Privacy policy
GORPED / CUSTOMER CARE
What we collect, why we need it and the choices you have.
Updated 10 September 2026
Who is responsible
Saftladen GmbH, Birkenstrasse 47, 6343 Risch-Rotkreuz, Switzerland is responsible for personal information processed to run the GORPED store. For privacy questions or a request concerning your information, email office@gorped.com or write to the address above.
This policy covers gorped.com, our Shopify checkout, order support, reviews and product waitlists. Third-party websites you choose to visit have their own privacy policies.
Orders, payments & support
We use your name, contact information, billing and shipping addresses, chosen products, order history, payment status, delivery information and correspondence to take and fulfil orders, process returns and answer questions. Shopify and payment providers process payment details; we do not receive your full card number.
Order tracking uses the order number and checkout email you enter to retrieve the corresponding delivery information. The contact form prepares an email draft in your email application; we receive its contents when you send it.
Where the GDPR applies, this processing is necessary to enter into or perform a contract, comply with legal obligations, or pursue our legitimate interests in support, fraud prevention and resolving disputes.
Website operation & security
Our hosting and commerce providers process connection information such as IP address, request time, requested page and browser information to deliver the website, maintain security and diagnose errors. Our submission endpoints use short-lived, keyed network identifiers to limit abuse. These are not used to build advertising profiles.
We remember cart contents and choices you make, such as delivery country, appearance and cookie preferences, so the functions you request work. The Cookie policy gives storage details. Where the GDPR applies, our bases are contract necessity or legitimate interests in providing and protecting the service, together with the applicable rules on device storage.
Visit totals without tracking cookies
We count visits and page views using a separate system that does not set a visitor identifier or read analytics cookies. It records totals by page, broad traffic source, country and device category. Country and device category are derived from connection information; raw IP addresses are not stored in the statistics records.
These counters do not recognise a person across visits, link activity to a customer or order, or provide an individual browsing history. Short-lived network rate-limit keys are used only to prevent abuse. Daily statistical totals are retained for up to 400 days.
We use these totals to understand and improve the store. You can turn this measurement off in Cookie settings under “Anonymous statistics”. Where personal information is temporarily processed for this purpose, we rely on our legitimate interest in measuring the use of our own service, subject to the applicable legal conditions.
Analytics you can choose
Only if you allow analytics, GORPED and Shopify use browser identifiers to connect visits, campaign links, product views, cart activity and purchases. This helps us understand conversion rates and which sources bring customers to the store.
Our first-party browser record lasts up to 30 days and remembers the first and most recent traffic source and landing page. Its random identifier lets our analytics service calculate the observed visit sequence during that period. A session restarts after 30 minutes of inactivity or a qualifying new campaign. With consent, we may attach attribution and visit-sequence information to a Shopify order. It is not an exact lifetime count of a customer’s visits across all devices.
Pseudonymous session records in our analytics store expire after 90 days. Statistical aggregates and minimal paid-order measurement records are retained for up to 400 days. The attribution attached to an order remains part of that order record. Shopify’s analytics retention is described in its cookie information and privacy policy.
Consent is the GDPR basis for this optional measurement. Rejecting or withdrawing consent stops new optional tracking; it does not automatically erase previous lawful records. You can also request deletion, subject to legal retention duties.
Reviews, photos & waitlists
For a submitted review, we receive the display name, email, country, product and colour, rating and text you provide. We use the email to manage the submission and prevent abuse; it is not displayed publicly. Reviews are stored for moderation and, if approved, publication. Photos separately supplied for publication may appear with a review. Please only supply images you have permission to share.
We process review submissions on the basis of your request to publish them and our legitimate interests in moderation and customer feedback. You can ask us to correct or remove a submission or photo.
If you join a product waitlist, we store your email, the product and the record of your sign-up consent to send the update you requested. This is separate from analytics permission and does not subscribe you to unrelated marketing. You can withdraw that consent by emailing office@gorped.com. Waitlist and review records are kept while needed for their stated purpose, subject to a removal request and any legal need to preserve evidence.
