Privacy Policy

for VAN TOL · vantol.ch

Version: 23 September 2026

This Privacy Policy explains which personal data are processed when you use vantol.ch and place orders, the purposes for which the data are processed, and the rights available to data subjects.

1. Controller and scope

The controller within the meaning of the General Data Protection Regulation (GDPR) is Jonas Leonhard Moser, trading as VAN TOL, using the contact details set out above.

This Privacy Policy applies to the vantol.ch online shop, the associated ordering and checkout process, and communications and contractual dealings with VAN TOL.

2. Legal bases for processing

We process personal data only where there is a legal basis for doing so. Depending on the processing activity, we rely in particular on:

• Art. 6(1)(b) GDPR where processing is necessary to take steps prior to entering into or to perform a contract, in particular for orders, payment, delivery, returns and customer service;

• Art. 6(1)(c) GDPR where we must process or retain data in order to comply with legal obligations;

• Art. 6(1)(f) GDPR where processing is necessary for the purposes of legitimate interests, in particular the secure and stable operation of the shop, prevention of misuse and fraud, and the establishment, exercise or defence of legal claims;

• Art. 6(1)(a) GDPR where we obtain consent for a specific processing activity. Consent may be withdrawn at any time with effect for the future.

3. Visiting the website and hosting via Vercel

The publicly accessible VAN TOL website is provided as a Next.js application using Vercel's hosting and cloud infrastructure.

The service provider is in particular Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

When the website is accessed, technically necessary connection and log data are processed. This may include, in particular, the IP address, date and time of access, requested resource, referrer URL, browser and device information, and technical error and security data.

To the extent that this processing is attributable to VAN TOL, it is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient provision of our online shop and the detection and prevention of technical attacks.

Where Vercel processes personal data on our behalf, this is carried out on the basis of a data processing agreement. Vercel is a provider established in the United States; data may therefore also be processed outside the European Economic Area. According to Vercel, appropriate transfer mechanisms are used for such transfers, in particular applicable adequacy mechanisms and/or Standard Contractual Clauses.

4. Shopify as shop, cart and checkout infrastructure

We use Shopify for the shop backend, product and order data, shopping cart and checkout functions, and parts of order processing.

For merchants in Europe, Shopify International Limited, Ireland, is generally the relevant Shopify contracting entity. Shopify initially processes customer data for European merchants through its European Shopify entity and uses additional affiliated companies and subprocessors to provide its services.

In connection with an order, the following data in particular may be transmitted to or processed by Shopify:

• name, billing address and delivery address;

• email address and, where applicable, telephone number;

• order, product, cart and configuration data;

• payment status and payment-related metadata, although VAN TOL does not necessarily receive full payment instrument details;

• IP address, device, browser, security and fraud-prevention data;

• information relating to returns, refunds and customer communications, where processed through Shopify.

For VAN TOL, processing is based in particular on Art. 6(1)(b) GDPR for performance of the purchase contract and, where necessary, Art. 6(1)(f) GDPR for secure shop infrastructure and fraud prevention.

Shopify may also process data outside the European Economic Area as part of its global infrastructure. According to Shopify, it uses the mechanisms provided for under the GDPR for international data transfers. Where Shopify acts as a processor, the Shopify Data Processing Addendum applies.

Certain Shopify services, such as Shop Pay or other Shopify consumer services, may additionally involve processing by Shopify in its own capacity. Shopify's privacy information applies in addition in such cases.

5. Orders and performance of the contract

When you place an order with VAN TOL, we process the data required to perform the contract. This includes, in particular, contact, billing, delivery, order, product and configuration data, as well as information relating to payment and order status.

Processing is based on Art. 6(1)(b) GDPR.

Mandatory information in the checkout is required so that we can conclude the contract, process payment and deliver the goods. If required information is not provided, an order may not be able to be completed or fulfilled.

6. Product configurations, engravings and manufacturing

For configured jewellery, we process the product characteristics selected by the customer, such as ring size, metal, colour, stone type and, where applicable, engraving text.

