Privacy policy

Introduction 

Data protection is a matter of trust, and your trust is important to us. We respect your privacy and personal sphere. The responsible and legally compliant handling of personal data is a major concern for us, Coffee Architects AG, Schützenstrasse 5, 8800 Thalwil, Switzerland ("CA", "we", "us", and the like). 

We process personal data at all times in compliance with applicable law, in particular Swiss data protection law and, where applicable, the European Union General Data Protection Regulation (EU GDPR). 

This privacy policy ("Policy") describes how we collect, use, and share your personal data (i) when we provide services to you or you use our website coffee-architects.com (the "Website"), process a transaction through it, communicate with us, or make a purchase (see Part B, Online Privacy Policy). 

This Policy forms an integral part of the contract between you and us if it is listed as a contractual component in the relevant contract. If this is the case and contradictions arise between the contents of this Policy and the provisions of the relevant contract, the provisions of the contract (including associated documents such as General Terms and Conditions) shall prevail over the contents of this Policy. 

CA operates and uses the Shopify platform to provide our services to you, including all related information, content, features, tools, products, and services, to offer you, the customer, a curated shopping experience (the “Services”).

In addition to this Policy, further terms of use, General Terms and Conditions (GTC), and privacy policies may apply. 

A - General Privacy Policy

1. Responsibility 

The controller responsible for the data processing described in this Policy is CA. 

2. Categories of Data Subjects and Categories of Personal Data 

Personal data (“personal data”) means all details and information relating to an identified or identifiable natural person. By this, we mean information that identifies you or another person or can be associated with you. 

Personal data does not include information collected anonymously or pseudonymized information that does not identify you or cannot be associated with you. 

We may collect or process the following categories of personal data, including inferences derived therefrom, depending on how you use the Services, where you live, and to the extent permitted or required by applicable law:

In connection with the provision of our services and your use of the services, we process personal data of the following categories of data subjects, such as: 

• Contact and identification data as well as (work) organizational data such as first name, last name, business and/or private address, business and/or private email address, business and/or private telephone number, country, company, sector, department, function, responsibility, and customer or client number, short biography. 

• Financial information including credit card, debit card, and financial account numbers, payment card information, financial account information, transaction details, payment method, payment confirmation, and other payment details.

• Account information including username, password, security questions, preferences, and settings.

• Transaction information, including the items you view, add to your cart, add to your wishlist, or purchase, return, exchange, or cancel, as well as your previous transactions.

• Interaction and usage data such as correspondence, customer preferences, type and scope of use of services, customer service information such as complaints and details from the assertion of rights as well as feedback. 

• Communications with us, including the information you provide in your messages to us, for example when sending a customer service inquiry.

• Device information including information about your device, your browser or your network connection, your IP address, and other unique identifiers.

• Usage information, including information about your interaction with the Services, in particular how and when you interact with or navigate in the Services, such as frequency of visits, date, time and duration of visits, pages visited, search terms, clicks on content, website of origin, details in contact and feedback forms, social media profiles, submitted reviews and comments, IP address, information about the end devices used (end device type, device ID, manufacturer, operating system, language, device settings, MAC address, etc.), cookie information, and browser settings. 

We may collect personal data from the following sources:

• Directly from you: For example, when you create an account, visit or use the Services, communicate with us, or otherwise transmit your personal data to us

• Automatically via the Services, including from your device: When you use our products or services or visit our websites, and through the use of cookies and similar technologies

• From our service providers: Also when we commission them to enable certain technologies, and when they collect or process your personal data on our behalf

• From our partners or other third parties.

In principle, we process personal data that you disclose to us (e.g., during registration as well as within the framework of using the online services, via email, post, or telephone). As a rule, there is no legal or contractual obligation to disclose personal data. However, we will have to collect and process personal data that is required for the commencement and execution of a contractual relationship. Otherwise, we cannot complete or continue the relevant order. The processing of certain data when you use our online services is also unavoidable. The logging of certain data (usually not personal data) cannot be prevented for technical reasons. 