Who receives information
- Shopify: product catalogue, checkout, orders, payments-related services and optional commerce analytics.
- Vercel: website and API hosting, delivery and operational security.
- Upstash: hosted storage used for reviews, waitlists, measurement records and rate limiting.
- Payment, fulfilment, carrier and email providers: the information needed to process payments, deliver orders and handle messages.
- Professional advisers or authorities: where necessary for accounting, legal claims or compliance with a legal obligation.
Providers receive information only as needed for the relevant service, subject to their role and applicable terms. Some, including payment providers and Shopify for certain services, also act as independent controllers. See Shopify, Vercel and Upstash for their privacy information.
We do not sell customer information for money. Optional analytics permission does not authorise advertising pixels. Shopify’s separate use of data for enhanced services is explained below; it may constitute sharing or targeted advertising under applicable US laws. Links to social platforms do not by themselves authorise those platforms to track you on our store.
Shopify & enhanced services
Shopify hosts our commerce platform and checkout; Vercel hosts the storefront. Shopify processes information about visits and purchases to provide these services. Shopify Network Intelligence is enabled. It can combine customer information from our store with interactions at other merchants and Shopify to support security, service improvement, personalisation and advertising, subject to the applicable privacy choices.
For these enhanced services, Shopify acts as an independent controller. Information may be processed by Shopify and its partners outside your country. See Shopify’s Consumer Privacy Policy for its purposes, legal bases and recipients.
Our banner’s analytics choice does not grant marketing or data-sharing permission; we send those permissions as off. You can also use the Shopify data-sharing opt-out form, email office@gorped.com, or visit Shopify’s privacy portal to object, withdraw applicable consent or exercise rights concerning Shopify’s processing.
International processing
Service providers may process information outside Switzerland or your country, including in the EEA, Canada and the United States. The applicable transfer mechanism depends on the recipient and destination.
Where required, transfers must be covered by an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses with the necessary Swiss or UK adaptations. Contact office@gorped.com for information about the safeguards relevant to your data. We do not treat optional cookie consent as a general waiver of international-transfer requirements.
How long we keep information
We keep information for the purpose for which it was collected and for applicable legal obligations. Order, invoice and accounting records are generally retained for 10 years where Swiss accounting law requires this. Legal claims or another applicable obligation may require a different period.
Support correspondence is kept while needed to resolve the matter and document relevant rights or obligations. Published reviews and supplied photos remain while used for that purpose, unless removed; related moderation records are kept as needed to manage the submission or a dispute. Waitlist records remain while needed for the requested update or to document consent or an opt-out.
The specific analytics periods are stated above. Browser storage periods are listed in the Cookie policy. Deleting browser storage does not itself delete an order or a server record.
Your rights
Depending on applicable law, you can request access to your personal information, correction, deletion, restriction of processing or a portable copy. You can object to processing based on legitimate interests and withdraw consent at any time without affecting the lawfulness of earlier processing. Mandatory records may need to be retained.
Email office@gorped.com to exercise a right. We may request proportionate information to verify your identity. We respond within applicable legal deadlines; we do not require you to create an account or pay a fee for an ordinary request.
Where US state privacy laws apply, you may also request the relevant access, correction, deletion and opt-out rights and appeal a refusal by contacting us. We do not discriminate against you for exercising a privacy right. Global Privacy Control signals opt out of sale or sharing through Shopify where applicable. The data-sharing controls above and Your privacy choices provide ways to exercise this right. An analytics opt-in does not override an advertising opt-out.
You may complain to the Swiss Federal Data Protection and Information Commissioner, an EEA supervisory authority, the UK Information Commissioner, or another competent authority. You do not have to contact us first.
Children & policy updates
The store is intended for people able to make a purchase themselves or with the appropriate permission. We do not knowingly solicit personal information from children for marketing. Contact us if a child has submitted information that should be removed.
We may update this policy when the service or our data practices change. The date above identifies this version. A policy update does not give us consent for a new optional tracking purpose.
To change optional analytics and anonymous statistics, open Cookie settings on gorped.com. For requests about your information, email office@gorped.com.