Privacy Policy

for VAN TOL · vantol.ch

Version: 6 September 2026

This Privacy Policy explains which personal data are processed when you use vantol.ch and place orders, the purposes for which the data are processed, and the rights available to data subjects.

1. Controller and scope

The controller within the meaning of the General Data Protection Regulation (GDPR) is Jonas Leonhard Moser, trading as VAN TOL, using the contact details set out above.

This Privacy Policy applies to the vantol.ch online shop, the associated ordering and checkout process, and communications and contractual dealings with VAN TOL.

2. Legal bases for processing

We process personal data only where there is a legal basis for doing so. Depending on the processing activity, we rely in particular on:

• Art. 6(1)(b) GDPR where processing is necessary to take steps prior to entering into or to perform a contract, in particular for orders, payment, delivery, returns and customer service;

• Art. 6(1)(c) GDPR where we must process or retain data in order to comply with legal obligations;

• Art. 6(1)(f) GDPR where processing is necessary for the purposes of legitimate interests, in particular the secure and stable operation of the shop, prevention of misuse and fraud, and the establishment, exercise or defence of legal claims;

• Art. 6(1)(a) GDPR where we obtain consent for a specific processing activity. Consent may be withdrawn at any time with effect for the future.

3. Visiting the website and hosting via Vercel

The publicly accessible VAN TOL website is provided as a Next.js application using Vercel's hosting and cloud infrastructure.

The service provider is in particular Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

When the website is accessed, technically necessary connection and log data are processed. This may include, in particular, the IP address, date and time of access, requested resource, referrer URL, browser and device information, and technical error and security data.

To the extent that this processing is attributable to VAN TOL, it is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient provision of our online shop and the detection and prevention of technical attacks.

Where Vercel processes personal data on our behalf, this is carried out on the basis of a data processing agreement. Vercel is a provider established in the United States; data may therefore also be processed outside the European Economic Area. According to Vercel, appropriate transfer mechanisms are used for such transfers, in particular applicable adequacy mechanisms and/or Standard Contractual Clauses.

4. Shopify as shop, cart and checkout infrastructure

We use Shopify for the shop backend, product and order data, shopping cart and checkout functions, and parts of order processing.

For merchants in Europe, Shopify International Limited, Ireland, is generally the relevant Shopify contracting entity. Shopify initially processes customer data for European merchants through its European Shopify entity and uses additional affiliated companies and subprocessors to provide its services.

In connection with an order, the following data in particular may be transmitted to or processed by Shopify:

• name, billing address and delivery address;

• email address and, where applicable, telephone number;

• order, product, cart and configuration data;

• payment status and payment-related metadata, although VAN TOL does not necessarily receive full payment instrument details;

• IP address, device, browser, security and fraud-prevention data;

• information relating to returns, refunds and customer communications, where processed through Shopify.

For VAN TOL, processing is based in particular on Art. 6(1)(b) GDPR for performance of the purchase contract and, where necessary, Art. 6(1)(f) GDPR for secure shop infrastructure and fraud prevention.

Shopify may also process data outside the European Economic Area as part of its global infrastructure. According to Shopify, it uses the mechanisms provided for under the GDPR for international data transfers. Where Shopify acts as a processor, the Shopify Data Processing Addendum applies.

Certain Shopify services, such as Shop Pay or other Shopify consumer services, may additionally involve processing by Shopify in its own capacity. Shopify's privacy information applies in addition in such cases.

5. Orders and performance of the contract

When you place an order with VAN TOL, we process the data required to perform the contract. This includes, in particular, contact, billing, delivery, order, product and configuration data, as well as information relating to payment and order status.

Processing is based on Art. 6(1)(b) GDPR.

Mandatory information in the checkout is required so that we can conclude the contract, process payment and deliver the goods. If required information is not provided, an order may not be able to be completed or fulfilled.

6. Product configurations, engravings and manufacturing

For configured jewellery, we process the product characteristics selected by the customer, such as ring size, metal, colour, stone type and, where applicable, engraving text.

For the manufacture or sourcing of a product, the configuration data required for this purpose may be transmitted to manufacturing, production or supply partners used by us. We avoid transmitting end-customer data where such data are not required for manufacturing.

For personalised products, an engraving text in particular may be transmitted to a production partner. The engraving text itself may contain personal data. Please therefore provide only the data required for the requested engraving.

The legal basis is Art. 6(1)(b) GDPR. If, in exceptional cases, personal manufacturing data are transferred to a recipient outside the European Economic Area, this will only take place in compliance with the legal requirements governing transfers to third countries.

7. Payment processing

For payment processing, we use the payment services offered in the Shopify checkout. The customer chooses the payment method in the checkout. To carry out the selected payment, the necessary order, contact, payment and transaction data are transmitted to the relevant payment service provider.

The legal basis for VAN TOL's transmission of data is Art. 6(1)(b) GDPR. Payment service providers may also process data under their own responsibility, in particular for fraud prevention, identity verification, payment processing and compliance with legal obligations.

7.1 Shopify Payments

VAN TOL uses Shopify Payments. Payment processing is carried out through Shopify and its payment and banking partners. Depending on the payment method selected, data such as name, billing information, transaction amount, order information, device and fraud-prevention data, and payment instrument data may be processed.

For customers in the European Economic Area, processing within the Shopify environment is carried out in particular through Shopify International Limited. As part of payment processing, data may also be transferred to additional payment and financial service providers and to other countries.

7.2 PayPal

If you choose PayPal as a payment method, the data required for payment processing are transmitted to PayPal. For customers in the European Economic Area, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, is involved in particular.

PayPal generally processes the data in connection with its payment services under its own data protection responsibility. Further details are provided in PayPal's privacy information.

