# Privacy Policy # Privacy Policy ## 1. Controller Kilometro, owner Daniel Machiussi Zürcherstrasse 7 8107 Buchs ZH Switzerland Email: [info@kilometro.ch](mailto:info@kilometro.ch) Phone: +41 76 270 06 66 Use this address for any question about data protection and to exercise your rights. ## 2. Principles and applicable law Protecting your data matters to us. We process personal data under the revised Swiss Federal Act on Data Protection (revFADP) and the Data Protection Ordinance (DPO). We deliver within Switzerland only, and we do not address our offer to customers in the EU. The EU General Data Protection Regulation (GDPR) therefore does not apply to our shop. ## 3. What data we process ### 3.1 Customer account and orders First name, last name, email address, phone number, delivery and billing address, order history, the payment and delivery method you chose, the moment you accepted the terms, and any notes you add to your order. ### 3.2 Orders without an account If you order without an account, we store your email address together with the order. Without it we cannot process the order. ### 3.3 Checkouts you did not complete If you leave the checkout, we keep an intermediate record. It holds your basket, your email address and the payment reference. This lets you continue later, and it lets us release the stock we reserved for you. ### 3.4 Newsletter Email address, the moment you gave your consent, and the status of your subscription. We use a double opt-in: after you sign up, you receive a confirmation email, and we add you to the list only after you confirm. Every newsletter email carries an unsubscribe link. ### 3.5 Product reviews Rating, title, text and, for reviews without an account, your email address. On the product page we publish the rating, the title, the text and the note about a verified purchase. We never publish your email address. ### 3.6 Gift cards When you buy a gift card, we store your name and email address, plus the name, email address and personal message for the person who receives it. We use this data only to deliver and redeem the gift card. The recipient receives a reference to this privacy policy with the gift card. ### 3.7 Wishlist and recently viewed products We store your wishlist with your customer account. The list of recently viewed products stays in your browser and never reaches our server. You can refuse this list in the cookie notice. We then delete it and start no new one. ### 3.8 Back-in-stock notification If you sign up for a back-in-stock notification, we store your email address, the product you want and a personal unsubscribe link. ### 3.9 Contact, showroom and feedback forms Name, email address, phone number and the text of your message. For the feedback form we also store technical details about the reported fault: the address you were on, your browser and the error message. ### 3.10 External test reports For our product information we evaluate publicly available test reports from specialist media. We store the name of the author, the publication, the date, the source and extracts from the report. We may name these details together with the quotation on the product page. We use an AI service for the evaluation (see section 8). If such a report is yours and you do not want to be named, write to [info@kilometro.ch](mailto:info@kilometro.ch). We will remove the reference. ### 3.11 Technical log data When you open our website, we receive your IP address, browser type, operating system, and the date and time. To prevent abuse we also count form submissions per IP address. We keep these counters in memory only and never store them permanently. ## 4. Purposes of the processing We process your data for the following purposes: - Handling orders, payments, deliveries and returns - Running your customer account - Communication and customer service - Sending the newsletter, if you gave your consent - Operating, securing and improving our website - Meeting legal duties, in particular in accounting and tax law ## 5. Cookies and local storage We use two cookies. Both are technically necessary to run the shop. - _session – links your basket to you, valid until you close the browser - _customer_session – keeps you signed in, valid for 7 days Scripts cannot read either cookie, and both travel over an encrypted connection only. Your browser also keeps two entries in local storage: your answer to our cookie notice, and the list of recently viewed products. Both entries stay on your device. You can delete them at any time in your browser settings. We use no advertising cookies and no cookies for audience measurement. ## 6. Web analytics We use Plausible Analytics for audience measurement. We run the software ourselves, on our own server in a data centre in Germany. No analytics provider receives the data. Plausible sets no cookies and creates no identifier that can recognise you again. On every page view our server passes your IP address and your browser identification to the analytics software. From these it derives the country, the device type and the browser, then discards both. The IP address is not stored. We also record: - the pages you open and the referring website - search terms and the filters you set - coupon codes you apply - shop events, for example a completed order with its amount The shop events carry no order number, no name and no email address. We record search terms and coupon codes exactly as you enter them. For that reason, do not type personal details into the search field. ## 7. Payment processing We process payments through Stripe. The contracting party for Switzerland is Stripe Payments Europe, Limited, based in Ireland. You enter your payment details directly with Stripe. We see neither the full card number nor the security code, only the card brand, the last four digits and a payment reference. Stripe also processes data in the United States. The Stripe privacy policy applies in addition: [https://stripe.com/privacy](https://stripe.com/privacy) ## 8. Other recipients We pass on personal data only where this is necessary for the purposes named above, or where the law obliges us. We do not sell data. Every service provider is under a contractual duty of confidentiality and data security. - Hetzner Online GmbH – data centre for the shop, the database, the analytics and the email mailboxes – Germany - Stripe – payment processing – Ireland and the United States - Mailgun (Sinch) – delivery of order and system emails – EU region - Cloudflare – storage of images and files, and name resolution – United States - Anthropic – evaluation of public test reports under section 3.10 – United States - Postal and transport companies – delivery of your order – Switzerland Our shop and our database run in a data centre in Germany. ## 9. Disclosure abroad Germany and Ireland belong to the European Economic Area. The Swiss Federal Council recognises these states as providing adequate data protection. These disclosures need no additional safeguard. For disclosures to the United States we rely on the safeguards of the provider concerned. Cloudflare is certified under the Swiss-U.S. Data Privacy Framework and additionally applies the standard contractual clauses. Stripe relies on the EU-U.S. Data Privacy Framework and on the standard contractual clauses. For Anthropic the standard contractual clauses apply. ## 10. Retention periods We delete or anonymise personal data as soon as the purpose of the processing ends. The following periods apply: - Orders and invoices – 10 years, under Article 958f of the Code of Obligations - Customer account – until you delete it - Basket – 30 days after the last change - Checkouts you did not complete – 90 days - Newsletter – until you unsubscribe - Back-in-stock notification – until we notify you, then 30 days - Enquiries from forms and feedback – 12 months - Product reviews – until you withdraw them ## 11. Your rights You have the following rights towards us: - Access to the personal data we process about you - Correction of inaccurate data - Deletion of your data, unless a legal retention duty prevents it - Release of your data in a common electronic format - Objection to a processing operation - Withdrawal of a consent you gave, at any time and with effect for the future You can delete your customer account yourself. Sign in and choose "Delete account" in your profile. We then anonymise your personal data and the related order data, and we unsubscribe your email address from the newsletter. We keep the orders themselves in anonymised form for accounting reasons. For every other request write to [info@kilometro.ch](mailto:info@kilometro.ch). We answer within 30 days. We may ask for additional details to confirm your identity. ## 12. No automated individual decisions We take no decisions that rest exclusively on automated processing and that have a legal consequence for you or affect you significantly. ## 13. Data security We take appropriate technical and organisational measures to protect your data. These include end-to-end encryption of the connection, encrypted storage of passwords, restricted access rights and regular security updates. Despite every care, a loss of data can never be ruled out completely. If we suffer a breach of data security with a high risk for you, we report it to the FDPIC and inform you as far as the law requires. ## 14. Right to complain If you disagree with how we process your data, please contact us first. You may also contact the Federal Data Protection and Information Commissioner (FDPIC): [https://www.edoeb.admin.ch](https://www.edoeb.admin.ch) ## 15. Changes We adapt this privacy policy when our processing or the legal situation changes. The version published on this page applies. Last updated: 27 August 2026 --- Source: https://kilometro.ch/en/privacy-policy