Privacy policy

1. What this policy is about

In this privacy policy, we, Acar Import & Export (ACAR Gartenbedarf), explain which personal data we process when you visit our website acar-gartenbedarf.ch, send us an enquiry via the contact form or by e-mail, or place an order with us.

We comply with the Swiss Federal Act on Data Protection (FADP; German abbreviation “DSG”), which has been in force since 1 September 2023. Where the EU General Data Protection Regulation (GDPR; German “DSGVO”) applies – for example if you are in the EU or the EEA and we offer you goods – it applies in addition.

“Personal data” means any information relating to an identified or identifiable person, for example a name, e-mail address or IP address.

In brief: without your consent, our website does not set any cookies and no data is transmitted to Google or other third parties. We load fonts and images from our own server and embed no maps, videos or social media plug-ins. Only if you choose “Accept” in the cookie notice do we use Google Analytics 4 to measure how the website is used (see section 5). You can change your choice at any time via “Cookie settings” in the footer.

2. Controller and contact

The controller for the data processing described in this policy is:

Acar Import & Export (ACAR Gartenbedarf)
Proprietor: Mazlum Acar
Elsässerstrasse 93
4056 Basel
Switzerland

E-mail: info@acar-gartenbedarf.ch

For questions about data protection and to exercise your rights, the simplest way is to write to us at info@acar-gartenbedarf.ch or by post to the address above.

3. Which data we process and where it comes from

Depending on how you get in touch with us, we process the following categories of personal data:

• Technical data when you visit the website: IP address, date and time, page accessed, browser and operating system (see section 4).
• Usage data (only with your consent): randomly generated identifier, pages viewed, origin of the visit, device and browser details, approximate location (see section 5).
• Enquiry data from the contact form: name, e-mail address, your message and voluntary details such as telephone number, subject of the enquiry and a free-text field on quantity and grain size (see section 6).
• Communication data when you write to us by e-mail: your contact details, and the content and time of the message.
• Order and billing data when you order from us: name, delivery address and billing address, products and quantities ordered, quotes, invoices, payment details.

We receive this data directly from you. We do not buy in addresses and we do not create profiles.

4. Visiting the website: hosting and server log files

Our website is a static website with small scripts for the contact form and the cookie notice. It is hosted by Kreativ Media GmbH, Höschgasse 45, 8008 Zurich. Kreativ Media GmbH processes the data as our processor; according to its own statements, it processes and stores personal data mainly in Switzerland and the European Economic Area (EEA).

Each time the website is accessed, the server automatically stores log data (server log files), in particular:

• IP address of the accessing device,
• date and time of access,
• address requested (URL), status code and amount of data transferred,
• previously visited page (referrer), where your browser transmits it,
• browser type and operating system (user agent).

We need this data to deliver the website, to ensure its security and stability, and to detect errors or misuse. We do not evaluate it in order to identify you personally, and we do not combine it with other data.

The log files are kept only for as long as necessary for these purposes and are then deleted.

The connection to our website is encrypted (HTTPS).

Cookies and third parties: without your consent, our website does not set any cookies and does not embed third-party content. Fonts and images are loaded from our own server; no data is transmitted to Google or other third parties when the website is accessed. Only if you agree to statistics is Google Analytics added (see section 5).

5. Web analytics with Google Analytics 4 (only with your consent)

On your first visit we show a cookie notice with two equally prominent buttons. If you choose “Accept”, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). If you choose “Decline” or make no choice, Google Analytics is not loaded, no analytics cookies are set and your browser does not connect to Google servers.

Purpose: we want to understand how our website is used – for example which pages are read and how visitors find us – in order to improve content and usability. We receive aggregated reports and do not assess individual persons.

Data processed: pseudonymous usage data, namely a randomly generated identifier, the pages viewed with the time, the origin of the visit (referrer), details of device, operating system, browser, language and screen size, and the approximate location (country, region, city). If you successfully submit the contact form, we also record the event “generate_lead”; the content of your enquiry is not sent to Google. Your IP address reaches Google with every measurement but, according to Google, it is used only briefly to derive the approximate location and is not logged or stored in Google Analytics 4.

Cookies and local storage:

The two Google cookies are set only after you have consented. The storage periods correspond to Google’s information (opens in a new window).

Privacy-friendly settings:

• Google signals and ad personalisation are disabled; no advertising cookies are set and the consent signals for advertising (“ad_storage”, “ad_user_data”, “ad_personalization”) remain “denied”.
• User-level data (identifiers and event data) is deleted automatically in Google Analytics after 14 months.

Legal basis: your consent (Art. 6 para. 1 let. a GDPR; under the FADP, consent as a ground of justification under Art. 31 para. 1). For storing your choice in local storage we rely on our legitimate interest in respecting your decision (Art. 6 para. 1 let. f GDPR).

Disclosure abroad: Google processes the data as our processor. A transfer to Google LLC in the USA is possible. Google LLC is certified under the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework. For companies certified under these frameworks, an adequate level of data protection applies under Annex 1 of the Swiss Data Protection Ordinance (German “DSV”, in force since 15 September 2024); the European Commission has adopted a corresponding adequacy decision for the EU-U.S. Data Privacy Framework (an appeal is pending before the Court of Justice of the European Union against the General Court judgment that upheld this decision). In addition, Google has agreed the European Commission’s standard contractual clauses, which apply where no framework is applicable.

Withdrawal: you can withdraw your consent at any time with effect for the future – via “Cookie settings” in the footer of every page or here:

Open cookie settings

If you choose “Decline”, we no longer load Google Analytics and delete the Google Analytics cookies in your browser. You can also delete cookies and site data in your browser settings; the cookie notice then reappears on your next visit. More about data processing by Google: Google’s privacy policy (opens in a new window).

