Privacy policy

How we handle your data when you visit spurlos.ch, order from us or sign up for the newsletter.

Who is responsible

SPURLOS Kollektiv, Association within the meaning of Article 60 et seq. of the Swiss Civil Code, Berchtoldstrasse 29, 3012 Bern, Switzerland, hallo@spurlos.ch. This policy follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). For questions about data protection, write to hallo@spurlos.ch.

What data we process

• Orders: name, shipping address, email address, the products you order and the amount. You enter payment details (card or TWINT) directly with our payment provider Stripe; we never see them.
• Newsletter: your email address and when you signed up and confirmed (double opt-in).
• Contact: your email address and whatever you write to us.
• Visiting the website: technical data such as IP address, date and time, the page requested, the referring website and your browser. It arises from hosting and from delivering images and videos.
• Statistics: aggregated figures on how the website is used, without cookies and without stored IP addresses (see «Statistics with Umami»).

Why

We process this data to handle and ship your order, to send you the newsletter, to answer your messages, to run and improve the website securely and to meet legal duties such as keeping accounting records. We do not sell data, we do not use advertising trackers and we make no automated individual decisions.

Legal bases

Where the GDPR applies, we rely on performing the contract for orders (Art. 6(1)(b)), on your consent for the newsletter (Art. 6(1)(a)), on legal obligations for record keeping (Art. 6(1)(c)) and on our legitimate interest in running the website securely and keeping simple statistics (Art. 6(1)(f)).

Ordering and payment

When you click checkout, we send you to Stripe’s payment page. There you enter your name, shipping address, email address and payment details. Stripe processes the payment, emails you the receipt and screens payments for fraud; for that screening Stripe is also responsible in its own right. We see your name, address and email address in our Stripe account in order to ship your parcel. In our content system (Sanity) we keep only an order overview with products and amounts, without names, addresses or email addresses. Swiss Post receives your name and shipping address to deliver the parcel.

Newsletter

We use Brevo for the newsletter. After you sign up you get an email with a confirmation link; only once you click it do we add you to the list. Brevo stores your email address and the times you signed up and confirmed, and measures whether a newsletter is opened and which links in it are clicked. You can unsubscribe at any time with the link in every issue.

Statistics with Umami

To understand which pages and products people are interested in, we use Umami Cloud; the statistics are stored in the EU. Umami sets no cookies and stores no IP addresses. It records the page requested (without extras in the address), the referring website, browser, operating system, device type, screen size, language and the country, which Umami derives from the IP address without storing it.

We also count a few steps in the shop: adding a product to the cart (with the product name), opening checkout, completing an order (with the amount) and signing up for the newsletter. Names, email addresses or order numbers are never sent to Umami.

To count visits, Umami combines the IP address, browser details and a random value that changes regularly into an identifier that we cannot use to identify you and that can no longer be linked once the value changes. If you do not want to be counted, you can block the measurement with a content blocker in your browser.

Cookies and browser storage

We set one strictly necessary cookie: «spurlos_cart» keeps your cart for up to 30 days. Your browser also remembers whether you prefer reduced animations («spurlos:motion») and, after a purchase and for that session only, that the purchase has already been counted in the statistics. This stays on your device. We use no analytics or advertising cookies. Our fonts are served from our own server. On its payment page, Stripe sets its own cookies, among other things to prevent fraud.

Service providers

We work with the following providers to run the shop. They process data on our behalf and only for the purposes above:

• Netlify (Netlify, Inc., USA) – website hosting, including the technical data of every request.
• Stripe (Stripe Payments Europe Ltd., Ireland, together with Stripe, Inc., USA) – payments, order and shipping details, receipts.
• Sanity (Sanity AS, Norway) – website content, delivery of images and videos and an order overview without names, addresses or email addresses.
• Umami (Umami Software, Inc., USA; stored in the EU) – cookieless statistics.
• Brevo (Sendinblue SAS, France) – newsletter and internal order notifications without customer data.
• Infomaniak (Infomaniak Network SA, Switzerland) – email.
• Swiss Post (Die Schweizerische Post AG) – shipping; it receives your name and shipping address for that.

Links to other websites

We link to our Instagram profile but embed no Instagram content. Meta only receives data from you once you follow such a link; Instagram’s privacy policy then applies.

Transfers abroad

Some providers process data in the EU/EEA (Stripe, Sanity, Brevo, Umami) or in the USA (Netlify, Stripe, partly Sanity). Switzerland recognises the EU and EEA as providing adequate protection. Netlify and Stripe are certified under the Swiss-U.S. Data Privacy Framework, which the Swiss Federal Council recognises as adequate. For Sanity, and for Umami, a US company that stores our statistics in the EU, access from the USA relies on standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

How long we keep data

We keep order and accounting records as long as the law requires (in Switzerland usually ten years). We delete newsletter data as soon as you unsubscribe, and emails once they are no longer needed. Netlify deletes the technical hosting logs automatically after a short time. The statistics contain nothing that leads back to you.

Security

The website is only served encrypted (HTTPS). The cart cookie is signed and cannot be read by scripts on the page. Only the people who handle orders have access to order data.

Your rights

You can ask at any time what data we hold about you, have it corrected or deleted, object to its processing, withdraw your consent and ask for a copy. Write to hallo@spurlos.ch. You can unsubscribe from the newsletter with the link in every issue. You can also lodge a complaint with the FDPIC (edoeb.admin.ch) or, if you live in the EU, with the data protection authority of your country.

Changes

We update this policy when the shop or the law changes. The version on this page applies. Last updated: October 2026.