Legal notice
Aeschbach Chocolatier AG
ChocoDromo 1a
Hochschwerzlen
6037 Root-Lucerne
Switzerland
Head Office/Sales: +41 41 747 33 33
Events/ChocoWelt: +41 41 747 33 66
ChocoCafe: +41 41 747 33 40
Email: shop@aeschbach-chocolatier.ch
Registered office: Root (LU)
Legal form: public limited company
VAT number: CHE-105.918.615
Commercial Register number: CH-170.3.018.356-7
Commercial Register Office: Canton of Lucerne
Online marketing & concept: Go 2 Flow AG
Photography: Janmaat GmbH
Privacy Policy
The data controller within the meaning of data protection legislation,
in particular the EU General Data Protection Regulation (GDPR), is:
in particular the EU General Data Protection Regulation (GDPR), is:
Aeschbach Chocolatier AG
Yves Aeschbach
ChocoDromo 1a
6037 Root
Email: shop@aeschbach-chocolatier.ch
Website: https://www.aeschbach-chocolatier.ch
General notice
Pursuant to Article 13 of the Swiss Federal Constitution and the federal data protection provisions (Data Protection Act, DSG), every person has the right to the protection of their privacy and to protection against the misuse of their personal data. The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.
In collaboration with our hosting providers, we endeavour to protect our databases as effectively as possible against unauthorised access, loss, misuse or falsification.
Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.
By using this website, you consent to the collection, processing and use of data as described below. In principle, this website can be visited without registration. In doing so, data such as the pages accessed or the names of the files accessed, along with the date and time, are stored on the server for statistical purposes, without this data being directly linked to you personally. Personal data, in particular your name, address or email address, is collected on a voluntary basis wherever possible. Your data will not be passed on to third parties without your consent.
Processing of personal data
Personal data refers to any information relating to an identified or identifiable individual. A data subject is a person in respect of whom personal data is processed. Processing encompasses any handling of personal data, irrespective of the means and procedures used, in particular the retention, disclosure, collection, erasure, storage, alteration, destruction and use of personal data.
We process personal data in accordance with Swiss data protection law. Furthermore, insofar as the EU GDPR applies, we process personal data in accordance with the following legal bases in connection with Article 6(1) of the GDPR:
(a) Processing of personal data with the consent of the data subject.
(b) Processing of personal data for the performance of a contract with the data subject and for the implementation of corresponding pre-contractual measures.
(c) Processing of personal data to comply with a legal obligation to which we are subject under any applicable EU law or under any applicable law of a country in which the GDPR is wholly or partly applicable.
(d) Processing of personal data to protect the vital interests of the data subject or of another natural person.
lit. f) Processing of personal data to safeguard our legitimate interests or those of third parties, provided that the fundamental freedoms and rights, as well as the interests, of the data subject do not take precedence. Legitimate interests include, in particular, our commercial interest in being able to provide our website, information security, the enforcement of our own legal claims and compliance with Swiss law.
We process personal data for as long as is necessary for the respective purpose or purposes. Where longer retention periods are required due to statutory and other obligations to which we are subject, we restrict processing accordingly.
Privacy Policy for Cookies
This website uses cookies. These are small text files that enable specific, user-related information to be stored on the user’s device whilst they are using the website. Cookies enable us, in particular, to determine the frequency of use and the number of users of the pages, to analyse usage behaviour, and also to make our website more user-friendly. Cookies remain stored after the end of a browser session and can be retrieved when the site is visited again. If you do not wish this to happen, you should configure your web browser to refuse cookies.
A general objection to the use of cookies for online marketing purposes can be made for a wide range of services – particularly in the case of tracking – via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. Furthermore, the storage of cookies can be prevented by disabling them in your browser settings. Please note that, in this case, you may not be able to use all the functions of this website.
Privacy Policy for SSL/TLS Encryption
This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as the enquiries you send to us as the website operator. You can recognise an encrypted connection by the fact that the address bar of your browser changes from “http://” to “https://” and by the padlock icon in your browser bar.
When SSL or TLS encryption is enabled, the data you send to us cannot be read by third parties.
Third-party services
This website may use Google Maps for embedding maps, Google Invisible reCAPTCHA for protection against bots and spam, and YouTube for embedding videos.
These services, provided by the US-based Google LLC, use cookies, amongst other things, and as a result, data is transferred to Google in the USA; however, we assume that, within this context, no personal tracking takes place solely through the use of our website.
