Privacy Policy
Coffee Service — Thurion GmbH
Version 2.2, in force from 17.09.2026 · replaces version 2.1 of 17.09.2026
Translation of the French original.
1. Controller
The controller within the meaning of art. 5 let. j of the Federal Act on Data Protection (FADP, SR 235.1) is:
Thurion GmbH
Gartenstrasse 7
4107 Ettingen (BL), Switzerland
UID: CHE-114.643.400 · CH-ID: CH-280-4012360-7
Phone: +41 61 722 10 40
Email: info@coffee-service.ch
Any question or request relating to data protection may be sent to these contact details, marked "Data protection". Thurion GmbH has not appointed a data protection adviser within the meaning of art. 10 FADP; such an appointment is optional for private controllers.
2. Applicable law
The website and the online shop are operated from Switzerland and are addressed to customers established in Switzerland and in the Principality of Liechtenstein. The processing described below is governed by the FADP and by the Data Protection Ordinance (DPO, SR 235.11), as well as, for advertising, by art. 3 para. 1 let. o of the Unfair Competition Act (UCA, SR 241) and, for data stored on terminal equipment, by art. 45c let. b of the Telecommunications Act (TCA, SR 784.10).
Regulation (EU) 2016/679 (GDPR) does not apply to the processing described here, as it is not aimed at offering goods or services to persons in the European Union, nor at monitoring their behaviour (art. 3 para. 2 GDPR). No representative within the meaning of art. 27 GDPR has been appointed.
3. Principles
Personal data is processed lawfully, in good faith and proportionately. It is collected for specified purposes recognisable to the data subject and is not further processed in a manner incompatible with those purposes. It is destroyed or anonymised as soon as it is no longer required (art. 6 FADP). No sensitive personal data within the meaning of art. 5 let. c FADP is knowingly processed in the operation of the website and the shop.
4. Processing carried out
4.1 Visiting the website (server log files)
Each time a page is called up, the server automatically records: IP address, date and time of the request, page requested, referring page, browser type and version, operating system, volume of data transmitted.
Purpose: technical provision of the website, stability, operational security, detection and analysis of abuse.
Justification: overriding private interest in the security and proper functioning of the system (art. 31 para. 1 and 2 FADP).
Retention: 14 days, with daily rotation and automatic deletion; longer retention only in the case of a documented security incident.
Hosting: virtual server at Infomaniak Network SA, Geneva, Switzerland. The data remains in Switzerland. Infomaniak acts as a processor within the meaning of art. 9 FADP.
4.2 Orders and performance of the contract
The following are processed: surname and first name, company name, billing and delivery addresses, email address, telephone number, order content, payment and delivery method, order history, correspondence relating to the order.
Purpose: conclusion and performance of the contract of sale, delivery, invoicing, collection, after-sales service, warranty and returns.
Justification: processing directly connected with the conclusion and performance of a contract with the data subject (art. 31 para. 2 let. a FADP); statutory accounting and invoicing obligations.
Disclosure limited to what is necessary: delivery data is passed to Swiss Post Ltd; payment data to the chosen payment service provider; accounting records, where applicable, to the fiduciary appointed by Thurion GmbH.
Retention: ten years from the end of the financial year, in accordance with art. 958f CO (accounting records); non-accounting order data is deleted or anonymised once the applicable contractual limitation periods have expired.
The fields marked as mandatory in the order form are necessary for the conclusion of the contract; without them the order cannot be processed.
Reminder of an uncompleted purchase. Where the email address is known (customer account or entered during the order) and an order started in the cart is not completed within ten hours, a single email is sent containing the cart content and a link to resume it. No further reminder follows; if an order has been placed in the meantime, no reminder is sent.
Justification: processing directly connected with the conclusion of a contract with the data subject (art. 31 para. 2 let. a FADP).
Objection: possible at any time and without formality, in particular by replying to the reminder email or by contacting the controller named in section 1; the email address is then excluded from such reminders.
