Valid from: 01.01.2026
1. Introduction and Controller
This Privacy Policy informs you about the processing of your personal data by Odlo Trading AG in connection with the use of our website odlo.com and our services. We align this policy with the Swiss Federal Act on Data Protection (FADP). We place great importance on transparency and the protection of your privacy.
Controller for data processing:
Odlo Trading AG, Bösch 47, 6331 Hünenberg, Switzerland
Email: datenschutz@odlo.com
2. Data Protection Advisor
We have appointed a Data Protection Advisor in accordance with Art. 10 FADP, who supports us in matters of data protection and serves as a point of contact for data subjects and the supervisory authority. They monitor compliance with data protection regulations and are available to you for concerns regarding your data.
Contact: Data Protection Advisor of Odlo Trading AG, Bösch 476331 Hünenberg, Switzerland,
Email: datenschutz@odlo.com
3. Terms and Legal Bases
In this policy, we use terms such as "Processing," "Personal Data," and "Profiling" according to the definitions in the FADP. By "Processing," we mean any handling of your personal data, regardless of the means and procedures applied, in particular the acquisition, storage, retention, use, modification, disclosure, archiving, deletion, or destruction of data.Legal bases for processing:Insofar as we require justification for the processing of personal data, we rely – unless otherwise stated in individual cases – on the following principles according to Art. 31 FADP:
Performance of contract: The processing is necessary for the initiation or fulfillment of a contract with you (e.g., purchase processing in the online shop, delivery).
Overriding private interest: We process data to safeguard our legitimate interests (e.g., marketing, security, improvement of our services, fraud prevention), provided your fundamental rights do not prevail.
Consent: In certain cases (e.g., for sensitive personal data or high-risk profiling), we obtain your express consent. This can be revoked at any time.
Legal obligation: We are legally obligated to retain or report data (e.g., retention obligations under commercial and tax law).
4. Categories of Personal Data
Depending on the use of our website and our services, we process the following categories of personal data in particular:
Master data (e.g., name, address, contact details, customer number, date of birth)
Contract and order data (e.g., ordered products, delivery and billing addresses, order history, returns)
Communication data (e.g., content of emails or contact forms, correspondence with customer service)
Usage and technical data (e.g., IP address, device and browser information, log data, cookie IDs, settings and interactions on the website)
Marketing and profile data (e.g., newsletter subscriptions and cancellations, interest and segmentation information, results of permissible profiling).
We only process sensitive personal data if this is necessary in individual cases and a corresponding legal basis (in particular your consent or a legal basis) exists.
5. Purposes of Data Processing
We process your personal data for the following purposes to provide you with our services and to constantly improve our offer:
5.1 When visiting our website (Server Logfiles & Cookies)
When accessing our website, technically necessary information (IP address, browser, operating system, timestamp, referrer URL) is temporarily stored in logfiles.Purpose: Ensuring the functionality, security, and stability of the website as well as error analysis.Cookies and similar technologies:We use cookies and similar technologies to improve your user experience.
Necessary Cookies: These are strictly required for the operation of the website (e.g., shopping cart function, login status).
Analysis & Marketing Cookies: We use these to analyze user behavior, perform range measurements, and display personalized advertising.
Legal notice on cookies in Switzerland:According to Art. 45c lit. b of the Telecommunications Act (TCA/FMG), we hereby inform you about the use of cookies and your right to refuse them. The processing of personal data in connection with non-necessary cookies is based on your consent (via our consent management tool / cookie banner) or our overriding interest in optimizing our offer. You can adjust your cookie settings at any time via our consent management tool or deactivate cookies in your browser, restrict them to certain types of cookies, or delete cookies already stored. This may result in certain functions of our website (e.g., shopping cart, login, language settings) being restricted or no longer fully available. Insofar as we use third-party tools (e.g., for web analysis, range measurement, marketing/retargeting, social media, or A/B testing), these providers may use cookies or similar technologies and thereby also process personal data in third countries.
5.2 Contract Fulfillment and Customer Account
For orders in our online shop, we process your master data (name, address, email, phone number), payment data, and order data.Purpose: Fulfillment of the purchase contract, delivery of goods, invoicing, payment processing, and customer service. The creation of a customer account is optional and serves to simplify future orders.You can have your customer account deleted at any time by contacting us or – if technically provided – using the corresponding function in your account. In this case, we delete or anonymize the data associated with the account, provided no legal retention obligations exist or overriding interests (e.g., for the assertion or defense of legal claims) oppose this (cf. Section 8).
5.3 Marketing and Personalization
We process your data to offer you a shopping experience tailored to you ("Profiling").
Newsletter: Dispatch only occurs after your registration (Double-Opt-In). You can unsubscribe at any time via the link in the newsletter.
Product recommendations: As an existing customer, you receive recommendations based on your previous purchases via email. We rely here on our overriding interest in direct marketing. You can object to this processing at any time.
High-Risk Profiling: Should we link data in a way that allows an assessment of essential aspects of your personality (e.g., comprehensive analyses that allow conclusions about your health), we will obtain your express prior consent for this, if legally required.