For the manufacture or sourcing of a product, the configuration data required for this purpose may be transmitted to manufacturing, production or supply partners used by us. We avoid transmitting end-customer data where such data are not required for manufacturing.

For personalised products, an engraving text in particular may be transmitted to a production partner. The engraving text itself may contain personal data. Please therefore provide only the data required for the requested engraving.

The legal basis is Art. 6(1)(b) GDPR. If, in exceptional cases, personal manufacturing data are transferred to a recipient outside the European Economic Area, this will only take place in compliance with the legal requirements governing transfers to third countries.

7. Payment processing

For payment processing, we use the payment services offered in the Shopify checkout. The customer chooses the payment method in the checkout. To carry out the selected payment, the necessary order, contact, payment and transaction data are transmitted to the relevant payment service provider.

The legal basis for VAN TOL's transmission of data is Art. 6(1)(b) GDPR. Payment service providers may also process data under their own responsibility, in particular for fraud prevention, identity verification, payment processing and compliance with legal obligations.

7.1 Shopify Payments

VAN TOL uses Shopify Payments. Payment processing is carried out through Shopify and its payment and banking partners. Depending on the payment method selected, data such as name, billing information, transaction amount, order information, device and fraud-prevention data, and payment instrument data may be processed.

For customers in the European Economic Area, processing within the Shopify environment is carried out in particular through Shopify International Limited. As part of payment processing, data may also be transferred to additional payment and financial service providers and to other countries.

7.2 PayPal

If you choose PayPal as a payment method, the data required for payment processing are transmitted to PayPal. For customers in the European Economic Area, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, is involved in particular.

PayPal generally processes the data in connection with its payment services under its own data protection responsibility. Further details are provided in PayPal's privacy information.

7.3 Klarna

If you choose a payment method provided through Klarna, the data required for payment processing are transmitted to Klarna. The provider is in particular Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.

As part of its payment products, Klarna may in particular carry out identity, fraud and creditworthiness checks. Klarna carries out this processing under its own responsibility in accordance with its privacy information.

8. Shipping and delivery

For delivery of an order, we transmit the data required for delivery to the shipping or logistics provider used for the shipment. This generally includes the name and delivery address and, where necessary for delivery or requested by the customer, contact details for delivery notifications.

The legal basis is Art. 6(1)(b) GDPR. Where additional contact details are processed exclusively for optional delivery notifications and consent is required for this purpose, processing is based on Art. 6(1)(a) GDPR.

9. Contacting us

If you contact us by email, telephone or another direct method, we process the information you provide in order to handle your enquiry.

If the enquiry relates to an order, a potential contract or an existing contract, the legal basis is Art. 6(1)(b) GDPR. For other enquiries, processing is based on Art. 6(1)(f) GDPR; our legitimate interest is the appropriate handling of enquiries.

A separate contact form is currently not used on vantol.ch.

10. Customer account, where offered

Where VAN TOL offers a customer account function within the Shopify system, the account, contact and order data required for this purpose are processed. The legal basis is Art. 6(1)(b) GDPR. A voluntary customer account may be closed in accordance with the functions offered; statutory retention obligations for order and accounting data remain unaffected.

11. Cookies, local storage and consent

VAN TOL and the technical service providers used for the shop and checkout use cookies or comparable storage technologies where this is necessary for operation of the website, shopping cart, checkout, security, payment processing or functions expressly requested by the user.

Under Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), consent is not required for storing or accessing information on a user's terminal device where this is strictly necessary. Subsequent processing of personal data is based, depending on the purpose, in particular on Art. 6(1)(b) or (f) GDPR.

Non-essential analytics, marketing or tracking technologies may generally be used in the European Economic Area only after the relevant consent has been obtained. If VAN TOL activates such technologies in the future, an appropriate consent and withdrawal mechanism will be provided and this Privacy Policy will be updated before or at the time of activation.

