PRIVACY POLICY

In short

This website sets no cookies, embeds no third-party advertising or analytics services and makes no connection to external servers when you open it. Even the fonts are served from our own server rather than loaded from Google. The only thing stored on your device is your shopping cart — and only if you put something in it yourself. That is why you see no consent banner here: there is nothing to consent to. There is one single exception, and it depends on your click: after an order you can have Google invite you to leave a review (see below).

We only receive personal data if you write to us yourself or place an order.

Controller

GRAF CLASSICS, owner Leonard Graf

Seeweg 5, 8280 Kreuzlingen, Switzerland

Phone +41 79 371 15 71

Email info@grafclassics.com

Company ID CHE-177.289.356

For any privacy question, an email to the same address is enough.

If you only browse the site

Server logs. For technical reasons our hosting provider records every request, including your IP address, date and time, the address requested and your browser identification. These logs serve the operation and security of the website; we do not evaluate them on a personal basis and do not combine them with other data.

Visitor counting. We count how often each page is opened, which country the request comes from, the type of device and browser, and which site you came from. No IP address, no cookie and no identifier on your device are stored. Visits by the site owner are not counted – the marker for this sits in the owner's own browser only, not in yours.

To tell returning visits from new ones, we derive two non-reversible check values from your IP address, your browser identification and a secret. The first includes the date and therefore changes daily; it answers how many different people visited on a given day. The second stays the same for as long as your IP address and browser do not change; it answers how many different people visited over a longer period, without counting anyone twice. Neither value can be used to work out who you are, and nothing is stored on or read from your device for this, which is why this counting needs no consent banner. The second value does, however, make it possible to relate visits to one another over a longer period; like all counting data it is deleted after 400 days. The legal basis is our legitimate interest in a functioning website (Art. 31(1) revFADP, Art. 6(1)(f) GDPR).

If you contact us

Contact form. We collect your name, email address and message, plus your phone number if you choose to give it. This information is used solely to answer your enquiry and is delivered to us by email. We also file it in our inbox (a database at Supabase, Frankfurt) so that we can keep track of which enquiries are still open.

Email, phone and WhatsApp. If you contact us directly, we process the information involved in order to deal with your request.

The legal basis is the performance of pre-contractual measures, or our legitimate interest in answering your enquiry.

If you place an order

Shopping cart. When you add an item to the cart, your own browser remembers that choice. It does not leave your device and only reaches us once you go to checkout. Emptying the cart or clearing your browser's site data removes it.

Payment via Stripe. Payment is handled by Stripe. You leave our website to do so and enter your details directly with Stripe: name, email address, delivery address and payment details. We never see your card number; it is never transmitted to us.

What we learn. After a successful payment, Stripe reports to us your name, email address, delivery address, your phone number, as well as the items ordered and the amount. We need these details in order to ship your order and send you the confirmation.

Where your order is kept. Your order is held at Stripe; our order overview reads it from there at the moment we look at it. A tracking number is likewise recorded with the order at Stripe.

Emails about your order. You receive a confirmation and, once the parcel is on its way, a message with the tracking number. Both are sent via Resend.

The legal basis is the performance of the purchase contract and compliance with our statutory retention obligations.

Customer list. After an order we add your name, email address, country, language and the date of your most recent order to our customer list at Resend. It gives us an overview of our clientele. We do not send you marketing through it; should we wish to do so in future, we will ask you first. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR); you may object at any time, an email is enough.

Notification when back in stock. If a size of an accessory is sold out, you can leave your email address. We store it at Resend together with the item, the size and your language, note the sign-up in our inbox, confirm it by email and write to you once as soon as the size is available again. We then remove your address from this waiting list. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time; an email is enough.

Reviews via Google Customer Reviews. On the confirmation page after your purchase we offer you the option of reviewing your purchase on Google. As long as you do not click “Show invitation from Google”, no connection to Google is made. With that click your browser loads a program from Google and sends Google your email address, the order number, the delivery country and the estimated delivery date; Google also receives your IP address and browser details and may set cookies. Google then shows you its own window in which you decide whether to take part in the survey. Only if you agree there will Google send you a survey by email after delivery; your review may appear as a seller review on Google. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time, for example via the unsubscribe link in Google’s email.

Who receives data

We do not sell data and do not pass it on for advertising purposes. We use the following providers. They process data on our behalf; where a provider also acts on its own responsibility, this is noted below:

Vercel Inc. (website hosting, USA): delivers the pages and keeps the server logs.

Supabase (database, located in Frankfurt am Main, Germany): stores the counts described above, which carry no personal reference, and our inbox with the messages from the contact form.

Resend (email delivery, Resend, Inc., USA; sent via Ireland): delivers contact form messages and the emails about your order, and holds our customer list and the waiting list.

Stripe (payment processing, Stripe Payments Europe Ltd., Dublin, Ireland): handles payment and stores the order data. Stripe also processes payment and fraud data on its own responsibility, in order to meet its own legal obligations; Stripe's own privacy policy applies in addition.

Google (Google Customer Reviews, Google LLC, Mountain View, USA): only if you open the invitation yourself after an order. Google processes the survey details on its own responsibility; Google’s privacy policy applies to this.

Beyond this we pass on data only where we are legally obliged to, or where you expressly agree.

Transfers abroad

Server logs may be processed by Vercel Inc. in the USA. The counting database is in Germany, within the European Economic Area. Emails are sent via Ireland; Resend, however, stores its account data, including the customer list and the waiting list, in the USA. For processing in the USA we rely on our providers' contractual guarantees and on the Standard Contractual Clauses approved by the European Commission. Payment processing is handled by Stripe in Ireland. Stripe may transfer data to its parent company Stripe, Inc. in the United States; the standard contractual clauses apply there as well. If you open the invitation to Google Customer Reviews after an order, your details may also be processed by Google LLC in the USA; Google LLC is certified under the EU-US and Swiss-US Data Privacy Framework.

How long we keep data

Server logs are deleted automatically by our provider after a short period. We delete the counting data after 400 days; it carries no personal reference in any case. Enquiries are kept for as long as handling them requires, and beyond that for as long as statutory retention obligations apply; messages marked as dealt with in our inbox are deleted automatically after two years. Orders are kept for ten years. We are legally required to do so (Art. 958f of the Swiss Code of Obligations); the period runs from the end of the financial year in which the order was placed. The waiting list entry is deleted once we have notified you, or earlier at your request. The customer list is kept for at most ten years after your most recent order, or until you object.

Your rights

You have the right to information about the data we process, to correction of inaccurate details, to deletion, to restriction of processing, and to receive or transfer your data. Where we rely on a legitimate interest, you may object to the processing.

An email to info@grafclassics.com is enough. You also have the right to complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), and, for people in the European Economic Area, to the supervisory authority where you live.

Data security

The website is delivered exclusively over an encrypted connection (HTTPS). Please note that email may be transmitted unencrypted and that complete protection against access by third parties is not possible in that case.

Changes

We update this policy when the website or the legal situation changes. The version published here at any given time applies.