Privacy

Last updated: 24 September 2026

This policy explains what personal data we process when you visit our online shop, place an order or write to us. It states who we share this data with, how long we keep it and how to exercise your rights. We have drawn it up in accordance with the Federal Act on Data Protection (FADP), in force since 1 September 2023.

Who is responsible for your data?

The data controller is L’Atelier du Verger Sàrl:

• Address: Impasse du Verger 2, 1754 Avry-sur-Matran, Switzerland
• UID: CHE-435.529.705
• Managing Director: Olivier Caron
• Email: contact@latelierduverger.live

For any question about your data, write to us at this address.

The data we process and why

We process only the data that each service requires.

Orders and delivery

When you place an order, we process:

• your name and your delivery and billing addresses
• your email address and, if you provide it, your phone number
• the contents of the order, its amount and the delivery method

This data is used to prepare, ship and invoice your order. Shopify, our sales platform, sends you confirmation and tracking emails. Swiss Post receives your name and address for delivery, and if needed your email address or phone number to notify you. For in-store pickup, your order awaits you at our shop at Grand-Rue 9 in Fribourg.

Payment

You pay on Shopify’s secure payment page. For Visa and Mastercard cards, Apple Pay and Google Pay, payment is processed through Shopify Payments. Stripe Payments Europe, based in Ireland, processes these transactions for Shopify. TWINT, PayPal and Klarna payments are processed by these companies, and Shop Pay by Shopify. The PostFinance Card is processed via PostFinance and its provider Worldline. Shopify manages gift vouchers. We never receive your full card number.

Payment providers also process certain data under their own responsibility, for example to prevent fraud. In that case, their own privacy policies apply.

Customer account

To create an account, your email address is enough. No password is required: at each login, Shopify sends you a one-time code by email. Your account stores your name, your addresses and your order history. A cookie named “session” keeps you logged in for up to one year. Logging out ends it. You may request the deletion of your account at any time.

Newsletter

The newsletter brings you news from the workshop: new products, tips and behind-the-scenes of our craftsmanship. We send it only to subscribers. When you subscribe, your choice is recorded in your Shopify customer profile. Mailchimp (The Rocket Science Group LLC, an Intuit company) then sends the newsletter from the United States. Mailchimp may measure email opens and clicks on its links, to help us improve our mailings. To unsubscribe, use the link in each email or your customer account.

Customer reviews

After a purchase, Judge.me sends you a review request by email. You can also leave a review from your customer account. We publish your first name, the initial of your surname, your rating and your text. Your email address is never published. Each review is checked before publication. To stop receiving these requests or to withdraw a review, write to us.

Email messages

You can write to us at contact@latelierduverger.live. We use your message and your contact details to reply to you and follow up on your request. If a product is out of stock, you can also write to us to be notified when it is back. Our mailbox is hosted in Switzerland by Infomaniak.

Website operation and security

On each visit, Shopify records technical data such as your IP address, your browser and the pages you view. This data is used to display the shop, keep your cart and protect the site against abuse. Shopify hosts our storefront on its Oxygen service.

Audience measurement and advertising

The following tools are activated only with your consent:

• Google Analytics 4, to understand how the shop is used
• Google Ads and Google Merchant Center, to showcase our products on Google and measure the effect of our ads
• the Meta pixel, for our advertising on Facebook and Instagram
• the TikTok pixel, installed on the payment page, for our advertising on TikTok

On the site, Google Tag Manager loads these tools. On the payment page, they are installed within Shopify, in particular through the Google & YouTube and TikTok apps. They record pages viewed, products browsed and purchases. Using this data, we measure our sales and show you our ads on other sites or networks. To link a purchase to an advert, these services may receive your email address or phone number in an encrypted (hashed) form, unreadable in plain text. Google, Meta and TikTok may also use this data for their own purposes, under their own responsibility.

Who receives your data?

We share your data only with the providers required for the services described above:

• Shopify (Shopify International Limited, Ireland): platform and hosting of the online shop
• Stripe Payments Europe (Ireland): Shopify Payments transactions
• TWINT, PayPal, Klarna, PostFinance and Worldline: payments made through them
• Swiss Post: delivery
• Anorac Consent (Anorac Studio Sàrl, Fribourg): cookie consent
• Google (Google Ireland Limited and Google LLC): audience measurement and advertising
• Meta (Meta Platforms Ireland Limited and Meta Platforms, Inc.): advertising on Facebook and Instagram
• TikTok (TikTok Technology Limited in Ireland and TikTok Information Technologies UK Limited): advertising on TikTok
• Mailchimp (The Rocket Science Group LLC, an Intuit company): newsletter
• Infomaniak Network SA (Geneva): email hosting
• Judge.me Ltd (United Kingdom): customer reviews
• our web provider in Switzerland, who develops and maintains the online shop
• the authorities, when the law requires it

Most of them act on our instructions. Swiss Post, the payment providers and the advertising networks also process certain data on their own behalf.

