Privacy policy

2. Responsible body

The controller responsible for data processing on this website is Urban Trading GmbH, Glattalstrasse 63, 8052 Zurich, Switzerland.

3. Data protection at a glance

We treat your data with the utmost care in accordance with the Swiss Data Protection Act (FADP) and – where applicable – the EU General Data Protection Regulation (GDPR). Your data will only be processed if there is a legal basis or explicit consent.

4. Legal basis for data processing

We process personal data based on the following legal bases:

• Consent (Art. 6 para. 6 FADP, Art. 6 para. 1 lit. a GDPR)
• Performance of a contract (Art. 6 para. 1 lit. b GDPR)
• Legal obligation (Art. 6 para. 1 lit. c GDPR)
• Legitimate interest (Art. 6 para. 1 lit. f GDPR)

5. What information we collect

• Contact details (e.g., name, address, email)
• Order data, payment information
• Technical data (e.g. IP address, device type, browser)
• Usage data (e.g., page views, interactions)

6. Purpose of processing

Your data will be used for:

• Processing orders
• Customer Support and Communication
• Optimization of our website
• Marketing and analytics (consent only)
• Fulfilment of legal obligations

7. Retention period

Personal data will only be stored for as long as is necessary for the fulfilment of the aforementioned purposes or as long as statutory retention periods exist.

8. Disclosure to third parties

Data will only be passed on if this is necessary for the performance of the contract. This applies in particular to the following cases:

• Shipping service provider: e.g. Post, DPD, Planzer, DHL, DB Schenker or other logistics partners
• Payment providers: e.g. Stripe, TWINT, MF Group (PowerPay), PayPal, Wallee (technical payment integration)
• Web hosting & IT services: e.g. Google, Cloudflare (CDN & security filters); Supabase (images in the help centre)
• E-mail communication & newsletter: Brevo (Sendinblue)
• Tracking & Analysis: see "Tracking & Tools"

Your data will not be transmitted any further unless you have expressly consented or we are legally obliged to do so.

9. International Data Transfers

Some of our service providers are located in third countries (e.g. USA). In such cases, we use recognized safeguards such as Standard Contractual Clauses to ensure an adequate level of data protection.

10. Tracking & Tools

We use the following services:

• Google Analytics
• Google Tag Manager
• Meta Pixel
• Microsoft Clarity
• Hotjar
• TikTok Pixel
• DoubleClick / Floodlight
• reCAPTCHA
• YouTube integration
• PrestaShop (shop search)
• Cloudflare (CDN, bot management, DDoS protection)

All services process data in accordance with their own privacy policy. Where necessary, we use standard contractual clauses.

11. Tracking, Search & Marketing Modules

We use various modules and services to optimize your visit to our website and the shopping experience:

• Shop search (PrestaShop): Search terms are processed to search the shop catalogue. Search terms, the number of results and the time are stored for internal search statistics.
• Pop-ups (e.g. Creative Popup): Email entries or actions in the pop-up are voluntary. No data processing takes place without consent.
• Marketing Automation (Brevo): See point 12.
• Contact Forms & Chat: Entries are stored for processing, anonymized protocols are used for quality control.
• Automated processes (e.g. wallee cron jobs): We use automated processes for payment processing and order management.

12. Use of Google reCAPTCHA

We use "Google reCAPTCHA" (version 3) on our website to protect entries via forms from automated access. The provider is Google Ireland Ltd., with parent company Google LLC, USA.

reCAPTCHA analyzes IP address, mouse movements, dwell time, among other things, and transmits them to Google. The processing is carried out on the basis of our legitimate interest.

Further information: Google's Privacy Policy & Terms of Service.

13. Use of Brevo (formerly Sendinblue)

We use "Brevo" (Sendinblue GmbH, Berlin) to send newsletters and transactional emails. Your data will be processed on servers in Germany. Processing is only carried out in the event of consent or for the performance of a contract.

More at: Brevo's privacy policy.

14. Cookies

We use cookies to optimize your user experience. On your first visit, you can agree or reject via our cookie banner. Your settings can be adjusted at any time.

15. Your rights

• Information about stored data
• Correction or deletion
• Objection to processing
• Data transfer (on request)

Please contact us at: [email protected]

16. Data security

We use modern security measures (e.g. SSL, access controls) and carefully select service providers.

17. Changes to this Statement

This privacy policy will be amended if necessary. The version valid at the time of the visit applies.
Last update: 12.11.2026

WhatsApp Business and CTRLino

If you contact us through WhatsApp, we process your phone number, displayed profile name, message contents, any attachments you send, and technical information such as timestamps and delivery status. We use this information for advice, support and order enquiries. Messages are transmitted through the WhatsApp Business Platform (Meta Cloud API) and stored in AIO.Convado on Supabase to handle enquiries. CTRLino can use AI to analyse messages and respond automatically. Message content needed for a reply may be passed to the AI service in use through the Lovable AI Gateway. Our support team can view the conversation and take over. You can contact us by email instead and request access to or deletion of your stored messages at [email protected]. The retention period section applies.

Provider privacy policy

Google OAuth and Google Business Profile in AIO.Convado

Authorised users can connect a Google account to AIO.Convado. Depending on the feature, Google permissions can cover the Google account identifier, primary email address and profile information, access to Google Business Profile, and read access to Google Analytics data. To connect a Business Profile, AIO.Convado retrieves authorised business accounts and locations. The review feature is used to manage reviews in the workspace, including display names, ratings, text and timestamps, and to send a reply to Google when requested. AIO.Convado stores connection data such as account and location identifiers and access tokens on Supabase so the connection remains available to authorised users. You can revoke access in your Google Account settings and request deletion of the connection data we hold at [email protected].

Provider privacy policy

Meta Pixel

Meta Pixel is used to measure and analyse advertising on Facebook and Instagram. When it is used, Meta Platforms Ireland Limited can receive information about page views and interactions, and technical data such as IP addresses, browser information and online identifiers. Meta can associate this information with a Facebook or Instagram account. Marketing cookie preferences are available in the cookie banner or cookie settings.

Provider privacy policy