4.3 Customer account
Opening an account is optional. The following are processed: access credentials (email address and password stored as a hash), stored contact details, saved delivery addresses, order history. Access to the customer account is granted by Thurion GmbH; open self-registration is disabled.
Purpose: provision of a personal area, simplification of later orders.
Justification: performance of the contractual relationship requested by the data subject (art. 31 para. 2 let. a FADP).
Retention: until the account is deleted by the customer or on request. Deleting the account does not delete the records subject to the statutory retention described in section 4.2, which are blocked from any other use until the period expires.
4.4 Contact, correspondence and support
The following are processed: the data transmitted (name, email address, telephone number, content of the message) and the metadata of the transmission, as well as the content of emails and telephone calls.
Mailboxes are hosted by the Swiss provider cyon GmbH, Basel. Requests sent to the support address are additionally recorded as a ticket in the company's management system so that their handling remains traceable.
Purpose: handling of the request and management of the relationship arising from it.
Justification: processing with a view to the conclusion of a contract (art. 31 para. 2 let. a FADP), respectively an overriding private interest in answering the requests received.
Retention: 24 months after the request is closed; if it leads to a contract, section 4.2 applies.
Unencrypted emails travel across the internet without protection against access by third parties. Please do not send particularly sensitive information by this channel.
4.5 Payments
Depending on the payment method chosen, the data required for payment is processed directly by the provider concerned, which acts in that respect as an independent controller and applies its own privacy terms. Full card details are neither collected nor stored on Thurion GmbH's systems.
Providers: in the case of advance payment by bank transfer, the amount is credited to Thurion GmbH's account at PostFinance Ltd, Bern, Switzerland, which receives the data necessary for the transaction (name of the payer, amount, payment reference) and processes it as an independent controller. PostFinance Ltd is also involved in payments on invoice. Additional payment methods and their providers will be named here once they are activated in the shop.
Retention: payment records are subject to the ten-year retention period of art. 958f CO.
4.6 Credit check (payment on invoice)
Payment on invoice may be agreed with business customers. In that case, a credit check may be carried out before the order is accepted. The following are transmitted for this purpose: surname and first name or company name, address, date of birth where applicable, and the order amount. The information obtained is used solely to decide whether payment on invoice is granted.
Category of recipient: a Swiss credit reference agency.
Justification: art. 31 para. 2 let. c FADP; the four cumulative conditions of that provision are met.
No automated individual decision: a refusal does not result exclusively from automated processing within the meaning of art. 21 FADP; it is assessed by a person. You may at any time request a review of a refusal and propose another payment method.
Retention: the result of the check is kept for twelve months and then deleted.
4.7 Advertising by electronic means
Customers whose email address was obtained in connection with a sale may receive information about similar goods and services of Thurion GmbH, in accordance with art. 3 para. 1 let. o UCA, the possibility of objecting having been indicated to them at the time of collection. Each message names the sender and includes a free and immediately usable means of objecting.
No newsletter requiring registration is currently offered. If one is offered, registration will be based on express consent obtained through a double opt-in procedure, with the date, time and IP address of the registration and of the confirmation recorded as evidence.
Objecting to advertising has no effect on messages necessary for the performance of the contract (order confirmations, dispatch notices, invoices), which do not constitute advertising.
4.8 Profiling
No high-risk profiling within the meaning of art. 5 let. g FADP is carried out. Order history is not used to create a personality profile within the meaning of the law.
5. Cookies and local storage
The shop stores data on your terminal equipment. In accordance with art. 45c let. b TCA, you are informed of this processing, of its purpose and of the possibility of refusing it.
Cookies set by this website
| Name | Purpose | Duration |
|---|---|---|
session_id | Session, cart, customer account login, protection against request forgery | 7 days |
frontend_lang | Storing the language selected | 1 year |
tz | Transmission of your browser's time zone, for displaying dates and times | Session, deleted when the browser is closed |
Data written to the browser's local storage
| Name | Purpose | Duration |
|---|---|---|
presence.focus | Indicates whether the shop tab is in the foreground, in order to synchronise the display across several open tabs | Until browsing data is cleared |
presence.lastPresence | Timestamp of the last activity in the tab, used together with the preceding entry | Until browsing data is cleared |
These cookies and this data are necessary for the shop to function and do not allow you to be identified outside it. No audience-measurement, advertising or retargeting cookies are set by this website, and no analytics tool is in use. Cookies set by a third-party video player are described in section 6.