Data disclosed outside Switzerland

Several providers process your data abroad. The FADP allows this to a country with adequate protection or with recognised safeguards (Art. 16 and 17 FADP). The Federal Council publishes the list of these countries in Annex 1 of the Data Protection Ordinance (DPO).

• Ireland and other European Union countries: recognised as offering adequate protection. This applies to Shopify and Stripe, as well as Google, Meta and TikTok.
• United Kingdom: recognised as offering adequate protection. Judge.me is based there, as is one of TikTok’s companies.
• Canada: recognised as offering adequate protection for private-sector organisations subject to Canadian personal information law. Shopify is headquartered there.
• United States: protection has been recognised as adequate since 15 September 2024 for certified companies. Certification follows the Swiss-U.S. Data Privacy Framework. Google LLC, Meta Platforms, Inc. and Mailchimp are certified. Shopify applies binding corporate rules approved by the European data protection authorities. Judge.me and TikTok use the European Commission’s standard contractual clauses.
• Singapore, Malaysia, China and other countries: TikTok stores data in Singapore and Malaysia. Some of its companies, notably in China, have limited remote access to it. Standard contractual clauses govern these transfers.

The Federal Data Protection and Information Commissioner (FDPIC) recognises these standard clauses. They must be supplemented by the adaptations provided for under Swiss law.

How long we keep your data

We keep your data for as long as necessary for the purpose for which we received it. After that, we delete it or make it anonymous. Some specific retention periods:

• orders, invoices and accounting records: 10 years, as required by the Swiss Code of Obligations (Art. 958f CO)
• customer account: for as long as it exists, and you may request its deletion at any time; afterwards, only order data is kept for accounting purposes
• newsletter: until you unsubscribe
• customer reviews: for as long as they are published, or until you request their withdrawal
• emails: for the time needed to handle your request and keep a record of it, after which we delete them
• audience measurement: no more than 14 months in Google Analytics
• your cookie choice: valid for 12 months, after which the banner asks you again; Anorac Consent keeps proof of it for 2 years
• cookies: the duration shown for each one in the list below

Security of your data

The connection to the site is encrypted (HTTPS). We limit access to your data to people who need it for their work. Our providers are contractually bound to protect the data they process for us. For payments, Shopify complies with the PCI DSS payment card security standard. A security breach may pose a high risk to you. In that case, we report it to the FDPIC and inform you if necessary (Art. 24 FADP).

Your rights and how to exercise them

You may at any time:

• find out whether we process data concerning you and receive a copy of it (right of access, Art. 25 FADP)
• have inaccurate data corrected (Art. 32 FADP)
• request the deletion of your data or object to processing, for example advertising (Art. 32 FADP)
• obtain the data you have provided to us in a commonly used format, or have it transmitted to a third party (Art. 28 FADP)
• withdraw your consent for the newsletter or cookies; the withdrawal applies going forward

To exercise these rights, write to us at contact@latelierduverger.live or at our postal address. We may ask you for proof of identity to protect your data. You will receive a response within 30 days. It is generally free of charge. If the law requires us to keep certain data, such as accounting records, we will tell you so. No automated individual decision is made about you (Art. 21 FADP).

In case of disagreement, you may contact the FDPIC. Its contact details: Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

If the GDPR applies to you

We sell only in Switzerland. The European Union’s General Data Protection Regulation (GDPR) may nonetheless apply to certain processing. Each is then based on one of the legal grounds set out in Art. 6 GDPR:

• the performance of your order or your request
• our legal obligations, for example accounting obligations
• our legitimate interest in protecting the site and asking for your opinion after a purchase
• your consent for the newsletter, non-essential cookies and advertising

You also have the right to restriction of processing. A complaint may be lodged with the data protection authority of your country of residence.

Changes to this policy

We update this policy when our services or the law change. The version published on this page is authoritative. Its date appears at the top of the page.

Your cookie choice

We use cookies and similar technologies, in accordance with Art. 45c of the Telecommunications Act (TCA). Essential cookies make the shop work: cart, login, payment and remembering your choice. They do not require consent. The other categories are activated only if you accept them: audience measurement, marketing and preferences.

Anorac Consent, a service hosted in Switzerland, displays the consent banner. It records your choice in the “anorac_consent_…” cookie and keeps proof of it. Your choice is also passed on to Shopify, which applies it on the payment page.

You can change your choice at any time using the “Cookie settings” link at the bottom of each page. The detailed list of cookies appears below.