Privacy Policy

iReparatur.ch / remarket.ch GmbH
Viaduktstrasse 42
4051 Basel
Switzerland
E-Mail: info@rpd.ch

We collect and process personal data only insofar as this is necessary for the establishment, content arrangement or amendment of the contractual relationship (inventory data). This includes name, address, email, telephone number and payment information.

Our website uses cookies to improve the user experience. You can adjust the cookie settings in your browser at any time. Technically necessary cookies cannot be deactivated.

Each time our website is accessed, usage data is automatically collected (e.g. IP address, browser type, access time). This data is used exclusively for statistical evaluations and to improve our services.

In order to show you suitable products and accessories for your device, we store your device preferences (e.g. which smartphone model you use) locally in your browser (localStorage). This data is not shared with third parties and remains exclusively on your device.

If you have a customer account, these preferences can also be stored in your account so that you receive personalised product recommendations across devices. You can view and delete your saved device preferences at any time in your account or remove the data from your browser via the browser settings.

Personal data is only shared with third parties insofar as this is necessary for the fulfilment of the contract (e.g. to shipping service providers or payment providers). No further sharing takes place.

We employ technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

You have the right to information, rectification, deletion and restriction of the processing of your personal data. Please contact us at info@rpd.ch.

By subscribing to the newsletter, you agree to receive regular information about offers and news. You can unsubscribe from the newsletter at any time via the unsubscribe link in the email or by emailing us.

We use Google Analytics to analyse website usage. The information generated is stored on Google servers. You can prevent data collection by Google Analytics by installing a browser add-on.

We collect anonymized page views, search queries and cart actions for internal statistics. Your IP address is hashed before storage (SHA-256 with a daily salt). No tracking cookies are set, no cross-site profiling is performed, and no data is shared with third parties. Retention: 30 days rolling. On sensitive pages (account, checkout, login, password reset) no data is collected at all.

This website uses the content delivery network and security services of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) with European data-centre network. Cloudflare processes your IP address, user-agent and request metadata as a processor to defend against attacks (DDoS, bots), accelerate delivery and terminate TLS. In addition we use the Google tag gateway on the Cloudflare edge: measurement data for Google Analytics 4 and Google Ads (see the respective sections) is forwarded to Google through an endpoint on our own domain instead of your browser communicating with Google servers directly. Cloudflare acts as a mere conduit (processor) and does not store the measurement data. Legal basis: legitimate interest in a secure and performant website (Art. 31(2)(d) DSG). A DPA based on the EU Standard Contractual Clauses is in place with Cloudflare. Details: cloudflare.com/privacypolicy.

To protect our forms (e.g. login, registration, contact, shipment tracking, returns, chat and checkout) against automated access and abuse, we use Cloudflare Turnstile. Turnstile checks in the background whether a request comes from a human, evaluating technical characteristics such as IP address, browser and device properties and interaction behaviour. The check is usually invisible; a short confirmation only appears if something looks suspicious. Turnstile does not set cookies for advertising or analytics. The data is also processed by Cloudflare in the USA (see section 15). The legal basis is our legitimate interest in securing our website and preventing spam and fraud.

In addition to the browser-based Meta Pixel, our server transmits conversion events (Purchase, AddToCart, InitiateCheckout, Lead forms such as the B2B registration) directly to the Meta Conversions API of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. The following data are transmitted: event name (e.g. "Purchase", "Lead", "AddToCart"), event ID for deduplication with the browser pixel, timestamp, order value, currency; contact data exclusively in hashed form (SHA-256): e-mail, phone, first/last name, city, ZIP, country code; technical identifiers: hashed internal customer ID, IP address, user-agent, Meta cookies (_fbc, _fbp), click ID (fbclid). The Conversions API improves measurement accuracy especially with ad blockers and iOS ITP. Transmission occurs only on conversion events, never on a plain page view. Legal basis: legitimate interest in effective advertising (Art. 31(2)(d) DSG). Object via browser settings, ad blockers or facebook.com/settings/?tab=ads.