Automated individual decision: We do not make any automated individual decisions within the meaning of Art. 21 FADP that have legal effects or significantly affect you.
5.4 Credit Check (Purchase on Invoice)
Insofar as we offer the payment method "Purchase on invoice," we transmit data (name, address, date of birth, order amount) to credit agencies for credit checks.Justification: We have an overriding private interest in protecting ourselves against payment defaults. We ensure that no data older than ten years is transmitted and that no sensitive personal data is included. In the event of a negative credit report, we reserve the right to refuse payment on invoice.
6. Disclosure of Data to Third Parties and Abroad
We only pass your data on to third parties if this is necessary for contract fulfillment (e.g., logistics partners, payment service providers), we are legally obligated to do so, or you have consented.
6.1 Processors
We use external service providers (processors) who process data on our behalf (e.g., IT providers, cloud services, marketing tools, customer support). These service providers are contractually obligated to process the data only as we would be allowed to do ourselves and to ensure data security (Art. 9 FADP).
6.2 Disclosure Abroad
We generally process data in Switzerland and the European Economic Area (EEA). However, we may also disclose data to countries outside this area (third countries), particularly the USA, within the framework of using IT services.The disclosure to third countries takes place in compliance with the legal requirements according to Art. 16 and 17 FADP:
Adequate data protection: The Federal Council has determined that an adequate level of data protection exists in the recipient state (Annex 1 Data Protection Ordinance/DSV). This applies, among others, to EEA states and the United Kingdom.
Swiss-US Data Privacy Framework: For recipients in the USA, we primarily rely on the Swiss-US Data Privacy Framework (DPF), provided the recipient is certified under this framework and is listed on the corresponding list of the US Department of Commerce.
Appropriate guarantees: If no adequacy decision exists (e.g., for non-certified US companies or other third countries), we agree on contractual guarantees, in particular the Standard Contractual Clauses of the EU Commission (EU SCCs), supplemented by the annex necessary for Switzerland (Swiss Addendum). Additionally, where necessary, we carry out risk assessments (Transfer Impact Assessments).
7. Data Security
We take appropriate technical and organizational measures (TOMs) to protect your data against loss, manipulation, unauthorized access, and misuse. These measures are based on the state of the art, the nature and scope of the data processing, and the risk to your personality rights (Art. 8 FADP). This includes, among other things, encryption technologies (SSL/TLS), access controls, firewalls, and regular security checks. Our employees and the service providers commissioned by us are bound by confidentiality and may only process personal data according to our instructions and in compliance with applicable data protection regulations.
8. Retention Period
We store your personal data only as long as is necessary for the fulfillment of the respective purposes or as long as legal retention obligations exist. After these periods have expired, the data is deleted or anonymized.The specific retention period is determined in particular by:
The duration of our business relationship or contract processing (including warranty and guarantee periods),
Legal retention and documentation obligations (e.g., from commercial and tax law),
The relevant statutes of limitation within which legal claims can be asserted, as well as
The necessity of retention for evidentiary purposes or to defend against claims.
9. Your Rights (Rights of the Data Subject)
According to the FADP, you as a data subject are entitled to extensive rights that you can assert against us:
Right of access (Art. 25 FADP): You can request information at any time and free of charge as to whether and which personal data we process about you.
Right to data portability (Art. 28 FADP): You have the right to request the data concerning you, which you have provided to us, in a common electronic format or to have it transferred to another controller, provided the processing is automated and based on your consent or a contract.
Right to rectification (Art. 32 FADP): You can request the correction of incorrect or the completion of incomplete data.
Right to erasure: You can request the deletion of your data, provided no legal retention obligations (e.g., 10 years for accounting records in tax law) or overriding interests on our part (e.g., for legal defense) oppose this.
Right to object: You can object to the processing of your data at any time, especially if it is based on an overriding private interest or is carried out for purposes of direct advertising.
Right of withdrawal: Insofar as the processing of your data is based on your consent, you can withdraw this at any time with effect for the future.
To exercise these rights, please contact our Data Protection Advisor in writing or by email: datenschutz@odlo.com. Please note that we may require proof of identity (e.g., a copy of an ID) for identification purposes.
Under legal requirements, we may restrict or refuse the exercise of the aforementioned rights (e.g., if overriding interests of third parties oppose this, legal retention obligations prevent deletion, or we are dependent on certain data to safeguard our own legal claims).
In addition, you have the right to file a report with the Federal Data Protection and Information Commissioner (FDPIC/EDÖB) should you believe that the processing of your personal data violates data protection law.
Contact Supervisory Authority: Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1, 3003 Bern, Switzerland
10. Changes
We reserve the right to adapt this Privacy Policy at any time to align it with new legal requirements, official orders, or changes in our data processing procedures. The current version published on our website shall apply. In the event of material changes, we will inform you in an appropriate manner (e.g., by notice on the website or via email, provided we have a corresponding contact address).