Privacy
Last updated: September 2026
Short version: we run no analytics, no tracking pixels and no advertising cookies. We keep the data needed to deliver your order and answer your email, and nothing else.
1. Applicable law
We are based in Switzerland. Processing is therefore governed primarily by the revised Federal Act on Data Protection (FADP, in force since 1 September 2023) and its ordinance. The EU GDPR applies in addition where processing falls within its scope. Both apply alongside each other.
2. Controller
Nachtseide, Philip Guelat, Reuchenettestrasse 106, 2504 Biel/Bienne, Switzerland – hello@nachtseide.ch.
3. What we collect
When you order: name, delivery and billing address, email address, optional phone number, what you bought and how you paid. When you email us: what you write. When you subscribe: your email address. When you visit: our host records standard server logs (IP address, browser, page requested, timestamp) for security and operation.
4. Purposes and legal bases
To perform the contract when you order, meaning processing, shipping and payment (Art. 6(1)(b) GDPR). With your consent for the newsletter, revocable at any time (lit. a). To meet legal obligations, in particular Swiss bookkeeping duties (lit. c). On legitimate interests for security and fraud prevention (lit. f). The FADP requires no separate legal basis as long as processing is lawful, proportionate, transparent and tied to its purpose, which is the case here.
5. Who receives your data
Only those who need it so your order arrives:
- Shopify International Ltd. (Ireland) and Shopify Inc. (Canada) run the cart, checkout and payment. Card details go straight to Shopify Payments; we never see or store them.
- Vercel Inc. (USA) hosts this website and produces the server logs described above.
- Swiss Post for delivery: name and address only.
- FormSubmit forwards newsletter sign-ups to our mailbox if you subscribe.
- Infomaniak (Switzerland) hosts our mailbox; incoming messages are also forwarded to a Google Mail account from which we reply.
- Our bookkeeping and the tax authorities, as far as the law requires.
We do not sell, rent or trade personal data. Ever.
6. What we do not do
No Google Analytics, no Meta pixel, no advertising or tracking cookies on nachtseide.ch, no cross-site profiling, no data brokers. Our fonts are downloaded once at build time and served from our own domain, so nothing goes to Google when a page loads. In the checkout on shop.nachtseide.ch, Shopify sets its own cookies, including for Shopify's internal statistics; that is outside our control. Should we ever introduce analytics, this page will be changed first.
7. Cookies and local storage
Your cart is stored locally in your browser (local storage) and is not transmitted to us. At checkout, Shopify sets technically necessary cookies as well as cookies for its own statistics. You can disable cookies and local storage in your browser; using the shop may then be limited.
8. Disclosure abroad (Art. 16–17 FADP)
Shopify, Vercel and FormSubmit process data in the EEA, Canada and the USA. Transfers rely on the EU Standard Contractual Clauses with the adaptations recognised for Switzerland, and on the Swiss–US Data Privacy Framework where the recipient is certified. Canada is covered by an adequacy decision. You can request a copy of these safeguards at any time.
9. Retention
Order and invoice records: ten years under Swiss commercial law. Newsletter subscription: until you unsubscribe. Emails to us: as long as needed to resolve the matter, then deleted. Server logs: a short rolling period at the host, for security reasons.
10. Your rights under the FADP
Access (Art. 25): whether and which data we process about you. Rectification (Art. 32): have inaccurate data corrected. Erasure: have data deleted unless a retention duty applies. Objection: object to a specific processing operation. Data release (Art. 28): receive your data in a common electronic format. Withdrawal of consent: at any time, with effect for the future. Write to the address above. We may ask you to identify yourself first.
11. Your rights under the GDPR
Where the GDPR applies, you additionally have the rights of access, rectification, erasure, restriction, data portability and objection under Art. 15–21, as well as the right to lodge a complaint with a supervisory authority.
12. Supervisory authority
Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. The civil courts are also open to you.
13. Security
The website is served exclusively over encrypted HTTPS. Payment runs through Shopify's encrypted infrastructure. Access to order data is limited to the people who need it to fulfil orders.
14. Changes and language versions
We may amend this privacy statement at any time. The version published on nachtseide.ch applies. In the event of discrepancies between language versions, the German version prevails.