Privacy policy
Last updated: 6 October 2026
The controller within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is:
RePan.ch
Dominic Müller
Tannenweg 3
5746 Walterswil
Phone: +41 (0)78 257 04 50
Email:
Website: https://repan.ch
In short: how our website works
The legal sections below are long. Here is, in plain words, what data is generated when you visit repan.ch, where it goes and how you stay in control. Skip to the legal provisions
Where the website runs
repan.ch is run by Vercel on servers in Frankfurt (EU). We cache product data such as prices and stock pans so the site loads quickly (Upstash). This cache contains no personal data. We serve our fonts ourselves, so your browser doesn’t load anything from Google for them.
Cart and order
The cart and orders run on our own shop system (WooCommerce). For an order, we need your name, address, email address and phone number. We only use this information to process your order, send you the pans and reach you if there are questions.
Address and pick-up
While you type your address, MapTiler suggests matching addresses; the text you type is sent to MapTiler for this. We check the chosen address with Swiss Post. If you have your pans picked up, we pass the address and pick-up date on to Swiss Post (pick@home).
Payment
Payment takes place on the payment provider’s page: zahls.ch (TWINT, card, PostFinance, Apple Pay) or PayPal. We never see card or bank details; we only receive confirmation of whether the payment went through.
Statistics with PostHog
To understand how the website is used and where it gets stuck, we use PostHog. The data is stored in the EU (Frankfurt), and IP addresses are anonymised. We record:
- pages viewed, clicks and how far you scroll (also as a heatmap)
- loading times and technical errors
- the key steps in the shop: adding a pan to the cart, checkout, order (with order number, amount and payment method)
- session recordings: a replay of how someone moves through the site. Everything typed into form fields is masked. Recordings are deleted after 30 days.
We don’t send names, email addresses or phone numbers to PostHog. For the statistics, your browser gets a random ID that doesn’t reveal who you are. We don’t use the data for advertising and don’t pass it on.
Statistics are on unless you turn them off. You can turn them off at any time in the cookie settings (link at the very bottom of this page and in the footer). After that, your browser no longer sends any data to PostHog.
What is stored in your browser
- Necessary: your cookie settings (1 year), the chosen language, the shop’s cart session (90 days) and the cart itself. Your contact details from checkout are only kept until you close the tab, so you don’t have to type them again after a cancelled payment.
- Statistics: the random PostHog ID, only while statistics are on.
We don’t use advertising or marketing cookies.
Principles
1. General note
Based on Article 13 of the Swiss Federal Constitution and the federal data protection provisions (Data Protection Act, FADP), everyone has the right to protection of their privacy and to protection against misuse of their personal data. The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
In cooperation with our hosting providers, we strive to protect the databases as well as possible against unauthorised access, loss, misuse or falsification.
Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.
By using this website, you consent to the collection, processing and use of data as described below. This website can generally be visited without registration. Data such as the pages accessed or the names of the files retrieved, date and time are stored on the server for statistical purposes without this data being directly related to you. Personal data, in particular name, address or email address, is collected on a voluntary basis as far as possible. Data is not passed on to third parties without your consent.
2. Processing of personal data
Personal data is any information relating to an identified or identifiable person. A data subject is a person whose personal data is processed. Processing includes any handling of personal data, regardless of the means and procedures used, in particular storing, disclosing, obtaining, deleting, saving, modifying, destroying and using personal data.
We process personal data in accordance with Swiss data protection law. In addition, where and insofar as the EU GDPR applies, we process personal data on the following legal bases in connection with Art. 6(1) GDPR:
- Consent (Art. 6(1) sentence 1 lit. a GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
- Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
- Legal obligation (Art. 6(1) sentence 1 lit. c GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
- Protection of vital interests (Art. 6(1) sentence 1 lit. d GDPR) – Processing is necessary to protect the vital interests of the data subject or of another natural person.
- Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
- Application procedure as a pre-contractual or contractual relationship (Art. 9(2) lit. b GDPR) – Where special categories of personal data within the meaning of Art. 9(1) GDPR (e.g. health data, such as severe disability status or ethnic origin) are requested from applicants in the course of the application procedure so that the controller or the data subject can exercise the rights arising from employment law and social security and social protection law and fulfil their obligations in this respect, they are processed in accordance with Art. 9(2) lit. b GDPR; in the case of protecting the vital interests of applicants or other persons in accordance with Art. 9(2) lit. c GDPR; or for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, for medical diagnosis, health or social care or treatment, or for the management of health or social care systems and services in accordance with Art. 9(2) lit. h GDPR. Where special categories of data are disclosed on the basis of voluntary consent, they are processed on the basis of Art. 9(2) lit. a GDPR.