VAN TOL currently does not use Google Analytics, Meta Pixel or TikTok Pixel on its own headless storefront.

12. Newsletter

If you sign up for our newsletter on vantol.ch, we process your email address, the language you selected, the place on the website where you signed up, and the times of your sign-up and of your confirmation or refusal.

Sign-up uses the double opt-in procedure: after signing up you receive an email in which you can confirm or decline the subscription. We only send you the newsletter after you have confirmed. If you do not confirm, you will not receive a newsletter. The confirmation email contains no advertising.

The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR). Storing the times of sign-up and confirmation serves as proof of your consent (Art. 7(1) GDPR) and is based on our legitimate interest in a legally compliant newsletter procedure (Art. 6(1)(f) GDPR).

Sign-up data are stored with Shopify (see section 4); after your confirmation, your consent may additionally be recorded in your Shopify customer record. To send the confirmation emails and the newsletter we use the email service Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes the data on our behalf under a data processing agreement; processing also takes place in the USA. For this transfer, Resend relies on the EU Standard Contractual Clauses and on its certification under the EU-U.S. Data Privacy Framework.

We do not evaluate whether you open our newsletter or click on links in it.

You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in every newsletter or by email to info@vantol.ch. After you unsubscribe, we no longer use your email address for the newsletter. We keep proof of your earlier consent for as long as claims arising from it can be asserted, generally up to three years after the end of the calendar year in which the consent ends.

12a. Notification of upcoming lines (waiting list)

On some pages we present jewellery lines that are not yet available. There you can leave your email address to be notified as soon as the line is released.

We process your email address, the line you signed up for, the language you selected, the time of your sign-up and the wording of the consent shown to you when you signed up. The data is stored with Shopify (see section 4).

We use your address solely to inform you about the release of the line you signed up for. Once sending through our email service is set up, you will receive an email after signing up in which you can confirm it; the notification itself is sent via Resend (see section 12).

The legal basis is your consent (Art. 6(1)(a) GDPR). Storing the time and the wording of your consent serves as proof of that consent (Art. 7(1) GDPR) on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

You can withdraw your consent at any time with effect for the future, by email to info@vantol.ch or via the unsubscribe link in our email. After the notification has been sent or after you withdraw your consent, we delete your entry, and in any case no later than twelve months after you signed up if the line has not been released by then. We keep the proof of your consent for as long as claims may be asserted on the basis of it.

12b. Booking the video consultation (Google Calendar, Google Meet)

On the page «Personal consultation» you can book a free video consultation. Booking and the video call are services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland («Google»).

On our page we only show which times are free and which are taken; we read that from our own calendar on the server. Only when you click a free time does the booking page open at Google in a new window. Before that, no data is transferred to Google. With the click, a connection to Google's servers is established; in particular your IP address and technical information about your browser are transferred, and Google may use cookies or similar technologies.

When booking, you enter your name, your email address and, where applicable, further voluntary information (for example the occasion, the desired date or a budget range). This information and the date and time of the appointment are stored by Google and made available to us to prepare and hold the consultation. The call itself takes place via Google Meet; we do not record it.

The legal basis for the booking and the call is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). The legal basis for loading the calendar is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give with the click; you can withdraw it at any time with effect for the future by no longer loading the calendar.

Google may also transfer data to the USA. Google LLC is certified under the EU-US Data Privacy Framework. We delete the appointment data as soon as it is no longer required for the consultation and any resulting order, at the latest after 12 months, unless statutory retention obligations apply. Further information: policies.google.com/privacy.

12c. Virtual try-on using your camera

On some pages you can try a piece of jewellery on virtually. Your browser shows your camera image and places a rendering of the piece on top of it.

Simply opening the page does not activate the camera and transmits no data. Only when you expressly start the try-on does your browser ask for access to your camera.

Your camera image does not leave your device. Hand, face and pose detection runs entirely in your browser. We receive neither the camera image nor any frames from it, and nothing is transmitted to us or to third parties, or stored. If you save a photo of the try-on, your browser stores it locally on your device.

