Privacy policy

Last updated: 12 October 2026

This privacy policy explains how we process personal data when you visit coffeedeal.ch, place orders, use customer accounts and communicate with us. We also use the WooCommerce system on labottegadelcaffe.ch for order and account processing. This policy follows the Swiss Federal Act on Data Protection (FADP). Where applicable in individual cases, we also take foreign data protection law into account.

1. Data controller

Buon Caffè by Luca
Michelli Design
Limmatstrasse 50
8005 Zürich
Switzerland
[email protected]
+41 77 285 56 88

2. Data we process

• Basic and contact data: name, billing and delivery addresses, email address, telephone number and customer account.
• Order and contract data: products, prices, vouchers, payment method, payment status, delivery, returns, support and warranty cases.
• Payment data: transaction identifiers and status information. Complete card or account details are generally processed directly by the selected payment service provider.
• Communication data: messages, enquiries, reviews, and voluntarily submitted documents or photos.
• Technical data: IP address, date and time, device, browser, pages visited, referrer, log and security data, cookie and consent status.
• Usage and marketing data: interactions with the shop, emails and advertising, where consent is required and has been given.

3. Purposes

We process personal data to provide and secure the shop, process orders and payments, make deliveries, manage customer accounts and loyalty features, handle support, defect and warranty cases, comply with statutory accounting and retention obligations, prevent misuse, and analyse and develop our range. Advertising and non-essential analytics are carried out only in accordance with applicable law and, where required, with consent.

4. Recipients and processors

Data is shared only where necessary for the stated purposes, where consent has been given or where required by law. Recipients may include hosting, CDN and security providers such as Cloudflare, IT and email service providers, warehouse and logistics partners such as Swiss Post or Planzer, accounting and advisory services, and public authorities.

Depending on the selection, we use Payrexx (including TWINT and the cards offered), Stripe, PayPal, HeyLight and bank transfer for payments, where the respective payment method is offered at checkout. Each service processes the data required for payment under its own privacy rules.

Google services, in particular Google Site Kit and, where applicable, Google Analytics, are used for statistics and audience measurement only in accordance with the consent settings. Technical usage data may be transmitted to Google in the process.

For translated pages, GTranslate and associated translation services may process technical request and usage data.

5. Cookies, analytics and consent

Necessary cookies and similar technologies enable the cart, checkout, sign-in, security and saved privacy settings. Statistics, marketing and external media services are loaded only where permitted by applicable law and where any required consent has been given. On labottegadelcaffe.ch, the selection can be changed in the privacy settings in the footer. Withdrawal of consent takes effect for the future.

On coffeedeal.ch, we store the cart, wishlist, product comparison, viewed product categories and recently used search terms locally in the browser. Technically necessary session cookies may be used for sign-in, shipping calculations and payment. Contact, billing and delivery details and order information entered at checkout are transmitted to our WooCommerce system on labottegadelcaffe.ch for calculation and processing. Depending on the selected payment method, the payment service provider processes the data required for this purpose.

6. Disclosure abroad

Some service providers process data outside Switzerland or the European Economic Area. In such cases, we ensure an adequate level of data protection, for example through an adequacy decision, recognised standard data protection clauses or a statutory exception. For US and other international providers, access from their country of establishment cannot be completely ruled out.

7. Retention

We retain data only for as long as necessary for the relevant purpose, contract processing, defence against claims and statutory obligations. Accounting records, invoices and business correspondence are generally retained for ten years. Customer accounts remain until deleted or until further retention is no longer necessary. Technical logs are generally kept for shorter periods unless a security incident requires longer retention.

8. Data security

We take appropriate technical and organisational measures against loss, misuse, unauthorised access and unlawful modification. However, completely risk-free data transmission or storage cannot be guaranteed.

9. Rights of data subjects

Under applicable law, you may request access to, correction, release or transfer of your data, as well as deletion or restriction of processing. Consent can be withdrawn at any time for the future. Statutory retention and documentation obligations and overriding legitimate interests remain reserved. Requests may be addressed to [email protected]. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

10. Automated decisions

We generally do not make exclusively automated decisions with significant legal effects. Payment and security service providers may carry out automated fraud or credit checks under their own rules.

11. Changes

We may amend this privacy policy if processing activities, services or the legal situation change. The version published on this website applies.