Under certain circumstances, you may want or need to transmit personal data of third parties to us or grant access thereto. We point out that in this case you are obliged to inform the persons concerned (e.g., employees) about the present Policy and its contents, to obtain the consent of the persons concerned if necessary, and to ensure the accuracy of the relevant personal data. 

3. Purposes of Processing 

Depending on how you interact with us or which services you use, we may use personal data for the following purposes:

• Further development of our services: We use your personal data to provide our services to you, fulfill our contract with you, process your payments, execute your orders, store your preferences and interests, send you notifications about your account, process purchases, returns, exchanges, and other transactions, create, maintain, and manage your account, organize shipping, enable returns and exchanges, enable you to post reviews, and offer you a personalized shopping experience, for example through product recommendations that match your purchases. This may also include using your personal data to better tailor and improve our services to your needs.

• Execution of contracts: We use your personal data in particular for the provision and performance of our services, the maintenance of customer or client databases (including management of customer or client accounts), the management and maintenance of the relationship with customers, invoicing, verification of your data, customer communication, and the operation of our technical infrastructure (including our online services). 

• Customer or client support: We use your personal data to provide you with customer support, respond to your inquiries, provide you with effective services, and maintain our business relationship with you. This includes in particular answering questions and concerns, supporting administrative, technical, or other matters, delivering information, and providing general customer or client services (e.g., via email, telephone, SMS, or by means of other forms of electronic communication). 

• Marketing and advertising: We use your personal data for marketing and advertising purposes, for example to send you marketing, advertising, and promotional communications via email, SMS, or post and to show you online advertising for products or services on the Services or other websites, including based on items you have previously purchased or added to your cart, and your other activity on the Services.

• Security and fraud prevention: We use your personal data to authenticate your account, ensure a secure payment and shopping experience, detect, investigate, and take action against potential fraudulent, illegal, unsafe, or malicious activities, protect public safety, and secure our services. When you use our services and register an account, you are responsible for the security of your access data. We strongly recommend that you do not share your username, password, or other access data with third parties.

• Debt collection & credit check: This includes in particular the assertion of claims and the judicial enforcement of outstanding claims as well as determining the creditworthiness of our customers so that our employees can check offer restrictions or special payment conditions in individual cases. 

• Anti-abuse measures: This includes in particular the detection, prevention, and elimination of abuses of our services or infrastructure. 

• Service quality: This includes in particular measures to ensure the quality of our services and security as well as technical troubleshooting and error correction. 

• Legal reasons: We use your personal data to comply with applicable law or to respond to valid legal processes, including requests from law enforcement agencies or government bodies, to investigate or participate in civil investigations, potential or actual litigation, or other contentious court proceedings, and to enforce or investigate potential violations of our terms or policies. This includes in particular compliance with applicable laws and regulations or responding to requests from competent courts and authorities and the assertion, exercise, or defense of legal claims. 

4. Legal Bases for Processing 

The processing of personal data requires a legal basis. CA relies on the legal bases of contract performance, legal obligation, and/or the pursuit of a legitimate interest when processing your personal data. In detail, this is as follows: 

5. Disclosure of Personal Data and Categories of Data Recipients 

We may disclose your personal data to recipients, such as service providers within CA and other third parties such as business partners, service providers, shareholders/investors, or authorities, in compliance with legal requirements. 

These include: 

• Service providers: We may disclose your personal data to service providers (Shopify, Payrexx, RunMyAccounts, Zapier, Trello) whom we call upon within the scope of our business activities to perform customer-related, IT-related, or administrative tasks in a contractor relationship, such as fiduciary and auditing companies, tax and legal advisors and other consultants, payment service providers, IT service providers (software and hosting providers, maintenance and support service providers, etc.), sales and cooperation partners, banks, and marketing service providers (e.g., for sending newsletters and for other marketing measures). Such disclosure or the granting of access thereto is generally limited to those personal data required for the provision of services by these service providers. 