For the detection, your browser loads program components and detection models from jsDelivr (cdn.jsdelivr.net) and Google (storage.googleapis.com, Google LLC, USA) when the try-on starts. This transmits your IP address and technical details about your browser to those providers, and the files may be cached by your browser. No such connection is made before you start the try-on.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give by starting the try-on. You may withdraw it at any time with effect for the future by no longer starting the try-on or by revoking camera access in your browser settings. The transfer to Google may involve data being sent to the USA; Google LLC is certified under the EU-US Data Privacy Framework.

13. No solely automated decision-making by VAN TOL

VAN TOL itself does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning a data subject or similarly significantly affect that person.

Payment service providers may carry out automated fraud, identity, risk or creditworthiness checks as part of their own services. The respective payment service providers are responsible for this processing; further details are provided in their privacy information.

14. Recipients and categories of recipients

Personal data are disclosed only where this is necessary for the purposes stated above or otherwise permitted by law. Recipients may include in particular:

• hosting and infrastructure providers, in particular Vercel;

• shop and checkout service providers, in particular Shopify;

• payment service providers and their banking and processing partners;

• shipping and logistics providers;

• email delivery providers, in particular Resend, if you subscribe to our newsletter or sign up to be notified about an upcoming line;

• manufacturing, production and supply partners where this is necessary for an order or personalisation;

• tax advisers, public authorities, courts or other bodies where a legal obligation or legitimate purpose connected with the establishment, exercise or defence of legal claims exists.

15. Transfers to third countries

Some service providers used by VAN TOL or their subprocessors are located outside the European Economic Area or process data there. This applies in particular to parts of the infrastructure of Vercel and Shopify and – for the newsletter and the waiting list – Resend.

Such a transfer takes place only where the requirements of Arts. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision of the European Commission, a valid certification under a recognised adequacy framework, appropriate Standard Contractual Clauses or another safeguard provided by law.

Information on the transfer mechanisms used in each case can also be found in the privacy and contractual information of the relevant service providers.

16. Retention periods

We retain personal data only for as long as required for the relevant purpose or for as long as statutory retention obligations apply.

Order, invoice and accounting-related data may in particular be retained for the applicable tax and commercial-law retention periods. Under current law, accounting records and invoices generally have to be retained for eight years; certain business records may be subject to six- or ten-year retention periods.

Communication data are generally deleted once the enquiry has been conclusively dealt with and there are no longer any statutory retention, evidentiary or legal-defence reasons for keeping them.

Technical log data are retained only for as long as required for security, error analysis and proper operation, subject to different retention periods applied by the technical service providers used.

17. Data security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. Data transmitted to and from vantol.ch are generally encrypted using TLS/HTTPS.

No internet-based process can guarantee absolute security. Our security measures are therefore reviewed and adjusted within the limits of technical and organisational feasibility.

18. Your rights

Subject to the statutory requirements, data subjects have in particular the following rights:

• right of access to the personal data being processed (Art. 15 GDPR);

• right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);

• right to erasure of personal data (Art. 17 GDPR);

• right to restriction of processing (Art. 18 GDPR);

• right to data portability where the statutory requirements are met (Art. 20 GDPR);

• right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR);

• right to withdraw consent at any time with effect for the future.

To exercise your rights, you can contact info@vantol.ch.

19. Objection to direct marketing

If personal data are used for direct marketing in the future, you may object to such processing at any time. Following an objection, the relevant data will no longer be used for direct marketing.

20. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. Due to VAN TOL's place of business, the following authority is particularly relevant:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany
Email: poststelle@lfdi.bwl.de
Telephone: +49 711 615541-0

21. Changes to this Privacy Policy

We update this Privacy Policy if our processing activities, the services we use or the legal requirements change. Before activating additional analytics, advertising, pixel, newsletter or comparable services, we will in particular assess whether this Policy must be supplemented and whether prior consent is required. The current version published on vantol.ch applies.