We process personal data for as long as is necessary for the respective purpose or purposes. Where longer retention obligations apply due to statutory or other obligations to which we are subject, we restrict processing accordingly.
3. Relevant legal bases
In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. If the legal basis is not stated in the privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1) lit. a and Art. 7 GDPR; the legal basis for processing to provide our services and carry out contractual measures and to answer enquiries is Art. 6(1) lit. b GDPR; the legal basis for processing to fulfil our legal obligations is Art. 6(1) lit. c GDPR; and the legal basis for processing to protect our legitimate interests is Art. 6(1) lit. f GDPR. Where vital interests of the data subject or another natural person make the processing of personal data necessary, Art. 6(1) lit. d GDPR serves as the legal basis.
4. Security measures
In accordance with the legal requirements and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.
These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access to, input, disclosure, securing of availability and separation of the data. We have also established procedures to ensure that data subjects’ rights are exercised, data is deleted and threats to the data are responded to. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.
5. Transfer of personal data
In the course of our processing of personal data, the data may be transferred or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.
6. Data processing in third countries
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if processing takes place in the context of using third-party services or disclosing or transferring data to other persons, bodies or companies, this is done only in accordance with the legal requirements.
Subject to express consent or a transfer required by contract or law, we only process data in third countries with a recognised level of data protection, on the basis of a contractual obligation through the standard contractual clauses of the EU Commission, where certifications exist or on the basis of binding corporate rules (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).
Cookies and encryption
7. Privacy policy for cookies
This website uses cookies. Cookies are text files that contain data from visited websites or domains and are stored by a browser on the user’s computer. A cookie is primarily used to store information about a user during or after their visit to an online service. The stored information may include, for example, the language settings on a website, the login status, a shopping cart or the point at which a video was watched. We also include in the term cookies other technologies that fulfil the same functions as cookies (e.g. when user information is stored using pseudonymous online identifiers, also referred to as “user IDs”).
The following cookie types and functions are distinguished:
- Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their browser.
- Permanent cookies: Permanent cookies remain stored even after the browser is closed. For example, the login status can be saved or preferred content displayed directly when the user visits a website again. Likewise, user interests used for reach measurement or marketing purposes can be stored in such a cookie.
- First-party cookies: First-party cookies are set by ourselves.
- Third-party cookies: Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
- Necessary (also: essential or strictly necessary) cookies: Cookies may be strictly necessary for the operation of a website (e.g. to store logins or other user input or for security reasons).
- Statistics, marketing and personalisation cookies: Cookies are also generally used for reach measurement and when a user’s interests or behaviour (e.g. viewing certain content, using functions, etc.) on individual websites are stored in a user profile. Such profiles are used, for example, to show users content that matches their potential interests. This procedure is also referred to as “tracking”, i.e. following the potential interests of users. Insofar as we use cookies or “tracking” technologies, we inform you separately in our privacy policy or when obtaining consent.
Notes on legal bases: The legal basis on which we process your personal data using cookies depends on whether we ask you for consent. If so and you consent to the use of cookies, the legal basis for processing your data is the consent given. Otherwise, the data processed using cookies is processed on the basis of our legitimate interests (e.g. in the business operation of our online service and its improvement) or, if the use of cookies is necessary, to fulfil our contractual obligations.
Storage period: Unless we give you explicit information on the storage period of permanent cookies (e.g. as part of a so-called cookie opt-in), please assume that the storage period can be up to two years.
General information on withdrawal and objection (opt-out): Depending on whether the processing is based on consent or a legal permission, you have the option at any time to withdraw consent given or to object to the processing of your data by cookie technologies (collectively referred to as “opt-out”). You can first declare your objection using your browser settings, e.g. by deactivating the use of cookies (which may also limit the functionality of our online service). An objection to the use of cookies for online marketing purposes can also be declared for a large number of services, especially in the case of tracking, via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. You can also find further information on objections in the information on the service providers and cookies used.
