Privacy Policy

The controller responsible for data processing within the meaning of the FADP is:

MrBrunch AG, Unterrohrstrasse 3, 8952 Schlieren, Switzerland

Email: info@mrbrunch.ch · Phone: +41 44 244 80 90 · UID: CHE-159.354.843

For any privacy-related requests, you can reach us at info@mrbrunch.ch.

This privacy policy applies to the use of our website, to orders placed in our online shop and to the further services described here. We process personal data in accordance with the principles of the FADP: lawfully, proportionately, for specified purposes and transparently.

You are not obliged to provide us with personal data. However, without certain information (e.g. delivery and billing address or email address) we cannot fulfil orders or offer certain website features.

A separate, internal privacy notice additionally applies to employees of MrBrunch AG.

When you create a customer account, we process the data you provide: email address, name, optionally your phone number, and your password (stored exclusively as an encrypted hash). You can optionally enable two-factor authentication.

When you order without registering (guest checkout), we also create a customer record with the data entered at checkout in order to process the order. No login is created in this case.

In your account we additionally store your order history, saved addresses and your language preference.

To process your order we handle:

• Delivery and billing address (name, company, street, postal code, city, phone, email)
• Geo-coordinates of the delivery address for delivery planning, determined via the Google Places address search
• Order contents, delivery date and time slot, number of people, comments, tip
• Payment status and payment method (payment itself is processed by Stripe, see section 10)

Address details are stored as a snapshot within the order so that receipts and delivery documents remain correct later on. For subscription orders (recurring deliveries) we additionally store the delivery frequency and the next delivery date.

We need this data to perform the contract, for delivery, invoicing and the statutory retention of business records.

If you order a voucher or greeting card for another person, we process the recipient data you provide (name, email address, personal message) solely to create and deliver the voucher or greeting card.

Please only provide data of persons who agree to this. As the person placing the order, you are responsible for informing the recipient.

For quote requests we process your contact details (name, email, phone), event details (date, number of people, location, requested services) and any files you upload. We also record whether a quote sent to you has been opened via its personal link so we can track its status.

For business customers we process the company name, billing and contact details, information on contact persons and commercial terms (e.g. collective billing, discounts).

To manage business relationships, we keep internal notes on enquiries, conversations and prospects. These serve customer care and sales.

If you contact us via a form, by email or by phone, or request a callback, we process your details (name, contact details, content of the enquiry) to respond to your request.

We use Google reCAPTCHA to protect our forms from abuse (see section 16).

On your first visit, a cookie banner asks for your consent to analytics and advertising cookies. We use technically necessary cookies without consent. You can change or withdraw your choice at any time via the "Cookie Settings" link in the website footer.

Payments are processed by Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe Inc., USA). Your email address, the order amount and the order items are transferred to Stripe. You enter your card or payment details directly with Stripe; we do not receive or store full card details.

Stripe uses its own fraud prevention checks and processes device and connection data for this purpose. Further information can be found in Stripe's privacy policy.

For deliveries we use the logistics platform Onfleet (Onfleet Inc., USA). Name, phone number, delivery address including coordinates, delivery notes and the ordered items are transferred to Onfleet so that our delivery team can complete the delivery.

We use the Google Distance Matrix (Google) to calculate delivery distances. If you use the location feature in the address input field, your device coordinates are transferred to the Nominatim map service of the OpenStreetMap Foundation to determine your address.

We use Bexio (Bexio AG, Switzerland) for accounting and invoicing. Contact and billing data of customers and business customers as well as invoice line items are transferred there.

We retain accounting-relevant records for 10 years in accordance with the statutory requirements of the Swiss Code of Obligations.

We store images and files (e.g. profile pictures, file attachments to quote requests, application documents) with the media service Cloudinary (Cloudinary Ltd., USA/Israel). Confidential documents are stored with access protection and can only be retrieved via signed, time-limited links.

Our website is operated on Vercel Inc. (USA). When you visit the website, connection data (IP address, date and time, page accessed, browser information) is processed in server logs for technical reasons.

• Database: Prisma Postgres with Prisma Accelerate (Prisma Data Inc., USA/EU) for storing the data described in this policy
• Upstash Redis (Upstash Inc., USA): short-lived technical keys based on the IP address to limit requests (rate limiting)
• Cloudflare Inc. (USA): DNS and domain protection

We protect your data with technical and organisational measures, including transport encryption (TLS), role-based access restrictions and two-factor authentication for administrative access.

• Google reCAPTCHA (Google): protects forms from automated abuse; IP address and device information are transferred to Google
• Security logs of login events (including IP address and browser information), automatically deleted after 90 days
• Logs of failed login attempts, automatically deleted after 7 days
• Rate limiting to prevent abuse (short-lived, IP-based counters)

If you apply via our application form, we process your details (personal data, contact details, availability, experience, motivation) and uploaded documents (e.g. CV, identity documents, work permit, bank details) solely to assess your application and to prepare a possible employment. Documents are stored with access protection (see section 14).

On our About page we also embed open positions via a widget from JOIN (JOIN Solutions AG). If you apply via JOIN, their privacy policy additionally applies.

After hiring, a separate internal privacy notice applies to employees, describing all personnel-related processing within the employment relationship.

For consultation appointments we sometimes link to Calendly (Calendly LLC, USA). Data processing during appointment booking is carried out directly by Calendly in accordance with their privacy policy.

On some pages we embed videos from YouTube (Google) in extended privacy mode (youtube-nocookie.com). When you play a video, data is transferred to Google.

Some of the service providers mentioned process personal data outside Switzerland, in particular in the EU and the USA. The EU and the EEA provide an adequate level of data protection within the meaning of the FADP.

For transfers to the USA, we rely on the Swiss-U.S. Data Privacy Framework where the provider is certified, and otherwise on the standard contractual clauses of the EU Commission (with the adaptations required for Switzerland) as appropriate safeguards within the meaning of Art. 16 para. 2 FADP.

We retain personal data only as long as necessary for the stated purposes or as required by statutory retention obligations. In particular:

• Accounting-relevant records (orders, invoices): 10 years (Swiss Code of Obligations)
• Security and login logs: 90 days
• Chat assistant conversation histories: 90 days
• WhatsApp conversations: 2 years after the last message
• Email sending logs and logs of failed logins: 7 days
• Email sending logs with open and click measurement: 365 days, without the email content (which is removed after 7 days)
• Customer account: until deletion or deactivation of the account
• Application documents: for the duration of the application process; upon hiring they become part of the personnel file

You can deactivate your customer account yourself in your profile settings or ask us to delete it at info@mrbrunch.ch. Statutory retention obligations remain reserved.

Under the FADP you have in particular the following rights:

• Information on whether and which personal data we process about you (Art. 25 FADP)
• Correction of inaccurate personal data
• Deletion of your personal data, unless retention obligations prevent this
• Delivery of the personal data you provided to us in a common electronic format (Art. 28 FADP)
• Objection to processing, in particular to marketing communication

To exercise these rights, contact info@mrbrunch.ch. We may request proof of identity to process your request. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).

We may amend this privacy policy at any time, for example when our services or the service providers we use change. The version published on the website applies.