Privacy Policy

1. Data we process

Order and contact data (name, company, e-mail, phone, billing and delivery address, on-site contact), event details (date, time, number of guests, dietary wishes, allergy notes, remarks), payment and invoice data, your messages and, for a customer account, your login data.

We use allergy and dietary information only to prepare your order safely.

2. Purposes

Handling orders, quotes, deliveries and payments; accounting and statutory retention; communicating with you; preventing abuse (security check, rate limiting); operating and securing the website and apps. Newsletters only with your consent.

3. Recipients and processors

Stripe (card and TWINT payments), UBS Switzerland AG (bank payments), Hetzner Online GmbH, Germany (our database servers), Cloudflare Inc. (website, abuse protection, Turnstile security check), Resend Inc. (sending our e-mails), Supabase Inc. (operating our accounting system) and authorities where required by law.

Data may be processed in Switzerland, the EU/EEA and the USA. Where required, transfers are safeguarded by standard contractual clauses or the Swiss-U.S. Data Privacy Framework.

4. Retention

We keep orders, invoices, payments and the audit log for 10 years (accounting law). Message texts are deleted 2 years after the last event of the order or quote, e-mail delivery logs after 90 days.

If you delete your customer account, we anonymise your profile immediately (while an invoice is open, deletion is possible only after payment); contact details on orders and invoices remain as accounting records until the 10 years expire and are anonymised afterwards.

5. Cookies and local storage

We use no advertising or analytics cookies. In your browser we store only what is needed: your cart, the links to your orders and quotes, and your customer-account sign-in. The Cloudflare Turnstile security check may process technically necessary data.

6. Your rights

You may request access, correction, deletion, restriction and a copy of your data, and object to processing. In your customer account you export your data yourself (JSON) and delete your account. For anything else write to [email protected].

You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

7. Security

Encrypted transmission, access only for authorised staff with two-factor sign-in, tamper-evident audit log, daily backups.