Privacy Policy

Last updated: 2026-06-01

1. Data controller

EKKE'S (Einzelfirma), operated by Pascal Chaillet, Chemin Du Jura 1, 1290 Chavannes-des-Bois, Switzerland. Contact for privacy matters: privacy@ekkes.ch.

2. Personal data we collect

Account data: name, email, hashed password, preferred language, date of birth (collected at checkout to confirm legal drinking age).
Order data: billing and shipping address, phone number, items purchased, payment provider reference, order history.
Payment data: we never store full card numbers. Payment authorisation is handled by SumUp; we keep only the gateway transaction reference.
Communication data: messages you send via the contact form, newsletter subscription status.
Usage data: with your consent, anonymised analytics about which pages you visit. IP addresses are truncated before storage.

3. Why we process your data (legal bases under the FADP)

Performance of the sales contract (Art. 31 para. 2 lit. a FADP): processing your order, taking payment, organising delivery.
Legal obligation: Swiss accounting law requires us to retain order records for 10 years.
Consent (Art. 6 para. 6 FADP): marketing emails, analytics cookies. You can withdraw consent at any time.
Overriding legitimate interest: fraud prevention, dispute resolution, securing the website.

4. Who we share data with

We work with the following data processors. Each is bound by a written processing agreement.

SumUp Payments Ltd. (UK) for payment processing.
The Rocket Science Group, LLC (Mailchimp) (USA) for newsletter delivery, only if you opted in.
Swiss Post, DHL Express, UPS for shipping.
Our hosting provider (Swiss data centre) for storage and execution of the website.
Sentry (USA) for error monitoring, with personally identifying data scrubbed before transmission.

Transfers to the USA are protected by either the EU-US Data Privacy Framework or Standard Contractual Clauses.

5. Retention

Order and invoice data: 10 years from the end of the financial year (Art. 958f Swiss CO).
Account data: until you delete your account, then immediately anonymised.
Marketing data: until you unsubscribe, then deleted within 30 days.
Analytics data: 14 months maximum.
Webhook and processing logs: 90 days.

6. Your rights

Under the FADP you have the right to access, rectify, delete, restrict, or export your personal data, and to withdraw any consent at any time. From your account dashboard you can:

Download a copy of all data we hold on you.
Delete your account (orders are anonymised rather than deleted to comply with accounting law).
Unsubscribe from marketing emails.

You can also exercise these rights by emailing privacy@ekkes.ch. You have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

7. Security

Traffic is encrypted via TLS. Passwords are hashed using bcrypt. Database access is restricted to authenticated administrators. We log access to personal data and review the logs for anomalies.

8. Cookies

See our cookie policy for the full list of cookies we use and how to manage them.

9. Changes to this policy

We will publish material changes on this page. If the change affects how we use your data, we will email registered customers in advance.