Privacy Notice

Data Protection Statement

1. WHAT IS THIS PRIVACY NOTICE ABOUT?

Mercury Compliance AG ("Mercury", hereinafter also "we", "us") is a law firm based in Zurich. In the course of our business activities, we obtain and process personal data, in particular personal data about our clients, associated persons, counterparties, courts and authorities, correspondent law firms, professional and other associations, visitors to our website, participants in events, recipients of newsletters and other entities or, in each case, their contact persons and employees (hereinafter also "you"). In this privacy notice we inform you about these data processing operations. If you disclose data to us about other persons (e.g. family members, representatives, counterparties or other associated persons), we assume that you are authorized to do so and that these data are correct and that you have ensured that these persons are informed about this disclosure, insofar as a legal duty to inform applies (e.g. by bringing this privacy notice to their attention in advance).

2. WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?

The responsibility for the processing of your data as described in this privacy notice rests with: Mercury Compliance AG Bodmerstrasse 9 8002 Zurich +41 44 280 05 05 compliance@mercury.ch

3. FOR WHAT PURPOSES DO WE PROCESS WHICH OF YOUR DATA?

When you use our services, our website www.mercury.ch (hereinafter "Website"), or otherwise deal with us, we obtain and process various categories of your personal data. In principle, we may collect and otherwise process this data in particular for the following purposes:

  • Communication: we process personal data so that we can communicate with you and with third parties, such as parties to proceedings, courts or authorities, by e-mail, telephone, letter or otherwise (e.g. to answer inquiries, in the context of legal advice and representation, as well as the initiation or execution of contracts). This also includes that we may send our clients, contractual partners and other interested persons information about events, changes in the law, news about Mercury or similar. This may take the form of newsletters and other regular contacts (electronic, postal, telephone). You may refuse such communications at any time, or refuse or withdraw your consent to such communications. For this purpose, we process in particular the content of the communication, your contact data and the marginal data of the communication, but also image and audio recordings of (video) telephone calls. In the case of audio or video recording, we will inform you separately and you are free to inform us if you do not wish to be recorded or to terminate the communication. If we need or want to establish your identity, we will collect additional data (e.g. a copy of an identification document). -- 1 of 8 -- Privacy Notice Version 01.09.2023 Page 2 of 8
  • Initiation and conclusion of contracts: With regard to the conclusion of a contract, such as in particular a contract for the establishment of an attorney-client relationship, with you or your client or employer, which also includes the clarification of any conflicts of interest, we may in particular collect your name, contact details, powers of attorney, declarations of consent, information about third parties (e.g., contact persons, family details, and counterparties), contract content, date of conclusion, creditworthiness data and all other data that you provide to us or that we collect from public sources or third parties (e.g. commercial register, credit agencies, sanctions lists, media, legal protection insurance or the Internet).
  • Administration and processing of contracts: We obtain and process personal data so that we can comply with our contractual obligations towards our clients and other contractual partners (e.g. suppliers, service providers, correspondence law firms, project partners) and, in particular, so that we can provide and demand the contractual services. This also includes data processing for client management (e.g. legal advice and representation of our clients before courts and authorities and correspondence) as well as data processing for the enforcement of contracts (debt collection, legal proceedings, etc.), accounting and public communication (if permitted). For this purpose, we process in particular the data which we receive or have collected in the course of the initiation, conclusion and execution of the contract, as well as data which we generate in the course of our contractual services or which we collect from public sources or other third parties (e.g. courts, authorities, counterparties, information services, media, detective agencies or from the Internet). Such data may include, in particular, interview and consultation transcripts, notes, internal and external correspondence, contractual documents, documents that we create and receive in the course of proceedings before courts and authorities (e.g., complaints, appeals and complaints letters, judgments and decisions), background information about you, counterparties or other persons, as well as other mandate-related information, performance records, invoices, and financial and payment information.
  • Operation of our Website: In order to operate our website in a secure and stable manner, we collect technical data, such as IP address, information about the operating system and settings of your terminal device, region, time and type of use. In addition, we may use cookies and similar technologies. For more information, cf. section 8.
  • Improvement of our electronic offers: In order to continuously improve our website, we may collect data about your behavior and preferences by, for example, analyzing how you navigate through our website and how you interact with our social media profiles.
  • Security purposes and access controls: We obtain and process personal data to ensure and continuously improve the appropriate security of our IT and other infrastructure (e.g., buildings). This includes, for example, monitoring and controlling electronic access to our IT systems as well as physical access to our premises, analysis and testing of our IT infrastructures, system and error checks and the creation of security copies.
  • Adherence to laws, directives and recommendations of authorities and internal regulations ("Compliance"): We obtain and process personal data to comply with applicable -- 2 of 8 -- Privacy Notice Version 01.09.2023 Page 3 of 8 laws (e.g., anti-money laundering, tax obligations, or our professional duties), self-regulations, certifications, industry standards, our corporate governance, and for internal as well as external investigations to which we are a party (e.g., by a law enforcement or regulatory agency or an appointed private entity).
  • Risk management and corporate governance: We collect and process personal data in the context of risk management (e.g. to protect against criminal activities) and corporate governance. This includes, among other things, our business organization (e.g. resource planning) and corporate development (e.g. acquisition and sale of business units or companies).
  • Job application: If you apply for a job with us, we obtain and process the relevant data for the purpose of reviewing the application, carrying out the application procedure and, in the case of successful applications, for preparing and concluding a corresponding contract. For this purpose, in addition to your contact data and the information from the corresponding communication, we also process in particular the data contained in your application documents and the data as we can additionally obtain about you, for example from job-related social networks, the Internet, the media and from references, if you consent to us obtaining references.
  • Other purposes: other purposes include, for example, training and educational purposes and administrative purposes (e.g. accounting). Mercury's other legitimate interests are also among the other purposes, which cannot be listed exhaustively.

