed.

Data Retention

We retain personal data only for as long as necessary for the relevant processing purpose, the performance of an engagement, the protection of legal claims, or compliance with statutory retention obligations.

Business documents may need to be retained for several years under commercial, tax, or social insurance regulations. Where the statutory retention requirement for accounting records and supporting documents applies, the retention period is generally ten years.

Once the applicable retention period has expired, personal data is deleted, anonymized, or otherwise handled in accordance with applicable legal requirements.

Your Rights

Subject to applicable data protection law, you may exercise the following rights:

• Request information about whether we process your personal data and, if so, which data is processed.
• Request the correction of inaccurate personal data.
• Request the deletion of personal data where no legal or contractual retention obligations prevent this.
• Request the release or transfer of certain personal data where the relevant legal requirements are satisfied.
• Withdraw previously given consent with effect for the future.
• Object to certain processing activities where the applicable law provides such a right.
• Exercise additional rights under the GDPR where that regulation applies.

To exercise your rights, please contact us at:

You may also contact the Swiss Federal Data Protection and Information Commissioner, FDPIC, or another competent data protection authority where applicable.

Changes to This Privacy Policy

We may update this privacy policy if our services, data processing activities, technical infrastructure, or legal requirements change.

The current version published on this website applies.