• Third parties in the context of fulfilling legal obligations: We may disclose your personal data to third parties if this is or appears necessary or appropriate to comply with applicable laws and regulations or to verify compliance and to respond to requests from competent authorities to whom we must provide information about you and your personal data in accordance with applicable laws and regulations. Furthermore, we work with business and marketing partners to offer you marketing services and show you advertisements. For example, we use Shopify to enable personalized advertising with third-party services based on your online activities with various merchants and websites. Our business and marketing partners use your data according to their own privacy policies. Depending on your residence, you may have the right to object to the sharing of your data to show you targeted advertising based on your online activities at various merchants and websites. Or if you instruct us, ask us, or otherwise give your consent to the disclosure of certain information to third parties, for example for sending products to you or through your use of social media widgets or login integrations.

• Debt collection service providers: We may process your personal data for the purpose of commissioning debt collection service providers and make it accessible to these service providers. 

• Third parties in the context of anti-abuse measures: We may pass on your personal data to third parties or obtain it from third parties in connection with signs of the unlawful use of services, provided that this is suitable for the detection, prevention, or elimination of a fraudulent or abusive use of services of CA or third parties. 

• CRM systems and customer communication: To manage our customer relationships and communication, we use CRM systems (e.g., Google Drive, Trello, Zapier, RunMyAccounts, Cropster). In doing so, email correspondence may be partially automated and stored in these systems and made accessible to authorized employees. Access is restricted to those persons who need this information to perform their tasks. Processing is carried out exclusively for the purposes of customer communication, support, and contract execution. 

6. Relationship to Shopify

The Services are hosted by Shopify. Shopify collects and processes personal data about your access to and use of the Services to provide and improve them for you. Information you submit to the Services will be transmitted to Shopify as well as to third parties who may be located in countries other than your country of residence and shared with them to provide and improve the Services for you. To protect, expand, and improve our business, we also use certain enhanced Shopify features that incorporate data and information from your interactions with our shop, other merchants, and Shopify. To provide these enhanced features, Shopify may use personal data collected through your interactions with our shop, other merchants, and Shopify. In these cases, Shopify is responsible for the processing of your personal data, including responding to your requests to exercise your rights regarding the use of your personal data for these purposes. Further information on how Shopify uses your personal data and what rights you have can be found in the Shopify Privacy Policy for Consumers . Depending on your residence, you can exercise certain rights with respect to your personal data here: (see: Shopify Privacy Portal).

7. Third-Party Websites and Links

Our Services may provide links to third-party websites or other online platforms. If you follow links to websites that are not affiliated with us or controlled by us, you should review their privacy and security policies and terms of use. We provide no guarantee for the privacy or security of such websites and are not responsible for them, including the accuracy, completeness, or reliability of the information contained therein. Information you provide in public or semi-public areas, including information you share on third-party social networks, may be viewed by other users of our Services and/or users of these third-party platforms without restriction regarding its use by us or third parties. The provision of such links does not in itself imply an endorsement of the content of these platforms or their owners or operators, unless otherwise stated in our Services.

8. Children's Data

Our Services are not intended for children, and we do not knowingly collect personal data from children under 16 years of age. Should you be a parent or legal guardian of a child who has transmitted their personal data to us, you can contact us at the contact details given below and request the deletion of this data. At the time this Privacy Policy came into effect, we are not aware that we "share" or "sell" personal data of persons under 16 years of age (as defined by these terms in applicable law).

9. Cross-border Processing of Personal Data 

As a matter of principle, your personal data is processed in Switzerland. Within the scope of its service provision, CA may also rely on products and services from foreign manufacturers, suppliers, and subcontractors who, in the context of their contract performance, access personal data on our systems from abroad or process it at their foreign location. 

Accordingly, the recipients of your personal data listed in section 5 may be located abroad, including outside the EU/EEA. The countries concerned may not have laws that protect your personal data to the same extent as in Switzerland or in the EU/EEA (so-called third countries). If we transmit your personal data to such a country, we ensure its protection in an appropriate manner, for example by concluding data transfer agreements based on the contracts approved, issued, or recognized by the European Commission (so-called standard contractual clauses). Please contact us via the contact options listed in Part C, section 1 if you wish to receive a copy of our data transfer agreements. 

In exceptional cases, transfer to countries without adequate protection is permissible, for example within the scope of the EU GDPR based on express consent, to fulfill a contract with the data subject or to process your contract request, for the conclusion or fulfillment of a contract with someone else in the interest of the data subject, or for the assertion, exercise, or defense of legal claims. 

