We process your data under the revised Swiss Data Protection Act (revDPA) and, to the extent you order from the EU, under the GDPR. This notice explains what data we collect, how we use it, and how you can exercise your rights.
Send with subject "Data protection" to the same address. We'll reply within one working day.
Supervisory authority
Federal Data Protection and Information Commissioner (FDPIC), Bern
What data we process
We only process the data necessary to operate the shop and fulfil your order.
Order data. Name, delivery and billing address, email, optional telephone number, order contents, payment method identifier.
Account data. Email and password hash, if you create a customer account.
Usage data. IP address, browser type, device information, pages visited. To the extent required for secure operation and analytics measurement.
Communications. Contents of your enquiries when you contact us.
Purposes and legal basis
Contract performance. Order processing, shipping, payment, customer service.
Legal obligations. Accounting, tax law, food and medicinal product law.
Legitimate interests (Art. 31 para. 1 revDPA). Shop operation, IT security, fraud prevention, analytics measurement, ad optimisation. We balance our interests with your protectable interests and rely on the Swiss opt-out model.
Cookies and tracking
The revised Swiss Data Protection Act follows an opt-out model and — unlike the EU ePrivacy directive — does not require a consent banner for non-essential cookies. We therefore do not display a blocking cookie banner and instead inform you transparently here. You may object to data processing at any time (see "Your rights" and "Browser-side opt-out" below).
Data transfer to the United States. Google (Alphabet) and Meta partially process data in the US. Switzerland has, via the Swiss-US Data Privacy Framework (DPF), effective September 2024, an adequacy decision for the US. The named providers are DPF-certified.
Browser-side opt-out
Delete or block cookies and site storage via your browser settings (block third-party cookies by default).
Klaviyo unsubscribe: unsubscribe link in any newsletter or by email request to us.
Recipients and data processing
We only share personal data with the following recipients:
Shopify. Hosting the online shop and processing checkout.
Payment service providers. Depending on the payment method selected, exclusively for processing.
Shipping service providers. Swiss Post or comparable providers for delivery.
Authorities. To the extent legally required.
We have data processing agreements with all relevant service providers in accordance with Article 9 of the revised DPA.
Data retention
We retain order-related data for the legally required duration. In Switzerland, currently ten years for accounting-relevant records. We delete data that is no longer required earlier.
Your rights
Under the revised DPA and, where applicable, the GDPR, you can request:
Information about the data we process relating to you
Correction of inaccurate data
Deletion of your data, to the extent no retention obligation applies
Restriction of processing
Objection to processing based on legitimate interest
Data portability in a structured format or transfer to another data controller
How to exercise your rights
An informal email to Kontaktformular with subject "Data protection" is sufficient. For sensitive enquiries, we may ask for brief identity verification.
Making a complaint
You can file a complaint with the Federal Data Protection and Information Commissioner (FDPIC) if you believe that the processing of your data violates Swiss data protection law.
Data security
We implement technical and organisational measures in accordance with the state of the art to protect your data from unauthorised access, loss and alteration. TLS on every page, access to order data restricted to authorised personnel, passwords stored exclusively as hashes.
Updates
We will update this notice whenever legal or technical conditions change. You can always find the current version at this URL.
