Privacy policy

Privacy Policy

1. Data Controller

The controller responsible for the processing of personal data is:

Orvyn by Gruber
Fichtweg 14
4254 Liesberg Dorf
Switzerland

UID: CHE-461.321.205
Email: privacy@orvyn.ch

2. Scope

This Privacy Policy explains how Orvyn processes personal data when you visit www.orvyn.ch, place an order, create a customer account, contact us, request a return, subscribe to our newsletter or use our other services.

Personal data is processed in accordance with the Swiss Federal Act on Data Protection and, where applicable, the European Union General Data Protection Regulation.

3. Personal Data We Process

Depending on how you use our services, we may process the following categories of personal data:

  • Name and contact details

  • Billing and delivery address

  • Email address and telephone number

  • Order, payment, delivery and return information

  • Customer account and communication data

  • IP address, device, browser and usage information

  • Cookie and consent information

  • Data used for fraud prevention and transaction security

Payment card information is generally processed directly by the relevant payment provider and is not stored in full by Orvyn.

4. Purposes and Legal Bases

We process personal data for the following purposes:

  • Processing and fulfilling orders

  • Processing payments

  • Delivery and shipment tracking

  • Processing returns, withdrawals and refunds

  • Creating and managing customer accounts

  • Responding to enquiries

  • Complying with statutory retention and documentation obligations

  • Ensuring the security of our online store

  • Detecting and preventing misuse and fraud

  • Sending newsletters and marketing communications

  • Analysing and improving our online store and advertising

Where the GDPR applies, processing is based on one or more of the following legal bases:

  • Article 6(1)(b) GDPR for the performance of a contract or pre-contractual measures

  • Article 6(1)(c) GDPR for compliance with legal obligations

  • Article 6(1)(f) GDPR for our legitimate interests, particularly in the secure and efficient operation of our online store

  • Article 6(1)(a) GDPR where consent has been provided, particularly for non-essential cookies, personalised advertising and newsletters

Consent may be withdrawn at any time with effect for the future.

5. Shopify

Our online store is operated using Shopify. Depending on the responsible group company, the provider is Shopify International Limited or Shopify Inc.

Shopify processes data required to operate the online store, display products, manage customer accounts, provide checkout and payment functions, ensure security and provide the technical infrastructure.

Further information is available in Shopify’s Privacy Policy.

6. Order Fulfilment and BrandsGateway

For inventory management, order fulfilment and direct product delivery, we work with BrandsGateway, Gateway Holdings OÜ and the warehouse and fulfilment partners involved in processing orders.

The data required to fulfil an order, particularly the customer’s name, delivery address, contact details and order information, is shared with these partners. Data is shared only to the extent necessary to process, deliver, return or refund an order.

7. Shipping Providers

We may share the data required for delivery and shipment tracking with shipping providers such as DHL, UPS or FedEx.

This may include the customer’s name, delivery address, contact details, order number and other information required for delivery.

8. Payment Providers

Depending on the payment method selected at checkout, data is shared with the relevant payment provider. These providers may include Shopify Payments, credit card providers, PayPal, Klarna, Apple Pay and Google Pay.

The privacy policies of the selected payment provider also apply. Payment providers may conduct their own checks for payment authorisation, transaction security and fraud prevention.

9. Contact and Google Workspace

If you contact us by email, contact form or another communication channel, we process the information you provide in order to respond to your enquiry.

We use Google Workspace for email communication. Personal data may therefore be processed by companies within the Google group.

10. Newsletter

Newsletters and other electronic marketing communications are sent only with the relevant consent or another applicable legal basis.

You may unsubscribe at any time using the unsubscribe link included in each message or by emailing privacy@orvyn.ch. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Cookies and Consent Management

Our website uses technically necessary cookies required to operate the online store, shopping cart, checkout, security functions and saved preferences.

For visitors from the European Union, non-essential cookies and similar technologies used for analytics, personalisation and advertising are activated only after the relevant consent has been provided.

Consent can be changed or withdrawn at any time through the cookie settings available on the website. Technically necessary cookies cannot be fully disabled because the online store may otherwise not function correctly.

12. Google Services

Where the relevant consent has been provided, we may use Google services, including Google Analytics, Google Ads and related measurement and advertising functions.

Information about the use of our website, the device, browser, IP address and interactions with our online store may be processed. Google may use this information for measurement, analytics and advertising personalisation.

13. Meta Services

Where the relevant consent has been provided, we may use technologies provided by Meta Platforms, including the Meta Pixel and Meta Conversions API.

These technologies may be used to measure visits, product views, shopping-cart activity and purchases and to evaluate or personalise advertising. Depending on the configuration, browser, device, usage and transaction data may be shared with Meta.

14. Reviews

We may use external services such as Judge.me to collect and display product and store reviews. The order and contact information required to request and display a review may be processed for this purpose.

Review requests are sent only in accordance with applicable legal requirements.

15. International Data Transfers

Some service providers may process personal data outside Switzerland or the European Economic Area.

Such transfers take place only where an adequate level of data protection exists or where appropriate safeguards are used, such as recognised standard contractual clauses, an adequacy decision or another legally permitted transfer mechanism.

16. Data Retention

Personal data is retained only for as long as required for the relevant purpose or to comply with statutory retention obligations.

Order, invoice and accounting records may generally be retained for up to ten years due to statutory obligations. Communication and support data is deleted when it is no longer required for processing or documentation purposes. Newsletter data is processed until the subscription is cancelled or consent is withdrawn.

17. Data Security

We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure and other misuse.

Data transmitted between the browser and our online store is generally encrypted.

18. Your Rights

Subject to applicable data protection law, you may have the following rights:

  • Right of access

  • Right to rectification

  • Right to erasure

  • Right to restriction of processing

  • Right to data portability

  • Right to object to certain processing

  • Right to withdraw consent

  • Right to lodge a complaint with a competent supervisory authority

Requests may be sent to privacy@orvyn.ch. We may request appropriate proof of identity to prevent unauthorised disclosure of personal data.

Individuals in Switzerland may contact the Swiss Federal Data Protection and Information Commissioner. Individuals in the European Union may contact the data protection supervisory authority in their country of residence.

19. Automated Decision-Making

Orvyn does not generally make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals.

Payment providers may conduct automated checks for payment authorisation and fraud prevention under their own responsibility.

20. Changes to This Privacy Policy

We may update this Privacy Policy if our data processing activities, service providers or legal requirements change.

The version published on www.orvyn.ch at the relevant time applies.