Privacy Policy

1. Data Protection at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified.

Data Collection on This Website

Data processing is carried out by the website operator (see legal notice).

We collect data that you provide to us (e.g., ordering information or contact data) and we also collect data automatically. Automatically collected data consists of technical data (e.g., IP address, browser type, operating system) recorded by our IT systems when you access the site.

2. Hosting and Infrastructure

Google Cloud

We host our website and the associated database on the infrastructure of Google (Google Cloud Platform). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To ensure data processing is compliant with privacy regulations, we have concluded a Data Processing Addendum (DPA) with Google. As Google is a US-based company, it cannot be ruled out that data may be transferred to the USA. Google uses Standard Contractual Clauses (SCCs) of the EU Commission as a guarantee for an adequate level of data protection.

Legal basis: The use of Google Cloud is based on Art. 6 (1) (f) GDPR (legitimate interest in the secure and fast provision of our online services).

Email Delivery (Postmark)

We send order confirmations, receipts, credit notes and sign-in links through the Postmark service. The provider is ActiveCampaign, LLC, 1 North Dearborn Street, 5th Floor, Chicago, IL 60602, USA. Your email address and the content of the respective email, including attachments, are transmitted. As this is a US provider, the transfer is based on the Standard Contractual Clauses of the EU Commission.

Legal basis: The processing is necessary for the performance of the contract (Art. 6(1)(b) GDPR).

3. Technical Storage (Cookies & LocalStorage)

Our website uses LocalStorage and strictly necessary cookies. These are small units of information stored locally in your browser.

  • Purpose: These storage methods are technically required to enable the basic functions of the online shop (e.g., maintaining your shopping cart, session management). For online payments, we keep your checkout entries (name, phone number, company, billing address, notes) in LocalStorage so they are not lost when you return from the payment page; they are removed once the order is completed.
  • No Marketing: We explicitly do not use any marketing, tracking, or analysis cookies.
  • Duration: LocalStorage data remains stored until you manually clear your browser cache or we remove the data programmatically.

4. Payment Processing

Depending on the shop and your account, we offer the payment methods Invoice and Online payment.

Purchase via Invoice

If you select the “Invoice” payment method, we process your address and order data exclusively for the purpose of processing the purchase, delivery, and billing. Invoices are created in the accounting software bexio. The provider is bexio AG, Alte Jonastrasse 24, 8640 Rapperswil-Jona, Switzerland. The invoice details of your company or group, the order items and your email address as the invoice contact are transmitted. The data is processed in Switzerland.

Online Payment (Saferpay)

For online payments by card, TWINT, Apple Pay or Google Pay, we use the payment service Saferpay. The provider is Worldline Schweiz AG, Hardturmstrasse 201, 8005 Zurich, Switzerland.

To pay, you are redirected to the Saferpay payment page. You enter your payment details (e.g., your card number) directly with Saferpay; they are not stored on our servers. We transmit the amount, an order reference, the selected language and, for fraud prevention (3-D Secure), your name, email address, phone number, billing address and, optionally, company to Saferpay. From Saferpay, we receive the payment confirmation, the payment method, a masked card number (e.g., xxxx 1234) and transaction and authorisation identifiers, which we use for receipts and refunds and show on the receipt. If you use TWINT, Apple Pay or Google Pay, the privacy policy of the respective provider also applies.

Legal basis: The processing is necessary for the performance of the purchase contract (Art. 6(1)(b) GDPR).

Contact Details for Online Payments

For online payments, including orders as a guest, we store your contact details (first name, last name, email address, phone number, billing address and, optionally, company) with the order. We use them to process the order, for questions about your pickup and for the receipt. Unfinished payment processes that do not lead to an order are deleted after 30 days. If you are signed in, we also save your billing address and company in your account so they are prefilled for your next order; you can change or remove them in the settings.

5. Your Rights and Data Retention

Retention Period

Your data will be stored in our database for as long as it is necessary for the provision of our services (contract fulfillment) or due to statutory retention periods (e.g., 10 years for accounting documents under applicable commercial and tax law).

Your Rights

You have the right at any time to:

  • Access information about the origin, recipient, and purpose of your stored data.
  • Rectify or Delete this data.
  • Restrict Processing and the right to Data Portability.

For any questions or deletion requests, please contact us at: info@collectivebakery.ch.