Privacy Policy.
What is actually collected when you browse or contact us, who receives it, how long it is kept, and your rights – under Israel's Protection of Privacy Law as amended by Amendment 13.
Effective: 4 November 2026 · Last updated: 4 November 2026 · Version 3
What changed in version 3: we added details on the use of AI tools (sections 5, 6 and 9), on sensitive information (section 3), on visitors and enquirers from the EU (section 11) and on the fields of the booking page.
1. Who we are and why this document exists
This policy covers the website schwebel-law.com (the "Site") and enquiries that reach us through it. The controller is Schwebel Law, Adv. Yona Schwebel, Israel. Privacy questions: yona@schwebel-law.com.
It is written to satisfy section 11 of Israel's Protection of Privacy Law, 5741-1981, as amended by Amendment 13 (in force 14 August 2025), and the Privacy Protection Authority's guideline on the duty to notify. It describes what is actually collected – not what "may" be. The firm is not required to appoint a privacy protection officer under section 17B1 of the Law and has not appointed one.
2. Notice under section 11 – when you contact us
There is no form on this Site. When you email, call, or book a call through the scheduling link, you give us information. Under section 11 of the Law, here is what you should know before you do:
- Purpose: to reply to you, run a conflict-of-interest check, and decide together whether the firm is the right fit. If an engagement follows – to handle the matter.
- You are under no legal obligation to provide the information. It is voluntary. Without contact details we cannot get back to you; you can always phone without leaving details.
- Who receives it: the infrastructure providers listed in section 5 (email, hosting, scheduling), the AI tool provider the firm uses (section 9), and other lawyers only if you ask or agree that we involve them in your matter.
- Your rights: to inspect the information (section 13 of the Law) and to correct it (section 14), as set out in section 8 below.
3. What we collect, from where, why, and for how long
| Category | Source | Purpose | Basis | Retention |
|---|---|---|---|---|
| Technical browsing data: IP address, browser and operating system, page URL, referrer, request time | Collected automatically by the Cloudflare infrastructure that hosts and protects the Site | Serving the Site, defending against attacks and abuse, fault monitoring | Legitimate interest in operating and securing the Site | In Cloudflare's infrastructure logs under its own policy; the firm neither receives nor keeps identifying logs |
| An enquiry by email or phone: name, contact details, the content of your message and any documents you attach | You | Replying, conflict check, opening a file | Your consent; after engagement – providing the legal service and legal obligations | An enquiry that does not become an engagement – 12 months; a client file – 7 years from the end of the engagement or of the legal proceedings, unless otherwise agreed in writing (section 90A of the Israel Bar Association Law, 5721-1961); documents listed in the Law's Second Schedule, such as wills, for the periods set there |
| Booking a meeting: the fields depend on the type of meeting – name, email, phone, time zone and the email addresses of any other participants you add; for an introductory call, also the topic you choose to enter | You, on the firm's booking page (Microsoft Bookings, part of Microsoft 365) | Scheduling the meeting and sending a confirmation and reminder | Your consent | 12 months from the call |
What is not collected: the Site sets no cookies, runs no analytics, advertising pixels or chat, and loads no fonts or scripts from third-party servers. There is no form, registration or user account.
Sensitive information: information about a person’s state of health, including medical information, is “information of special sensitivity” under section 3 of the Protection of Privacy Law, 5741-1981. The firm treats information about disability and diagnoses in the same way. Such information is collected only at a meeting, and only to the extent needed for your matter. Please do not send medical information by email or through the booking page.
4. Why we do not ask for cookie consent
Because there are no cookies. Any technology that would need cookies or a persistent identifier will be added only after this policy is updated, and will appear in section 3.
5. Who we share information with
- Cloudflare, Inc. (USA) – hosting, content delivery, security. Processes technical browsing data as a service provider.
- Microsoft Ireland Operations Ltd. / Microsoft Corporation – the firm's email, calendar and booking page (Microsoft 365, including Microsoft Bookings). Email enquiries and booked calls are stored there. The firm’s email and documents are currently stored in Israel.
- Anthropic, PBC (USA) – the AI tool Claude, under a business licence, which the firm uses in its legal work (see section 9).
- Other lawyers and advisers – only on your matter, only when needed, and only after we have discussed it with you.
