Privacy policy

1. Controller

UID: CHE-407.633.645. Send privacy questions and requests to info@mineralienzentrum.ch.

Still openRepresentative in the EU (Art. 27 GDPR) and in the United Kingdom, and a data protection adviser: a lawyer must determine whether these are needed and who takes them on. Until then, no one is named.

2. Which law applies

As a Swiss company we are subject to the Swiss Federal Act on Data Protection (FADP). Because we also deliver to people in the EU, the EEA and the United Kingdom, we additionally observe the General Data Protection Regulation (GDPR) and the UK GDPR for them.

The legal bases named below refer to Art. 6(1) GDPR: (a) consent, (b) contract and pre-contractual steps, (f) legitimate interest. The FADP does not require a legal basis for every processing operation; we process every visitor’s data in the same way.

3. Visiting the website

When you open a page, your browser necessarily sends your IP address, the address requested, the time and browser details to our server. We need this to deliver the page and protect it from abuse; for that, our server briefly counts requests per IP address. The legal basis is our legitimate interest in secure operation (f).

We delete web server logs after 14 days.

We serve fonts from our own server. Maps, videos and social networks are not embedded: Google Maps, Instagram and Facebook are plain links, and those providers receive data only if you open such a link.

4. Consent and cookies

On your first visit we ask whether you allow analytics, marketing & advertising, and functional & third-party content; all three start switched off, and refusing is as easy as accepting. Without your consent, only what is strictly necessary runs, and our tracker isn't loaded. All cookies and browser storage, with their purpose and duration, are listed in the cookie policy. Your cart, a guest’s wishlist, recently viewed pieces and similar settings stay in your browser. Your consent lasts 12 months or until we materially change the purposes; we then ask again and remove what it covered.

We store your choice in your browser and, as proof, on our server: a random id, the version, the categories chosen, the kind of decision, the language and the time, but no IP address, browser details or visitor id. The legal basis is our legitimate interest in being able to prove consent (f). We delete this proof after 3 years.

You can change or withdraw your choice at any time. Withdrawal applies for the future and doesn’t affect what was lawful before it.

5. Our own visitor analytics

Only if you consent to analytics does the website load our own tracker. The data is held in our own database and we don’t pass it to third parties. We record:

• two random ids in the cookies mz_vid and mz_sid,
• pages opened, with their title and the previous page, active time and scroll depth,
• events such as clicks on buttons and links, downloads, search terms, filters, pieces viewed and liked, and steps in the cart and at checkout,
• for forms, only the form’s name and an error code, never what you type,
• where the visit came from: the referring site and campaign tags,
• device type, browser, operating system, screen and window size, language, time zone and connection type,
• an approximate area, see IP address and approximate area.

Search terms that look like an email address or phone number are dropped on arrival. We remove query strings and ids from page addresses.

This data is pseudonymous, not anonymous: the id recognises your browser, and if you order having given consent, we link the order to the visit in order to attribute the sale to its source. We don’t otherwise link visits to your customer account. Individual visit timelines are visible only to authorised staff, and each time one is opened it is logged.

The legal basis is your consent (a). We delete detailed events after 90 days and visits after 14 months. Totals per day and hour, with no link to individuals, stay for 5 years. Through Cookie Settings you can also delete the statistics already stored about your browser; a sale then remains with no link to the visit.

We count orders and enquiries in our sales and enquiry figures even without your consent, in that case with no link to a visit (legitimate interest in evaluating our business, f).

6. IP address and approximate area

For analytics we work out an approximate area from your IP address: country, region, city, coordinates rounded to about 11 km, time zone and network operator. This happens on our own server using a locally stored MaxMind database (GeoLite2); no address goes to MaxMind. We then discard the IP address for analytics.

The result is an estimate: VPNs, proxies and mobile networks can place you elsewhere entirely. Without your consent to analytics, this lookup doesn’t take place.

7. Advertising and optional services

We don't currently use third-party analytics or advertising services: no Google Analytics, no Google Ads, no Meta Pixel and no TikTok Pixel. These providers receive no data about you through our website.

With your consent to marketing we note in our own statistics which ad network a visit came through, recognised from the click id in the address (such as fbclid or gclid). We don't store the click id itself. If you withdraw consent, we remove this from all visits of your browser. The legal basis is your consent (a).

Before switching on any such service, we'll name it here and in the cookie policy and ask for your consent again.