Please note that personal data processed for our own marketing purposes is stored in a contractor relationship on servers of service providers abroad and may be processed by them on our behalf to design advertising campaigns. 

10. Further information on the processing of personal data for marketing purposes 

As described above, we also process personal data of yours for marketing purposes. To this end, we make the following further statements: 

• Obtaining and disclosure of information from data analysis (Smart Data): Through the use of data analysis methods, we obtain statistical and analytical information (data products) that we use for our own evaluations. Any further use of such data will only take place with your additional consent, if required by law. 

• Personal data obtained from third parties: For marketing purposes, we can also obtain personal data from data suppliers (e.g., address dealers). For the same purposes, we can obtain data from third-party website operators and online networks such as surfing behavior on third-party websites and interests. 

• Provision of data for third-party advertising marketing: With your separate consent, you allow us to make your personal data processed by us for marketing purposes accessible to advertising marketing companies for the purpose of target-group-based advertising on the basis of an identification number without personal reference and in aggregated form.
  Furthermore, we can provide advertising marketing companies with information about you in aggregated form, which can be linked by these advertising marketing companies with information from your use of a website or an online service of partners of the advertising marketing companies' network. To do this, we use your IP address, which we receive from the respective partners of the advertising marketing network. 

CA does not disclose your identity to either advertising marketing companies or partners of advertising marketing networks. The parties involved are obliged to refrain from and prevent the establishment of a personal reference. 

• Right of objection:
  You have the option at any time to object to (i) the receipt of advertising and the processing of your data for marketing purposes and/or (ii) the provision of your data for third-party advertising marketing. In this case, no personal data will be obtained or processed for this purpose. The personal data already obtained and combined for this purpose will be deleted within five working days. 

• Regarding the prevention of the processing of personal data collected and processed via our online services, please note the corresponding provisions in Part B. 

11. Technical and Organizational Measures 

We have taken appropriate technical and organizational measures to protect your personal data (in particular access and misuse by unauthorized third parties) or to ensure data security appropriate to the risk and have also agreed such measures with the third parties called upon by us (see section 5 above). The measures taken are continuously reviewed and adapted to technological developments. 

Please note that no security measures are perfect or insurmountable, and we therefore cannot guarantee absolute security. Furthermore, your data may not be secure during transmission. We therefore recommend that you do not use unsecured channels for transmitting sensitive or confidential information.

How long we store your personal data depends on various factors, for example whether we need the information to manage your account, provide services to you, fulfill legal obligations, resolve disputes, or enforce other applicable contracts and policies.

12. International Data Transfer 

Please note that we may also transfer, store, and process your personal data outside of the country in which you reside.

If we transfer your personal data from the European Economic Area or the United Kingdom, we rely on recognized transfer mechanisms such as the standard contractual clauses of the European Commission or equivalent contracts issued by the competent authority of the United Kingdom, unless the data transfer is to a country that has been proven to provide an adequate level of protection.

B - Online Privacy Policy 

1 . General 

During your visit or your use of our online services, we process personal data from you that you disclose to us, for example, within the scope of a purchase (e.g., purchase of coffee), when using a shopping cart and providing billing and delivery data (e.g., your contact data such as name, telephone number, address or email address as well as other information). 

In addition, we use cookies in our online services in accordance with the explanations in section 3 of this Policy, so that you can use our online services perfectly. Furthermore, we only use cookies if you have agreed via the cookie popup that is displayed to you when you visit our online services. 

2. Cookies 

So-called cookies are used on our online services. Cookies are small files that are stored on your computer or mobile device when you visit or use one of our online services. Cookies store certain information and settings about your browser as well as data about the exchange with the relevant online service via your browser. When a cookie is activated, an identification number (cookie ID) is assigned to it, via which your browser is identified and the information contained in the cookie can be used. 

Further information on the cookies used by us in our online services can be found in our separate Cookie Policy (available at: coffee-architects.com/policies/privacy-policy). 