Your browser can be set to notify you when cookies are stored, to accept them case by case, to refuse them generally, or to delete them automatically when it is closed; local storage data is cleared together with browsing data. Refusing the necessary cookies prevents the cart, the ordering process and the customer account from working.
6. Third-party services
Fonts (Google Fonts). The display fonts are loaded from Google's servers. Your IP address and the technical characteristics of your browser are therefore transmitted to Google. Provider: Google Ireland Limited, Dublin, with possible transfer to Google LLC, United States.
Videos (Vimeo). Some pages embed videos hosted by Vimeo. They load with the page; your IP address, the page visited and the technical characteristics of your browser are therefore transmitted to the provider, even if you do not play any video. The videos are embedded with the "Do Not Track" parameter, which limits the advertising use of that data. When they load, the provider additionally stores on your terminal equipment a technical cookie protecting against automated access (__cf_bm, issued by Cloudflare), with a duration of thirty minutes; that cookie serves neither audience measurement nor advertising. Provider: Vimeo.com, Inc., New York, United States.
No other third-party service is integrated into this website — in particular no audience-measurement tool, no statistics service and no reCAPTCHA.
7. Disclosure of data abroad
Hosting, email and order processing take place in Switzerland. Disclosure abroad occurs in connection with the services mentioned in section 6, to Ireland and to the United States.
Ireland is among the states for which the Federal Council has found an adequate level of data protection (art. 16 para. 1 FADP; Annex 1 DPO). The United States is also listed there, but only for data processed by organisations certified under the Swiss-U.S. Data Privacy Framework. Where the recipient is not certified, disclosure takes place only subject to the safeguards of art. 16 para. 2 FADP, in particular the standard data protection clauses recognised by the FDPIC.
Despite these safeguards, the level of protection abroad may differ from that of Swiss law, in particular as regards access to data by public authorities.
8. Data security
Appropriate technical and organisational measures are taken to ensure security commensurate with the risk (art. 8 FADP; art. 1 to 3 DPO), in particular: encryption of transmissions by TLS with forced redirection from HTTP to HTTPS, access control and rights management, passwords stored as hashes, daily backups, regular updating of software components, confidentiality undertakings by persons with access to the data, and contractual arrangements with processors (art. 9 FADP).
No transmission of data over the internet can be guaranteed absolutely.
In the event of a breach of data security likely to result in a high risk to the personality or fundamental rights of the data subjects, the incident is reported as soon as possible to the Federal Data Protection and Information Commissioner; the data subjects are informed where the law so requires or where this is necessary for their protection (art. 24 FADP).
9. Rights of data subjects
- Right of access (art. 25 FADP): to obtain confirmation that data concerning you is processed and to receive the information necessary to assert your rights. The information is provided free of charge as a rule, within 30 days. This right cannot be waived in advance.
- Rectification (art. 32 para. 1 FADP): rectification of inaccurate data.
- Erasure and objection (art. 32 para. 2 FADP, in conjunction with art. 28 et seq. CC): erasure or destruction of the data, prohibition of a specified processing or disclosure.
- Handing over and transfer of data (art. 28 FADP): to obtain the personal data you have provided in a commonly used electronic format.
- Withdrawal of consent: possible at any time, without retroactive effect on processing already carried out.
These rights may be restricted, refused or deferred in the cases provided for in art. 26 and 27 FADP. Requests are to be addressed to the contact details in section 1. In order to avoid disclosure to an unauthorised person, proof of identity may be required.
You may also contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, and assert your civil claims before the competent courts.
10. Amendments
This policy may be adapted to reflect changes in the processing carried out or in the legal framework. The version published on this website at the time of your visit is the applicable one.