Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is:

Herbavita-Swiss GmbH
Christoph Merian-Ring 23
4153 Reinach BL
Switzerland

Email: info@herbavitaswiss.ch

2. Legal basis

We process personal data under the Swiss Federal Act on Data Protection (FADP) and its ordinance (DPO). Where the EU General Data Protection Regulation (GDPR) applies, for example to visitors from the EU or EEA, we rely on the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c)) and our legitimate interests (Art. 6(1)(f)).

3. Hosting and server log files

This website is hosted by Vercel Inc., USA. Each page request processes technically necessary data: IP address, date and time, requested address, referring page (referrer), browser and operating system. We need this data to deliver the website and keep it secure and stable (legitimate interest).

When an order is submitted, the IP address is also used briefly to limit the number of requests (abuse protection); it is not stored permanently.

Vercel privacy information: vercel.com/legal/privacy-policy

4. Google Analytics

We use Google Analytics 4 (measurement ID G-8DZT5QWYLR), a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA ("Google"). Google Analytics loads on every page and sets cookies (_ga and _ga_…, retention up to 2 years). Google uses them to analyse how the website is used, e.g. pages viewed, time on site, approximate location, device and browser. According to Google, IP addresses are not stored in Google Analytics 4. Data may be transferred to Google servers in the USA.

We use these analyses to improve our website (legitimate interest).

You can object by blocking or deleting cookies in your browser or by installing Google’s browser add-on: tools.google.com/dlpage/gaoptout. More information: policies.google.com/privacy

5. Customer account

For the customer account we collect your name, email address and password. Account and login are provided by Supabase (Supabase Inc., USA); the password is only stored in encrypted (hashed) form. You receive an email to confirm your address.

While you are logged in, your browser keeps a login token in local storage (localStorage). It is removed when you log out.

Supabase privacy information: supabase.com/privacy

6. Orders and analysis reports

When you place an order, we process the following data:

• first and last name, email address, phone number (optional)
• delivery address for the sample kit
• selected analyses, amount, payment method, order number and processing status
• your analysis report

We need this data to perform the contract: sending the sample kit, matching your payment, analysing the sample and providing the report. It is stored in a database at Supabase. Orders are linked to your customer account via your email address, even if you open the account later with the same address. Analysis reports (PDF) are kept in protected storage at Supabase and are available only to you, in your account, via a time-limited link.

An automatic message via the Telegram messaging service notifies us of new orders. It contains the order number, name, email address, ordered analyses, amount and payment method. Telegram privacy information: telegram.org/privacy

You pay by TWINT or bank transfer (Swiss QR-bill/IBAN). Payment is processed by TWINT or your bank; we only receive the details needed to match it. We do not store payment or banking credentials.

To ship the sample kit, we pass your name and address to the postal service.

7. Contact form and email

The contact form does not send any data to our server. It opens your email program with a prepared message to info@herbavitaswiss.ch. If you write to us, we process your details (name, email address, phone number if given, and message) to answer your enquiry.

8. Newsletter

The newsletter field on our home page currently neither stores nor transmits any data; we do not send a newsletter at present. We will update this policy before introducing one.

9. Cookies and local storage

• Google Analytics: cookies _ga and _ga_… (see section 4)
• Cart: your cart is kept in your browser’s local storage (localStorage) and is only sent to us when you submit an order.
• Login: login token in local storage while you are logged in (see section 5)

We set no other cookies. You can delete or block cookies and local storage in your browser settings; the cart and login may then not work.

10. Fonts, media and external links

Fonts, images and videos are served from our own server; no connection is made to Google Fonts or other font providers. References to Facebook and Google Maps are plain links: data is only transmitted if you click them, in which case the provider’s privacy policy applies.

11. Disclosure abroad

Vercel, Supabase, Google and Telegram may process personal data outside Switzerland and the EEA, in particular in the USA. Where no adequate level of protection has been recognised, disclosure is based on appropriate safeguards, in particular the European Commission’s standard contractual clauses or, where the provider is certified, the Swiss-U.S. or EU-U.S. Data Privacy Framework.

12. Retention

We keep personal data only as long as needed for the respective purpose. Order and accounting records are kept for the statutory period of 10 years (Art. 958f Swiss Code of Obligations). Analysis reports are archived for 10 years in accordance with our Terms. Account data is deleted when you request deletion of your account, unless a retention obligation applies.

13. Data security

Data between your browser and our website is transmitted encrypted (HTTPS). Only authorised laboratory staff have access to orders and analysis reports.

14. Your rights

You have the right to access your personal data, to have it corrected, deleted or restricted, to receive or transfer it, and to object to processing. Please contact info@herbavitaswiss.ch.

You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) and, where the GDPR applies, with a data protection supervisory authority in the EU.

15. Changes

We may amend this policy at any time. The version published on this website applies.