Privacy policy
Last updated: 12 October 2026
This Privacy Policy explains which personal data we process when you visit onzeunion.com, create an account, place a bid, buy from us or contact us, and what rights you have.
1. Who is responsible
The controller responsible for the processing described here is:
Clava KLG, Bankstrasse 12, 8570 Weinfelden, Switzerland
Company identification number (UID): CHE-493.303.022
Email: contact@onzeunion.com
Clava KLG operates the online shop ONZE ("ONZE", "we", "us"). Please send all privacy questions and requests to the email address above. We have not appointed a data protection officer, because we are not legally required to.
2. Which laws apply
We are based in Switzerland and process personal data under the Swiss Federal Act on Data Protection (FADP).
We also ship to customers in the European Economic Area (EEA) and the United Kingdom. Where we offer goods to people there, the EU General Data Protection Regulation (GDPR) or the UK GDPR applies in addition. References to legal bases under the GDPR in this policy are relevant only in those cases.
This policy does not create rights beyond those the applicable law gives you.
3. What data we process
We process only the data we need to run the shop. Most of it comes directly from you; some is created automatically when you use the site.
|
Category |
Examples |
Source |
|---|---|---|
|
Contact and identity data |
Name, email address, phone number, billing and delivery address |
You |
|
Account data |
Email address used to sign in, saved addresses, order history, marketing preferences |
You, our shop system |
|
Order and contract data |
Items bought, prices, discounts, delivery method, returns, invoices |
You, our shop system |
|
Auction data |
Bids, maximum bids, time of each bid, auctions won or lost |
You, our auction system |
|
Payment data |
Payment method, payment status, partial card details (for example the last four digits), fraud risk assessment. Full card numbers are processed only by the payment providers, never by us. |
You, payment providers |
|
Communication data |
Emails and contact form messages, including their content and time |
You |
|
Technical and usage data |
IP address, device and browser type, language, pages viewed, referring page, date and time of access, cart contents |
Your device |
|
Referral data |
Whether you reached us through an affiliate link or discount code, and which partner referred you |
Your device, affiliate partners |
You are not obliged to give us personal data. Without the data marked as required at checkout or when bidding, however, we cannot accept a bid or fulfil an order.
If you give us data about another person, for example a different delivery recipient, please make sure that person knows about this policy.
4. Why we process your data and on what legal basis
|
Purpose |
What we do |
Legal basis under the GDPR, where it applies |
|---|---|---|
|
Orders and delivery |
Conclude and perform the purchase contract, take payment, ship goods, handle customs formalities, returns and warranty claims |
Performance of a contract, Art. 6(1)(b) |
|
Auctions |
Record and rank bids, determine the winning bidder, notify bidders, invoice the winner |
Performance of a contract and steps before a contract, Art. 6(1)(b) |
|
Customer account |
Let you sign in, view orders and manage addresses |
Performance of a contract, Art. 6(1)(b) |
|
Customer service |
Answer enquiries and complaints |
Art. 6(1)(b), or our legitimate interest in answering enquiries, Art. 6(1)(f) |
|
Legal obligations |
Keep accounting records, meet tax and customs duties, respond to lawful requests from authorities |
Legal obligation, Art. 6(1)(c); for Swiss law duties, legitimate interest, Art. 6(1)(f) |
|
Security and fraud prevention |
Protect the site, detect misuse, fake bids and payment fraud, enforce our terms |
Legitimate interest, Art. 6(1)(f) |
|
Operating and improving the shop |
Deliver the website, measure in aggregated form how it is used, fix errors |
Legitimate interest, Art. 6(1)(f); consent, Art. 6(1)(a), where cookies that are not strictly necessary are involved |
|
Marketing emails |
Send our newsletter and offers if you subscribed |
Consent, Art. 6(1)(a) |
|
Affiliate programme |
Attribute a sale to the partner who referred you and pay their commission |
Legitimate interest, Art. 6(1)(f); consent, Art. 6(1)(a), where a cookie that is not strictly necessary is involved |
|
Legal claims |
Establish, exercise or defend legal claims |
Legitimate interest, Art. 6(1)(f) |
You can withdraw a consent at any time with effect for the future. Every marketing email contains an unsubscribe link.
Under Swiss law we do not need a specific legal basis for each processing activity. We process your data in line with the FADP principles of good faith, proportionality and purpose limitation.