Processing of cookie data on the basis of consent: We use a cookie consent management procedure in which users’ consent to the use of cookies, or to the processing operations and providers named in the cookie consent management procedure, is obtained and can be managed and withdrawn by users. The declaration of consent is stored so that it does not have to be requested again and so that consent can be proven in accordance with the legal obligation. Storage can take place on the server and/or in a cookie (so-called opt-in cookie, or using comparable technologies) in order to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following applies: consent can be stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g. which categories of cookies and/or service providers) and the browser, system and device used.
- Types of data processed: usage data (e.g. websites visited, interest in content, access times), meta and communication data (e.g. device information, IP addresses).
- Data subjects: users (e.g. website visitors, users of online services).
- Legal bases: consent (Art. 6(1) sentence 1 lit. a GDPR), legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
8. Privacy policy for SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, such as enquiries you send to us as the site operator, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser’s address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.
When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Privacy policy for server log files
The provider of this website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:
- browser type and browser version
- operating system used
- referrer URL
- host name of the accessing computer
- time of the server request
This data cannot be assigned to specific persons. This data is not combined with other data sources. We reserve the right to check this data retrospectively if we become aware of specific indications of unlawful use.
Forms and embedded services
9. Third-party services
This website may use Google Maps for embedding maps, Google Invisible reCAPTCHA for protection against bots and spam, and YouTube for embedding videos.
These services of the American Google LLC use cookies, among other things, and as a result data is transferred to Google in the USA; we assume that no personal tracking takes place in this context solely through the use of our website.
Google has committed to ensuring adequate data protection in accordance with the US-European and US-Swiss Privacy Shield.
Further information can be found in Google’s privacy policy.
10. Privacy policy for the contact form
If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent.
11. Privacy policy for the comment function on this website
For the comment function on this website, in addition to your comment, information on the time the comment was created, your email address and, if you do not post anonymously, the user name you have chosen are stored.
Storage of the IP address
Our comment function stores the IP addresses of users who write comments. As we do not check comments on our site before they are published, we need this data in order to be able to take action against the author in the event of legal violations such as insults or propaganda.
Your rights
12. Rights of data subjects
Right to confirmation
Every data subject has the right to request confirmation from the website operator as to whether personal data concerning them is being processed. If you wish to exercise this right to confirmation, you can contact the data protection officer at any time.
Right of access
Every person whose personal data is processed has the right to obtain from the operator of this website, at any time and free of charge, information about the personal data stored about them and a copy of this information. Furthermore, information may be provided about the following where applicable:
- the purposes of the processing
- the categories of personal data processed
- the recipients to whom the personal data has been or will be disclosed
- if possible, the planned period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period
- the existence of a right to rectification or erasure of the personal data concerning them, or to restriction of processing by the controller, or a right to object to such processing
- the existence of a right to lodge a complaint with a supervisory authority
- if the personal data is not collected from the data subject: all available information about the source of the data
Furthermore, the data subject has the right to be informed whether personal data has been transferred to a third country or to an international organisation. If this is the case, the data subject also has the right to obtain information about the appropriate safeguards in connection with the transfer.
If you wish to exercise this right of access, you can contact our data protection officer at any time.
Right to rectification
Every person whose personal data is processed has the right to demand the immediate rectification of inaccurate personal data concerning them. Furthermore, taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.
If you wish to exercise this right to rectification, you can contact our data protection officer at any time.
Right to erasure (right to be forgotten)
Every person whose personal data is processed has the right to demand that the controller of this website erase the personal data concerning them without delay, provided that one of the following grounds applies and insofar as the processing is not necessary:
- The personal data was collected or otherwise processed for purposes for which it is no longer necessary
- The data subject withdraws the consent on which the processing was based, and there is no other legal ground for the processing
- The data subject objects to the processing on grounds relating to their particular situation and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing in the case of direct marketing and related profiling
- The personal data has been processed unlawfully
- The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject
- The personal data was collected in relation to the offer of information society services directly to a child
If one of the above grounds applies and you wish to have personal data stored by the operator of this website erased, you can contact our data protection officer at any time. The data protection officer of this website will ensure that the erasure request is complied with immediately.