4. WHERE DOES THE DATA COME FROM?

  • From you: The majority of the data we process is provided by you (or your terminal device) to us (e.g., in connection with our services, use of our website, or communication with us). You are not obliged to disclose your data, with exceptions in individual cases (e.g. legal obligations). However, if you wish to conclude contracts with us or use our services, for example, you must provide us with certain data. The use of our website is also not possible without data processing.
  • From third parties: We may also take data from publicly available sources (e.g. debt collection registers, land registers, commercial registers, media or the Internet including social media) or receive such data from (i) public authorities, (ii) your employer or client who either has a business relationship with us or is otherwise involved with us, as well as from (iii) other third parties (e.g. clients, counterparties, legal protection insurers, credit agencies, address dealers, associations, contractual partners, Internet analysis services). This includes, in particular, the data we process in the course of initiating, concluding and executing contracts, as well as data from correspondence and discussions with third parties, but also all other categories of data pursuant to section 3. -- 3 of 8 -- Privacy Notice Version 01.09.2023 Page 4 of 8

5. TO WHOM DO WE DISCLOSE YOUR DATA?

In connection with the purposes listed in section 3, we transfer your personal data in particular to the categories of recipients listed below. If necessary, we obtain your consent for this or have our supervisory authority release us from our professional duty of confidentiality.

