Privacy

Controller. The data controller is Chrüzli — equilibric di Alberto Tacconi, Strada Regina 4a, 6832 Pedrinate, Switzerland (see Imprint for full details). Questions: hello [at] chruzli.ch.

What we collect and why. To process and deliver your order we collect your name, shipping address, email and order details. Legal basis: performance of the contract (art. 6(1)(b) GDPR / art. 31 nLPD). We keep order data as long as required by Swiss accounting law (10 years).

Payment. Payments are handled by Stripe (card, TWINT, Apple Pay and other methods available at checkout). At checkout you are redirected to Stripe’s hosted payment pages, which set their own cookies. We never see or store your card details. Stripe processes your payment data as an independent controller under its own privacy policy.

Fulfilment. Production and shipping are handled by our print partner Printful, which produces within the European Union. Printful receives your name and shipping address solely to produce and deliver your order (data processor).

Order confirmation emails. We use Brevo (Sendinblue) to send you a transactional order confirmation email. Brevo receives your name, email address and order details solely for this purpose (data processor). Your data is hosted in the European Union. Order data sent to Brevo is used only for the confirmation email. Subscribing to the newsletter is a separate processing operation, based on your consent (see below).

Newsletter. If you subscribe to our newsletter we use your email address to tell you about new products and give you early access to launches. The legal basis is your consent (art. 6(1)(a) GDPR, art. 31 nLPD). Subscription works via double opt-in: you receive a confirmation email and are added to the list only after clicking the link, which also serves as proof of consent. We record the language of the page you subscribe from so we can write to you in your language. The list is managed by Brevo (processor), with data hosted in the European Union. You can withdraw your consent at any time via the link at the bottom of every email; withdrawal does not affect the lawfulness of processing carried out before it (art. 7(3) GDPR). The unconfirmed address stays in Brevo’s contact database: it does not enter the list and receives no communication, and it is removed when the list is cleaned up. Confirmed addresses are kept until you withdraw your consent. After you unsubscribe we keep your address on a suppression list for the sole purpose of not contacting you again.

Hosting. The site runs on Netlify (static pages and serverless functions). To deliver the site Netlify processes technical data such as your IP address and server logs; its servers are located in the United States. The serverless functions also process, on Netlify’s US servers, the data you send us through the site’s forms — order data and, if you subscribe, your email address — which is then passed on to the providers listed above.

Usage statistics (analytics). We use PostHog to understand how the site is used and to improve it. PostHog is loaded only after you agree via our cookie banner; if you decline, it is not loaded and sets no cookies. When enabled it uses cookies and identifiers to measure visits. Your analytics data is hosted in the European Union (PostHog EU Cloud). We do not sell this data and do not use it for third-party advertising profiling. You can withdraw your consent at any time via the cookie banner or by clearing the cookies in your browser.

Cookies and storage. We use your browser’s local storage to remember the contents of your shopping bag on your device; this is technically necessary and requires no consent. Cookies are otherwise set in only two cases: by PostHog when you consent to analytics (see above), and by Stripe’s hosted pages when you proceed to payment.

Your rights. You may request access, rectification, deletion or a copy of your data, and object to processing. Write to hello [at] chruzli.ch. You may also lodge a complaint with the Swiss FDPIC (or your local EU authority).

Recipients & transfers abroad. To run the shop your data is shared only with the providers above: Stripe (payment), Printful (production, EU), Brevo (order and newsletter emails, EU), Netlify (hosting, USA) and — only with your consent — PostHog (analytics, EU). This involves transfers abroad, to the European Union and to the United States. They rest on the performance of your contract and, for analytics and the newsletter, on your consent (art. 19 nLPD), and are protected by appropriate safeguards such as the EU standard contractual clauses or an adequacy decision. We do not sell your data.