8. Customer account, addresses and wishlist

For a customer account we store your first and last name, email address, your password only as a hash, a phone number if you wish, and your language. At registration and for later acceptances, we record which version of the terms and of this policy you accepted and when, with IP address and browser details. For each sign-in we store a session with IP address, browser details and last use; the cookie mz_client keeps you signed in for up to 30 days.

In your account you can save addresses (label, name, company, address, phone) and keep a wishlist. As a guest your wishlist stays in your browser; once you sign in, we adopt it into your account.

The legal basis is the contract (b), and for proof of acceptance and session data our legitimate interest in evidence and security (f). We need your name and email address for an account; the phone number is optional.

You can change and delete addresses and the wishlist yourself. In your account under Details you can download a copy of your data and delete your account with your password; we also do both at your request. An account without orders is deleted. An account with orders is anonymized once no order is in progress: name, email address, password, phone, addresses, wishlist and sessions are removed, as are your enquiries and the statistics linked to the account. The orders remain, with the customer details they contain, as business records, without the IP address.

9. Orders and guest orders

For an order we store your name, email address, phone number, billing and delivery address, delivery method, your note, pieces and amounts, payment and shipping status, carrier and tracking number, language, the version of the terms and of this policy you accepted, and the IP address and browser details when ordering. The phone number is needed for shipping, for delivery questions, and optional for collection. We delete the IP address and browser details after 180 days: that is about as long as a payment can still be disputed.

Without an account, your email address is enough. You manage the order through a private link in our emails; we hold only a random secret from which the link is calculated. Anyone who later registers with the same address doesn’t automatically take over guest orders.

The legal basis is the contract (b), and for the IP address our legitimate interest in protection against abuse (f). Without your name, email address and, for shipping, delivery address, we can’t carry out an order. For shipping we pass your name, address and, where given, phone number to the carrier; for shipments abroad these details may also reach customs authorities.

We keep business records for at least 10 years under Art. 958f of the Swiss Code of Obligations. Under the GDPR we base this on our legitimate interest in complying with Swiss law (f).

10. Payment through Stripe

You pay on Stripe’s secure page. You enter card details directly there; they don’t reach our systems. We pass Stripe your email address, order number, pieces and amounts and, for shipping, your name, phone number and delivery address.

From Stripe we receive the payment status, payment method, card brand, last four digits, transaction ids and a receipt link. Stripe’s technical messages may contain further payment details, such as name and billing address; we delete their contents after 13 months.

The contracting parties for Swiss merchants are Stripe Payments Europe, Limited (Ireland) and Stripe Payments UK Ltd (United Kingdom). Stripe may also process data in the USA and check payments automatically to prevent fraud. See Stripe’s privacy notice. The legal basis is the contract (b).

11. Return and cancellation requests

You can request a cancellation or return on your order page. For this we store the order, the kind of request and its reason, your message, the pieces concerned, email address, language and IP address, and our staff’s decision and note. Guests confirm the request with a six-digit code by email, valid for 15 minutes and stored only as a hash. The gallery receives an email, and you receive our answer by email. A request a guest never confirmed is deleted after 30 days, and the IP address of every request after 180 days. Confirmed requests stay as part of the order.

If you email us instead, your message is held in our mailbox. The legal basis is the contract (b), and for the IP address our legitimate interest in protection against abuse (f).

12. Enquiries

If you write to us through the enquiry form, we store your name, email address, message, the occasion, the piece concerned if any, and your language. The enquiry goes by email to the gallery, and authorised staff read it in our administration area.

In our figures we count it as an enquiry, linked to your visit only with your analytics consent. The legal basis is pre-contractual steps (b) and our legitimate interest in answering you (f).

We delete enquiries 2 years after they arrive, or sooner if you ask. A conversation about a piece can still lead to a purchase within that time. The email to the gallery also sits in the mailbox until we delete it there.

13. Digital Vault

If you ask for access to the Digital Vault, we store your name, email address, your interest, your message if any, your language, the status, who approved the request and when, and when you confirmed access. You confirm access with a six-digit code by email, valid for 10 minutes and stored only as a hash. You receive the acknowledgement, approval and code by email.

In our figures we count the request, linked to your visit only with your analytics consent. The legal basis is pre-contractual steps (b) and our legitimate interest in protected access (f).

We delete Vault requests 2 years after their last change, or sooner if you ask.