- Authorities – where required by law, court order or a lawful demand.
We do not sell information, do not use it for advertising, and do not pass it on for anyone's direct marketing.
6. Transfers outside Israel
The firm’s email and documents in Microsoft 365 are currently stored in Israel; Microsoft may also process data outside Israel under its terms. Cloudflare also processes technical browsing data on servers outside Israel. Information entered into Claude is processed in several regions and stored on servers in the United States.
Where information is transferred outside Israel, the transfer is made under Regulations 2(4) and 3 of the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001, on the basis of the recipient’s written undertaking to comply with the conditions that apply to a database in Israel: the Cloudflare Customer DPA, incorporated into Cloudflare’s subscription agreement; the Microsoft Products and Services DPA, which applies to Microsoft 365 under Microsoft’s Product Terms; and the Anthropic DPA, incorporated into Anthropic’s Commercial Terms.
7. Security
Traffic to the Site is encrypted (HTTPS); the Site runs no third-party code and protects itself with a strict Content Security Policy; access to the firm's email and documents is protected by access control and two-factor authentication. The firm follows the Protection of Privacy Regulations (Data Security), 5777-2017, at the security level that applies to it. No system is completely immune, and we do not promise absolute security. In a security incident that may affect you, we will notify you as the law requires.
8. Your rights
- Access to the information held about you (section 13 of the Law).
- Correction or deletion of information that is inaccurate, incomplete or out of date (section 14).
- Portability – on request, we will give you the information you provided in a structured, machine-readable format.
- Deletion and objection – asking us to delete an enquiry that did not become an engagement, and asking us not to contact you again.
- Complaint to the Privacy Protection Authority: ppa@justice.gov.il.
To exercise a right, email yona@schwebel-law.com. We will respond within 30 days. Information covered by lawyer–client privilege or by statutory retention duties may be excluded from some rights; if so, we will explain why.
9. Artificial intelligence and automated decisions
The firm uses Anthropic’s Claude under a business licence, and Microsoft 365. Under the provider’s terms, information entered into Claude under this licence is not used to train models; it is processed and stored on servers outside Israel. The firm’s email and documents in Microsoft 365 are currently stored in Israel. Sensitive information, including medical information, is entered into these tools only when needed for your matter, and only to the minimum extent necessary. Every document, agreement and opinion is reviewed and approved by the lawyer, who bears full responsibility for it.
The Site makes no automated decisions about you and builds no profiles, and no decision on a client’s matter is made by an automated system. See also our approach.
10. Minors
The Site is intended for adults. We do not knowingly collect information from minors; if we discover that we have, we will delete it.
11. Visitors and enquirers from the European Union
Where the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) applies to the processing of your information – for example because you are in the Union and approach the firm for its services (Article 3(2)) – the following also applies:
- Controller: the firm, as set out in section 13.
- Legal bases: legitimate interests in operating and securing the Site (Article 6(1)(f)); your consent, or steps you request before an engagement – enquiries and bookings (Articles 6(1)(a) and 6(1)(b)); performance of the engagement (Article 6(1)(b)); and compliance with legal obligations that apply to the firm (Article 6(1)(c)).
- Health information: processed on the basis of your explicit consent (Article 9(2)(a)), or where necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f)).
- Transfers: Israel is covered by a European Commission adequacy decision (Decision 2011/61/EU, under Article 45), which the Commission reaffirmed in its review of 15 January 2024. Transfers to providers outside Israel are made under their data processing addenda, listed in section 6.
- Your rights: in addition to the rights in section 8 – the rights under Articles 15 to 22, including restriction, objection and portability; withdrawing consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)); and lodging a complaint with an EU supervisory authority (Article 13(2)(d)).
- EU representative: the firm has not appointed a representative in the Union, as its processing is occasional and does not include large-scale processing of special categories of data (Article 27(2)(a)).
12. Changes
An updated version will be published on this page with a new effective date and version number. A material change – such as adding analytics or a form – will be flagged at the top of the page for 30 days. Previous versions are kept by the firm.
13. Contact
Schwebel Law
Adv. Yona Schwebel
Email: yona@schwebel-law.com
Phone: +972 54 288 9554
Israel