  • Service providers: We work with service providers in Switzerland and abroad who (i) process data on our behalf (e.g. IT providers), (ii) process data jointly with us or (iii) process data on their own responsibility that they have received from us or collected for us. (These service providers include, for example, IT providers, banks, insurance companies, debt collection companies, credit reporting agencies, address checkers, other law firms or consulting firms). We generally conclude contracts with these third parties regarding the use and protection of personal data.
  • Clients and other contractual partners: First of all, this refers to clients and other contractual partners of ours for whom the transfer of your data results from the contract (e.g., because you work for a contractual partner or he provides services for you). This category of recipients also includes entities with which we cooperate, such as other law firms in Switzerland and abroad. The recipients generally process the data under their own responsibility.
  • Authorities and courts: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if this is necessary for the fulfillment of our contractual obligations and in particular for the conduct of our mandate, or if we are legally obligated or authorized to do so, or if this appears necessary to protect our interests. These recipients process the data under their own responsibility.
  • Counterparties and persons involved: If necessary for the fulfillment of our contractual obligations, in particular for the management of the mandate, we also disclose your personal data to counterparties and other involved persons (e.g. guarantors, financiers, affiliated companies, other law firms, informants or experts, etc.).
  • Other persons: This refers to other cases where the involvement of third parties arises from the purposes set out in section 3. This concerns, for example, delivery addressees or recipients of payments specified by you, third parties in the context of representative relationships (e.g. your lawyer or your bank) or persons involved in official or legal proceedings. We may also disclose your personal data to our supervisory authority, in particular if this is necessary in individual cases to release us from our professional duty of confidentiality. If we cooperate with the media and provide them with material (e.g. photos), you may also be affected. In the course of our business development, we may sell or acquire businesses, operations, assets or companies, or enter into partnerships, which may also result in the disclosure of data (including data about you, e.g. as a client or supplier or as their representative) to the persons involved in these transactions. In the course of communications with our competitors, industry organizations, associations and other bodies, there may also be exchanges of data relating to you. -- 4 of 8 -- Privacy Notice Version 01.09.2023 Page 5 of 8 All of these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

6. DO YOUR PERSONAL DATA ALSO END UP ABROAD?

We process and store personal data mainly in Switzerland and in the European Economic Area (EEA), but potentially in any country in the world, depending on the case - for example, via subcontractors of our service providers or in proceedings before foreign courts or authorities. In the course of our activities for clients, your personal data may also end up in any country in the world. If a recipient is located in a country without adequate data protection, we contractually obligate the recipient to maintain an adequate level of data protection (for this purpose, we use the revised standard contractual clauses of the European Commission, which can be found here: https://eur- lex.europa.eu/eli/dec_impl/2021/914/oj?, including the supplements required for Switzerland), unless the recipient is already subject to a legally recognized set of rules to ensure data protection. We may also transfer personal data to a country without adequate data protection without concluding a separate contract for this purpose if we can rely on an exceptional provision for this purpose. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract that is in your interest requires such disclosure (e.g., if we disclose data to our correspondence offices), if you have given your consent or it is not possible to obtain your consent within a reasonable period of time and the disclosure is necessary to protect your life or physical integrity or that of a third party, or if the data in question has been made generally available by you and you have not objected to its processing. We may also rely on the exception for data from a register provided for by law (e.g. commercial register) to which we have been granted access. We may also rely on the exception for data from a register provided for by law (e.g. commercial register) to which we have been legitimately granted access.

7. WHAT RIGHTS DO YOU HAVE?

You have certain rights in connection with our data processing. In accordance with applicable law, you may, in particular, request information about the processing of your personal data, have incorrect personal data corrected, request the deletion of personal data, object to data processing, request the release of certain personal data in a standard electronic format or its transfer to other data controllers. If you wish to exercise your rights towards us, please contact us; you will find our contact details in section 2. In order for us to exclude any misuse, we must identify you (e.g. with a copy of your ID card, if necessary). Please note that these rights are subject to conditions, exceptions or limitations (e.g. to protect third parties or trade secrets or due to our professional duty of confidentiality).

-- 5 of 8 --

8. HOW ARE COOKIES AND SIMILAR TECHNOLOGIES USED ON OUR WEBSITE?

When using our website, data is generated that is stored in logs (especially technical data). In addition, we may use cookies and similar technologies (e.g. pixel tags or fingerprints) to recognize website visitors, evaluate their behavior and recognize preferences. A cookie is a small file that is transmitted between the server and your system and enables the recognition of a specific device or browser. You can set your browser to automatically reject, accept or delete cookies. You can also disable or delete cookies on a case-by-case basis. You can find out how to manage cookies in your browser in the help menu of your browser. Both the technical data we collect and cookies generally do not contain any personal data. We may also use social media plug-ins, which are small pieces of software that establish a connection between your visit to our website and a third-party provider. The social media plug-in tells the third-party provider that you have visited our website and may send the third-party provider cookies that the third- party provider has previously placed on your web browser. For more information about how these third- party providers use your personal data collected via their social media plug-ins, please refer to their respective privacy notices. In addition, we use our own tools as well as third-party services (which may in turn use cookies) on our website, in particular to improve the functionality or content of our website (e.g. integration of videos or maps), to compile statistics as well as to serve advertisements. Currently, we may in particular use offers of the following service providers and advertising partners, where their contact details and further information on the individual data processing is available in the respective privacy policy:

  • Google Analytics Provider: Google Ireland Privacy policy: https://support.google.com/analytics/answer/6004245 Information for Google accounts: https://policies.google.com/technologies/partner- sites?hl=de Some of the third-party providers we use may be located outside of Switzerland. You can find information on the disclosure of data abroad under section 6. In terms of data protection law, they are in part "only" order processors of us and in part responsible bodies. Further information on this can be found in the privacy notices.

9. HOW DO WE PROCESS PERSONAL DATA ON OUR PAGES IN SOCIAL NETWORKS?

We operate pages and other online presences on social networks and other platforms operated by third parties and process data about you in this context. In doing so, we receive data from you (e.g., when you communicate with us or comment on our content) and from the platforms (e.g., statistics). The providers of the platforms can analyze your usage and process this data together with other data they have about you. They also process this data for their own purposes (e.g., marketing and market research purposes and to administer their platforms), and act as their own data controllers for this purpose. For

-- 6 of 8 --

10. WHAT ELSE NEEDS TO BE CONSIDERED?

We do not assume that the EU General Data Protection Regulation ("GDPR") is applicable in our case. However, if this should exceptionally be the case for certain data processing operations, this section 10 shall apply in addition exclusively for the purposes of the GDPR and the data processing operations subject to it. We base the processing of your personal data in particular on the fact that

  • it is necessary for the initiation and conclusion of contracts and their administration and enforcement as described in section 3 (Art. 6 Para. 1 lit. b GDPR);
  • it is necessary for the protection of legitimate interests of us or of third parties as described in section 3, namely for communication with you or third parties to operate our website, to improve our electronic offerings and registration for certain offers and services, for security purposes, for compliance with Swiss law and internal regulations for our risk management and corporate governance and for other purposes such as training and education, administration, evidence and quality assurance, organization, implementation and follow-up of events and to protect other legitimate interests (cf. section 3) (Art. 6 para. 1 lit. f GDPR);
  • it is required or permitted by law on the basis of our mandate or our position under the law of the EEA or a member state (Art. 6 para. 1 lit. c GDPR) or is necessary to protect your vital interests or those of other natural persons (Art. 6 para. 1 lit. d GDPR);
  • you have separately consented to the processing, e.g. via a corresponding declaration on our website (Art. 6 para. 1 lit. a and Art. 9 para. 2 lit. a GDPR). We would like to point out that we generally process your data for as long as our processing purposes (cf. section 3), the legal retention periods and our legitimate interests, in particular for documentation and evidence purposes, require or storage is technically necessary (e.g. in the case of backups or document management systems). If there are no legal or contractual obligations or technical reasons to the contrary, we will delete or anonymize your data as a matter of principle after the storage or processing period has expired within the framework of our usual processes and in accordance with our retention policy. -- 7 of 8 -- Privacy Notice Version 01.09.2023 Page 8 of 8 If you do not disclose certain personal data, this may mean that it is not possible to provide the related services or conclude a contract. As a matter of principle, we indicate where personal data requested by us is mandatory. The right to object to the processing of your data as set out in section 7 applies in particular to data processing for the purpose of direct marketing. If you do not agree with our handling of your rights or data protection, please let us know (cf. contact details in section 2). If you are located in the EEA, you also have the right to complain to the data protection supervisory authority in your country. A list of the authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de.

11. CAN THIS PRIVACY NOTICE BE AMENDED?

This Privacy Policy is not part of any contract with you. We may modify this Privacy Notice at any time. The version published on this website is the current version.

-- 8 of 8 --