3. Web Analysis Tools 

To obtain information about the use of our online services and to improve our range, including in particular the functions of the online services, we use web analysis tools. These tools are mostly provided by a third-party provider. In general, the information collected for this purpose about the use of our online services is transmitted to the server of the third-party provider through the use of cookies. Depending on the third-party provider, these servers are located abroad. 

We also use so-called re-targeting technologies on our online services. This allows us to address users of our online services with advertising on third-party websites. The display of advertisements on websites is based on cookies in your browser, a cookie ID, and an analysis of previous use. 

4. Prevention of Cookies and Web Analysis Tools 

Most internet browsers accept cookies by default. You can, however, set your browser so that it accepts no or only certain cookies or that you are notified in each case before a cookie of an online service you visit is accepted. You can also delete cookies on your computer or mobile device by using the corresponding function of your browser. Instructions on how to prevent cookies through browser settings can be found at the following link: allaboutcookies.org 

In addition, you have the option to adjust your consent to the use of cookies on our online services via cookie popup. 

If you decide not to accept our cookies or the cookies and tools of our partner companies, you will not see certain information on our online services and will not be able to use some functions designed to improve your visit. 

5. Social Plugins 

On our websites, we also use so-called social plugins from social networks (e.g., Instagram). The plugins are recognizable by the logo of the respective social network. 

All plugins used are set up in a 2-click process. As a result, the respective plugins are only activated when you click on the logo of the social network concerned. 

When you call up a page of our website that contains an activated plugin, your browser establishes a direct connection to the servers of the respective provider. The content of the plugin is transmitted directly by the respective provider to your browser and integrated into the page. Through the integration of the plugins, certain information is transmitted to the respective provider and stored by them. 

If you are not a member of the corresponding social networks, there is still the possibility that they learn and store your IP address via the social plugin. If you are logged into one of the social networks, the respective provider can immediately assign the visit to our website to your personal profile in the social network. If you interact with the plugins, for example by pressing a corresponding button, the corresponding information is also transmitted directly to a server of the providers and stored there. The information is also published in the relevant social network in your respective profile and displayed there to your contacts. Purpose and scope of the data collection and the further processing and use of the data by the respective providers as well as your rights in this regard and setting options for protecting your privacy can be found in the privacy notices of the providers. 

If you want to prevent the relevant providers of social networks from assigning the data collected via our website to your personal profile in the respective social network, you must log out of the corresponding social network before visiting our website. You can also completely prevent the loading of plugins with specialized add-ons for your browser, such as "NoScript" (noscript.net/) or "Ghostery" (ghostery.com/). 

8. Third-Party Services Used by Us in Detail 

Upon request, we will send you a list of the third-party services used on our online services (including web analysis tools, social plugins, and other services or interfaces such as Zapier, Trello, RunMyAccounts, Google Drive, Google Tag Manager, YouTube, Cropster). Please contact us for this purpose via the contact options listed in Part C, section 1. 

C - General Provisions 

1. Contact 

If you have any questions or concerns, you can contact us as follows: 

By email: hello@coffee-architects.com

By post: Coffee Architects AG, Schützenstrasse 5, 8800 Thalwil, Switzerland 

You can contact the data protection officer or data protection consultant of CA as follows: 

By email: privacy@coffee-architects.com 

By post: Coffee Architects AG, Mr. Dario Stoop, Schützenstrasse 5, 8800 Thalwil, Switzerland

2. Duration of Storage of Personal Data and Deletion/Anonymization 

We store and process your personal data for as long as is necessary to achieve the purpose of its collection or as is prescribed or permitted by law/authority. For example, we have a legitimate interest in storing your personal data for as long as it is subject to a commercial, tax, or other legal retention obligation or storage is necessary for evidentiary or security reasons or other reasons (e.g., in connection with the assertion, exercise, or defense of legal claims). Thereafter, your personal data will be deleted from our systems or anonymized so that you can no longer be identified. 

3. Provision of Personal Data by CA 

Within the framework of our service provision, we provide you with personal data about you and, if applicable, other persons (e.g., employees of your company or employees of your company's customers). If (i) we conclude that the provision of certain personal data to you and your subsequent processing of this personal data violates legal or official requirements, or if (ii) a data subject, a supervisory authority, or another competent authority (e.g., a court) objects to the provision of all or certain personal data to you, we reserve the right to stop or temporarily suspend the provision of the personal data concerned. This may mean that in such a case you can no longer use our services or can only use them to a limited extent. We will inform you in such a case. 

