Privacy policy

Introduction

Protecting your privacy and the security of all personal data is of paramount importance to us – Ofrex AG, Rohrstrasse 44, 8152 Glattbrugg, Switzerland (“Ofrex”, “we”, “us”). This Privacy Policy explains which personal data we collect, why we need it, how we process it, and what rights you have. We process your personal data in accordance with the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), and any other applicable laws.

Scope and Controller

This Privacy Policy applies to all digital offerings of Ofrex, in particular to our website and online shop at ofrex.ch and all sub-domains, our telephone ordering and support hotline, and all related content, features, services, and communication channels.

Controller within the meaning of data protection laws is Ofrex AG. For questions or concerns, please contact us at:

Ofrex AG, Privacy, Rohrstrasse 44, CH-8152 Glattbrugg
E-mail: privacy@ofrex.ch, Tel.: +41 (0)44 809 65 00

Where, in exceptional cases, other companies decide independently or jointly with Ofrex on the purposes and means of processing – for example Shopify Inc.; see Sec. 6.1 – they are also deemed (joint) controllers.

Definitions

Personal data means any information relating to an identified or identifiable natural person. Processing means any operation performed on personal data, such as collection, storage, use, disclosure, or deletion. Processors are third parties that process personal data on our behalf and according to our instructions. Further terms follow Art. 5 FADP and Art. 4 GDPR.

What personal data do we process?

Categories of data

In particular, we process the following categories of data:

• Master data such as name, salutation, customer number, date of birth, contact and delivery addresses, e-mail address and telephone number;
• Contract and transaction data such as purchased or returned items, payment method, billing and delivery information, as well as service and warranty requests;
• Account information such as username, hashed password, language settings, wish lists and carts;
• Communication data from e-mails, chats, support tickets and, where applicable, telephone or video recordings (about which we will inform you in advance);
• Usage and device data such as IP address, browser and device information, log files, time and location data, and cookie identifiers;
• Preference data derived from analyses, e.g., interests, buying preferences and affinities;
• Application data such as CVs, certificates, references and related correspondence; and
• Special category data (e.g., health information) only if you voluntarily provide it (for example during recruitment).

Sources of data

We receive the above data

• directly from you when you create an account, make a purchase or communicate with us;
• automatically through cookies, log files and similar technologies when you use our website or apps;
• from service providers and partners, e.g., payment or shipping providers and credit rating agencies; and
• from publicly available sources such as commercial or criminal registers, media and the internet.

Purposes and legal bases of processing

We process your personal data for the following purposes:

1. Provision and operation of our services: including order, payment and delivery processing, account management and customer support. Processing is carried out as necessary for contract performance or to take steps prior to entering into a contract.
2. Personalisation and improvement: to adapt our website, generate product recommendations and optimise internal processes. Legal basis is our legitimate interest in tailoring and continuously improving our offering.
3. Marketing and advertising: we inform you via newsletter, print mailings or online advertising. This is based on your consent or our legitimate interest in direct marketing; you may object at any time.
4. Security, fraud and abuse prevention: including authentication, fraud detection and general IT security measures. We rely on legal obligations or our legitimate interest in protecting our company and our customers.
5. Compliance with legal obligations: to meet statutory retention, documentation or reporting duties, e.g., tax or anti-money-laundering requirements.
6. Recruitment and HR processes: to decide on the establishment of an employment relationship; legal basis is pre-contractual steps and/or your consent.

Specific constellations

Shopify

Our online shop runs on the Shopify platform (Shopify International Ltd., Ireland; parent company Shopify Inc., Canada/USA). Shopify acts as hosting and e-commerce provider and may process certain data under its own responsibility, e.g., for fraud prevention or platform-wide analysis of purchasing behaviour. Shopify is the controller for such processing. For details, see Shopify’s consumer privacy policy at https://privacy.shopify.com.

Google Cloud Platform (GCP)

We operate our primary data warehouse on Google Cloud Platform (GCP). Storage takes place in data centres within the EU or Switzerland. Where a transfer to third countries outside the EEA is necessary in individual cases, we rely on Standard Contractual Clauses or comparable safeguards under Art. 16 FADP / Art. 46 GDPR.

Disclosure and transfer of data

• Within the Ofrex group, only those units receive access that need it to fulfil contractual obligations or legitimate interests, e.g., IT services, accounting or customer service.
• Processors such as hosting, shipping, payment, marketing or collection service providers process data solely under our instructions and based on a data processing agreement.
• Other third parties receive data only
  • with your explicit consent,
  • where required for contract performance (e.g., logistics partners),
  • where we are under a legal obligation, or
  • where we need to enforce claims or defend against claims.
• International transfers are made only with an adequate level of protection via adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules or comparable safeguards. You may request a copy at privacy@ofrex.ch.

Cookies, tracking and profiling

We use cookies and similar technologies to

• ensure the basic functionality of our online shop,
• analyse usage and performance of our website (e.g., via Google Analytics with IP anonymisation),
• offer enhanced convenience features, and
• display interest-based advertising to you.

You can disable non-essential cookies at any time via the cookie settings on our website or in your browser. See our cookie policy for details.

To better tailor our offerings, we analyse usage and transaction data to derive preferences and interests. Automated profiling does not result in decisions producing legal effects concerning you or similarly significantly affecting you.

Data security

We implement appropriate technical and organisational measures – such as TLS encryption, access controls, pseudonymisation and regular backups – to protect your data against loss, misuse or unauthorised access. Absolute security cannot be guaranteed.

Retention periods

We store your personal data only as long as necessary for the respective purpose, as long as we have a legitimate interest in retention (e.g., to assert or defend claims), or where statutory retention obligations apply. After these periods, data will be deleted or anonymised.

Your rights

Subject to statutory exceptions, you have the right to access, rectification, erasure or restriction of processing, to object to certain processing (notably direct marketing), to data portability, and to withdraw consent at any time. To exercise your rights, simply contact privacy@ofrex.ch. You also have the right to lodge a complaint with a competent data protection authority.

Children’s data

Our services are not directed to persons under 16 years of age. We do not knowingly collect data from minors without parental consent. If we become aware of such data, we will delete it without delay.

Third-party services and links

Our website may contain links to external sites. We are not responsible for their content or privacy practices. Please review the respective provider’s privacy policies.

Changes to this Privacy Policy

We may amend this Privacy Policy at any time, for example to reflect changes in law or business processes. The current version is available at ofrex.ch/privacy. For material changes, we will inform you appropriately, e.g., by e-mail or a notice on our website.

Last updated: 5 August 2025