Privacy policy

1. Information about the collection of personal data and contact information of the person responsible

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following we inform you about the handling of your personal information when using our website. Personal information is any data with which you could be personally identified.

1.2 The person responsible for the data processing on this website in terms of the Swiss Federal Act on Data Protection (FADP) and, where applicable, the General Data Protection Regulation (GDPR) is:

Name: Demo Shop AG
Address: Musterstrasse 1, 8000 Zürich
Email: [email protected]
Telephone: 044 000 00 00

The person responsible for the processing of personal data is the natural or legal person who determines the purposes and means of the processing of personal data alone or jointly with others.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or requests to the person responsible), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string "https://" and the lock icon in your browser's address bar.

2. Data collection when you visit our website

When you use our website for information purposes, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you call our website, we collect the following data that are technically necessary for us to display the web page:

• our visited web page
• date and time at the time of the access
• quantity of the sent data in byte
• source/reference, by which you arrived on the page
• used browser
• used operating system
• IP address

The processing takes place in accordance with Article 6 paragraph 1 lit. f GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently should concrete evidence point to illegal use.

3. Hosting and content delivery network

Our shop runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany ("Hetzner"), in the EU. They hold the website, the shop system and the database with your order data. Hetzner processes the data solely on our behalf.

To make our shop fast and secure, we use the content delivery network and security services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"). All requests to our website pass through Cloudflare's servers. The data listed in section 2, including your IP address, are processed to deliver the content and to fend off attacks. The processing takes place in accordance with Art. 6 para. 1 lit. f GDPR based on our legitimate interest in providing our shop securely and quickly. For the transfer to the USA, see section 10.

4. Cookies and local storage

To enable certain functions, we use cookies and your browser's local storage. These are small text files or entries that are stored on your end device. The following are necessary to run the shop and are set without consent:

• "lang" (cookie, 1 year): the language you last chose, so that your next visit starts in your language.
• "cart_id" (local storage): the identifier of your shopping cart, so that it is kept until you order.
• "analytics_consent" (local storage): your choice in the cookie banner.
• "ga_purchase_…" (local storage): prevents an order from appearing twice in our statistics.

The processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR for the performance of the contract or in accordance with Art. 6 para. 1 lit. f GDPR to preserve our legitimate interests in the best possible functionality of the website and a customer-friendly and efficient design of the visit.

Cookies for web analysis (Google Analytics) are only set with your consent (see section 9). You can change your choice at any time with the "Cookie settings" link at the bottom of every page.

You can set your browser so that you are informed about the use of cookies and decide individually on whether to accept them or to deactivate the acceptance of cookies, just in certain cases or completely. Each browser differs in the way it manages the cookie settings. This is described in the Help menu of each browser, which explains how to modify your cookie settings. You can find these for the respective browser at the following links:Edge,Firefox,Chrome,Safari orOpera.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5. Contact

Personal data is collected when you contact us (e.g. via contact form or email). Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used solely for the purpose of answering your request and for the associated technical administration. The legal basis for the data processing is our legitimate interest in answering your request in accordance with Article 6 paragraph 1 lit. f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted after final processing of your inquiry; this is the case if it can be inferred from the circumstances that the facts in question have been conclusively clarified and provided that there are no legal storage obligations to the contrary.

6. Data processing for contract processing

Pursuant to Art. 6 para. 1 lit. b GDPR, personal data is collected and processed if you provide it to us for the performance of a contract. For an order we need your email address, your name and your delivery address; company, additional address line, telephone number and a different billing address are optional. No customer account is created. We store and use the data communicated by you to fulfil our contractual obligations. After complete processing of the contract, your data will be blocked in consideration of tax and commercial retention periods and deleted after expiry of these periods, unless you have expressly consented to further use of your data or a legally permitted further use of data has been reserved by us, about which we will inform you accordingly below.

7. Data processing for order processing

To process your order we work together with the following service providers, which support us wholly or partly in the execution of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information. The personal data collected by us will be passed on to the transport company commissioned with delivery within the framework of implementing the contract, as far as this is necessary for delivering the goods. We will pass on your payment data to the commissioned credit institution within the framework of payment processing, if this is necessary for payment processing. If payment service providers are used, we inform you about this explicitly below. The legal basis for the transmission of the data is Article 6 para. 1 lit. b GDPR.

7.1 Use of Stripe

If you choose a payment method of the payment service provider Stripe (e.g. credit card or TWINT), payment is processed by the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, to whom we pass on the information you provided during the ordering process together with the information about your order (name, address, email address, invoice amount, currency and transaction number). You enter your card details directly with Stripe; we neither receive nor store them. Your data will only be passed on for the purpose of payment processing with the payment service provider Stripe Payments Europe, Ltd. Stripe may also process data to prevent fraud and transfer it to Stripe, Inc. in the USA (see section 10). For information on the data protection of Stripe, click here.

7.2 Use of TWINT

If you have opted for the TWINT payment method, the payment is processed via Stripe (see section 7.1) and the payment service provider TWINT AG, Stauffacherstrasse 31, 8004 Zurich, Switzerland, to whom your order information (invoice amount, currency and transaction number) is forwarded as part of the order process. Your data will only be passed on for the purpose of payment processing with the payment service provider TWINT AG. You can find more information on data protection at TWINT AG here.

7.3 Sending emails

We send order confirmations and other emails about your order via Amazon Simple Email Service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS"). For this purpose, your email address, your name and the content of the email (details of your order) are transmitted to AWS. AWS processes the data on our behalf in data centres in Europe; access by Amazon Web Services, Inc. in the USA cannot be ruled out (see section 10). The legal basis is Art. 6 para. 1 lit. b GDPR.

