Privacy notice

Responsible company

Scope and controller

This notice describes personal data processing on the 2BFresh website. The company identified above is the controller. Contact us about privacy using the email or postal address shown there. We take account of the Swiss Federal Act on Data Protection (FADP), its ordinance (DPO), and the requirements of the EU GDPR where applicable.

Purposes of processing

We process personal data to provide and secure our website, answer contact inquiries and handle contract-related requests. With your permission, we use visit statistics and performance data to improve our website. The following sections explain the data involved and the applicable legal bases.

Website visits and hosting

Visiting the site involves processing technical connection data, including your IP address, time, requested page, browser information and, where applicable, referring page. This enables delivery of the website, troubleshooting and protection against abuse. Where GDPR applies, the basis is Article 6(1)(f); our legitimate interest is operating a secure and reliable website.

Technical request information, warnings and error messages are logged to operate the site and troubleshoot errors. We use external IT providers for hosting and content delivery. Providers and known processing locations are listed under “Recipients and service providers”.

Contact inquiries

When you contact us, we process your name, email address, message and phone number if you request a callback. We use these details to handle and answer your inquiry. The inquiry is stored in our management system with timestamps and handling and notification statuses, and forwarded by email to the relevant staff. We use the providers listed below for storage, transmission and email communication.

For a contract with you or steps requested before entering a contract, the GDPR basis is Article 6(1)(b). For other inquiries, including those on behalf of a company, the basis is Article 6(1)(f); our legitimate interest is responding to business inquiries. Name, email and message are required for the form; a phone number is required only for a callback. Without these details, the form cannot be submitted or the callback cannot be made. You can also contact us directly.

Images and media

We use external storage and delivery services to display images and other media. Direct requests give the provider technical connection data such as your IP address. The purpose is displaying our content. Where GDPR applies, the basis is Article 6(1)(f); our legitimate interest is operating a functional business website. The providers are listed below.

Fonts

The fonts used are served with our website. Your browser does not connect to Google Fonts to load them.

Cookies, analytics and external links

The protected management area uses necessary login cookies. We store your choice about optional measurements in local browser storage for up to 180 days. If storage is unavailable, the choice applies only to the current page session.

Only with your permission do we load Vercel Web Analytics for visit statistics and Vercel Speed Insights for loading-performance measurements. Data includes visited pages, referring pages, device and browser information and performance metrics. Query parameters and fragments are removed from the measured page URL before sending it. Form entries are not sent as analytics events. The legal basis is your consent under GDPR Article 6(1)(a). Without permission these services are not loaded and the website remains usable. You can change your choice and withdraw consent for the future using “Datenschutzeinstellungen” in the footer.

No advertising pixels are embedded. Links to Google Maps or social networks open external services; maps and social feeds are not embedded. The relevant provider’s privacy information applies after opening its service.

Recipients and service providers

Personal data is made available to relevant staff and external IT providers as necessary for the purposes described. This includes hosting, database operation, media delivery, email communication and optional visit and performance measurements. Further disclosure may occur where we are legally required to do so. The following overview lists the providers or recipient categories and confirmed locations.

We also process authorised staff login and contact data in our protected management system to administer and secure the website (GDPR Article 6(1)(f)).

International transfers

Server regions in Germany have been selected for parts of our infrastructure. Providers may also process data in the USA and other countries, including through their global infrastructure and subprocessors. A selected server region therefore does not necessarily cover every processing location. The exact storage location of email mailboxes and their backups has not yet been confirmed.

Retention

We retain personal data only as long as necessary for the purposes described or to meet statutory retention obligations.

Inquiries in the management system are automatically deleted six months after creation during daily cleanup. Their status and later edits do not extend this period. Email copies are reviewed monthly and deleted no later than six months after the inquiry is closed. These deletions do not cover backups.

Hosting runtime logs are retained for one day on the Vercel Pro plan. This period does not automatically apply to other security and infrastructure logs. Business records subject to statutory retention are handled separately; the accounting records specified in Article 958f of the Swiss Code of Obligations are retained for ten years from the end of the financial year.

Your rights

Subject to applicable law, you may request access to, correction of and deletion of your personal data. Restriction and portability rights also apply where their conditions are met. You may withdraw consent at any time for the future without affecting the lawfulness of processing before withdrawal.

You may object to processing based on legitimate interests on grounds relating to your particular situation, and to direct marketing at any time. Use the contact details above to exercise your rights. We may carry out a proportionate identity check. Under GDPR we normally respond within one month and inform you of any legally permitted extension.

You may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Berne, www.edoeb.admin.ch. Where GDPR applies, you may lodge a complaint with a competent EU/EEA supervisory authority, particularly in the country of your habitual residence, workplace or alleged infringement.

Automated decisions and changes

The reviewed site does not use automated decisions producing legal or similarly significant effects or corresponding profiling. A hidden form field detects simple spam submissions. We update this notice when our services or processing change. The date appears at the top of this page.