Privacy policy

1. Controller

The controller for the processing of personal data on this website is:

VeCrisps, einfache Gesellschaft, Christian Lito
Kirchenfeldstrasse 25
3005 Bern, Schweiz
Email: christian.lito@mygymer.ch

The revised Swiss Data Protection Act (DSG), in force since 1 September 2023, is the applicable law. Where the European General Data Protection Regulation (GDPR) applies, we also observe its principles. Full details of the operator can be found in the legal notice.

2. Order data

When you place an order, we process:

• first and last name,
• delivery and billing address,
• email address,
• phone number, if you provide it,
• order contents, time of order and payment status.

Purpose: performing the contract of sale, shipping the goods, communicating with you about your order and meeting our statutory retention obligations.

Basis: the processing is necessary to perform the contract you conclude with us. Without these details we cannot fulfil an order.

Retention: we keep order and payment data for as long as it is needed to handle the order. Business records, which include orders and receipts, must be retained for ten years under Art. 958f of the Swiss Code of Obligations. After that we delete them.

3. Payment processing via Stripe

Payments are processed via Stripe. The provider for customers in the European area is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, in part together with Stripe, Inc., based in the USA.

When you pay, you are directed to a payment page hosted by Stripe. Card numbers, security codes and TWINT payment details are processed exclusively by Stripe and never reach our own servers. Stripe is certified under the payment card industry security standard (PCI DSS).

From Stripe we receive, in order to match up the order: name, email and delivery address, the payment amount, the payment status and the payment method used. We never see the full card details.

Where data is transferred to the USA in the process, the transfer is based on the standard contractual clauses or on the Swiss-U.S. Data Privacy Framework. How Stripe processes data is set out in Stripe's privacy policy.

4. Shipping

For delivery we pass on your name, delivery address and, where needed for the delivery, email address or phone number to the carrier we have engaged. Only what is necessary for the delivery is passed on.

5. Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the website is accessed, Vercel processes technically necessary data such as IP address, date and time, page accessed and browser type, in order to deliver the website and ensure secure operation. These log data are kept only for a short period. The transfer to the USA is based on the standard contractual clauses or the Swiss-U.S. Data Privacy Framework.

6. Fonts

We use the typefaces «Newsreader» and «Geist». Both are bundled when the website is built and are served from our own server. No data is transmitted to Google or other font providers when the page is accessed.

7. Cookies and analytics

This website sets no cookies for analytics or advertising and uses no tracking services such as Google Analytics, no social media plugins and no advertising networks. We do not create usage profiles.

To see how many visits there are and how fast the pages load, we use Vercel Web Analytics and Vercel Speed Insights from our host (see section 5). Both work without cookies and without a persistent identifier. They record the page visited, the referring page, country, device type, browser and loading times. The IP address is not stored; a visit identifier is derived from it only to group views from the same day and is discarded after 24 hours. We cannot identify you from this data. The legal basis is our legitimate interest in a working, fast website.

Technically necessary cookies may be set by Stripe during the payment process in order to secure the session and prevent fraud. These cookies are required for the payment.

In addition, a technically necessary cookie remembers the language you have chosen, so that the website appears in the same language on your next visit. It contains only the code «de» or «en» and allows no conclusions about your person.

8. Discount code and Instagram

A discount code is offered on the website, together with an invitation to follow our Instagram account. We require no email address and no name in order to issue the code.

What is stored is the code issued, the time, and a check value formed from the IP address and browser identifier. This value is a hash and cannot be reversed; we do not store the IP address itself. It serves solely to prevent codes from being collected en masse. The legal basis is our legitimate interest in a functioning discount system.

The discount code is created at Stripe so that it can be redeemed during the payment process. Clause 3 applies to the processing by Stripe.

The code itself is additionally stored in your browser's storage so that it can be shown to you again on your next visit. This entry stays on your device and is not transmitted to us. You can delete it at any time through your browser settings.

Whether you actually follow the Instagram account is something we can neither check nor wish to check. No Instagram content is embedded on this website. There is merely an ordinary link to the profile. Only when you click it are you taken to Instagram, and Meta's privacy policy then applies. As long as you do not click, Instagram learns nothing about your visit to us.

9. Contact by email

If you write to us by email, we process your details in order to answer the enquiry. We delete the correspondence as soon as it is no longer needed and no statutory retention obligations stand in the way.

10. Your rights

You have the right at any time to:

• information about the data processed about you,
• rectification of incorrect data,
• erasure of your data, where no retention obligation applies,
• restriction of processing,
• release of the data in a common format,
• object to processing.

To exercise these rights, contact us at christian.lito@mygymer.ch. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

11. Data security

This website and the payment process are transmitted in encrypted form over HTTPS. We take appropriate technical and organisational measures to protect your data against unauthorised access.

12. Changes

We may amend this privacy policy if our website or the legal situation changes. The version published here at the time applies.