In addition to browser-based Google Analytics (see section 10), our server transmits conversion events directly to the Measurement Protocol of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (and Google LLC, Mountain View, USA). Transmitted: event name (e.g. "purchase", "generate_lead", "add_to_cart"), event ID, GA4 client ID, session ID, timestamp; hashed e-mail and phone (for Enhanced Conversions / user-ID matching); order value, currency, product IDs and quantities; technical metadata: user-agent, truncated IP address, geo region. The non_personalized_ads parameter is set so that data is used only for reporting and campaign optimisation within the meaning of Art. 31(2)(d) DSG. Separately, we use customer lists for advertising, see section 16 “Customer lists for advertising”; you can also object there. Legal basis: legitimate interest in effective advertising and correct reach measurement. Details: policies.google.com/privacy.

Some of our service providers (in particular Meta Platforms Inc., Google LLC, Cloudflare Inc., OpenAI, L.L.C.) process data — at least in part — in the USA. Pursuant to Art. 16(2)(a) FADP and Art. 45 GDPR, the USA is not generally considered a safe third country, in particular because of access by US authorities under US law (FISA Section 702, Cloud Act). The transfer is therefore based on: (a) the European Commission's adequacy decision of 10 July 2023 for the EU-U.S. Data Privacy Framework, provided the recipient is certified (verifiable at dataprivacyframework.gov/list); (b) the Swiss Federal Council's recognition ordinance of 14 August 2024 for the Swiss-U.S. Data Privacy Framework, in force since 15 September 2024; (c) additionally the EU Standard Contractual Clauses (Decision 2021/914) including supplementary technical measures (hashing of personal fields prior to transfer, transport encryption). Despite these mechanisms a residual risk may remain that US authorities access your data. You have the right to object to such transfer — if you object, certain services (advertising conversion measurement, personalised content) will be available only in restricted form. Object informally at info@rpd.ch.

When you buy from us, we use your email address and phone number to make advertising on Google (Search, YouTube, Gmail) and Meta (Facebook, Instagram) more relevant. For this purpose, we upload this information exclusively as hash values (SHA-256) to Google Ireland Limited or Meta Platforms Ireland Ltd.; a hash value is not reversible, so the original information cannot be derived from it. The providers match the hashes against their user accounts and delete unmatched values after matching. We do not learn who was matched.

We use the lists for the following purpose:

• Exclusion: Anyone who has bought from us in the last 30 days will not see advertising for the same offer.

Transmitted data: email address, phone number, first and last name, postcode and country, each hashed. No information about devices, amounts or payments. The lists are rebuilt daily; anyone who no longer belongs to a list is removed in the process. A person remains in a list for no more than 12 months after their last purchase.

The legal basis is our legitimate interest in effective, non-intrusive advertising (Art. 31 DSG; for customers resident in the EU, Art. 6(1)(f) GDPR). The providers may transfer data to the USA; both are certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework respectively.

Objection: You can object at any time, with one click in your customer account (My Account → Notifications) or by email to info@rpd.ch. You will be removed from all lists at the latest at the next daily sync.

Our support chat is assisted by artificial intelligence. When you start the chat, we process your name, your email address (if provided), your messages and technical data such as the page visited, browser and IP address. To answer you, chat content is transmitted to OpenAI (OpenAI, L.L.C., USA) and analysed automatically there; for transfers to the USA see section 15. Before the chat starts, Cloudflare Turnstile checks that the request comes from a human (see section 12). We store chat histories to handle your request, so that a member of our team can take over when needed, and to improve our support. We delete the IP address and browser data after 90 days. After 12 months we anonymise the chat: name, email address and phone numbers are removed; we keep using the conversation content, no longer linked to you, to improve our support. If the chat led to an order or a request to our team (e.g. an appointment or a reply by email), we keep it like our other business correspondence for up to 10 years. OpenAI stores the transmitted content for abuse monitoring for no more than 30 days and does not use it for training. The legal basis is the consent you give before starting the chat. You can withdraw it at any time and request deletion of your chat data at info@rpd.ch. Please do not enter sensitive data such as passwords or payment details in the chat.

We reserve the right to amend this Privacy Policy at any time. The current version is available on our website. As of: October 2026.