Privacy policy

This policy explains which personal data Cetora Collect Sàrl processes when you use this website, place an order, offer us a collection or write to us, why we process it and what your rights are. It is based on the Swiss Federal Act on Data Protection (FADP) and, where it applies, on the European Union's General Data Protection Regulation (GDPR).

1. Controller

Cetora Collect Sàrl
Grand'Rue 57
1110 Morges
Suisse
Email: contact@cetoracollect.ch

For any question about your data or to exercise your rights, write to us at this address.

2. Data processed and purposes

Visiting the website

When you browse the website, our hosting provider records the technical data needed for it to work securely: IP address, date and time, requested page, browser. Our own security logs, used in particular to block intrusion attempts and form abuse, only store IP addresses as a non-reversible hash.

Customer account

If you create an account: first name, last name, email address, phone number (optional), language, saved addresses, order history and wishlist. Your password is stored as an irreversible hash: we do not know it. The account lets you follow your orders and find your addresses and wishlist again.

Orders

To process an order, with or without an account: name, email address, phone number (optional), shipping and billing addresses, any note you add, items ordered, amounts, shipping method, payment and shipping status, tracking number. We use this data to perform the contract (preparation, shipping, invoicing, after-sales service) and to meet our accounting and tax obligations.

Payment takes place on the secure page of our provider Stripe. We neither receive nor store your card details: Stripe only tells us the status of the payment.

Buyback requests

When you offer us a collection: contact details, description of the collection and the photos you attach. Photos are kept in a private area that only our team can access. We use this data to review your request, make you an offer and, if the sale goes ahead, document the purchase.

Contact form and purchase requests

Name, email address, subject, message and, where relevant, the item concerned. We use this data to answer your request, for example a request to buy a Cetora Select piece.

Newsletter

If you subscribe: email address, language, date and wording of the consent you gave. The subscription only becomes active once you confirm it through the link sent by email, and every newsletter contains an unsubscribe link.

Cart and wishlist without an account

A cookie containing a random identifier links your browser to your cart and wishlist, without you having to create an account. See our cookie policy.

Audience measurement

Only if you accept it, the website records browsing events in its own database: product pages viewed, searches, items added to the cart and wishlist, checkouts started, language and, where relevant, the campaign you came from. These events contain no IP address and no personal identifier, and are not passed on to any third-party tool. They help us understand which items interest our visitors. You can change your choice at any time with the “Manage cookies” link at the bottom of the page.

Emails sent

We keep a record of the transactional emails sent (recipient, type of message, date), so that we can answer a question about an order or a request.

3. Legal bases

We process your data to perform a contract or pre-contractual steps (orders, account, buyback and purchase requests), to comply with our legal obligations (accounting, tax), on the basis of our legitimate interest (website security, prevention of abuse and fraud, answering your messages) or with your consent (newsletter, audience measurement). You can withdraw your consent at any time; this does not affect processing already carried out.

4. Recipients and service providers

We do not sell or rent your data. We only share it with the providers needed to run the website and the shop, who are contractually bound to protect it:

• Infomaniak Network SA, Geneva, Switzerland: hosting of the website and database, sending of emails;
• Stripe Payments Europe, Limited, Dublin, Ireland, and its affiliates: processing of payments by card, TWINT and the other methods offered on the payment page. For fraud prevention and its own legal obligations, Stripe acts as an independent controller, under its own privacy policy (stripe.com/privacy);
• bexio AG, Rapperswil, Switzerland: accounting software, which receives sales data (order number, items, amounts) but not your contact details;
• the carrier handling the delivery: name and delivery address;
• our advisers bound by professional secrecy (accountant, legal advisers), where necessary.

Finally, we disclose data to the authorities where the law requires us to.

5. Transfers abroad

The website and its database are hosted in Switzerland. Stripe processes payment data in the European Union, whose level of data protection Switzerland recognises as adequate, and may transfer some of it to the United States, in particular to Stripe, LLC, which participates in the Swiss-U.S. Data Privacy Framework. For its other transfers, Stripe applies the safeguards provided for by law, such as standard contractual clauses.

6. Retention periods

• orders, invoices and accounting records: 10 years, as required by the Swiss Code of Obligations;
• customer account: until it is deleted, which you can request at any time; the data of your orders is kept for the legal period;
• cart and wishlist without an account: deleted automatically after 90 days (cart) and 180 days (wishlist) of inactivity;
• buyback requests, contact messages and purchase requests: as long as needed to handle the request and follow it up; if a purchase or sale is concluded, the relevant records are kept with the accounts;
• newsletter: until you unsubscribe; an unconfirmed subscription is deleted after 30 days;
• audience measurement: 25 months at most;
• email record and technical logs: as long as needed for website security and to follow up requests;
• database backups: 14 days, on a rolling basis.

7. Security

The website can only be reached over an encrypted connection (HTTPS). Passwords are stored as an irreversible hash, the administration area is restricted to our team and protected, and the files you send us, such as the photos of a buyback request, are stored outside the public part of the website.

8. Your rights

At any time, you can ask us:

• which data we process about you (right of access);
• to correct inaccurate data;
• to delete your data, except data the law requires us to keep;
• to restrict or object to processing, in particular to the newsletter;
• to receive the data you provided to us in a common format, or to have it transferred to another controller (portability).

Write to us at contact@cetoracollect.ch. We may ask you to prove your identity and usually reply within 30 days. If you believe your data is not being processed properly, you can contact the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, where the GDPR applies, the data protection authority of your country of residence.

9. Automated decisions

We do not take decisions based solely on automated processing and do not carry out profiling. Stripe may however automatically decline a payment it considers fraudulent, under its own rules.

10. Changes

We may update this policy, in particular if our services or the law change. The version in force is the one published on this page; its number and date appear at the top of the page.