Who is responsible for your data
We process personal data under the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP), and, for California residents, the CCPA as amended by the CPRA.
What we collect and why
- Order data - name, delivery and billing address, email, phone. Needed to perform our contract with you. Kept for 30 days.
- Payment data - handled by our payment providers. We never see or store your full card number.
- Account data - only if you choose to create an account. Based on your consent, deleted when you close it.
- Marketing data - your email address, if you opt in. Based on consent; withdraw any time using the unsubscribe link.
- Usage data - pages viewed, device type and approximate location, only if you accept analytics cookies.
- Support messages - kept only as long as needed to handle follow-up questions.
Legal bases
We rely on contract performance (Art. 6(1)(b) GDPR) to take and deliver your order; consent (Art. 6(1)(a)) for marketing, analytics and advertising cookies; legal obligation (Art. 6(1)(c)) for tax and accounting records; and legitimate interests (Art. 6(1)(f)) for fraud prevention and keeping our shop secure.
Who we share it with
We share only what each provider needs to do its job:
- Shopify - shop platform and checkout
- Payment providers - to process your payment securely
- Fulfilment partner and carriers - to pick, pack and deliver your order
- Email and support tools - to send order updates and answer your messages
- Analytics and advertising partners - only with your consent
We do not sell your personal data. Some providers are outside Switzerland and the EEA; those transfers rely on the EU Standard Contractual Clauses or an adequacy decision. Ask us for a copy of the safeguards.
Cookies and tracking
Essential cookies keep your cart and checkout working and need no consent. Analytics and advertising cookies - including the Meta pixel - are set only after you accept them in our cookie banner. You can change or withdraw your choice at any time.
Your rights
You may request access to your data, correction, erasure, restriction of processing and portability, and you may object to processing based on legitimate interests. Where processing rests on consent you can withdraw it at any time, without affecting what was lawful beforehand. Write to us at contactbabycocoon0@gmail.com and we answer within one month.
California residents may additionally request disclosure of the categories of personal information collected and shared, request deletion, and opt out of sharing for cross-context behavioural advertising. We will not discriminate against you for exercising these rights.
You may complain to a supervisory authority - in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or in the EU your national authority.
Children
We sell products for children, but this shop is intended for adult purchasers. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.
Security
Traffic is encrypted with TLS, payment details are handled by PCI-DSS compliant providers, and access to order data is limited to people who need it. No system is perfectly secure; we will notify you and the regulator of any breach where the law requires it.