Privacy policy

The controller for data processing in connection with this website is Prism Discovery AG, Cherstrasse 4, 8152 Glattbrugg, Switzerland.

For questions about data protection or to exercise your rights, contact us at info@prism-discovery.ch.

This policy applies to the website prism-discovery.ch and to contacting us by email or phone. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Data processed in client mandates (for example eDiscovery, investigations or the reporting channel) is not covered by this policy. It is governed by the respective contracts and data processing agreements.

Where the GDPR applies, we rely on the following legal bases: steps prior to and performance of a contract (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c)) and our legitimate interests (Art. 6(1)(f)), such as operating the website securely and answering enquiries.

When you open the website, your browser necessarily sends data to the web server. The server records your IP address, the date and time of access, the page or file requested, the amount of data transferred, the status code, the previously visited page (referrer) and your browser and operating system.

We need these server logs to deliver the website and keep it secure and stable, for example to fend off attacks. We do not analyse them for marketing, create user profiles or combine them with other data. They are deleted after 30 days at the latest, unless a security incident requires longer retention as evidence.

This website sets no cookies, uses no analytics or tracking tools and embeds no third-party content such as fonts, scripts, maps or videos. All fonts are loaded from our own server. Visiting the website therefore transfers no data to third parties other than our hosting provider.

The website is hosted by METANET AG, Josefstrasse 218, 8005 Zurich, Switzerland. The servers are located in data centres in Switzerland. METANET processes the server logs on our behalf and is contractually bound to confidentiality and data protection.

If you contact us by email or phone, we process the information you give us, usually your name, contact details, company and the content of your enquiry. We use this data to answer your enquiry and, where applicable, to prepare a mandate.

Please do not send confidential documents or sensitive personal data when you first contact us. We use email for contractual and organisational matters. We never exchange confidential client data by email; it is processed exclusively on our review platform in Switzerland.

We keep correspondence for as long as needed to deal with your request or as required by statutory retention obligations; business correspondence is generally kept for up to ten years (Art. 958f Swiss Code of Obligations).

If you apply for a job with us, we process your application documents solely for the application process. If you are not hired, we delete them no later than six months after the process ends, unless you have agreed to longer retention.

The website contains links to external services, such as our team members' LinkedIn profiles. These are simple links. No data is transferred to these providers until you click a link; from then on, that provider's privacy policy applies. For users in Switzerland and the EEA, LinkedIn is operated by LinkedIn Ireland Unlimited Company.

We do not sell personal data. We disclose it only where necessary for the purposes described: to service providers acting on our behalf (hosting, email and IT operations) and to authorities where we are legally required to do so.

Website data is processed exclusively in Switzerland. For email and office applications, not for client data from mandates, we use Microsoft 365, which may also process data in the EU and the USA. Microsoft is certified under the Swiss-U.S. Data Privacy Framework, for which the Swiss Federal Council has recognised an adequate level of data protection. In addition, the European Commission's standard contractual clauses in Microsoft's data protection addendum apply.

The website is delivered exclusively over encrypted HTTPS connections. We use multi-factor authentication for all our systems. We consistently sign our emails digitally with SwissSign certificates and encrypt them wherever the recipient supports it. Confidential client data is never exchanged by email but processed exclusively on our review platform; for other files we use our own file-exchange platform. We operate both on our own servers in a data centre in Switzerland.

We also protect personal data against unauthorised access, loss and misuse with further appropriate technical and organisational measures, which we review regularly.

Access: you can ask whether we process personal data about you, and which.

Rectification: you can have incorrect data corrected.

Erasure and restriction: you can ask us to delete your data or restrict its processing, unless a retention obligation applies.

Objection: you can object to processing based on our legitimate interests.

Data portability: you can ask us to hand over or transfer data you have provided to us in a common electronic format.

Withdrawal of consent: you can withdraw any consent you have given at any time, with effect for the future.

Send your request to info@prism-discovery.ch. We may ask for proof of identity so that data does not reach unauthorised persons. You also have the right to complain to the FDPIC (www.edoeb.admin.ch) or, where the GDPR applies, to a data protection supervisory authority in the EU or EEA.

We do not make automated individual decisions and do not carry out profiling.

We may update this privacy policy, for example when the website or the legal requirements change. The version published here applies.

Last updated: October 2026