Privacy policy

We are established in Switzerland, so processing is governed first by the revised Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023) and the Data Protection Ordinance (DPO). The EU GDPR applies in addition wherever a specific processing operation falls within its scope. The two apply alongside each other; neither replaces the other.

Albelys — Philip Guelat Reuchenettestrasse 106 2504 Biel Switzerland Email: hello@albelys.ch

When you order: name, delivery and billing address, email address, and what you bought. When you email us: whatever you choose to write. When you subscribe to the letter: your email address and language. When you visit: our host records standard server logs (IP address, browser, page requested, timestamp) for security and to keep the site running.

To perform the contract when you order (Art. 6(1)(b) GDPR). With your consent for the newsletter, which you can withdraw at any time (Art. 6(1)(a)). To meet legal obligations, in particular Swiss bookkeeping duties (Art. 6(1)(c)). On legitimate interests for security and fraud prevention (Art. 6(1)(f)). Under the FADP no separate legal basis is required, provided processing is lawful, proportionate, transparent and purpose-limited — which it is.

Only those who need it to get an order to you: — Stripe Payments Europe Ltd (Ireland) and Stripe Inc. (US) for payment. Card details go straight to Stripe and we never see or store them. — Vercel Inc. (US) hosts this website and generates the server logs above. — Swiss Post for delivery: name and address only. — Resend (Resend, Inc., US) stores newsletter addresses for us, if you subscribe. Nothing else about you is sent there, and it is used for our own letter only. — Our accountant and the Swiss tax authorities, where the law requires. We do not sell, rent or trade personal data. Ever.

No Google Analytics, no Meta pixel, no advertising or tracking cookies, no cross-site profiling, no data brokers. Our newsletter carries no open-tracking or click-tracking pixels — we do not record whether you read it. Our fonts are downloaded once at build time and served from our own domain, so loading a page sends nothing to Google. This is not a temporary state we plan to grow out of quietly: if we ever add analytics, this page changes first and the cookie page will tell you.

Stripe, Vercel and Resend process data in the EEA and the United States. Transfers rely on the EU Standard Contractual Clauses with the amendments recognised for Switzerland, and on the Swiss–US Data Privacy Framework where the recipient is certified. You may request a copy of the safeguards from us at any time.

Order and invoice records: ten years, as Swiss commercial law requires. Newsletter subscription: until you unsubscribe. Emails you send us: as long as needed to resolve the matter, then deleted. Server logs: a short rolling period held by our host for security.

Information (Art. 25): ask whether we hold data about you and what it is. Rectification (Art. 32): have inaccurate data corrected. Erasure: have data deleted, unless a retention duty prevents it. Objection: object to a particular processing. Data portability (Art. 28): receive your data in a common electronic format. Withdraw consent: at any time, with effect for the future. Write to the address above. We may ask you to identify yourself first.

Where the GDPR applies, you additionally have the rights of access, rectification, erasure, restriction, portability and objection under Art. 15–21, and the right to lodge a complaint with a supervisory authority in your country.

Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1, 3003 Bern, Switzerland You may also bring a claim before the competent civil courts.

The site is served only over encrypted HTTPS. Payment happens on Stripe's own encrypted infrastructure. Access to order data is limited to the people who need it to fulfil your order.