Grüssen-Shop

Privacy Policy

Last updated: September 2026

1. What this covers

This privacy policy describes what personal data is processed when you use gruessen-shop.ch or order through the website, what we use it for, who we share it with and what rights you have. It is based on the Swiss Federal Act on Data Protection (FADP).

2. Controller

The controller for the processing described here is:

3. What data we process and why

  • Orders: first and last name, email address, phone number, ordered items, amount, chosen pickup time, any note and the order status. We use this data to process the order, send you confirmations and pickup notices by email, and contact you about questions or an order that was not collected. About two hours after pickup we send you one email asking for feedback, with a link to our Google reviews; you can stop these emails at any time with the link in that email, in which case we keep your email address on a suppression list.
  • Payment: from SumUp we receive the payment status, the amount and a transaction reference, not your full card details (see section 5).
  • Store credit: if an order paid online is not collected, we store the credit with its code, amount, validity, the related order, your email address (and your customer account, if any) and every redemption. We also evaluate uncollected orders by email address and phone number in order to disable payment at pickup after repeated non-collection.
  • Customer account (optional): email address, password (stored encrypted), name, phone number, preferred language, your orders and loyalty stamps.
  • Age checks: for age-restricted items we keep a record of the time of the check, the method and the staff member who checked. The legal basis is the statutory youth-protection rules, in particular the Alcohol Act and the Tobacco Products Act as well as cantonal law. We do not store copies of ID documents.
  • Staff card (5% discount for employees in the Grüssen-Center): first name, last name, business, a photo for checking at the till, email address and, optionally, phone number. The basis is your consent. The data is kept while the card is valid; you can request deletion at any time.
  • Technical data: when you visit the website, our hosting providers process technically necessary information such as IP address, date and time, page requested and browser type to deliver the website and protect it against misuse.

4. Analytics, cookies and local storage

For anonymous statistics (e.g. page views and completed orders) we use Plausible Analytics, which we run ourselves at analytics.yoxy.ch. Plausible sets no cookies and stores no personal data. We use neither Google Analytics nor advertising pixels.

We use cookies and your browser’s storage only where technically necessary: to keep you signed in, to store your cart and order note, and to complete payment.

5. Online payment

Online you pay by card, Apple Pay or Google Pay through SumUp. The payment form is loaded from gateway.sumup.com only on the checkout page; SumUp receives your IP address in the process. You enter your card details directly with SumUp; we neither see nor store them.

SumUp processes payment data as an independent controller under its own privacy policy.

6. Service providers and other recipients

We use the following providers, which process data on our behalf or, where stated, as independent controllers:

  • Website hosting and storage of product images: Vercel Inc., USA (Vercel Blob).
  • Database for account and order data: Neon Inc., USA, with data stored in the EU.
  • Online payment: SumUp (independent controller).
  • Delivery of product images: Cloudflare, Inc., USA (Cloudflare Pages).
  • Sending emails (order confirmations, pickup notices, review requests, password links): email delivery provider (Cyon GmbH, Switzerland, or Resend, USA).
  • Analytics: Plausible Analytics, self-hosted (see section 4).

Links to Just Eat, Uber Eats, Google Maps, Instagram and TikTok are plain links. Only when you follow one do these providers process your data under their own privacy policies. Our maintenance page embeds a Google Maps map; when it loads, Google receives your IP address.

Beyond that, we share your data only where this is necessary to process your order or where we are legally required to.

7. Disclosure abroad

Some providers are based in the USA or store data in the EU. For countries without an adequate level of data protection, we rely on the Standard Contractual Clauses or, where the provider is certified, the Swiss-U.S. Data Privacy Framework.

8. Retention

We keep personal data only as long as needed for the relevant purpose. Because of statutory retention duties, we generally keep order and accounting records for ten years. After that we delete or anonymise them.

9. Your rights

You can request access to your data, ask for it to be corrected or deleted, object to its processing, receive your data in a common format, and withdraw consent at any time with effect for the future.

To do so, write to us at info@gruessen-shop.ch. You can also contact the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

10. Data security

We take appropriate technical and organisational measures against loss, misuse and unauthorised access. The connection to the website is encrypted with TLS.

11. Changes

We update this privacy policy when our processing or the legal situation changes. The version published on this website applies.