Right to restriction of processing
Every person whose personal data is processed has the right to demand that the controller of this website restrict processing if one of the following conditions is met:
- The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data
- The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of its use instead
- The controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims
- The data subject has objected to processing on grounds relating to their particular situation, and it is not yet clear whether the legitimate grounds of the controller override those of the data subject
If one of the above conditions is met and you wish to request the restriction of personal data stored by the operator of this website, you can contact our data protection officer at any time. The data protection officer of this website will arrange for the restriction of processing.
Right to data portability
Every person whose personal data is processed has the right to receive the personal data concerning them in a structured, commonly used and machine-readable format. They also have the right to have this data transmitted to another controller if the legal requirements are met.
Furthermore, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.
To assert the right to data portability, you can contact the data protection officer appointed by the operator of this website at any time.
Right to object
Every person whose personal data is processed has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them.
In the event of an objection, the operator of this website will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.
To exercise the right to object, you can contact the data protection officer of this website directly.
Right to withdraw consent under data protection law
Every person whose personal data is processed has the right to withdraw consent to the processing of personal data at any time.
If you wish to exercise your right to withdraw consent, you can contact our data protection officer at any time.
Privacy policy for objection to advertising emails
We hereby object to the use of contact details published as part of the imprint obligation for sending unsolicited advertising and information material. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example through spam emails.
Analytics, social media and payment services
13. Privacy policy for Google Analytics
This website uses Google Analytics, a web analytics service of Google Ireland Limited. If the controller responsible for data processing on this website is based outside the European Economic Area or Switzerland, Google Analytics data processing is carried out by Google LLC. Google LLC and Google Ireland Limited are hereinafter referred to as “Google”.
The statistics obtained allow us to improve our offering and make it more interesting for you as a user. This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out using a user ID. If you have a Google user account, you can deactivate the cross-device analysis of your usage in the settings there under “My data”, “Personal data”.
The legal basis for using Google Analytics is Art. 6(1) sentence 1 lit. f GDPR. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. Please note that on this website Google Analytics has been extended by the code “_anonymizeIp();” to ensure anonymised collection of IP addresses. This means that IP addresses are processed in shortened form, ruling out any personal reference. Insofar as the data collected about you relates to a person, this is therefore excluded immediately and the personal data is deleted straight away.
Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website and internet use.
Google Analytics uses cookies. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. You can prevent the storage of cookies by setting your browser software accordingly; however, please note that in this case you may not be able to use all the functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plugin available at the following link: Deactivate Google Analytics.
You can also prevent the use of Google Analytics by clicking on this link: Deactivate Google Analytics. This stores a so-called opt-out cookie on your device, which prevents the processing of personal data by Google Analytics. Please note that if you delete all cookies on your device, these opt-out cookies will also be deleted, i.e. you will have to set the opt-out cookies again if you want to continue to prevent this form of data collection. The opt-out cookies are set per browser and computer or device and must therefore be activated separately for each browser, computer or other device.
14. Privacy policy for the use of Google Web Fonts
For the uniform display of fonts, this website uses so-called web fonts provided by Google. When you call up a page, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly. If your browser does not support web fonts, a standard font from your computer is used.
Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://www.google.com/policies/privacy/
15. Privacy policy for HubSpot
Our website uses HubSpot, a marketing automation software of the company HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland. HubSpot is a software company from the USA with a European branch in Ireland. HubSpot helps us to analyse the use of our portal. For this purpose, HubSpot uses cookies.
Certain usage data is linked to your person (e.g. after registering in a registration form) and stored in our CRM. This allows us to send you information and offers tailored specifically to your interests.
Your personal data may also be forwarded to HubSpot servers in the United States (USA). The adequate level of protection is ensured by the fact that HubSpot, Inc. participates in the EU-US Privacy Shield agreement and is certified for compliance with it.
We use HubSpot to provide you with information and offers tailored to your needs. We therefore have a legitimate interest in this processing within the meaning of Art. 6(1) lit. f of the General Data Protection Regulation. The legal basis for our processing of your personal data in connection with the use of HubSpot is Art. 6(1) lit. f of the General Data Protection Regulation.
When using HubSpot, we store your personal data for as long as is necessary to provide you with information and offers tailored to your needs.
The provision of the personal data collected via HubSpot is not required by law or contract, nor is it necessary for the conclusion of a contract. If you do not provide us with this data, we cannot provide you with information and offers tailored to your needs.