7.3 Klarna

If you choose a payment method provided through Klarna, the data required for payment processing are transmitted to Klarna. The provider is in particular Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.

As part of its payment products, Klarna may in particular carry out identity, fraud and creditworthiness checks. Klarna carries out this processing under its own responsibility in accordance with its privacy information.

8. Shipping and delivery

For delivery of an order, we transmit the data required for delivery to the shipping or logistics provider used for the shipment. This generally includes the name and delivery address and, where necessary for delivery or requested by the customer, contact details for delivery notifications.

The legal basis is Art. 6(1)(b) GDPR. Where additional contact details are processed exclusively for optional delivery notifications and consent is required for this purpose, processing is based on Art. 6(1)(a) GDPR.

9. Contacting us

If you contact us by email, telephone or another direct method, we process the information you provide in order to handle your enquiry.

If the enquiry relates to an order, a potential contract or an existing contract, the legal basis is Art. 6(1)(b) GDPR. For other enquiries, processing is based on Art. 6(1)(f) GDPR; our legitimate interest is the appropriate handling of enquiries.

A separate contact form is currently not used on vantol.ch.

10. Customer account, where offered

Where VAN TOL offers a customer account function within the Shopify system, the account, contact and order data required for this purpose are processed. The legal basis is Art. 6(1)(b) GDPR. A voluntary customer account may be closed in accordance with the functions offered; statutory retention obligations for order and accounting data remain unaffected.

11. Cookies, local storage and consent

VAN TOL and the technical service providers used for the shop and checkout use cookies or comparable storage technologies where this is necessary for operation of the website, shopping cart, checkout, security, payment processing or functions expressly requested by the user.

Under Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), consent is not required for storing or accessing information on a user's terminal device where this is strictly necessary. Subsequent processing of personal data is based, depending on the purpose, in particular on Art. 6(1)(b) or (f) GDPR.

Non-essential analytics, marketing or tracking technologies may generally be used in the European Economic Area only after the relevant consent has been obtained. If VAN TOL activates such technologies in the future, an appropriate consent and withdrawal mechanism will be provided and this Privacy Policy will be updated before or at the time of activation.

VAN TOL currently does not use Google Analytics, Meta Pixel or TikTok Pixel on its own headless storefront.

12. No newsletter tracking

VAN TOL currently does not offer an email newsletter. VAN TOL therefore currently does not process personal data for newsletter distribution or newsletter tracking.

13. No solely automated decision-making by VAN TOL

VAN TOL itself does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning a data subject or similarly significantly affect that person.

Payment service providers may carry out automated fraud, identity, risk or creditworthiness checks as part of their own services. The respective payment service providers are responsible for this processing; further details are provided in their privacy information.

14. Recipients and categories of recipients

Personal data are disclosed only where this is necessary for the purposes stated above or otherwise permitted by law. Recipients may include in particular:

• hosting and infrastructure providers, in particular Vercel;

• shop and checkout service providers, in particular Shopify;

• payment service providers and their banking and processing partners;

• shipping and logistics providers;

• manufacturing, production and supply partners where this is necessary for an order or personalisation;

• tax advisers, public authorities, courts or other bodies where a legal obligation or legitimate purpose connected with the establishment, exercise or defence of legal claims exists.

15. Transfers to third countries

Some service providers used by VAN TOL or their subprocessors are located outside the European Economic Area or process data there. This applies in particular to parts of the infrastructure of Vercel and Shopify.

Such a transfer takes place only where the requirements of Arts. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision of the European Commission, a valid certification under a recognised adequacy framework, appropriate Standard Contractual Clauses or another safeguard provided by law.

Information on the transfer mechanisms used in each case can also be found in the privacy and contractual information of the relevant service providers.

16. Retention periods

We retain personal data only for as long as required for the relevant purpose or for as long as statutory retention obligations apply.

Order, invoice and accounting-related data may in particular be retained for the applicable tax and commercial-law retention periods. Under current law, accounting records and invoices generally have to be retained for eight years; certain business records may be subject to six- or ten-year retention periods.

Communication data are generally deleted once the enquiry has been conclusively dealt with and there are no longer any statutory retention, evidentiary or legal-defence reasons for keeping them.

Technical log data are retained only for as long as required for security, error analysis and proper operation, subject to different retention periods applied by the technical service providers used.

17. Data security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. Data transmitted to and from vantol.ch are generally encrypted using TLS/HTTPS.

No internet-based process can guarantee absolute security. Our security measures are therefore reviewed and adjusted within the limits of technical and organisational feasibility.

18. Your rights

Subject to the statutory requirements, data subjects have in particular the following rights:

• right of access to the personal data being processed (Art. 15 GDPR);

• right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);

• right to erasure of personal data (Art. 17 GDPR);

• right to restriction of processing (Art. 18 GDPR);

• right to data portability where the statutory requirements are met (Art. 20 GDPR);

• right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR);

• right to withdraw consent at any time with effect for the future.

To exercise your rights, you can contact info@vantol.ch.

19. Objection to direct marketing

If personal data are used for direct marketing in the future, you may object to such processing at any time. Following an objection, the relevant data will no longer be used for direct marketing.

20. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. Due to VAN TOL's place of business, the following authority is particularly relevant:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany
Email: poststelle@lfdi.bwl.de
Telephone: +49 711 615541-0

21. Changes to this Privacy Policy

We update this Privacy Policy if our processing activities, the services we use or the legal requirements change. Before activating additional analytics, advertising, pixel, newsletter or comparable services, we will in particular assess whether this Policy must be supplemented and whether prior consent is required. The current version published on vantol.ch applies.