Privacy Policy

This Privacy Policy describes how Tiny Yumzies ("Tiny Yumzies", "we", "us") handles personal data when you use tinyyumzies.ch, buy Products, contact us, or join the mailing list.

Swiss law applies, including the Federal Act on Data Protection (FADP). If you are in the EU, EEA, or Liechtenstein, the GDPR may also apply to our processing of your data in connection with an offer or a contract.

We are the controller of personal data collected through the Site. Use the contact form, or show contact details:

Last updated: 17 September 2026

1. Data we collect

We do not require a user account. We collect the following, depending on how you use the Site:

• Orders: name, email, shipping address, country, phone if Stripe supplies it, cart contents, amounts, shipping charge, payment status, Stripe checkout session ID, and payment intent ID. We do not store full card numbers. Stripe processes the payment.
• Contact form: first name, last name, email, subject, and message. We store the submission and send copies by email (currently via SendGrid when that service is configured).
• Newsletter: email address and language preference. Subscribing is optional. There is no automated unsubscribe link yet; email us through the contact form to be removed.
• Language cookie and local storage, and cart local storage, as described in the Cookie Policy.
• Technical data our hosting provider and application logs may record (IP address, date, pages, error logs) for security and operation of the Site.

We do not intentionally collect special categories of data. Allergen questions in a message you send us are processed only to reply.

2. Why we use it (purposes and legal bases)

We use personal data to:

• Take, fulfil, and document orders, including delivery and payment (contract; Swiss FADP; GDPR Art. 6(1)(b) where GDPR applies).
• Keep invoices and business records (legal obligation, including Swiss bookkeeping and tax rules; typically up to 10 years under the Swiss Code of Obligations for accounting records).
• Reply to messages you send (contract or our legitimate interest in handling enquiries; your request).
• Send the mailing list you signed up for, including related promotional codes (consent, which you may withdraw).
• Keep the Site working, including language display and fraud/security measures (legitimate interest; strictly necessary cookies as described in the Cookie Policy).

We do not sell personal data. We do not use profiling to make automated decisions that produce legal effects about you.

3. Who receives data

We disclose personal data only as needed:

• Stripe (payment processing, fraud prevention, hosted checkout). Stripe's privacy notice: stripe.com/privacy.
• Postal and logistics partners, for delivery.
• Email delivery provider (SendGrid / Twilio) for contact-form mail, when configured.
• Hosting and database providers that run the Site and store order, subscriber, and contact records.
• Google, when your browser loads Google Fonts (IP address and browser data). See the Cookie Policy.
• Professional advisers, authorities, or a buyer of the business, where the law requires or permits it.

Some of these organisations are in the United States or other countries. Where the FADP or GDPR requires a transfer mechanism (for example Standard Contractual Clauses), we rely on the mechanisms those providers offer. Stripe and Google publish their own transfer information.

4. How long we keep it

• Orders and customer records: for as long as needed to fulfil the contract and then for the statutory retention period (accounting records are commonly kept for 10 years in Switzerland).
• Contact submissions: for as long as needed to handle the enquiry and for a reasonable period afterward in case of follow-up or abuse.
• Newsletter: until you ask to be removed, or we shut the list down.
• Language cookie: 12 months, or until you delete it.
• Cart in local storage: on your device until successful payment or you clear it.

5. Your rights

Subject to the limits in the FADP (and GDPR where it applies), you may request access, correction, deletion, restriction of processing, and, where applicable, data portability. You may object to processing based on legitimate interests. You may withdraw newsletter consent at any time, without affecting processing that already took place.

Use the contact form, or show contact details, and state what you want us to do. We may need to verify that the request comes from you.

You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). EU/EEA residents may also complain to their local supervisory authority.

6. Children

The shop is aimed at adults. We do not knowingly take orders from children. If you believe we have data about a child, contact us and we will delete it where we are not required to keep it.

7. Security

We use HTTPS, restrict access to order systems, and keep payment card data with Stripe rather than in our database. No method of transmission or storage is completely secure.

8. Cookies

See the Cookie Policy for the language cookie, cart storage, Stripe, and Google Fonts. We do not use advertising or analytics cookies on the Site today.

9. Changes

We may update this policy when the Site or the law changes. The date at the top will change. Material changes to how we use data already collected will be handled as the law requires.