PRIVACY POLICY

IMPORTANT NOTE: The German version of this document will govern our relationship – this translated version is provided for convenience only and will not be interpreted to modify the German version. For the German version, please see https://thomasmuller.ch/de/datenschutz/.

1. Introduction and Controller

In this privacy policy, we, Thomas Müller Chocolatier (Rheinstrasse 20, CH-8200 Schaffhausen, Switzerland), explain how we collect and process personal data. Personal data means any information relating to an identified or identifiable person.

This privacy policy is based on the Swiss Federal Act on Data Protection (FADP). As we also deliver our products to customers in the European Union / EEA and in further countries (including the United Kingdom, Norway, Canada, Japan, Israel and Hong Kong), the EU General Data Protection Regulation (GDPR) additionally applies to the processing of personal data of persons in the EU/EEA (Art. 3(2) GDPR), and the UK GDPR to the processing of personal data of persons in the United Kingdom.

The controller responsible for the data processing described here is:

Thomas Müller Chocolatier
Rheinstrasse 20
CH-8200 Schaffhausen, Switzerland
E-mail: info@thomasmuller.ch

If you have any data protection concerns, you can contact us at this address at any time.

2. What Data We Process

We primarily process personal data that we receive from our customers and business partners in the course of our business relationship, or that we collect from users when operating our website. This includes in particular:

• Order and contract data: name, address, delivery address, e-mail address, telephone number, products ordered, payment information;
• Communication data: information from enquiries, correspondence and job applications;
• Technical data when using our website: IP address, information about your device and browser, date and time of your visit, pages accessed, cookies (see section 4);
• Marketing data: newsletter registration, interests and preferences.

Where permitted, we may occasionally also obtain data from publicly accessible sources (e.g. commercial registers, the internet) or receive data from third parties (e.g. credit checks for purchases on account, or your delivery address from a person sending you a gift).

If you provide us with personal data of other persons (e.g. a gift delivery address), please make sure that you are entitled to do so and that these persons are aware of this privacy policy.

3. Purposes of Data Processing and Legal Bases

We process your personal data in particular for the following purposes:

• Conclusion and performance of contracts, in particular processing and delivering your orders, including international shipping, payment processing and customer service (legal basis under the GDPR: Art. 6(1)(b));
• Communication with you and handling your enquiries (Art. 6(1)(b) and (f) GDPR);
• Marketing and advertising, e.g. sending our newsletter where you have given your consent (Art. 6(1)(a) GDPR), or advertising to existing customers, which you may object to at any time (Art. 6(1)(f) GDPR);
• Improving our offerings and our website, including audience measurement (Art. 6(1)(a) and (f) GDPR);
• Compliance with legal obligations, e.g. accounting retention obligations as well as customs and export requirements for international deliveries (Art. 6(1)(c) GDPR);
• Establishing, exercising and defending legal claims as well as preventing and investigating criminal offences, e.g. fraud prevention (Art. 6(1)(f) GDPR);
• Ensuring our operations, in particular IT security (Art. 6(1)(f) GDPR).

You may withdraw any consent you have given at any time with effect for the future; this does not affect processing that has already taken place.

4. Cookies, Tracking and Third-Party Services

We use cookies and similar technologies on our website. Cookies are small files that are stored on your device when you visit our website. In addition to session cookies, which are deleted after your visit, we use permanent cookies, for example to save settings (e.g. language, shopping cart) and to understand how our offerings are used.

We use technically necessary cookies on the basis of our legitimate interest in a functioning website. We only use all other cookies and tracking services (analytics, marketing) if you have given your consent via our cookie banner. You can withdraw or adjust your consent at any time via the cookie settings on our website. You can also block or delete cookies in your browser; however, certain functions (e.g. shopping cart, ordering process) may then no longer be available.

Our newsletters may contain visible and invisible image elements which, when retrieved, allow us to determine whether and when you opened the e-mail. You can block this in your e-mail program.

