Skip to content
A-ARTS
DE – Deutsch
← Back

Privacy Policy

Last updated: 12 November 2026

This privacy policy explains which personal data we process when you visit a-arts.ch and use our forms, for what purposes, to whom we disclose it and what rights you have. Personal data means any information relating to an identified or identifiable natural person.

It is based on the Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023). Where the EU General Data Protection Regulation (GDPR) applies, for example because you are in the EU and buy or enquire about a work, the GDPR notes in this policy apply in addition. This English version is provided for convenience; in case of discrepancies, the German version prevails.

1. Controller

The controller responsible for processing personal data on this website is:

A-Arts, sole proprietorship of Alan Arnold (owner: Alan Arnold)
[OFFEN: confirm address – Heuwinkelstrasse 18, 4123 Allschwil, or an address in Basel (the website says "A-Arts, Basel")?]
Switzerland
E-mail: alan.arnold@aa-coaching.ch [OFFEN: separate A-Arts address, e.g. kontakt@a-arts.ch?]

[OFFEN: exact business name, if different from "A-Arts"]

2. Summary

  • We only use Google Analytics if you expressly agree in the cookie notice (see section "Cookies and similar technologies"). Without your consent no analysis takes place. We do not use advertising cookies.
  • Fonts are served from our own server; there are no requests to Google Fonts or similar services.
  • We only process data that is necessary to operate and secure the website and to handle your enquiry or purchase.
  • We do not sell personal data or share it for advertising purposes.
  • We use carefully selected service providers (hosting, database, e-mail delivery, bot protection, backups). Some of them are based in the USA (see sections "Service providers" and "Transfers abroad").

3. Visiting the website (server log data)

When you access this website, our hosting provider Vercel automatically processes technical data transmitted by your browser (server log data):

  • IP address of the requesting device
  • date and time of access
  • page or file requested and amount of data transferred
  • referrer URL (previously visited page), if transmitted
  • browser type and version, operating system

Purpose: delivering the website, ensuring stability and security (e.g. preventing attacks), troubleshooting. This data is not combined with other data and not used for profiling. It is stored only as long as necessary for these purposes and then deleted automatically.

Legal basis (GDPR): legitimate interest in the secure and reliable operation of the website (Art. 6(1)(f) GDPR).

4. Cookies and similar technologies

Apart from Google Analytics, which is only used with your consent (see below), this website sets no tracking, analytics or marketing cookies. On pages with a form, the bot protection Cloudflare Turnstile is loaded (see section "Bot and spam protection"); it serves security purposes only, is technically necessary and is not used for advertising or cross-site tracking.

The password-protected admin area (for the operator only) uses technically necessary session cookies.

You can delete or block cookies in your browser settings at any time.

Google Analytics (only with your consent)

If you click "Accept" in the cookie notice, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (responsible for Switzerland and the EEA), parent company Google LLC, USA. If you click "Decline" or make no choice, Google Analytics is not loaded. Browsers with "Global Privacy Control" enabled are treated as "Decline".

  • Purpose: analysing how our website is used (e.g. pages viewed, time spent, approximate origin by country/region, device type, referring page) in order to improve our content.
  • Data: usage data as above, a random identifier in cookies (_ga, _ga_…) and technical device and browser data. According to Google, Google Analytics 4 does not store IP addresses. Advertising features and "Google Signals" are switched off; we do not combine the data with other data about you.
  • Retention: cookies up to 2 years; analytics data at Google is deleted after 14 months. Your choice in the cookie notice is stored in your browser for 12 months (local storage, not a cookie).
  • Transfers abroad: Google may process data in the USA. Google LLC is certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework (see section "Transfers abroad").
  • Legal basis: your consent (Art. 6(1)(a) GDPR; voluntary consent under the FADP).
  • Withdrawal: you can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer of every page. The Google Analytics cookies are then deleted.

More information: Google Privacy Policy and Safeguarding your data – Google Analytics.

5. Contact form, enquiries and e-mail

When you contact us via the contact or enquiry form (e.g. a price enquiry about a work) or by e-mail, we process:

  • name and e-mail address (required)
  • phone number and subject (optional)
  • the content of your message
  • language, time of the enquiry and your confirmation that you have read this privacy policy
  • for abuse prevention, a hashed form of your IP address (not stored in plain text; see section "Abuse prevention and security")

Purpose: answering and handling your enquiry, preparing a possible purchase.

Form data is stored in our database (Supabase, servers in Zurich, Switzerland) and sent by our e-mail delivery service (Resend). Your enquiry is delivered to Alan Arnold by e-mail. [OFFEN: name the e-mail hosting provider.] By default, the notification to the practitioner contains your contact details and a note that a message exists, but not the text of your message (for enquiries also not the subject); the practitioner reads it in the protected admin area. The message text is only included in the e-mail if the practitioner explicitly enables this. Your own confirmation e-mails contain no message texts.

Retention: we delete enquiries once they have been dealt with and no further contact is expected, at the latest 12 months after the last contact (for backup copies see "Backups"), unless a contract results from the enquiry or statutory retention obligations apply.

Legal basis (GDPR): taking steps prior to or performing a contract (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

6. Purchasing artworks

When you buy a work, we process the data necessary for the contract: name, e-mail address, phone number (optional), delivery and billing address, the work purchased, price, payment and shipping status. We use this data to process the purchase, for shipping or handover and for bookkeeping.

For shipping, we pass your name, delivery address and, if applicable, phone number to the transport company commissioned. [OFFEN: name the shipping provider, e.g. Swiss Post or an art shipping company.] For deliveries abroad, customs authorities may receive information.