5. Auctions
Some of our items are sold by online auction. Our auctions run on the app Auction Today by Apex Apps LLC (see section 7). To place a bid you must identify yourself with an email address or a customer account.
When you bid, we store the amount, the time and your identity as bidder. Other visitors can see the current highest bid and the bid history. Your name is never shown in full: other visitors see only the first and last letter of your bidder name, with the rest masked by an asterisk (for example “S*a”). Your email address and other contact details are not shown to other visitors.
We email you about the auctions you take part in, for example when you are outbid or when you win. These are service messages, not advertising, and are sent without a separate consent.
The winner is the person with the highest valid bid when the auction ends. This is calculated automatically from the bids. We may exclude bidders who misuse the auction, for example by bidding without intending to pay. Such a decision is always taken by a person.
6. Cookies and similar technologies
Our shop uses cookies and comparable technologies such as local storage. They are small files or entries stored on your device.
- Strictly necessary cookies keep you signed in, remember your cart, your country and your privacy choices, and protect the checkout against fraud. The shop does not work without them, so they are set without consent.
- Analytics cookies from our shop platform Shopify help us understand in aggregated form how the shop is used, for example which pages are visited and where visitors come from.
- Affiliate tracking: if you arrive through a link from one of our partners, a cookie records the referral so that the partner can be credited if you buy.
Visitors from the EEA, the United Kingdom and other regions that require it see a cookie banner. In those regions, cookies that are not strictly necessary are set only after you agree. You can change or withdraw your choice at any time through the cookie settings link in the footer of the shop. In all regions you can also block or delete cookies in your browser settings; parts of the shop may then stop working.
A current list of the cookies set by Shopify is available in Shopify's cookie policy.
We do not currently use advertising pixels or tracking tools from social networks or advertising networks, and we do not sell your personal data.
Fonts. Our home page loads a font from Google Fonts, a service of Google Ireland Limited and Google LLC. Your browser connects to Google's servers to fetch the font, and Google receives your IP address in the process. Google Fonts does not set cookies. See Google's privacy policy for details.
7. Who receives your data
We share personal data only with recipients who need it for the purposes above. Service providers who process data on our behalf are bound by contract to use it only as we instruct.
|
Recipient |
What for |
Location |
|---|---|---|
|
Shopify International Limited and its group companies, including Shopify Inc. |
Shop platform: hosting, checkout, customer accounts, order management, email delivery, shop analytics, cookie banner |
Ireland, Canada; data of European merchants is stored in Europe by default |
|
Shopify Payments and its payment processors (for example Stripe), card schemes and banks |
Processing card and wallet payments, fraud screening |
Ireland, EEA, United States |
|
Apple, Google and Shopify (Shop Pay), if you choose their wallet at checkout |
Express payment with Apple Pay, Google Pay or Shop Pay |
Ireland, United States, Canada |
|
Swiss Post and its international partner carriers; customs authorities in the destination country |
Delivery, shipment tracking, customs clearance |
Switzerland and the destination country |
|
not bad eh? LTD, Gibraltar (app "Official Swiss Post App") |
Creating shipping labels: passes your name and delivery address to Swiss Post |
Gibraltar |
|
TFTW GmbH, Basel, Switzerland (app "Swiss Post Labels") |
Creating shipping labels: passes your name and delivery address to Swiss Post |
Switzerland |
|
Apex Apps LLC, Sheridan, Wyoming, USA (app "Auction Today") |
Running auctions: storing bids, displaying masked bidder names, notifying bidders |
United States (hosted on Amazon Web Services, US West region), Canada |
|
Secomapp (app "UpPromote") |
Affiliate programme: attributing orders to referring partners, calculating commissions |
United States (hosted on DigitalOcean); the provider may also access data from Vietnam |
|
Proton AG |
Our business email |
Switzerland |
|
Accountants, tax and legal advisers, banks |
Bookkeeping, tax, payments, legal advice |
Switzerland |
|
Authorities and courts |
Where the law obliges us or where needed to assert our rights |
Switzerland and, in individual cases, abroad |
Affiliate partners do not receive your name, address or contact details from us. For orders they referred, their partner dashboard shows the products, quantity and amount of the order, their commission, the order number, the date and whether the referral came through a link or a discount code. Because partners usually know whom they shared their link or code with, they may be able to tell that a particular person placed an order.
