1. Overview and Scope

This privacy policy informs you which personal data we process when you visit this website, for what purpose, and what rights you have.

Personal data is any information relating to an identified or identifiable natural person. “Processing” includes any handling of personal data, regardless of the means and procedures used — in particular collecting, storing, using, disclosing and destroying. The terms “Bearbeitung” (Swiss law) and “Verarbeitung” (European law) are used synonymously below.

As a company based in Switzerland, the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO) are authoritative for us.

Since we also offer our goods and services to individuals in the European Union and the European Economic Area and evaluate the usage behaviour of visitors from this area, the General Data Protection Regulation (GDPR) also applies to these processing operations (Art. 3 para. 2 GDPR). Where the two sets of regulations differ, we adhere to the stricter requirement. Information that applies exclusively to one of the two regimes is marked accordingly.

For visitors from Germany, Section 25 of the Telecommunications-Digital Services Data Protection Act (TDDDG) additionally applies to the storage of information on your end device and access thereto.

2. Controller, Representative and Contact

The controller responsible for processing personal data on this website is:

Dr. TRETTER AG
Schaffhauserstrasse 96
8222 Beringen
Switzerland

Email: info@tretter.ch
Phone: +41 52 670 06 10

The controller is the person who, alone or jointly with others, decides on the purpose and means of processing.

2.1 Data Protection Advisor / Data Protection Officer

We are not obliged to appoint a data protection advisor or data protection officer under Art. 37 GDPR or Art. 10 FADP. For all data protection concerns, please contact the address specified under Section 2.

3. Principles of our data processing

We process personal data in good faith, proportionately, transparently, and for a specific purpose. We collect data only for a specific purpose identifiable to you and do not process it in a manner incompatible with that purpose. We limit ourselves to the extent necessary for the respective purpose and keep the data accurate and up-to-date.

Where we obtain your consent for a specific processing operation — for example, for analytics services or the newsletter — this is explicitly noted below. You can revoke any given consent at any time with effect for the future; the lawfulness of the processing carried out up to the point of revocation remains unaffected.

4. Legal Bases

Under Swiss law, as a private company, we do not require a specific legal basis for processing, as long as we comply with the principles under Section 3 and there is no violation of personal rights.

Insofar as the GDPR is applicable, we rely on the following legal bases:

• Art. 6 para. 1 lit. a GDPR (Consent) — Analytics services, non-essential cookies, newsletter dispatch and its evaluation.
• Art. 6 para. 1 lit. b GDPR (Contract or pre-contractual measures) — Processing of enquiries related to a contract or an offer, as well as the processing of orders.
• Art. 6 para. 1 lit. c GDPR (Legal obligation) — Compliance with statutory retention and documentation obligations.
• Art. 6 para. 1 lit. f GDPR (Legitimate interests) — Secure and trouble-free operation of the website, defence against attacks, answering general enquiries, assertion and defence of legal claims.

The applicable basis for each individual processing operation is stated in the respective section.

5. Your Rights

You have the following rights under the FADP and — where applicable — under the GDPR, in particular:

• Right of access (Art. 25 FADP / Art. 15 GDPR): You can request information at any time as to whether and which personal data we process about you. Upon request, we will provide you with a copy of the processed data.
• Rectification (Art. 32 FADP / Art. 16 GDPR): You can request that inaccurate personal data be rectified or incomplete data be completed.
• Erasure or destruction (Art. 32 FADP / Art. 17 GDPR): You can request the erasure or destruction of your personal data, provided there are no statutory retention obligations or overriding interests to the contrary.
• Restriction of processing (Art. 18 GDPR): You can request that processing be restricted, for example, while we verify the accuracy of disputed data.
• Data portability (Art. 28 FADP / Art. 20 GDPR): You can request that we provide you with personal data that you have disclosed to us in a common electronic format or transfer it to another controller.
• Objection (Art. 30 FADP / Art. 21 GDPR): You can object to a specific processing operation — see the separate notice below.
• Withdrawal of consent (Art. 7 para. 3 GDPR): possible at any time, with effect for the future.

To exercise these rights, an informal notification to the address stated in section 2 is sufficient. We may request suitable evidence to verify your identity. The exercise of your rights is generally free of charge for you.

5.1 Note on your right to object under Art. 21 GDPR

Insofar as we process personal data on the basis of legitimate interests (Art. 6 para. 1 lit. f GDPR), you have the right to object to this processing at any time for reasons arising from your particular situation. We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

If your personal data is processed for direct marketing purposes, you can object at any time and without stating reasons. Your data will then no longer be used for this purpose.

5.2 Complaint to a supervisory authority

You can contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, at any time.

Data subjects in the EU/EEA also have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement.

6. Hosting

We host the content of this website with:

ALL-INKL.COM – Neue Medien Münnich
Owner: René Münnich
Hauptstrasse 68
02742 Friedersdorf
Germany

The provider processes the data collected on this website as a processor exclusively according to our instructions. A data processing agreement exists in accordance with Art. 9 FADP and Art. 28 GDPR.

The legal basis is our legitimate interest in a secure and efficient provision of this website (Art. 6 para. 1 lit. f GDPR). For disclosure abroad, see Section 10.

7. Data processing when visiting our website

7.1 Server log files

When you access our website, the hosting provider automatically collects the following information:

• Browser type and browser version
• operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is used to ensure the secure and trouble-free operation of the website and to defend against attacks. It is not combined with other data sources.

Legal basis: legitimate interest in the technically flawless and secure operation of the website (Art. 6 para. 1 lit. f GDPR).

Retention period: 30 days.

7.2 Cookies and storage on your end device

This website uses cookies and comparable technologies. Cookies are small text files that are stored on your device and do not cause any harm.

