Privacy Policy

1. What this notice covers

Your privacy matters to us. On this page we explain, in plain terms, what data is involved when you use gruessen-shop.ch or order from us, what we use it for, and what rights you have. The basis for this is the Swiss Data Protection Act (FADP/DSG).

2. Who is responsible for your data

Responsible (the “controller” under the FADP/DSG) for the processing described here is the operator of the shop:

• Grüssen-Shop · c/o Sarones GmbH
• Grüssenweg 4, 4133 Pratteln, Switzerland
• Email: info@sarones.ch · Phone: 032 511 31 33
• Company ID (UID): CHE-226.514.684

3. What data we process — and why

We process only the data we actually need to run the shop and handle your order:

• For your order: first and last name, delivery or contact address, email address, phone number and order details (products, amount, chosen pickup time, pickup or delivery). Payment is made in person on collection — we do not collect or store any payment data via the website (see section 5).
• For an optional customer account: email address, name, saved addresses, your past orders and your preferred language.
• For the area check and the waitlist: your postal code and — if you choose to leave it — your email address, so we can let you know once we deliver to you.
• For age-restricted products (18+): to meet the statutory age check (Tobacco Products Act), we keep a verification record with the time of the check, the method used and the staff member who checked. We do not store copies of ID documents.
• For the staff card (5% discount for Grüssen-Center employees): first name, last name, business, a photo for visual verification at the till, plus your email address and — optionally — phone number. The basis is your consent at sign-up. The data is kept while the card is valid; the card is revoked when your employment ends. You can request deletion at any time (see contact above).

4. Privacy-friendly analytics & cookies

For anonymous statistics (e.g. page views and completed orders) we use Plausible Analytics, which we self-host on our own infrastructure. Plausible sets no cookies, stores no personal data, and does not track you across different sites or providers. We use neither Google Analytics nor a Meta/Facebook pixel, and the data never leaves our own infrastructure.

We use cookies only where they are technically necessary: to keep you signed in, to hold your shopping cart, and to remember your postal code or delivery area. By law, such necessary cookies do not require consent.

5. Payment in person

Payment is made exclusively in person on collection — by card, TWINT or cash. No payment data is collected, transmitted or stored via the website. Card payments at the in-store terminal are handled directly by our terminal provider (SumUp); we never see your card details and do not store them.

6. Service providers that support us

To run the shop we rely on a few carefully chosen providers that process data only on our behalf and under our instructions:

• Hosting & delivery of the website: Vercel Inc. (provider based in the USA); it is served from the Frankfurt (EU) region.
• Database: Neon Inc. – stores account and order data in a data centre within the EU (Frankfurt).
• In-person card payments: SumUp Payments Ltd. – handles card payments at the in-store terminal. No online payment takes place via the website.
• Email delivery: Cyon GmbH, Basel (Switzerland) – sends transactional emails such as order confirmations, reminders and password-reset links.
• Maps: when you enter a delivery address, we load map tiles from OpenStreetMap, which receives your IP address in the process.

Beyond that, we do not pass your data to third parties — unless it is necessary to fulfil your order or we are legally required to do so.

7. Data outside Switzerland

Some of these providers are located abroad — namely Vercel in the USA. Where a country does not, from Switzerland’s perspective, offer an equivalent level of data protection, we secure the transfer contractually, as a rule via the recognised Standard Contractual Clauses.

8. How long we keep your data

We keep your data only as long as we need it for the relevant purpose. Order and invoice data is subject to statutory retention obligations and is therefore kept longer — under commercial and tax law, generally ten years. After that it is deleted or anonymised.

9. Your rights

The FADP/DSG gives you several rights: you can ask what data we hold about you, request its correction or deletion, have its processing restricted, obtain a copy of your data in a common format, and withdraw any consent you have given at any time with effect for the future.

Just write to us at info@sarones.ch. If you are unhappy with how we handle your data, you can also turn to the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).

10. How we protect your data

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. The connection to our website is encrypted end to end with SSL/TLS.

11. Updates to this notice

We may update this privacy policy from time to time, for example when we add new features or the legal situation changes. The current version published on this website always applies.