14. Protecting registration (CAPTCHA)

On the page for registering an account we use Cloudflare Turnstile to fend off automated sign-ups. Only there does your browser load a script from Cloudflare, Inc. (USA), which processes your IP address and details of your browser and device. Our server checks the result with Cloudflare and also passes on your IP address. A guest order involves no CAPTCHA.

The legal basis is our legitimate interest in protection against automated abuse (f). See the Turnstile privacy notice.

15. Sending email

We send you emails about your account, orders and requests, such as a welcome, password links, order confirmation, payment, shipping, delivery, collection, cancellation, refund and confirmation codes. We record order emails sent with the recipient’s address, type and time.

Our emails contain no open or click tracking. Your email program loads product photos in order emails from our server when you open them. The legal basis is the contract (b).

We send our emails through Hostpoint in Switzerland, where the mailboxes of mineralienzentrum.ch are also kept.

16. Newsletter

We don’t currently offer a newsletter and collect no addresses for one.

17. Security log

Regardless of your cookie choice, our server keeps a security log of registrations, sign-ins, failed sign-ins and changes to accounts, addresses, orders, payments, refunds, returns and Vault requests. It records who acted (type of account and id, for staff also name and role), what happened to which record and when, and the old and new values.

Passwords and credentials are never written, email addresses and phone numbers are masked, and addresses, customers’ names and their messages replaced: the log records that a field changed, not what it changed to. IP addresses and browser details are held separately, are accessible only to specially authorised staff, and are deleted after 90 days; the log itself after 2 years.

Entries can’t be changed or deleted before that period ends. Entries from before this rule may still contain names; they remain until that period ends, even after an account is anonymized. The legal basis is our legitimate interest in security and accountability (f).

18. Recipients and transfers abroad

Data processing agreements are in place with netcup and Hostpoint.

The EU recognises Switzerland’s level of data protection as adequate. From Switzerland, we transfer without further safeguards to countries the Federal Council lists as adequate in Annex 1 of the Data Protection Ordinance, including the EU and EEA states and the United Kingdom.

The USA counts as adequate only for companies certified under the Swiss-U.S. or EU-U.S. Data Privacy Framework. For other recipients and countries we rely on the European Commission’s standard contractual clauses with the adjustments needed for Switzerland, where the provider’s contract includes them. We transfer delivery addresses abroad because this is necessary to perform the contract (Art. 17(1)(b) FADP, Art. 49(1)(b) GDPR).

Still openA data processing agreement with KERA TECH SOLUTIONS, with the safeguards needed for Kosovo, is still to be concluded. For Stripe and Cloudflare, the basis (certification or standard contractual clauses) is still to be checked.

19. Retention

Deleted data may remain in a backup until that backup expires, so for up to 30 days. Orders aren’t deleted automatically after the 10 years either, but reviewed by hand.

20. Your rights

Under the FADP and, where applicable, the GDPR and UK GDPR, you have the right to:

• access your personal data (Art. 25 FADP, Art. 15 GDPR),
• have incorrect data corrected (Art. 32 FADP, Art. 16 GDPR),
• erasure or restriction, unless a retention duty or overriding interest prevents it (Art. 32 FADP, Arts. 17 and 18 GDPR),
• receive or transfer the data you gave us (Art. 28 FADP, Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 30 FADP, Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

The quickest way is yourself: in your account under Details you can download a copy of your data (as a machine-readable JSON file), delete your account and change your details and addresses; you change your cookie choice and the statistics about your browser in Cookie Settings. Without an account, or for anything else, write to info@mineralienzentrum.ch. We reply within 30 days. Before releasing or deleting data we check that the request comes from you, usually by its coming from the email address concerned; where needed we ask for further proof. Data we must keep by law, such as orders, we don’t delete before the period ends, and we tell you so.

You can complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch; in the EU and EEA the authority where you live or work; in the United Kingdom the Information Commissioner’s Office.

We don’t make automated individual decisions.

21. Data security

We store passwords and sign-in tokens only as hashes. Connections use HTTPS, sign-in attempts are limited, and staff sessions end after 7 days or 24 hours without use. Staff see only what their role allows, and their access to sensitive areas is logged. No security is absolute; you will hear of a breach that affects you as the law provides.

22. Changes

If our processing changes, we update this policy. We ask signed-in customers to confirm the new version at their next order, and record the version and the time.