Privacy policy

1. Who is responsible

The controller for the processing of your personal data on baqless.com is

BAQLESS AG
Tiergartenstrasse 4, Postfach 139
4415 Lausen, Switzerland
Email contact@baqless.ch

For questions about data protection, you can reach us at the same address. We have not appointed a data protection officer, as the law does not require us to.

2. Which law applies

We process personal data under the Swiss Federal Act on Data Protection (FADP). If you order from or visit the shop from the EU, the EEA or the United Kingdom, the EU General Data Protection Regulation (GDPR) or the UK GDPR also applies. Where this policy names legal bases, they are those under Art. 6(1) GDPR.

3. What data we process and why

Visiting the shop

Each time a page is loaded, the shop system records technical data: IP address, date and time, the page visited, the page you came from, browser, operating system, device and language setting. We need this data to deliver the pages, to run the shop in a stable and secure way and to fend off misuse. The legal basis is our legitimate interest in a secure, working shop (point f).

Your order

For your order, we process your name, delivery and billing address, email address, telephone number if you give it or the carrier needs it for delivery, the pairs ordered, prices, shipping method, payment method and the status of payment and delivery. Without these details we cannot conclude or perform the contract. The legal basis is our contract with you (point b) and our legal duty to keep accounts and records (point c).

Payment

Payment runs through Shopify Payments and, depending on the payment method, through other payment service providers. Your card and account details go directly to the payment service provider. We do not see them. We receive the payment status, the payment method and, for cards, the brand and the last four digits. The payment service provider checks every payment for fraud and may automatically decline a payment with a high risk. If this happens, you can contact us and we will review the case in person. The legal basis is our contract with you (point b) and the legitimate interest in preventing fraud (point f). For some payment methods, such as Shop Pay or PayPal, the provider processes your data under its own responsibility and its own privacy policy.

Shipping and customs

For delivery, we pass your name, delivery address, telephone number and email address to the carrier: Swiss Post in Switzerland and Liechtenstein, FedEx for the countries of the EU. For customs clearance, FedEx and the customs authority of your country also receive the details of the goods and their value. If your parcel comes from Japan, we pass the order data to our partner Kimura Shoten Inc., Tokyo, which ships your parcel on our behalf. The legal basis is our contract with you (point b) and the legal duty to file a customs declaration (point c).

Customer account

If you open a customer account, we store your email address, name, addresses and orders, so you can track orders and order faster. You can have the account deleted at any time. The legal basis is our contract with you (point b).

Contact, order feedback and withdrawal

If you write to us by email, through the contact form, through the form “Tell us about your order” or through “Withdraw from contract here”, we process your details, your message and, if you send them, photos and videos of a pair. We need them to answer your request, to check a fault or to carry out your withdrawal. The legal basis is our contract with you (point b), our legal duty to handle the withdrawal (point c) and our legitimate interest in answering requests (point f).

Newsletter

You only receive the newsletter if you sign up and give your consent. We send it with Shopify's email function (Shopify Email) and record when and how you signed up. We see whether you open an email and which links you click, and we use this to shape the next issue. You can unsubscribe at any time using the link in every email. The legal basis is your consent (point a).

Vouchers

If we issue you a voucher, we store the code, amount, validity and the order it relates to. The legal basis is our contract with you (point b).

Legal claims

We also process data where necessary to enforce or defend claims. The legal basis is our legitimate interest (point f).

4. Cookies and similar technologies

The shop uses cookies and similar technologies. Necessary cookies are needed for the cart, checkout, language setting, login and security. We set them without consent because the shop does not work without them (point f).

We set cookies for statistics, personalisation and advertising only with your consent (point a). On your first visit, we ask you through the cookie banner. You can change or withdraw your choice at any time under “Cookie preferences” at the foot of every page.

Google Analytics and Google advertising

With your consent, we use Google Analytics 4 and the Google tag through Shopify's “Google & YouTube” app. Google records which pages you visit, which device and browser you use, which page brought you to us and whether you add something to your cart or buy it. We use this to understand how the shop is used, and to show ads on Google and YouTube and measure their success. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also transfer data to Google LLC in the USA. The legal basis is your consent (point a).