Google has undertaken to ensure an adequate level of data protection in accordance with the US-EU and US-Swiss Privacy Shield frameworks.
Further information can be found in Google’s privacy policy.
Privacy Policy for the Contact Form
If you send us enquiries via the contact form, the details you provide in the enquiry form – including the contact details you enter there – will be stored by us for the purpose of processing your enquiry and in the event of any follow-up questions. We will not pass on this data without your consent.
Paid services
In order to provide paid services, we request additional data, such as payment details, so that we can fulfil your order or commission. We store this data in our systems until the statutory retention periods have expired.
Google AdWords
This website uses Google Conversion Tracking. If you have arrived at our website via an advert placed by Google, Google AdWords will set a cookie on your computer. The conversion tracking cookie is set when a user clicks on an advert placed by Google. These cookies expire after 30 days and are not used for personal identification. If the user visits certain pages on our website and the cookie has not yet expired, we and Google can recognise that the user clicked on the advert and was redirected to that page. Each Google AdWords customer is assigned a different cookie. Cookies cannot therefore be tracked across the websites of AdWords customers. The information collected via the conversion cookie is used to compile conversion statistics for AdWords customers who have opted for conversion tracking. Customers are informed of the total number of users who have clicked on their advert and been redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.
If you do not wish to participate in tracking, you can refuse the setting of the cookie required for this – for example, via a browser setting that generally disables the automatic setting of cookies, or by configuring your browser to block cookies from the domain ‘googleleadservices.com’.
Please note that you must not delete the opt-out cookies as long as you do not wish to have your data recorded. If you have deleted all your cookies in your browser, you will need to set the relevant opt-out cookie again.
Use of Google Remarketing
This website uses the remarketing function provided by Google Inc. The function is designed to present website visitors with interest-based adverts within the Google advertising network. A so-called ‘cookie’ is stored in the website visitor’s browser, which makes it possible to recognise the visitor when they access websites that belong to Google’s advertising network. On these pages, the visitor may be shown adverts relating to content that they have previously viewed on websites using Google’s remarketing feature.
According to Google, no personal data is collected during this process. However, if you do not wish to use Google’s remarketing function, you can generally disable it by adjusting the relevant settings at http://www.google.com/settings/ads. Alternatively, you can opt out of the use of cookies for interest-based advertising via the Advertising Network Initiative by following the instructions at http://www.networkadvertising.org/managing/opt_out.asp .
Privacy Policy for Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. To disable Google Analytics, Google provides a browser plug-in at https://tools.google.com/dlpage/gaoptout?hl=de. Google Analytics uses cookies. These are small text files that enable specific, user-related information to be stored on the user’s device. This allows Google to analyse how our website is used. The information collected by the cookie regarding the use of our website (including your IP address) is usually transmitted to a Google server in the USA and stored there. Please note that on this website, Google Analytics has been extended to include the code “gat._anonymizeIp();” to ensure that IP addresses are collected anonymously (known as IP masking). If anonymisation is active, Google truncates IP addresses within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area, meaning that it is not possible to draw any conclusions about your identity. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. Google complies with the data protection provisions of the ‘Privacy Shield’ agreement, is registered with the US Department of Commerce’s ‘Privacy Shield’ programme, and uses the information collected to analyse the use of our websites, compile reports for us on this matter and provide us with other related services. You can find out more at https://support.google.com/analytics/answer/6004245?hl=de.
Google Tag Manager
Google Tag Manager is a solution that enables us to manage so-called website tags via a user interface, thereby allowing us, for example, to integrate Google Analytics and other Google marketing services into our online offering. The Tag Manager itself, which implements the tags, does not process any of the users’ personal data. With regard to the processing of users’ personal data, please refer to the following information on Google’s services. Terms of Service: https://www.google.com/intl/de/tagmanager/use-policy.html.
Facebook Privacy Policy
This website uses features provided by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. When you visit our pages featuring Facebook plug-ins, a connection is established between your browser and Facebook’s servers. Data is transferred to Facebook as part of this process. If you have a Facebook account, this data may be linked to it. If you do not wish this data to be linked to your Facebook account, please log out of Facebook before visiting our site. Interactions, in particular the use of a comment function or clicking a ‘Like’ or ‘Share’ button, are also passed on to Facebook. You can find out more at https://de-de.facebook.com/about/privacy.
