1. Who we are
Bissessur is a law and tax practice with offices in the Netherlands and Switzerland. This statement explains how we handle personal data when you visit our website, contact us, subscribe to our updates or work with us.
The controllers of your personal data are:
- Bissessur Legal B.V., Schiphol Boulevard 127, 1118 BG Schiphol, the Netherlands. Chamber of Commerce number 84751789.
- Bissessur (Switzerland) B.V., Amsterdam, Zürich Branch, Dufourstrasse 49, 8008 Zürich, Switzerland. UID CHE-318.486.276. This entity is the controller for matters handled by our Zürich office.
For any question about this statement or your personal data, contact us at frontdesk@bissessur.legal or by post at the Schiphol address above.
We have not appointed a Data Protection Officer, as this is not required for a firm of our size and activities.
2. Personal data we collect through the website
We only collect what we need for the purpose concerned.
| Situation | Data | Purpose |
|---|---|---|
| Contact form | Name, email address, message, company, area of interest, country | To answer your enquiry and, where relevant, prepare a possible engagement |
| Newsletter sign-up | First and last name, email address, job title, company | To send you firm updates and insights you asked for |
| Visiting any page | IP address, browser type, date and time, pages requested (server logs) | To run the website securely and detect misuse |
| Website statistics | See section 3 | To understand how the website is used and improve it |
Both forms ask you to agree to this privacy statement before you submit. You can unsubscribe from the newsletter at any time through the link in each mailing or by emailing us.
We do not use the website to make automated decisions about you, and we do not sell personal data.
3. Cookies, statistics and embedded content
When you first visit the website, a cookie banner (Cookiebot) asks which cookies you accept. Strictly necessary cookies are always placed; other cookies only with your consent. You can change or withdraw your consent at any time via Cookie settings at the bottom of every page, or change your cookie settings here.
Website statistics (Matomo). We measure visits with Matomo, which we host ourselves on our own server in the Netherlands (stats.bissessur.legal). By default, Matomo runs without cookies and anonymises IP addresses before they are stored, so the statistics cannot be traced back to you; this measurement has little or no impact on your privacy and does not require consent. Only if you accept statistics cookies does Matomo also place its own first-party cookies, so that we can recognise returning visits. If you withdraw that consent, these cookies are removed. If your browser sends a "Do Not Track" signal, we do not record your visit at all. The statistics are not shared with third parties and are not used for advertising.
Google Maps. Our office pages can show an embedded Google Maps map. The map only loads after you accept marketing cookies; until then you see a link to open the location in Google Maps instead. When the map loads, Google receives your IP address and may place cookies. Google processes this data under its own privacy policy and may transfer it outside the EU.
Social media. Our website links to our LinkedIn, X and YouTube pages. These are plain links: no data is sent to those platforms until you click them. Once you are on their sites, their own privacy policies apply.
4. Clients, counterparties and business contacts
When we act for a client, we process the personal data needed to provide our services. This includes contact details of the client and its representatives, information in the file, correspondence and invoicing data. It may also include data about counterparties, witnesses and other people involved in the matter.
As lawyers we are bound by professional secrecy. We only share information from a file where the engagement requires it, where you have agreed, or where the law obliges us.
Under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) we must identify clients and, where applicable, their ultimate beneficial owners. For this we may ask for a copy of an identity document and check public registers and sanctions lists. We use this data only to meet these legal obligations.
For business contacts, such as people we meet at events or who exchange business cards with us, we keep basic contact details to stay in touch. We may invite them to events or send updates; they can opt out at any time.
5. Legal bases, service providers and transfers
We process personal data on these legal bases under the GDPR and, for our Zürich office, the Swiss Federal Act on Data Protection (FADP):
- Contract: to carry out an engagement or take steps at your request before one.
- Legal obligation: for client identification under the Wwft, tax and bookkeeping rules, and professional rules for lawyers.
- Legitimate interest: to answer enquiries, keep in touch with business contacts, and keep our website and systems secure.
- Consent: for the newsletter and for non-essential cookies, including statistics cookies and embedded maps. You can withdraw consent at any time.
We use the following service providers, who process data on our behalf under data processing agreements:
| Provider | Service | Location |
|---|---|---|
| TransIP | Website and statistics hosting | The Netherlands |
| Microsoft (Microsoft 365) | Email and document storage, including messages sent through our web forms | EU |
| Usercentrics / Cybot (Cookiebot) | Cookie consent management | EU |
We also work with other professionals where a matter requires it, such as courts, bailiffs, notaries, accountants and correspondent law firms. They receive only the data the matter needs.
If data is transferred outside the EU or Switzerland, for example to Google when you load an embedded map, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
6. How long we keep your data
We keep personal data no longer than needed for the purpose, unless the law requires a longer period.
| Data | Retention |
|---|---|
| Contact form messages that do not lead to an engagement | 12 months |
| Newsletter subscription | Until you unsubscribe |
| Server logs | 14 days |
| Website statistics (Matomo) | 25 months, then deleted or aggregated |
| Client identification records (Wwft) | 5 years after the end of the client relationship |
| Invoices and financial records | 7 years (Dutch tax law) |
| Client files | 7 years after closing the file |
7. Security, your rights and complaints
Security. We protect personal data with technical and organisational measures. These include encrypted connections (HTTPS), access restricted to people who need it, regular updates of our systems, and daily backups.
Your rights. You have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted, unless we must keep it by law;
- restrict or object to processing, including for direct marketing;
- receive your data in a structured, commonly used format (data portability);
- withdraw consent at any time, without affecting processing that took place before.
To exercise these rights, email frontdesk@bissessur.legal. We may ask you to confirm your identity and will respond within one month. Some rights are limited where our professional secrecy or legal obligations apply.
Complaints. If you are not satisfied with how we handle your data, please contact us first. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or, for our Zürich office, the Swiss Federal Data Protection and Information Commissioner (FDPIC).
Changes. We may update this statement when our services or the law change. The latest version is always on this page.
Last updated: 22 October 2026