1. Data Controller
The data controller responsible for processing personal data on this website is:
Seebrot
Lukas Meier & Claudia Brunner
18 Hauptstrasse
9320 Arbon, Switzerland
Email: [email protected]
Phone: +41 71 446 28 14
2. Applicable Law
This Privacy Policy is designed to comply with the Swiss Federal Act on Data Protection (FADP, revDSG/nDSG, in force since 1 September 2023) and, where applicable, the EU General Data Protection Regulation (GDPR) for visitors from the European Economic Area. Where Swiss and EU law differ, we apply the standard that affords you the greater protection.
3. Personal Data We Collect
We may process the following categories of personal data:
- Contact data: name, email address, phone number, and message content when you use our contact form, email us, or call our bakery.
- Order data: details of pre-orders, cake requests, delivery preferences, and payment-related information when you place an order.
- Technical data: IP address, browser type, device information, pages visited, and referral source — collected via cookies and similar technologies (see our Cookie Policy).
- Communication data: records of correspondence with our team.
We do not knowingly collect data from children under 16 without parental consent.
4. Purposes and Legal Bases
We process your personal data for the following purposes:
- Responding to enquiries and fulfilling orders — based on pre-contractual measures and contract performance (Art. 31 para. 2 lit. a FADP; Art. 6(1)(b) GDPR).
- Operating and securing our website — based on our legitimate interest in providing a functional, secure online presence (Art. 31 para. 1 FADP; Art. 6(1)(f) GDPR).
- Analytics and marketing cookies — only with your consent via our cookie banner (Art. 6(1)(a) GDPR; Art. 6 para. 6 FADP).
- Legal obligations — such as tax and accounting records (Art. 31 para. 1 FADP; Art. 6(1)(c) GDPR).
5. Cookies and Tracking
We use essential cookies to store your cookie preferences and, if you consent, analytics and marketing cookies. For full details, categories, retention periods, and how to withdraw consent, please see our Cookie Policy.
6. Data Sharing and Processors
We do not sell your personal data. We may share data with:
- IT and hosting providers who process data on our behalf under data processing agreements.
- Analytics providers, only if you have consented to analytics cookies.
- Authorities when required by Swiss law or a binding court order.
Some processors may be located outside Switzerland or the EEA. In such cases we ensure adequate protection through Standard Contractual Clauses, adequacy decisions, or other mechanisms recognised under FADP and GDPR.
7. Retention
We retain personal data only as long as necessary for the purposes described above:
- Contact form submissions: up to 24 months after the enquiry is resolved.
- Order records: 10 years (Swiss commercial and tax law requirements).
- Cookie consent records: 12 months, then re-prompted.
- Server logs: up to 90 days.
8. Your Rights
Under the Swiss FADP (nDSG) and, where applicable, the GDPR, you have the right to:
- Access your personal data and obtain a copy.
- Request correction of inaccurate data.
- Request deletion of data no longer needed or unlawfully processed.
- Restrict or object to processing based on legitimate interests.
- Data portability for data processed by automated means with your consent or under contract.
- Withdraw consent at any time (without affecting prior lawful processing).
- Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC/EDÖB) at edoeb.admin.ch, Feldeggweg 1, 3003 Bern, Switzerland, or with your local EU/EEA supervisory authority if GDPR applies.
To exercise your rights, contact us at [email protected]. We will respond within 30 days.
9. Data Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or alteration, including encrypted connections (HTTPS), access controls, and regular review of our processing activities.
10. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The current version is always available on this page with the date of last revision. Material changes will be communicated where appropriate.