We distinguish between:

• Technically necessary cookies, without which the operation of the website or functions expressly requested by you are not possible. We set these without consent; the legal basis is Section 25 para. 2 no. 2 TDDDG in conjunction with our legitimate interest under Art. 6 para. 1 lit. f GDPR.
• Analysis and tracking cookies, which we only set after your prior consent; the legal basis is Section 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.

Overview of the cookies used:

You can restrict, disable or delete cookies via your browser settings. This may limit the functionality of this website.

7.3 Consent management with Borlabs Cookie

We use Borlabs Cookie to obtain and manage your consent. Your decision is stored locally in your browser and is not transmitted to the provider. You can adjust or revoke your consent at any time via the settings.

Legal basis: legal obligation to document consents (Art. 6 para. 1 lit. c GDPR) as well as legitimate interest in legally compliant consent management (Art. 6 para. 1 lit. f GDPR).

7.4 Contact form, email and telephone

If you contact us via the contact form, by email or by phone, we process your information to respond to your enquiry and for any follow-up questions.

Legal basis: Art. 6 para. 1 lit. b GDPR, provided your enquiry is related to a contract or pre-contractual measures; otherwise, our legitimate interest in answering enquiries (Art. 6 para. 1 lit. f GDPR).

The provision of information marked as mandatory fields is required for us to process your enquiry. Further information is voluntary.

We retain this data until the enquiry has been conclusively processed, but for a maximum of 24 months. Statutory retention obligations remain reserved, in particular the ten-year retention obligation under Art. 958f CO for business correspondence with documentary character.

8. Google Analytics

This website uses Google Analytics 4, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables us to evaluate the use of the website and improve it. Google Analytics 4 does not store IP addresses; the IP address is used exclusively to determine the approximate location and is then discarded. In doing so, data may be transmitted to Google servers in the USA.

It is used exclusively with your consent. No data is transmitted to Google before your consent. You can revoke your consent at any time with effect for the future via the consent window.

Legal basis: your consent under Section 25 para. 1 TDDDG and Art. 6 para. 1 lit. a GDPR.

Google processes the data as a processor based on the Google Ads Data Processing Terms. Storage period for usage data: 12 months.

Further information: https://policies.google.com/privacy

9. Newsletter

The newsletter is sent exclusively after your explicit consent via the double opt-in procedure. We require your email address for registration; further information is voluntary. For documentation purposes, we log registration and confirmation with time and IP address. You can unsubscribe at any time via the unsubscribe link in each newsletter message.

Legal basis: Art. 6 para. 1 lit. a GDPR; the logging is additionally based on Art. 6 para. 1 lit. c GDPR.

We use the following provider for sending:

rapidmail GmbH
Augustinerplatz 2
79098 Freiburg im Breisgau
Germany

rapidmail processes the data as a processor based on a contract according to Art. 28 GDPR and Art. 9 FADP; the data is stored on servers in Germany.

Performance measurement: rapidmail evaluates whether newsletters have been opened and which links have been clicked. This evaluation serves to improve our newsletters and is carried out on the basis of your consent, which you give upon registration (Art. 6 para. 1 lit. a GDPR). A revocation is only possible by unsubscribing from the newsletter entirely.

Your data stored for newsletter subscription will be retained until unsubscribed and then deleted. We retain proof of registration and unsubscription for 3 years to defend against any claims.

10. Disclosure of personal data abroad

We disclose personal data to service providers abroad insofar as this is necessary for the operation of this website.

• Germany (Hosting, newsletter dispatch): From the perspective of Swiss law, the Federal Council has recognised an adequate level of data protection for Germany (Annex 1 DPO). From the perspective of the GDPR, this is processing within the EU; there is no third-country transfer. Additional safeguards are not required.
• USA (Google Analytics): The Federal Council has included the USA in the list of countries with an adequate level of data protection with effect from September 15, 2024, insofar as the receiving company is certified under the Swiss-U.S. Data Privacy Framework. From the perspective of the GDPR, the transfer is based on the European Commission’s adequacy decision of July 10, 2023, regarding the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Google LLC is certified under both frameworks. Additionally, standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR with the Swiss addendum are in place.

Transfer to Switzerland: Personal data of users from the EU/EEA is transferred to our headquarters in Switzerland. The European Commission has attested to Switzerland having an adequate level of data protection; the transfer is therefore based on Art. 45 GDPR and does not require additional safeguards.

11. Retention and Erasure

We retain personal data for as long as required by the respective processing purpose, and then erase or anonymise it. Specific periods are indicated for each processing operation.

Longer retention occurs if legal obligations require it — in particular, the ten-year retention obligation for business books and records under Art. 958f CO — or as long as data is needed for the assertion, exercise or defence of legal claims. During this time, processing is limited to the retention purpose.

12. Necessity of Provision

You are neither legally nor contractually obliged to provide us with personal data. However, without the data marked as mandatory, we cannot provide certain services, namely, we cannot answer your enquiry, conclude or process a contract, or send you a newsletter.

13. Automated Individual Decisions and Profiling

We do not make decisions that have legal effects for you or significantly affect you and are based exclusively on automated processing (Art. 21 FADP / Art. 22 GDPR). High-risk profiling does not take place.

14. Data Security

We ensure the security of personal data with appropriate technical and organisational measures, in particular through encrypted transmission of this website using TLS. We point out that data transmission over the Internet, especially via email, can have security vulnerabilities and complete protection against access by third parties is not possible.

15. Changes to this Privacy Policy

We may amend this privacy policy at any time to adapt it to changes in the legal situation or changes in processing. The version published on this website at the time is authoritative. The date of the current version can be found at the end of this document.

Status of this Privacy Policy: September 2026