Privacy Policy for Instagram
Functions from the Instagram service are integrated into our pages. These functions are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. If you are logged into your Instagram account, you can link the content on our pages to your Instagram profile by clicking the Instagram button. This enables Instagram to associate your visit to our pages with your user account. Please note that, as the provider of this website, we have no knowledge of the content of the data transmitted or how it is used by Instagram.
Further information on this can be found in Instagram’s privacy policy: http://instagram.com/about/legal/privacy/
External payment service providers
This website uses external payment service providers via whose platforms users and we can carry out payment transactions. For example, via
- PostFinance (https://www.postfinance.ch/de/detail/rechtliches-barrierefreiheit.html)
- Visa (https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html)
- Mastercard (https://www.mastercard.ch/de-ch/datenschutz.html)
- American Express (https://www.americanexpress.com/de/content/privacy-policy-statement.html)
- PayPal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full)
In the context of fulfilling contracts, we use payment service providers on the basis of the Swiss Data Protection Ordinance and, where necessary, Article 6(1)(b) of the EU GDPR. Furthermore, we use external payment service providers on the basis of our legitimate interests in accordance with the Swiss Data Protection Ordinance and, where necessary, in accordance with Article 6(1)(f) of the EU GDPR, in order to offer our users effective and secure payment options.
The data processed by the payment service providers includes personal details, such as name and address; bank details, including account numbers or credit card numbers; passwords, TANs and checksums; as well as information relating to the contract, amounts and recipients. This information is required to carry out the transactions. However, the data entered is processed and stored solely by the payment service providers. As the operator, we do not receive any information regarding (bank) accounts or credit cards, but only information confirming the acceptance or rejection of the payment. In certain circumstances, the data may be transferred by the payment service providers to credit reference agencies. The purpose of this transfer is to verify identity and creditworthiness. In this regard, we refer you to the terms and conditions and privacy policies of the payment service providers.
Payment transactions are governed by the terms and conditions and privacy policies of the respective payment service providers, which are available on their respective websites or within the transaction applications. We also refer you to these for further information and for exercising your rights of withdrawal, access and other data subject rights.
Newsletter – Mailchimp
Newsletters are sent via the mailing service provider ‘MailChimp’, a newsletter distribution platform operated by the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. You can view the mailing service provider’s privacy policy here. The Rocket Science Group LLC d/b/a MailChimp is certified under the Privacy Shield Framework and thereby guarantees compliance with European data protection standards (Privacy Shield). The mailing service provider is engaged on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR and a data processing agreement pursuant to Article 28(3), first sentence, of the GDPR.
The mailing service provider may use recipients’ data in pseudonymous form – i.e. without linking it to a specific user – to optimise or improve its own services, e.g. for the technical optimisation of the dispatch and presentation of the newsletters, or for statistical purposes. However, the mailing service provider does not use the data of our newsletter recipients to contact them directly or to pass the data on to third parties.
Privacy Policy for YouTube
This website uses plugins from the YouTube website, which is operated by Google. The operator of the website is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit one of our pages featuring a YouTube plugin, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our pages you have visited.
If you are logged into your YouTube account, you allow YouTube to link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.
Further information on the handling of user data can be found in YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy
Order processing in the online shop with a customer account
We process our customers’ data in accordance with the data protection provisions of the Federal Government (Data Protection Act, DSG) and the EU GDPR, within the framework of the ordering processes in our online shop, in order to enable them to select and order the chosen products and services, as well as to facilitate their payment, delivery and fulfilment.
The data processed includes master data (customer details), communication data, contractual data and payment data; the data subjects affected by this processing include our customers, prospective customers and other business partners. The processing is carried out for the purpose of providing contractual services in connection with the operation of an online shop, billing, delivery and customer services. In doing so, we use session cookies, e.g. to store the contents of the shopping basket, and persistent cookies, e.g. to store the login status.
Processing is carried out on the basis of Article 6(1)(b) (execution of orders) and (c) (legally required archiving) of the GDPR. The information marked as required is necessary for the conclusion and performance of the contract. We only disclose the data to third parties in connection with delivery, payment or in accordance with statutory permissions and obligations. The data is only processed in third countries if this is necessary for the performance of the contract (e.g. at the customer’s request in connection with delivery or payment).
