Privacy policy

We are established in Switzerland, so processing is governed first by the revised Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023) and the Data Protection Ordinance (DPO). The EU GDPR applies in addition wherever a specific processing operation falls within its scope. The two apply alongside each other; neither replaces the other.

Albelys, P. Ringler Reuchenettestrasse 106 2504 Biel Switzerland Email: hello@albelys.ch

When you order: name, delivery and billing address, email address, what you bought and the language you ordered in. When you email us: whatever you choose to write. When you subscribe to the letter: your email address and language. When you visit: our host records standard server logs (IP address, browser, page requested, timestamp) for security and to keep the site running. On visits from Switzerland: the data of the Meta pixel (section 5).

To perform the contract when you order (Art. 6(1)(b) GDPR). With your consent for the newsletter, which you can withdraw at any time (Art. 6(1)(a)). To meet legal obligations, in particular Swiss bookkeeping duties (Art. 6(1)(c)). On legitimate interests for security and fraud prevention (Art. 6(1)(f)). To measure and improve our advertising on Facebook and Instagram (Meta pixel, section 5): we tell you about it on this page, and you can refuse at any time (Art. 45c Telecommunications Act). Under the FADP no separate legal basis is required, provided processing is lawful, proportionate, transparent and purpose-limited, which it is.

Only those who need it to get an order to you: • Stripe Payments Europe Ltd (Ireland) and Stripe Inc. (US) for payment. Card details go straight to Stripe and we never see or store them. • Vercel Inc. (US) hosts this website and generates the server logs above. • Swiss Post for delivery: name and address only. • Resend (Resend, Inc., US) sends our emails: the order confirmation and the shipping notice, with your name, email address, delivery address, what you bought and the tracking number. If you subscribe to the newsletter, it also stores your address for it. It is used for our own emails only. • Our accountant and the Swiss tax authorities, where the law requires. For our advertising on Facebook and Instagram, also Meta Platforms Ireland Ltd. (Ireland): see section 5. We do not sell, rent or trade personal data. Ever.

On albelys.ch we use the Meta pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. It shows us whether our ads on Facebook and Instagram lead to visits and orders, and it lets us show our ads again to people who have visited the site. We load it only for visits from Switzerland (recognised from the country of your IP address), and not when your browser sends the Global Privacy Control signal or you have switched it off. When it is active, Meta receives which pages you open, which products you view or put in your bag (with the price), when you go to checkout and, after you pay, the order value and the products. Never your name, email address or delivery address. Also your IP address, details of your browser and device, and a random identifier in the cookie _fbp. If you arrive from a Meta ad, a click identifier in the cookie _fbc is added. If you are logged in to Facebook or Instagram in the same browser, Meta can link the visit to your account. Stripe's payment pages run no pixel. So that fewer of these events get lost, Meta also passes them on server-side (Conversions API with Meta). This happens only while the pixel is active and covers the same data. We and Meta are jointly responsible for collecting the data and passing it to Meta (agreement with Meta). For everything Meta does with the data afterwards, Meta alone is responsible: see Meta's privacy policy. Switching it off: the switch below turns the pixel off on albelys.ch for this browser. Your choice stays stored in your browser, and the cookies _fbp and _fbc are deleted.Everywhere else, you can tell Meta in its Accounts Centre not to link your activity on other websites to your account. You can also simply write to us.

No Google Analytics, no advertising or tracking services other than the Meta pixel above, no data brokers. Our emails, the newsletter and the order emails alike, carry no open-tracking or click-tracking pixels. We do not record whether you read them. Our fonts are downloaded once at build time and served from our own domain, so loading a page sends nothing to Google. If we ever add another service, this page changes first.

Stripe, Vercel, Resend and Meta process data in the EEA and the United States. Transfers rely on the EU Standard Contractual Clauses with the amendments recognised for Switzerland, and on the Swiss-U.S. Data Privacy Framework where the recipient is certified. You may request a copy of the safeguards from us at any time.

Order and invoice records: ten years, as Swiss commercial law requires. Newsletter subscription: until you unsubscribe. Emails you send us: as long as needed to resolve the matter, then deleted. Server logs: a short rolling period held by our host for security. Meta pixel cookies: 90 days, unless you delete them sooner. How long Meta keeps the data is set out in Meta's privacy policy.

Information (Art. 25): ask whether we hold data about you and what it is. Rectification (Art. 32): have inaccurate data corrected. Erasure: have data deleted, unless a retention duty prevents it. Objection: object to a particular processing. Data portability (Art. 28): receive your data in a common electronic format. Withdraw consent: at any time, with effect for the future. Write to the address above. We may ask you to identify yourself first.

Where the GDPR applies, you additionally have the rights of access, rectification, erasure, restriction, portability and objection under Art. 15 to 21, and the right to lodge a complaint with a supervisory authority in your country.

Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1, 3003 Bern, Switzerland You may also bring a claim before the competent civil courts.

The site is served only over encrypted HTTPS. Payment happens on Stripe's own encrypted infrastructure. Access to order data is limited to the people who need it to fulfil your order.