• We currently use in particular the following services:Google Analytics, Google Tag Manager and Google Ads (Google Ireland Ltd., Dublin, Ireland; processor: Google LLC, USA) — to analyse the use of our website and to measure and manage our advertising campaigns. These services are only loaded after you have given your consent via our cookie notice; without your consent, no data is transmitted to Google. We do not transmit full IP addresses to Google and receive the information in aggregated form. You can withdraw your consent at any time by deleting the cookies in your browser — on your next visit, you can make a new choice. Privacy policy: https://policies.google.com/privacy
• Mailchimp (Intuit Inc., Atlanta, USA) — for sending our newsletter to registered subscribers. In addition, order and customer data are transmitted to Mailchimp via the connection to our online shop in order to tailor our newsletter content to our customers. This involves the transfer of data to the USA. You can unsubscribe at any time via the link included in every newsletter. Privacy notice: https://mailchimp.com/legal/
• Cookie consent: We store your choice made in the cookie notice in a technically necessary cookie (“cn_consent”) with a lifetime of 12 months. This cookie does not contain any personal data, only your decision.
• Fonts are hosted locally on our server. No data is transmitted to Google Fonts or other font providers when you visit our website.
• Wordfence (Defiant Inc., Seattle, USA) — to protect our website against attacks and abuse. For this purpose, technical access data (in particular IP addresses, time and type of access) are logged and compared with the provider’s servers in the USA in order to detect and block attacks. This processing is based on our legitimate interest in the security of our website. Privacy notice: https://www.wordfence.com/privacy-policy/

5. Social Media

We maintain presences on social networks (currently Facebook, Instagram, YouTube, LinkedIn). If you contact us there, we process the resulting data for the purposes described in section 3, in particular for communication and marketing. The platform operators additionally analyse your use under their own responsibility. Information on this and on your rights vis-à-vis the operators can be found in their privacy policies:

• Facebook/Instagram: https://www.facebook.com/privacy/policy
• YouTube: https://policies.google.com/privacy
• LinkedIn: https://www.linkedin.com/legal/privacy-policy

6. Disclosure of Data and Transfers Abroad

Within the scope of the purposes described above, we disclose your personal data in particular to the following recipients:

• Service providers (processors), e.g. IT, hosting, payment and shipping service providers as well as the providers listed in section 4;
• Transport and logistics companies for the delivery of your order and, for international deliveries, also customs authorities of the destination country (the information required for customs clearance, such as name, address and value of the goods, is transmitted);
• Authorities and courts, where we are legally obliged or entitled to do so;
• Other third parties in connection with potential or actual legal proceedings.

Some of these recipients are located abroad, in particular in the EU/EEA and in the USA (e.g. Google, Microsoft, Meta, Mailchimp, Amazon, SAP), as well as in the other countries we deliver to (local logistics providers and customs authorities).

If a recipient is located in a country without adequate data protection, we base the transfer on appropriate safeguards: transfers to the USA are made, where the recipient is certified accordingly, on the basis of the Swiss–U.S. Data Privacy Framework or the EU–U.S. Data Privacy Framework. Otherwise, we use the Standard Contractual Clauses of the European Commission (available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), supplemented where necessary for Swiss data exports. In exceptional cases, we may rely on statutory exemptions, for example where the transfer is necessary for the performance of your contract (e.g. delivery to your address abroad), where you have consented, or where the transfer is necessary for the establishment, exercise or defence of legal claims.

7. Retention Period

We store your personal data for as long as this is necessary to fulfil our contractual and legal obligations or the purposes pursued — as a rule, for the duration of the business relationship and beyond that in accordance with statutory retention obligations (in Switzerland, e.g. ten years for business records) or for as long as claims can be asserted. The data is then deleted or anonymised. Shorter retention periods of twelve months or less generally apply to operational data (e.g. system logs).

8. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access and misuse, such as access controls and restrictions, encryption of transmissions, training and internal directives.

9. Provision of Personal Data

To conclude and process an order or a contract, we require certain personal data (e.g. name, delivery and billing address). Without this data, we are generally unable to conclude or perform the contract. As a rule, you are under no legal obligation to provide us with data.

10. Profiling and Automated Individual Decisions

We may partially evaluate your personal data by automated means in order to show you offers and advertising tailored to you (profiling). We do not use fully automated individual decision-making within the meaning of Art. 22 GDPR; should we do so in individual cases, we will inform you separately where required by law.

11. Your Rights

Within the scope of the data protection law applicable to you, you have in particular the right to:

• access the personal data we process about you;
• rectification of inaccurate data;
• erasure of your data;
• restriction of processing;
• data portability (receipt of certain data in a commonly used format);
• object to processing based on legitimate interests, in particular direct marketing and related profiling;
• withdraw any consent given, with effect for the future.

We reserve the right to assert restrictions provided for by law, for example where we are obliged to retain data or need it to establish, exercise or defend legal claims. To exercise your rights, you can contact us at the address given in section 1; we may require proof of your identity.

You also have the right to lodge a complaint with a data protection supervisory authority:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch
• EU/EEA: the supervisory authority responsible for you, https://edpb.europa.eu
• United Kingdom: Information Commissioner’s Office (ICO), https://ico.org.uk

12. Changes to this Privacy Policy

We may amend this privacy policy at any time. The current version published on our website applies. If this privacy policy forms part of an agreement with you, we will inform you of material changes by e-mail or in another appropriate manner.