8. Newsletter

If you subscribe to our newsletter, we use your email address and the language in which you use our website to send you information about our products and offers. The processing takes place in accordance with Art. 6 para. 1 lit. a GDPR on the basis of your consent.

We use the double opt-in procedure for subscriptions: after subscribing, you receive an email with a link to confirm your subscription. Only then will you receive the newsletter. We store the time of subscription and confirmation in order to be able to prove your consent. If you do not confirm your subscription within 7 days, your data is deleted automatically.

Like our other emails, we send the newsletter via AWS (see section 7.3); for this purpose, your email address and the content of the newsletter are transmitted to AWS.

You can withdraw your consent at any time with effect for the future, using the unsubscribe link in every newsletter or by sending a message to [email protected]. When you unsubscribe, we delete your email address and the other subscription data.

9. Web analysis services

Google Analytics

This website uses Google Analytics 4, a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics helps us understand how our shop is used (e.g. pages viewed, products viewed, shopping cart and completed orders) so that we can improve it.

Google Analytics cookies ("_ga" and "_ga_…", lifetime up to 2 years) are only set if you have consented in the cookie banner. The processing is then carried out in accordance with Art. 6 para. 1 lit. a GDPR on the basis of your consent. You can withdraw your consent at any time with effect for the future with the "Cookie settings" link at the bottom of every page.

We use Google's Consent Mode. If you have not consented, no analytics cookies are set; Google then only receives messages without cookies and without identifiers (e.g. time, page viewed, information about your browser and your choice in the cookie banner). From these, Google creates aggregated estimates for our statistics. This processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR based on our legitimate interest in the statistical analysis of user behaviour for optimisation purposes.

Google Analytics 4 does not store IP addresses. On our behalf, Google will use this information to evaluate your use of the website and to compile reports on website activity. Google signals and ad personalisation are disabled. The data is deleted after 14 months. The information may be transferred to Google servers in the USA (see section 10). For more information about how Google Analytics handles user data, see Google's privacy policy.

10. Transfer of data abroad

The service providers named above partly process data outside Switzerland, in particular in the EU (Hetzner, Stripe, AWS, Google) and in the USA (Cloudflare, Stripe, AWS, Google). According to the Swiss Federal Council, the EU states ensure an adequate level of data protection. For the USA, we rely on the Swiss-U.S. Data Privacy Framework, under which the US companies named are certified, and additionally on the European Commission's standard contractual clauses.

11. Rights of the affected parties

The applicable data protection law grants you comprehensive rights of data subjects (rights of information and intervention) vis-à-vis the data controller with regard to the processing of your personal data, about which we inform you below:

Under the Swiss Federal Act on Data Protection, you have in particular the right of access (Art. 25 FADP), the right to receive or transfer your data (Art. 28 FADP) and the right to have your data corrected or deleted and to object to the processing (Art. 32 FADP). You can also contact the Federal Data Protection and Information Commissioner (FDPIC). To exercise your rights, a message to [email protected] is sufficient. Where the GDPR applies, you also have the following rights:

• Right to information in accordance with Article 15 GDPR: in particular, you have a right to information about your personal data processed by us, the purposes of the processing, the categories of processed personal data, the recipients or categories of recipients to which your data were or are disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing or objection to the processing, the right to lodge a complaint with a supervisory authority, the origin of your data if it was not collected by us, the existence of automated decision-making including profiling and any meaningful information about the logic involved and the scope and intended effects of such processing, as well as your right to be informed about the guarantees pursuant to Article 46 GDPR when your data is transferred to third countries;
• Right of rectification in accordance with Article 16 GDPR: you have the right to immediate rectification of incorrect data relating to you and/or completion of your incomplete data stored by us;
• Right to erasure in accordance with Article 17 GDPR: you have the right to require the deletion of your personal data when the conditions of Article 17 para. 1 GDPR are met. However, this right does not exist in particular if the processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• Right to restrict the processing pursuant to Art. 18 GDPR: you have the right to request the restriction of the processing of your personal data as long as the accuracy of your data contested by you is being verified, if you refuse to delete your data due to inadmissible data processing and instead request the restriction of the processing of your data, if you need your data to assert, exercise or defend legal claims after we no longer need this data once the purpose has been achieved, or if you have filed an objection for reasons of your particular situation, as long as it has not yet been determined whether our legitimate reasons prevail;
• Right to be informed pursuant to Art. 19 GDPR: if you have exercised your right to have the responsible party correct, delete or restrict the processing, this party is obliged to inform all recipients to whom the personal data concerning you has been disclosed of this correction or deletion of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients.
• Right to data portability pursuant to Art. 20 GDPR: you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transfer to another controller, insofar as this is technically feasible;
• Right to revoke consents granted in accordance with Art. 7 para. 3 GDPR: you have the right to revoke consent to the processing of data at any time with effect for the future. In the event of revocation, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
• Right of complaint under Art. 77 GDPR: if you believe that the processing of personal data concerning you is contrary to the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your place of work or the place of the suspected infringement, without prejudice to any other administrative or judicial remedy.

12. Right of objection

If we process your personal data on the basis of a balancing of interests because of our overriding legitimate interest, you have the right at any time, for reasons arising from your particular situation, to object to this processing with effect for the future. If you exercise your right of objection, we will stop processing the data concerned. However, we reserve the right to continue processing if we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims. If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. You can object as described above. If you exercise your right of objection, we will stop processing the data concerned for direct marketing purposes.

13. Duration of the retention of personal data

The duration of the retention of personal data is determined on the basis of the respective statutory retention period (e.g. commercial and tax retention periods). After the period has expired, the data is routinely deleted if it is no longer necessary for the performance or initiation of the contract and/or if we no longer have a legitimate interest in further storage.

Zürich, 4 October 2026