Privacy policy

The controller within the meaning of the Federal Act on Data Protection (FADP) is:

For any question about your data, write to info@carnetevasion.ch. We reply ourselves: there is no intermediary service.

We only ask for what an order needs in order to go through.

• Your order — name, delivery address, email, phone. Without this information, the parcel does not leave and the confirmation does not arrive.
• The content of your personalisations — a name, a date, a quote, a message. This is what we engrave or print: we must keep it while making the piece, and afterwards so that we can remake it if it turns out to be defective.
• Your payment — we only see its amount and status. No card data passes through or is stored on our site: it is entered at Stripe.
• Your messages — what you write in the contact form, so that we can reply to you.
• Your newsletter subscription, if you ask for it, and only in that case.
• Your customer area, if you open one — your email address, and what you save there yourself: name, phone, delivery addresses. We store no password, since there is none: you sign in with a link sent to your address, valid for fifteen minutes and only once.

This processing serves to perform the contract you conclude with us, to meet our accounting obligations, and to reply to you. The newsletter is based on your consent, which you can withdraw at any time.

We neither sell nor rent your data. We do not use it for targeted advertising. We do not build any behavioural profile.

The site sets no advertising cookies or trackers. We use neither Google Analytics, nor social network pixels, nor any equivalent, and no browsing data goes to a third party.

We do, however, count page views, with our own counter: the time, the page address and, for the first page of a visit only, the domain name you came from, the type of device (mobile, tablet or computer) and the language of your browser — nothing else. No IP address, no browser fingerprint, no identifier: no page view is linked to another one, or to you. These figures are added up by hour and by day, and the minute-by-minute record is deleted after two days: they tell us which creations are of interest and when, never who looked at them. That is why they require neither consent nor a banner — there is nothing personal to consent to.

Your basket is kept in your browser, using local storage. It is never sent to us until you place an order, and emptying it is enough to delete it.

If you sign in to your customer area, we set a signed session cookie, valid for thirty days. It is only used to recognise you from one page to the next and tracks nothing of your browsing. The “Sign out” button deletes it.

When you go to the payment page, Stripe sets its own cookies, needed for the payment to work and to detect fraud. They are covered by Stripe's privacy policy.

Only to the providers without whom the order cannot go through. Each receives only the part that concerns it, and none is allowed to use it for its own purposes.

• Stripe (Ireland and United States) — collecting payment, collecting the delivery address, fighting fraud.
• Sanity (United States, European hosting available) — recording orders and their content.
• Infomaniak (Switzerland) — sending confirmation and tracking emails.
• Swiss Post — delivery of the parcel, with the recipient's name and address.

Some of these providers are based outside Switzerland. Transfers to the United States rely on the contractual safeguards provided for by Art. 16 FADP. Transfers to the European Union benefit from protection recognised as adequate by the Federal Council.

We may also be required to disclose data to an authority when the law requires it.

• Orders and invoices — ten years, the retention period imposed on accounting records by Art. 958f CO.
• Contact form messages — two years after the last exchange.
• Newsletter subscription — until you unsubscribe.

The FADP gives you the right to know what data we hold about you, to obtain a copy, to have it corrected if it is inaccurate, to ask for it to be deleted, and to object to certain processing.

One honest limit: we cannot delete the data on an invoice before the end of the legal retention period. Everything else can be deleted.

A request to info@carnetevasion.ch is enough, and it is free. We may ask you to prove your identity, to avoid disclosing your data to someone else. We reply within thirty days.

If our reply does not satisfy you, you may refer the matter to the Federal Data Protection and Information Commissioner (FDPIC) in Bern.

Exchanges with the site are encrypted. Payments are processed by a PCI-DSS certified provider, and no bank data reaches us. Access to orders is restricted to the people who make and ship them.

No system is infallible. If a breach of the security of your data posed a high risk to you, we would inform you and the FDPIC, as required by Art. 24 FADP.

This policy may change along with the site. The date of the last update appears at the bottom of the page. A substantial change will be notified to you, and will never apply retroactively to an order already placed.

The terms of sale are set out in our general terms and conditions.