Users may optionally create a user account, which allows them, in particular, to view their orders. During registration, users are informed of the mandatory details required. User accounts are not public and cannot be indexed by search engines, e.g. Google. Once users have closed their user account, their data relating to that account will be deleted, subject to any retention required for commercial or tax law purposes in accordance with Article 6(1)(c) of the GDPR. Information in the customer account remains until it is deleted, after which it is archived in the event of a legal obligation. It is the users’ responsibility to back up their data prior to the end of the contract following cancellation.
When users register, log in again or use our online services, we store the IP address and the time of the respective user action. This storage is based on our legitimate interests, as well as the users’ interests in protection against misuse and other unauthorised use. As a general rule, this data is not disclosed to third parties, unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Article 6(1)(c) of the GDPR.
The data is deleted once statutory warranty obligations and similar obligations have expired; the necessity of retaining the data is reviewed at irregular intervals. In the case of statutory archiving obligations, the data is deleted once these obligations have expired.
Note on data transfers to the USA
For the sake of completeness, we would like to point out to users resident or based in Switzerland that surveillance measures by US authorities exist in the USA which generally permit the storage of all personal data relating to any individuals whose data has been transferred from Switzerland to the USA. This takes place without any differentiation, restriction or exception based on the intended purpose, and without an objective criterion that would allow the US authorities’ access to the data and its subsequent use to be restricted to very specific, strictly limited purposes that are capable of justifying the interference associated with both access to and the use of such data. Furthermore, we point out that, in the US, there are no legal remedies available to data subjects from Switzerland that would allow them to gain access to the data concerning them and to obtain its rectification or erasure, nor is there any effective judicial protection against the general access rights of US authorities. We explicitly draw the data subject’s attention to this legal and factual situation so that they may make a fully informed decision regarding their consent to the use of their data.
We would like to point out to users resident in an EU Member State that, from the European Union’s perspective – partly due to the issues mentioned in this section – the USA does not have an adequate level of data protection. Where we have explained in this privacy policy that recipients of data (such as Google) are based in the USA, we will ensure that your data is protected to an adequate standard by our partners, either through contractual arrangements with these companies or by ensuring that these companies are certified under the EU-US or Swiss-US Privacy Shield.
Data security
We employ appropriate technical and organisational security measures to protect your personal data stored with us against manipulation, partial or complete loss, and unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.
You should always treat your login details as confidential and close the browser window once you have finished communicating with us, particularly if you share a computer with others.
We also take internal data protection very seriously. Our employees and the service providers we engage are bound by us to maintain confidentiality and to comply with data protection regulations.
Right of access, rectification, erasure and restriction of processing; right to data portability
You have the right to request information about the personal data we hold about you. In addition, you have the right to have inaccurate data rectified and the right to have your personal data erased, provided this is not prevented by a statutory retention obligation or a legal basis that permits us to process the data. You also have the right to request that we return the data you have provided to us (right to data portability). Upon request, we will also pass the data on to a third party of your choice. You have the right to receive the data in a commonly used file format. You can contact us for the aforementioned purposes via the email address provided in the legal notice. We may, at our discretion, request proof of identity in order to process your requests.
Email marketing upon subscription to the newsletter
When you subscribe to our newsletter, we use the data required for this purpose or provided separately by you to send you our email newsletter on a regular basis, based on your consent. You can unsubscribe from the newsletter at any time, either by sending a message via the contact details provided below or via a link provided for this purpose in the newsletter. Once you have unsubscribed, we will delete your email address, unless you have expressly consented to the continued use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this policy.
Credit checks and scoring
Where we provide goods or services on credit, e.g. for purchases on account, we may, in order to safeguard our legitimate interests, obtain a credit report from a credit reference agency based on mathematical and statistical methods. To this end, we transfer the personal data required for a credit check to a credit reference agency and use the information received regarding the statistical probability of default to make a balanced decision on the establishment, performance or termination of the contractual relationship.
Changes
We may amend this Privacy Policy at any time without prior notice. The current version published on our website shall apply. Where the Privacy Policy forms part of an agreement with you, we will inform you of any changes by email or by other appropriate means in the event of an update.
Enquiries to the Data Protection Officer
If you have any questions regarding data protection, please send us an email or contact the data protection officer within our organisation, as listed at the beginning of this privacy policy.
Root-Lucerne, October 2021