If we sell or restructure the business, customer data may pass to the successor, who must continue to honour this policy.
8. Shopify's own processing
Our shop runs on Shopify. For most processing, Shopify acts on our behalf and under our instructions.
For some services Shopify decides itself how data is used and is then responsible in its own right. This applies in particular if you use Shop Pay, the Shop app or sign in with Shop, and to Shopify's fraud prevention and security functions across the shops on its platform. Details are in Shopify's consumer privacy policy. You can exercise your rights towards Shopify through the Shopify privacy portal.
If you pay with Apple Pay or Google Pay, the respective provider processes your data under its own privacy policy.
9. Transfers to other countries
Some recipients listed in section 7 are located outside Switzerland, in particular in the EEA, the United Kingdom, Canada and the United States. Individual providers may also use sub-processors in other countries worldwide.
The EEA, the United Kingdom, Gibraltar and Canada are recognised by Switzerland as providing adequate data protection. Where data goes to a country without such recognition, including the United States and Vietnam, the transfer is protected by one of the following:
- the recipient's certification under the Swiss-U.S. or EU-U.S. Data Privacy Framework, or
- standard contractual clauses approved by the European Commission and adapted for Switzerland, or
- an exception provided by law, for example where the transfer is necessary to perform a contract with you, such as delivering an order to an address abroad.
You can ask us for a copy of the safeguards that apply to a specific transfer.
10. How long we keep your data
We keep personal data only as long as the purpose requires or the law obliges us.
|
Data |
Retention |
|---|---|
|
Orders, invoices and related correspondence |
10 years after the end of the business year, as required by Swiss accounting and tax law |
|
Auction bids |
For the duration of the auction and then as long as claims from it can be raised; winning bids are kept with the order |
|
Customer account |
Until you ask us to delete it; order records are then kept as stated above |
|
Enquiries without an order |
Up to 2 years after the last contact |
|
Newsletter subscription |
Until you unsubscribe; we then keep a record of the unsubscribe so that we do not contact you again |
|
Abandoned checkouts |
Up to 3 months |
|
Technical logs and cookies |
From the end of the session up to about 2 years, depending on the cookie |
After these periods we delete or anonymise the data.
11. Your rights
Within the limits of the applicable law you have the right to:
- Access: learn whether we process data about you and receive a copy.
- Rectification: have incorrect or incomplete data corrected.
- Erasure: have your data deleted, unless we must or may keep it, for example for accounting.
- Restriction and objection: have processing restricted, and object to processing based on our legitimate interests. You can object to direct marketing at any time without giving reasons.
- Data portability: receive the data you gave us in a common electronic format, or have it sent to another provider.
- Withdrawal of consent: withdraw a consent at any time. Processing carried out before the withdrawal remains lawful.
To exercise a right, email contact@onzeunion.com. We may ask for proof of identity so that data does not reach the wrong person. We answer free of charge, normally within 30 days.
You can also complain to a data protection authority:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch
- EEA: the supervisory authority of the country where you live or work; a list is on the European Data Protection Board website
- United Kingdom: Information Commissioner's Office, ico.org.uk
We would appreciate the chance to resolve your concern first.
Residents of certain US states have comparable rights to access, correct and delete their data. We do not sell personal data and do not share it for cross-context behavioural advertising.
12. Security
We and our providers use appropriate technical and organisational measures to protect your data, including encrypted transmission (TLS) and restricted access to our shop administration. Payment data is processed by certified payment providers under the PCI DSS standard. No transmission over the internet is completely secure; please contact us if you suspect misuse of your data.
13. Automated decisions and profiling
We do not make decisions that have legal or similarly significant effects on you solely by automated means. Our payment providers and Shopify assess orders automatically for fraud risk. If an order is flagged, a person at ONZE decides whether to accept it.
14. Children
Our shop is intended for adults. Bidding and buying require that you are at least 18 years old. We do not knowingly collect data from children. If you believe a child has given us personal data, please contact us and we will delete it.
15. Links to other websites
Our shop may link to other websites, such as social media profiles. Their operators are responsible for their own data processing.
16. Changes to this policy
We may update this policy when our shop, our providers or the law change. The version published on this page applies. If a change significantly affects you, we will inform you by email or by a notice in the shop.
17. Language
This policy is published in English. If we provide a translation and the versions differ, the English version prevails.