Privacy policy

[Nome completo ou razão social], [Rua e número], [CEP] [Cidade], Switzerland. Email for privacy matters: contato@ogumderonda.com.

• Account: name, email, password (stored only as an encrypted hash that we cannot read) and preferred language.
• Orders: products, amounts, date, delivery name and address, and the phone number and email given at payment.
• Payment: handled by Stripe. We only receive a confirmation and a payment reference, never your full card details.
• Communication: emails you send us and the emails we send about your account and orders.
• Technical data: IP address, time of access, pages opened and browser, logged by the server for security.

• To conclude and fulfil the purchase contract: processing payment, shipping products and customer service (GDPR art. 6(1)(b)).
• To run your account so you can follow your orders and reset your password.
• To meet legal obligations, such as keeping accounting records for 10 years (art. 958f Swiss Code of Obligations; GDPR art. 6(1)(c)).
• To protect the shop against fraud and attacks (legitimate interest, GDPR art. 6(1)(f)).

We do not send newsletters or advertising without your explicit consent. We do not sell data.

We only use what the shop needs to work, so we do not ask for consent:

• ogum_session: session cookie that keeps you logged in (up to 7 days, not readable by scripts).
• NEXT_LOCALE: remembers your chosen language.
• Cart: the products in your cart are stored only in your browser (localStorage).

We use no analytics, advertising or social media tools. Fonts are served from our own server; no data is sent to Google to display them.

We share data only with service providers who need it to run the shop and who process it on our instructions:

• Payment: Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (USA).
• Website and database hosting: [Provedor de hospedagem, ex.: Infomaniak Network SA, Genebra, Suíça].
• Email delivery: [Provedor de e-mail, ex.: Infomaniak Network SA, Genebra, Suíça].
• Product images: Cloudflare, Inc. (Cloudflare R2), stored in the European Union. When you open a page, your browser loads the images from this service, which receives your IP address to deliver them.
• Error monitoring: Functional Software, Inc. (Sentry), stored in the European Union. If a technical error occurs on the website, the service receives a technical report (error message, page opened without parameters, browser type). Names, email addresses, passwords, cookies and IP addresses are not sent.
• Shipping: Die Schweizerische Post AG / La Poste Suisse SA and, for international shipments, the postal service of the destination country (name, address and, if needed, phone number).

Some providers are located outside Switzerland. Switzerland recognises the European Union as offering adequate protection. For the USA, we only transfer data to companies certified under the Swiss-U.S. Data Privacy Framework (and, for EU customers, the EU-U.S. Data Privacy Framework), such as Stripe, Cloudflare and Sentry, or under approved standard contractual clauses.

• Account: until you ask us to delete it.
• Orders and accounting records: 10 years, as required by law.
• Password reset links: valid for at most 1 hour and unusable after being used.
• Server logs: up to 30 days.

We use encrypted connections (HTTPS), passwords hashed with bcrypt, restricted access to the admin area and limits on repeated login attempts. When you change your password, all sessions on other devices are ended.

You can ask at any time for access to your data, correction, deletion, restriction of processing, a copy in a common format (portability), and object to processing. If you gave consent, you can withdraw it at any time. To do so, write to contato@ogumderonda.com. We may ask you to confirm your identity.

You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, if you live in the EU, with the data protection authority of your country.

We do not make automated decisions or create profiles from your data.

We may update this policy. The version published on this page, with the date at the top, always applies.