Meta Pixel

With your consent, we use the Meta Pixel through the “Facebook & Instagram” app. It records which pages you visit and whether you add something to your cart or buy it, together with technical details of your device and browser. We use this to show ads on Facebook and Instagram and measure their success. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. We are jointly responsible with Meta for collecting the data and passing it to Meta (Art. 26 GDPR); Meta is responsible for any further processing. Meta may transfer data to Meta Platforms, Inc. in the USA. The legal basis is your consent (point a).

Without your consent, we load neither Google Analytics nor the Meta Pixel. You can change your choice at any time under “Cookie preferences” at the foot of every page.

Shopify describes which cookies it sets and how long they are stored at shopify.com/legal/cookies.

5. Who receives your data

We pass on your data only as far as necessary for the purpose concerned. We do not sell personal data.

Processors, which process data only on our instructions:

  • Shopify International Limited, Dublin, Ireland, operator of our shop system, together with Shopify Inc., Canada, and their sub-processors, also for payment processing through Shopify Payments, sending emails and customer accounts
  • Kimura Shoten Inc., Tokyo, Japan, for shipping from the warehouse in Japan
  • Hostpoint AG, Switzerland, for our email mailboxes
  • our agency in Switzerland, which provides technical support for the shop and has access to the shop system for that purpose
  • providers of accounting and audit services, where we use them

Independent controllers, which process data under their own responsibility:

  • Swiss Post Ltd and FedEx for delivery and customs clearance
  • Google Ireland Limited and Meta Platforms Ireland Limited for analytics and advertising, only with your consent (for the Meta Pixel, jointly with us for the collection)
  • payment service providers, card schemes and banks for payment
  • customs and tax authorities, courts and other authorities, where the law obliges us

6. Data abroad

Some recipients process data outside Switzerland and the EEA:

  • Canada (Shopify Inc.): Switzerland and the EU recognise an adequate level of data protection in Canada.
  • USA (service providers of Shopify, Google LLC and Meta Platforms, Inc.): the transfer is based on the Data Privacy Framework between Switzerland, the EU and the USA where the recipient is certified, otherwise on the European Commission's standard contractual clauses as recognised by the FDPIC.
  • Japan (Kimura Shoten Inc.): the European Commission recognises an adequate level of data protection in Japan. From Switzerland, the disclosure is based on the performance of our contract with you, because Kimura Shoten ships your order (Art. 17(1)(b) FADP).
  • Worldwide (carriers): for your parcel to arrive, delivery data goes to the country you order to. The legal basis is the performance of our contract with you (Art. 17(1)(b) FADP, Art. 49(1)(b) GDPR).

You can obtain a copy of the standard contractual clauses used by Shopify on request.

7. How long we keep data

  • Orders, invoices and payment records: ten years, as Swiss law requires for business records and accounting vouchers (Art. 958f Swiss Code of Obligations, Art. 70 Swiss VAT Act).
  • Customer account: until you have it deleted, after that only what we must keep.
  • Order feedback, withdrawals and vouchers: until the matter is closed and any claims are time-barred.
  • Newsletter: until you unsubscribe. We keep the proof of your consent for as long as we may need to show it.
  • Technical data of the shop system: as long as Shopify needs it for operation and security.
  • Data from Google Analytics and the Meta Pixel: Google and Meta keep it according to their own retention periods. Once you withdraw your consent, no new data is collected.

We delete or anonymise everything else as soon as we no longer need it.

8. Your rights

You can at any time

  • ask what data we process about you,
  • have incorrect data corrected,
  • have data deleted, unless we are required to keep it,
  • receive your data in a common electronic format or have it transferred to another party,
  • object to processing based on our legitimate interest, and to processing for advertising at any time,
  • withdraw your consent with effect for the future,
  • under the GDPR, ask us to restrict processing.

A message to contact@baqless.ch is enough. So that we do not give data to the wrong person, we may ask you to prove your identity. We answer within 30 days.

If you believe we are not processing your data correctly, you can lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. In the EU and the EEA, it is the data protection authority of your country of residence.

9. Automated decisions

We do not take decisions about you that are based solely on automated processing and significantly affect you. The exception is the payment service provider's fraud check (section 3, Payment). If a payment is declined, you can state your point of view and ask for a person to review the case.

10. Security

The shop and checkout run over encrypted connections (TLS). Only the people who need it for their task have access to the shop system.

11. Changes

If services or purposes change, we update this policy. The version on this page applies.

Last updated: 27.10.2026