4. Your Rights 

You have, provided it is envisaged in the scope of the applicable law and under the conditions laid down in the applicable law, the following rights in relation to the processing of your personal data: 

• Right of access: You have the right to obtain confirmation from us as to whether we are processing personal data about you and, if so, to request information on the processing of your personal data. This information includes, in particular, details of the purpose of the processing, the categories of personal data, and the recipients or categories of recipients to whom the personal data have been or will be made available. 

• Right to rectification: You have the right to have your personal data processed by us corrected and/or completed. 

• Right to erasure: You are entitled to have your personal data deleted, provided that we are not obliged under applicable laws and regulations to continue to store your personal data (in whole or in part) or have an overriding interest in further storage, if 

• the personal data are no longer required for the purposes pursued; 

• you have withdrawn your consent (provided such was given) and there is no other legal basis for the processing; 

• you have effectively objected to the processing; 

• the personal data have been processed unlawfully. 

• Right to restriction of processing: You can request from us the restriction of processing in the following cases: 

• if you dispute the accuracy of the personal data, for the duration of our verification and subsequent correction or rejection of the correction; 

• if you refuse deletion in the event of unlawful processing and instead wish to restrict processing; 

• if, after the purpose has been fulfilled, you request that the personal data should not be deleted but kept for the assertion of rights; 

The personal data concerned will be separated or marked for the duration of the restriction. Apart from storage, any further processing of these personal data will only take place with your consent. 

• Right to data portability: Under certain conditions, you have the right to receive the personal data provided by you in a structured, commonly used, and machine-readable format. You are entitled to have these personal data transmitted to another company without hindrance, as far as this is technically possible. 

• Right of objection: You have the right, for reasons relating to your particular situation, to object at any time to the processing of your personal data by us and to request us to stop processing your personal data. If you have a right of objection and exercise this right, your personal data will no longer be processed by us for such purposes. 

A right of objection does not exist in particular if we have compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or if the processing serves the assertion, exercise, or defense of legal claims or is necessary for the conclusion and performance of a contract. 

Insofar as we process your personal data for the purpose of direct marketing, you have the right to object to this processing at any time. Following your objection, your personal data will no longer be processed for this purpose. 

• Right to withdraw consent: If you have given us consent to process your personal data for one or more specific purposes, you have the right to withdraw your consent for one or more of these purposes. The withdrawal of consent does not affect the lawfulness of processing carried out until the withdrawal. 

You can assert your rights in connection with the processing of your personal data in writing via the contact options listed above by sending us your request via post or email. Please enclose a copy of your identity document (identity card or passport) with your request. 

We reserve the right to assert the legally provided restrictions on our part, for example if we are legally obliged to store or process certain personal data or have an overriding interest therein because we need it, e.g., for the assertion, exercise, or defense of legal claims. Please note that the exercise of the aforementioned rights may conflict with contractual agreements between you and us (e.g., on the provision of services) and this may lead to consequences such as, e.g., premature termination of the contract or costs. In these cases, we will inform you in advance. 

You also have the right to lodge a complaint with the competent supervisory authority, in particular in the Member State of your habitual residence or the place of the alleged infringement, if you believe that the processing of your personal data violates the applicable data protection law. The competent supervisory authority for data protection in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC). 

5. Changes 

We reserve the right to change and supplement all parts of this Policy at any time and at our sole discretion. The version published on our website (coffee-architects.com) shall apply in each case. We will inform you appropriately and in accordance with the requirements of the applicable law about these changes. 

Insofar as this Policy forms part of a contract between you and us, we will inform you appropriately in advance and obtain your consent if we change or supplement the Policy to your disadvantage. Your consent is voluntary. If you do not agree with the corresponding change or supplement, you can oppose it. If you do not oppose within the period announced in advance, this counts as your consent to the corresponding change or supplement. There is no right to extraordinary termination of a contract due to a change or supplement to the present Policy. 

Version from 03.08.2026