Further information on the use of data by HubSpot can be found in HubSpot’s privacy policy at: https://legal.hubspot.com/de/privacy-policy.
You can object to the use of your data at any time, e.g. by email to our email address given in this privacy policy.
HubSpot is certified under the terms of the “EU-U.S. Privacy Shield Framework” and is subject to TRUSTe’s Privacy Seal and the “U.S.-Swiss Safe Harbor” framework.
16. Privacy policy for Facebook
This website uses functions of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. When you call up our pages with Facebook plug-ins, a connection is established between your browser and Facebook’s servers. Data is already transferred to Facebook in the process. If you have a Facebook account, this data can be linked to it. If you do not want this data to be assigned to your Facebook account, please log out of Facebook before visiting our site. Interactions, in particular using a comment function or clicking a “Like” or “Share” button, are also passed on to Facebook. Find out more at https://de-de.facebook.com/about/privacy.
17. Privacy policy for Instagram
Functions of the Instagram service are integrated on our website. These functions are offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. If you are logged into your Instagram account, you can link the content of our pages to your Instagram profile by clicking the Instagram button. This allows Instagram to assign your visit to our pages to your user account. Please note that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by Instagram.
Further information can be found in Instagram’s privacy policy: http://instagram.com/about/legal/privacy/
18. Privacy policy for LinkedIn
Within our online offering, we use the marketing services of the social network LinkedIn of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”).
These use cookies, i.e. text files that are stored on your computer. This enables us to analyse your use of the website. For example, we can measure the success of our ads and show users products they were previously interested in.
This collects, for example, information on the operating system, the browser, the website you previously visited (referrer URL), which web pages the user visited, which offers the user clicked on, and the date and time of your visit to our website.
The information generated by the cookie about your use of this website is transferred in pseudonymised form to a LinkedIn server in the USA and stored there. LinkedIn therefore does not store the name or email address of the respective user. Rather, the above data is only assigned to the person for whom the cookie was generated. This does not apply if the user has allowed LinkedIn to process the data without pseudonymisation or has a LinkedIn account.
You can prevent the storage of cookies by setting your browser software accordingly; however, please note that in this case you may not be able to use all the functions of this website to their full extent. You can also object to the use of your data directly with LinkedIn: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
We use LinkedIn Analytics to analyse and regularly improve the use of our website. The statistics obtained allow us to improve our offering and make it more interesting for you as a user. All LinkedIn companies have adopted the standard contractual clauses to ensure that the data traffic to the USA and Singapore necessary for the development, execution and maintenance of the services takes place lawfully. If we ask users for consent, the legal basis for processing is Art. 6(1) lit. a GDPR. Otherwise, the legal basis for using LinkedIn Analytics is Art. 6(1) sentence 1 lit. f GDPR.
Third-party information: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; user agreement and privacy policy.
19. External payment service providers
This website uses external payment service providers through whose platforms users and we can carry out payment transactions. For example via
- PostFinance (https://www.postfinance.ch/de/detail/rechtliches-barrierefreiheit.html)
- Visa (https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html)
- Mastercard (https://www.mastercard.ch/de-ch/datenschutz.html)
- American Express (https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html)
- PayPal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full)
- Bexio AG (https://www.bexio.com/de-CH/datenschutz)
- Payrexx AG (https://www.payrexx.ch/site/assets/files/2592/datenschutzerklaerung.pdf)
- Apple Pay (https://support.apple.com/de-ch/ht203027)
- Stripe (https://stripe.com/ch/privacy)
- Klarna (https://www.klarna.com/de/datenschutz/)
- Skrill (https://www.skrill.com/de/fusszeile/datenschutzrichtlinie/)
- Giropay (https://www.giropay.de/rechtliches/datenschutzerklaerung) etc.
In the context of fulfilling contracts, we use payment service providers on the basis of the Swiss Data Protection Ordinance and, where necessary, Art. 6(1) lit. b EU GDPR. Otherwise, we use external payment service providers on the basis of our legitimate interests in accordance with the Swiss Data Protection Ordinance and, where necessary, Art. 6(1) lit. f EU GDPR, in order to offer our users effective and secure payment options.
The data processed by the payment service providers includes master data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, amount and recipient-related information. This information is required to carry out the transactions. However, the data entered is only processed and stored by the payment service providers. As the operator, we do not receive any information about the (bank) account or credit card, but only information confirming (accepting) or rejecting the payment. Under certain circumstances, the payment service providers may transmit the data to credit agencies. The purpose of this transmission is to check identity and creditworthiness. In this regard, we refer to the terms and conditions and privacy notices of the payment service providers.