6. Contact form

Through our contact form you can send us an enquiry, a request for a quote or an order. In doing so, we process:

• Mandatory details: name, e-mail address and your message;
• voluntary details: telephone number, type of enquiry, free text on quantity and grain size.

Without the mandatory details we cannot answer your enquiry.

This is how the processing works:

• Your details are sent by e-mail to info@acar-gartenbedarf.ch. The e-mail also contains the time of the enquiry and the IP address from which it was sent – so that we can detect misuse.
• The e-mail is sent via our host’s mail server. The details are not stored in a database on the web server. Our e-mail mailbox is also operated by Kreativ Media GmbH, Zurich.
• You receive an automatic confirmation with a summary of your details at the address you provided.

Protection against spam and misuse: We use no CAPTCHA and no third-party services. Instead, the form contains a field that is invisible to humans (“honeypot”) and checks whether it was submitted suspiciously fast. We also limit the number of enquiries per IP address within a short time; for this purpose the server briefly stores a pseudonymised hash of your IP address, created with a secret key (not the IP address itself); entries older than 24 hours are deleted whenever the form script is called. The form works without cookies.

Purpose: We use your details solely to answer your enquiry, to prepare a quote for you and, where applicable, to process an order. We do not pass them on to third parties for advertising or market research purposes, and we do not send a newsletter.

Retention: If your enquiry does not lead to an order, we delete it as soon as we no longer need it, after 24 months at the latest. If it leads to an order, the periods in section 8 apply.

E-mails are generally transmitted unencrypted. Please do not send us any particularly sensitive data via the form or by e-mail.

7. Contact by e-mail

If you write to us directly by e-mail at info@acar-gartenbedarf.ch, we process your details in order to answer your request. Section 6 or section 8 applies to retention.

8. Orders, delivery and collection

If you order from us, we process the order and billing data named in section 3 in order to confirm your order, deliver it or arrange collection, invoice it and comply with legal obligations.

Recipients: Where necessary for processing, we pass data on to:

• transport and parcel services for delivery (name, delivery address and, where applicable, telephone number for delivery);
• banks and payment service providers for processing payments;
• our fiduciary or accountant, where necessary.

Apart from Google Analytics (section 5, only with your consent), data is disclosed abroad only if you request delivery abroad; disclosure is then necessary for the performance of the contract (Art. 17 para. 1 let. b FADP; Art. 49 para. 1 let. b GDPR).

Retention: In accordance with Art. 958f of the Swiss Code of Obligations (CO; German “OR”), we keep business records and accounting vouchers (e.g. invoices) for ten years from the end of the financial year. After that we delete or anonymise the data.

9. Legal bases

Under the FADP, we process personal data in accordance with the statutory principles, that is, lawfully, in good faith, proportionately and only for recognisable purposes. Where a justification is required, we rely on overriding interests – in particular answering your enquiry and performing a contract with you –, on the law or on your consent (Art. 31 para. 1 FADP), for example for Google Analytics.

Where the GDPR applies, we rely on the following legal bases:

• Contract and pre-contractual measures (Art. 6 para. 1 let. b GDPR): answering enquiries, quotes, processing orders;
• Legal obligations (Art. 6 para. 1 let. c GDPR): retention obligations;
• Consent (Art. 6 para. 1 let. a GDPR): Google Analytics 4;
• Legitimate interests (Art. 6 para. 1 let. f GDPR): secure operation of the website (log files), protection against spam and misuse, storing your cookie choice, general communication, enforcement of claims.

10. Overview of processors

11. Retention at a glance

• Server log files: only as long as necessary, see section 4
• Hash values for spam protection: deleted once older than 24 hours (whenever the form script is called), see section 6
• Google Analytics data: 14 months (setting in Google Analytics, see section 5); Google cookies: up to 2 years or until you withdraw your consent
• Your cookie choice (local storage): until you change it or delete your browser’s site data
• Enquiries without an order: until no longer needed, 24 months at the latest
• Order and accounting records: ten years (Art. 958f CO)

Beyond that, we keep data for as long as necessary to assert or defend legal claims.

12. Data security

We take appropriate technical and organisational measures to protect your data against loss, unauthorised access and misuse. These include encrypted transmission of the website (HTTPS), validation of all form input, access restrictions and the careful selection of our service providers. No one can guarantee complete protection when data is transmitted over the internet, in particular by e-mail.

13. Your rights

Under the FADP, you have in particular the right:

• to request access to whether and which personal data we process about you (Art. 25 FADP);
• to have inaccurate data rectified (Art. 32 para. 1 FADP);
• to object to processing and to request erasure of your data, unless a statutory retention obligation or an overriding interest prevents this (Arts. 30 and 32 FADP);
• to request the release or transfer of your data in a common electronic format (Art. 28 FADP);
• to withdraw any consent you have given at any time with effect for the future (for Google Analytics via “Cookie settings” in the footer, see section 5).

Where the GDPR applies, you have the corresponding rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent (Art. 7 para. 3 and Arts. 15–21 GDPR).

Send your request to info@acar-gartenbedarf.ch or by post to our address. So that we do not release data to unauthorised persons, we may ask you to prove your identity. Access is generally free of charge; as a rule, we answer your request within 30 days.

We make no automated individual decisions and carry out no profiling.

Complaint to a supervisory authority: In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC; German “EDÖB”), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch (opens in a new window). Where the GDPR applies, you may also lodge a complaint with a data protection supervisory authority in the EU or EEA, in particular the authority of your place of residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

14. Changes to this privacy policy

We amend this privacy policy when our data processing or the legal requirements change. The version published on this page at the relevant time applies.

See also: Imprint

This page is a translation. In the event of any discrepancy, the German version prevails.