Datenschutzerklärung

The controller responsible for data processing on this website is:

This Privacy Policy applies to the website swiss-light.ch and all related services offered by SWISS LIGHT GmbH. It is based on:

• The Swiss Federal Act on Data Protection (nFADP / DSG, in force since 1 September 2023)
• The Swiss Ordinance on Data Protection (DPO / DSV)
• The EU General Data Protection Regulation (GDPR), insofar as it applies to our processing of personal data of individuals in the EU/EEA

Depending on the purpose of the processing, we rely in particular on the following legal bases:

• Consent (Art. 6(1)(a) GDPR / Art. 31(1) nFADP) — e.g. analytics cookies, newsletter
• Contract performance (Art. 6(1)(b) GDPR / Art. 31(2)(a) nFADP) — e.g. processing orders, payment, shipping
• Legitimate interests (Art. 6(1)(f) GDPR / Art. 31(1) nFADP) — e.g. website security, fraud prevention, essential cookies
• Legal obligation (Art. 6(1)(c) GDPR / Art. 31(2)(b) nFADP) — e.g. tax record retention

We use cookies and browser local storage to provide our services and, with your consent, to analyse website usage. You can accept or decline optional analytics cookies via the cookie consent banner shown on your first visit.

Optional analytics tools are not loaded until you click "Accept all". If you click "Reject all", Google Analytics, Vercel Analytics, and Vercel Speed Insights remain disabled.

You can change your choice at any time via the "Cookie Settings" link in the footer. Withdrawal of consent does not affect processing that took place before your withdrawal.

You can revoke your cookie consent at any time by clicking the "Cookie Settings" link in the website footer, or by clearing your browser storage.

Where necessary for the provision of our website and services, we use the following service providers. Depending on the specific processing activity, these providers may act as processors or, in individual cases, as independent controllers under their own data protection terms:

In addition, our website contains links to external platforms such as Facebook and Instagram and may offer user-triggered share functions. These services are generally contacted only when you actively click the relevant link or sharing function.

Some of our service providers may process personal data outside Switzerland, the EU, or the EEA, in particular in the United States. Where this is the case, we seek to rely on appropriate safeguards recognised under applicable law. These may include, depending on the provider and processing activity:

• Stripe: EU Standard Contractual Clauses (SCCs) and Stripe's Binding Corporate Rules
• Vercel: EU Standard Contractual Clauses (SCCs); optional analytics and Speed Insights only with your explicit consent
• Google: EU Standard Contractual Clauses (SCCs); analytics only with your explicit consent
• AWS: Data processed in the EU (eu-west-1 region, Ireland)
• Supabase: Data processed in the EU (eu-central-1 region, Frankfurt)

If you consent to optional analytics, associated analytics data may also be transferred to providers in the United States. In that case, the transfer takes place on the basis of your consent and the safeguards described above, to the extent applicable.

• Account data: Retained for as long as your account exists, deleted upon account deletion
• Order data: Retained for 10 years to comply with Swiss commercial record-keeping obligations (Art. 958f CO)
• Contact form messages: Retained for up to 2 years for follow-up, then deleted
• Product reviews: Retained until you delete them or request deletion
• Transactional email logs and delivery events: Retained only for as long as needed to ensure deliverability, security, and handling of bounces or complaints
• Analytics data: Retained in accordance with the configuration of the respective provider; for Google Analytics this is currently configured for 14 months
• Server logs: Automatically deleted after 30 days

Under the Swiss nFADP and the GDPR, you have the following rights:

• Right of access (Art. 25 nFADP / Art. 15 GDPR) — You may request a copy of all personal data we hold about you.
• Right to rectification (Art. 32(1) nFADP / Art. 16 GDPR) — You may request correction of inaccurate data.
• Right to erasure (Art. 32(2)(c) nFADP / Art. 17 GDPR) — You may request deletion of your data, subject to legal retention obligations.
• Right to data portability (Art. 28 nFADP / Art. 20 GDPR) — You may request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR) — You may object to processing based on legitimate interests.
• Right to withdraw consent — You may withdraw any given consent at any time (e.g. cookie consent, newsletter). Withdrawal does not affect the lawfulness of prior processing.
• Right to restriction (Art. 18 GDPR) — You may request restriction of processing under certain conditions.

To exercise any of these rights, contact us at mail@swiss-light.ch. We will respond within 30 days.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the competent supervisory authority:

For individuals in the EU/EEA, you may also contact the data protection authority in your country of residence.

We use Stripe to process payments. When you make a purchase, payment card data and comparable payment credentials are generally processed directly by Stripe. Stripe is PCI DSS Level 1 certified.

We generally receive from Stripe transaction-related information such as payment status, transaction identifiers, and limited payment metadata. We do not intentionally store full card numbers, CVV codes, or comparable secret payment credentials.

Stripe's privacy policy: stripe.com/privacy

We may update this Privacy Policy from time to time. The updated version will be indicated by the date at the top of the page. We encourage you to review this page periodically. Where required by law, we will provide additional notice or request renewed consent for material changes.

Zuletzt aktualisiert: April 28, 2026