Legal

Privacy Policy

The German version is legally binding. This translation is provided for information only.

1. Controller

The controller responsible for processing your personal data under the Swiss Federal Act on Data Protection (FADP) is:

Aaliechtli
Marktgasse 7, 9050 Appenzell, Switzerland
Email: welcome@aaliechtli.ch
Phone: +41 71 787 21 60

Aaliechtli AG

If you have questions about data protection, write directly to the email address above.

2. Principles

This website deliberately does without cookies, tracking and analytics services, and customer accounts. Aaliechtli processes only the personal data needed to fulfil an order, answer a contact request or run the website securely.

3. What data we process and why

3.1 Orders (Stripe and Cloudflare)

When you place an order in the online shop, you are redirected to the payment provider Stripe. Stripe collects and processes the data needed for the payment, for example the payment method and the amount. Aaliechtli stores the order data needed for fulfilment and shipping in a private order store that shop visitors cannot access, within Cloudflare’s infrastructure. Orders are not stored in Sanity.

The order record contains: order reference, order and payment status, payment provider and transaction reference (Stripe Payment Intent), amount and currency, the items ordered (title, quantity, unit price, selected variant), name and email address, the shipping address and the time of the order. Payment method data such as card numbers is processed by Stripe only and is never stored by Aaliechtli.

Purpose: performing the contract, namely order confirmation, shipping, customer communication and accounting.
Legal basis: Art. 31 FADP (performance of a contract); for data subjects in the EU, Art. 6(1)(b) GDPR.

3.2 Contact form (Resend)

When you use the contact form on this website, Aaliechtli sends the data you enter, for example your name, email address and message, by email to the Aaliechtli mailbox through the email delivery service Resend.

Purpose: answering your request.
Legal basis: Art. 31 FADP (consent given by submitting the form); for data subjects in the EU, Art. 6(1)(a) or (f) GDPR.

3.3 Server logs (Cloudflare)

This website is delivered through Cloudflare’s infrastructure. When you visit the website, server log data is collected for technical reasons, for example your IP address, the date and time of access, the page requested and the browser used. This data serves only to keep the website running reliably and securely. It is not combined with other data sources.

Purpose: IT security and operational security.
Legal basis: Art. 31 FADP (overriding interest in operational security); for data subjects in the EU, Art. 6(1)(f) GDPR.

4. Recipients and processors

To run this website and fulfil orders, Aaliechtli uses the processors listed below. They process personal data only on Aaliechtli’s instructions and within the scope agreed by contract.

Cloudflare

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

Purpose: hosting, delivery of the website, protection against attacks and the private order store.

Data processing: USA and server locations distributed worldwide (including Switzerland and the EU). The transfer is safeguarded by the European Commission’s standard contractual clauses (Art. 16 et seq. FADP).

Sanity

Sanity AS, Trondheimsveien 2, 0560 Oslo, Norway.

Purpose: product catalogue and editorial website content. Order and payment data is not stored there.

Data processing: Norway/EEA; data may in part be stored on cloud infrastructure in the USA, safeguarded by the European Commission’s standard contractual clauses (Art. 16 et seq. FADP).

Stripe

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Purpose: payment processing, including credit card and TWINT.

Data processing: Ireland/EEA; a transfer to Stripe, Inc. in the USA is possible and is safeguarded by the European Commission’s standard contractual clauses (Art. 16 et seq. FADP).

Resend

Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.

Purpose: sending email (forwarding of contact form messages and order confirmations).

Data processing: USA. The transfer is safeguarded by the European Commission’s standard contractual clauses (Art. 16 et seq. FADP).

5. Processing abroad

Some of the processors named above may process personal data outside Switzerland and the EU or EEA, in particular where their registered office or server infrastructure is in a country without a recognised adequate level of data protection. In that case, Aaliechtli ensures adequate protection through suitable safeguards, in particular the European Commission’s standard contractual clauses or equivalent instruments recognised by the Federal Data Protection and Information Commissioner (FDPIC), in accordance with Art. 16 et seq. FADP and Art. 44 et seq. GDPR.

In practice, Cloudflare and Resend process personal data in the USA, Stripe in Ireland with a possible transfer to the USA, and Sanity in Norway with possible storage in the USA, in each case on the basis of the European Commission’s standard contractual clauses.

6. Retention period

Aaliechtli keeps order and invoice data for the statutory retention period for business records of 10 years (Art. 958f CO).

Aaliechtli keeps contact form requests for 12 months after the request is closed and then deletes them.

Cloudflare server log data is kept only briefly (about seven days under the current configuration) and is then deleted automatically.

7. Your rights

Under the FADP, you have the right to request information about the personal data Aaliechtli processes about you, and to request its correction, deletion or restriction of processing. Data subjects in the EU can also rely on the corresponding rights under Art. 15 to 21 GDPR, including data portability and the right to object.

To exercise these rights, an informal message to welcome@aaliechtli.ch is enough. Aaliechtli will answer your request within the statutory period.

You also have the right to lodge a complaint with the competent supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). For data subjects in the EU, it is the data protection authority of their country of residence.

8. Data security

Data is transmitted in encrypted form (TLS/SSL) between your browser and this website. Aaliechtli and the processors it uses take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss and misuse.

9. Changes to this privacy policy

Aaliechtli may update this privacy policy, for example when legal requirements or the services in use change. The version published on this website at the time of your visit applies.

Last updated: 9 July 2026