Privacy policy
Version 0.1-draft, valid from November 15, 2026
Version 0.1-draft, valid from 2026-11-15
We take your privacy seriously and collect only the data we need to sell you marbles. This policy explains what data we process, why, for how long, and what rights you have. It is based on the Swiss Federal Act on Data Protection (FADP) and, for people in the EU/EEA and the UK, on the GDPR / UK GDPR.
1. Who is responsible
Controller:
- [Company name]
- [Street, postcode, city, Switzerland]
- Email: privacy@marblarium.ch
Representative in the EU (art. 27 GDPR): [EU representative (art. 27 GDPR), appointed before launch]
Representative in the UK: [UK representative, if the UK remains a delivery country]
2. Your account and login
- What we use to create your account:
- your email address;
- optionally your name, preferred language and currency;
- your confirmation that you are at least 18 years old.
- How you log in:
- without a password. We send you a one-time code by email, valid for 10 minutes.
- Or you can log in with Google, Apple, Facebook or Microsoft. In that case, the provider sends us your name, your email address and a technical ID, and the provider learns that you use our shop. Their own privacy policy applies to them.
- Session cookie: we set it so that you stay logged in (see section 9).
Legal basis: contract (art. 6(1)(b) GDPR).
3. Purchases, invoices and delivery
What we process when you buy:
- your name, billing and delivery address, and optionally your phone number and company/VAT number;
- the items and prices;
- payment and shipping status.
Who receives it: the carrier and, for deliveries abroad, the customs authorities of Switzerland and the destination country. They need your name, address, the goods description and the value.
How long we keep it: Swiss law requires us to keep invoices and accounting records for 10 years.
Legal basis: contract and legal obligations.
4. Auctions
- What we store: your bids, your maximum bid, timestamps and a pseudonymised technical fingerprint of your IP address. We use the fingerprint to prevent fraud.
- What others see: only your pseudonym (e.g.
a***z (12)). Your real name is never shown, and your maximum bid is never shown to anyone. - New accounts: they have a bidding limit until their first paid order. You can ask for a review by a person at any time.
- How long we keep it: non-winning bids are unlinked from your account after 2 years.
Legal basis: contract and our legitimate interest in fair auctions.
5. Payment
Who handles payment: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, as an independent controller.
What we receive from PayPal: the payment status, a transaction number and the payer's email address. We never receive your card or bank details.
PayPal's privacy policy applies.
6. Legal compliance: sanctions and fraud prevention
- Sanctions screening: we check names and addresses against the Swiss (SECO), EU and US sanctions lists, because Swiss embargo law prohibits supplies to listed persons and certain countries.
- Manual review: some orders are reviewed by a person before delivery, for example orders to certain countries.
Legal basis: our legal obligations under Swiss law and our legitimate interest (art. 6(1)(f) GDPR).
7. Emails and notifications
What we send:
- emails that are necessary for your account and orders: login codes, outbid messages, auction results, invoices, shipping notices;
- the alerts you have chosen (watched items, saved searches).
You can change your notification settings at any time in your account.
Marketing: we send marketing emails only with your consent, or as an existing customer for similar products. You can unsubscribe at any time.
8. Server logs and security
What our server logs: your IP address, browser type, the page requested and the time.
Why and for how long: we use these logs to keep the site secure and delete them after 30 days.
Error reports: we remove personal data from them.
9. Cookies and statistics
We use only strictly necessary cookies:
sessionid: login, 2 weeks;csrftoken: security, 1 year;-
NEXT_LOCALE: your language, 1 year. -
PayPal: only on the payment step, if you choose PayPal, PayPal sets its own cookies.
- Statistics: our visitor statistics work without cookies and without personal profiles.
- No tracking: we don't use advertising or tracking tools, and we don't use social media plugins.
- Blocking cookies: you can block cookies in your browser, but then you can't log in.
10. Where your data is processed
Our servers: Switzerland.
Our service providers:
- hosting in Switzerland;
- an email service provider [to be chosen; Switzerland or EU];
- encrypted backups [in Switzerland or the EU].
Other countries:
- when you use social login or PayPal, these companies may also process data in the USA. They are certified under the EU-US and Swiss-US Data Privacy Framework;
- for deliveries, data goes to the carrier and the customs authority of the destination country.
11. How long we keep data
| Data | Retention |
|---|---|
| Account | Until you delete it; inactive accounts are deleted after 3 years (we warn you 30 days before) |
| Orders, invoices, payments, returns | 10 years (legal duty) |
| Non-winning bids | 2 years, then unlinked from your account |
| Server logs | 30 days |
| Backups | 30 days |
12. Your rights
You have the right to:
- access your data;
- receive your data in a portable format;
- have incorrect data corrected;
- have your data deleted, except data we must keep by law;
- object to processing based on legitimate interest;
- withdraw consent at any time.
How to use them:
- most of these rights work directly in your account, under Account → Privacy: download my data, delete my account;
- or write to privacy@marblarium.ch. We answer within 30 days.
Complaints:
- with the Swiss Federal Data Protection and Information Commissioner (FDPIC);
- in the EU/EEA, with the data protection authority of your country.
13. Minimum age
Our shop is for adults. You must be at least 18 years old to create an account, buy or bid.
14. Security
How we protect your data:
- encrypted connections and encrypted backups;
- passwordless login;
- two-factor authentication for our staff;
- strict access rights.
15. Changes
We may update this policy. The current version is always published here. If there is an important change, we inform you and ask you to confirm the new version at your next login.