Payment transactions are subject to the terms and conditions and privacy notices of the respective payment service providers, which are available on their websites or transaction applications. We also refer to these for further information and for asserting rights of withdrawal, access and other data subject rights.
20. Privacy policy for YouTube
Functions of the “YouTube” service are integrated on this website. “YouTube” is owned by Google Ireland Limited, a company registered and operated under Irish law with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland, which operates the services in the European Economic Area and Switzerland.
Your legal agreement with “YouTube” consists of the terms and conditions available at the following link: https://www.youtube.com/static?gl=de&template=terms&hl=de. These terms form a legally binding agreement between you and “YouTube” regarding the use of the services. Google’s privacy policy explains how “YouTube” handles your personal data and protects your data when you use the service.
Orders in the shop
21. Order processing in the online shop with customer account
We process our customers’ data in accordance with the federal data protection provisions (Data Protection Act, FADP) and the EU GDPR in the context of the ordering processes in our online shop, in order to enable them to select and order the chosen products and services, and to pay for and have them delivered or carried out.
The data processed includes master data, communication data, contract data and payment data, and the persons affected by the processing include our customers, prospective customers and other business partners. The processing is carried out for the purpose of providing contractual services in the context of operating an online shop, billing, delivery and customer service. For this purpose, we use session cookies, e.g. for storing the contents of the shopping cart, and permanent cookies, e.g. for storing the login status.
The processing is carried out on the basis of Art. 6(1) lit. b (execution of ordering processes) and lit. c (legally required archiving) GDPR. The information marked as required is necessary to establish and fulfil the contract. We disclose the data to third parties only in the context of delivery, payment or within the scope of legal permissions and obligations. The data is only processed in third countries if this is necessary for the fulfilment of the contract (e.g. at the customer’s request for delivery or payment).
Users can optionally create a user account in which they can, in particular, view their orders. During registration, users are informed of the required mandatory information. User accounts are not public and cannot be indexed by search engines, e.g. Google. If users have cancelled their user account, their data relating to the user account will be deleted, unless its retention is necessary for commercial or tax law reasons in accordance with Art. 6(1) lit. c GDPR. Information in the customer account remains until it is deleted, followed by archiving in the case of a legal obligation. It is the responsibility of users to back up their data before the end of the contract if they cancel.
During registration and subsequent logins, as well as when using our online services, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests and those of users in protection against misuse and other unauthorised use. This data is generally not passed on to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6(1) lit. c GDPR.
Deletion takes place after the expiry of statutory warranty and comparable obligations; the necessity of retaining the data is reviewed at irregular intervals. In the case of statutory archiving obligations, deletion takes place after their expiry.
Final provisions
22. General disclaimer
All information on our website has been carefully checked. We strive to provide information that is up to date, correct and complete. Nevertheless, errors cannot be completely ruled out, so we cannot guarantee the completeness, accuracy and timeliness of information, including of a journalistic and editorial nature. Liability claims for material or immaterial damage caused by the use of the information provided are excluded unless there is demonstrably intentional or grossly negligent fault.
The publisher may change or delete texts at its own discretion and without notice and is not obliged to update the content of this website. Use of and access to this website is at the visitor’s own risk. The publisher, its clients or partners are not responsible for damages, such as direct, indirect, incidental, specifically determinable in advance or consequential damages, allegedly caused by visiting this website, and consequently accept no liability for them.
The publisher also accepts no responsibility or liability for the content and availability of third-party websites that can be reached via external links on this website. The operators of the linked pages are solely responsible for their content. The publisher therefore expressly distances itself from all third-party content that may be relevant under criminal or liability law or that violates common decency.
23. Changes
We may amend this privacy policy at any time without notice. The current version published on our website applies. Insofar as the privacy policy is part of an agreement with you, we will inform you of the change by email or in another suitable way in the event of an update.
24. Questions to the data protection officer
If you have any questions about data protection, please send us an email or contact the person responsible for data protection in our organisation listed at the beginning of this privacy policy.
Created with the help of: SwissAnwalt
Your cookie settings
You can turn statistics on or off here at any time.