Payments are currently made by bank transfer or as individually agreed [OFFEN: confirm payment methods, e.g. bank transfer, TWINT, cash on collection]; no online payment takes place via the website.

Retention: contract and accounting records are kept for 10 years (Art. 958f Swiss Code of Obligations); other data is deleted when no longer needed.

Legal basis (GDPR): performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).

7. Bot and spam protection (Cloudflare Turnstile)

To protect our forms from automated access (bots, spam), we use Cloudflare Turnstile by Cloudflare, Inc., USA. Turnstile uses technical characteristics (including IP address, browser and device information, interaction with the page) to check whether a form is submitted by a human. It works without picture puzzles and is not used for advertising or tracking; according to Cloudflare, the data is used to provide and improve the service.

Its use is technically necessary for the security of the forms. Legal basis (GDPR): legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). More information: Cloudflare Privacy Policy.

8. Abuse prevention and security

To prevent abuse (e.g. spam), we limit the number of requests per time period. For this purpose we do not store your IP address in plain text, only as an irreversible hash value combined with a secret key. These entries are deleted after a short time, at the latest after 30 days.

The website is transmitted exclusively in encrypted form (HTTPS). We take appropriate technical and organisational measures to protect your data against unauthorised access, loss and misuse, including access restrictions, login to the admin area only with a password and a second factor (two-factor authentication), logging of changes, data minimisation and nightly encrypted backups.

9. Backups

To prevent data loss, we create an encrypted backup copy of the database (including enquiries) and of stored files every night. The backup is created automatically via GitHub Actions and stored in encrypted form with Cloudflare R2; without the secret key, which only we hold, the backups cannot be read.

Backup retention: daily backups for 30 days, plus one monthly snapshot each for 12 months. After that, backups are deleted automatically. This means that data we have deleted in the live system may still be contained in an encrypted backup for up to 12 months. It will not be restored from there except to remedy a data loss – in that case we immediately delete previously deleted data again.

Legal basis (GDPR): legitimate interest in data security and availability (Art. 6(1)(f), Art. 32 GDPR).

10. Service providers (processors)

We use the following service providers, who process personal data on our behalf and according to our instructions. Data processing agreements are in place with them:

  • Hosting: Vercel Inc., USA – delivery of the website, server log data. Location: USA and global server network.
  • Database: Supabase, Inc., USA – storage of enquiries. Location: servers in Zurich (Switzerland); support access by the provider from third countries is possible.
  • Content and images: Supabase, Inc., USA (Supabase Storage) – storage of website content, artworks and images, login of Alan Arnold to the admin area. Location: as database (Zurich, Switzerland).
  • Backups: Cloudflare, Inc., USA (Cloudflare R2) – encrypted nightly backups of the database (including enquiries) and files. Location: EU (Cloudflare R2 EU jurisdiction).
  • Running the backups: GitHub, Inc. (Microsoft), USA (GitHub Actions) – automated creation and testing of backups; data is processed only temporarily and encrypted before storage. Location: USA.
  • E-mail delivery: Resend (Plus Five Five, Inc.), USA – sending notification e-mails. Location: USA.
  • Bot protection: Cloudflare, Inc., USA – protection of forms (Turnstile). Location: USA and global server network.
  • Web analytics (only with consent): Google Ireland Limited, Ireland / Google LLC, USA – Google Analytics. Location: EU and USA.

In addition, the web designer we have commissioned may have technical access to these systems for maintenance and support and is bound to confidentiality. [OFFEN: name of the web designer/agency and data processing agreement.]

Other recipients are only involved where necessary to perform the contract (e.g. shipping company, fiduciary/accounting) or where we are legally obliged to disclose data.

11. Transfers abroad

Some of the service providers listed are based in the USA or may process data there. Under Swiss law, the USA only offers an adequate level of data protection if the receiving company is certified under the Swiss-U.S. Data Privacy Framework (adequacy decision of the Swiss Federal Council, in force since 15 September 2024; for the EU, the EU-U.S. Data Privacy Framework). Where a provider is certified, we rely on this. Otherwise, transfers are based on the European Commission's Standard Contractual Clauses, recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) and included in the data processing agreements (Art. 16(2) FADP, Art. 46 GDPR).

The database containing enquiries and artworks is located in Switzerland (Zurich). The encrypted backups are stored in the EU; Switzerland recognises EU member states as providing adequate data protection.

12. Your rights

Under applicable data protection law, you have in particular the following rights:

  • access to the personal data we process about you (Art. 25 FADP, Art. 15 GDPR)
  • rectification of inaccurate data (Art. 32 FADP, Art. 16 GDPR)
  • erasure of your data, unless statutory retention obligations apply (Art. 32 FADP, Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • objection to processing based on our legitimate interest (Art. 30(2)(b) FADP, Art. 21 GDPR)
  • data portability, i.e. receiving your data in a common electronic format (Art. 28 FADP, Art. 20 GDPR)
  • withdrawal of consent with effect for the future

Please send your request to: alan.arnold@aa-coaching.ch [OFFEN: A-Arts address]. We may ask for appropriate proof of identity. We generally respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch; in the EU with the data protection authority of your place of residence or work.

13. No automated decisions

We do not make automated individual decisions. Apart from statistical analysis with Google Analytics (only with your consent, pseudonymised) we do not create profiles. The automatic check by the bot protection and the request limits serve security purposes only.

14. Changes

We may update this privacy policy if our data processing or the legal situation changes. The version published on this website applies.

Last updated: 12 November 2026