Privacy Policy

1. Scope and current service

This policy explains how EmberNails processes personal data in connection with this website. EmberNails is a Swiss association (Verein), formed through a school project. The website remains in development. The shop and checkout are test features: Stripe sandbox checkout records test orders and payment status, but no real payment is taken and no delivery address is collected.

We designed this notice for the Swiss Federal Act on Data Protection (FADP) and, where the GDPR applies to us, for the EU General Data Protection Regulation (GDPR). This notice describes the current website, not future payment or delivery services. Draft notice: the bracketed contact, provider, and retention details still need confirmation. This notice is not complete for public launch.

2. Controller and contact

The controller is EmberNails (Swiss association / Verein), of Hirschgraben 10, 6003 Luzern, Switzerland. For privacy requests, email lukas_imhof@sluz.ch or write to the postal address above. General enquiries can be sent to shoana_duss@sluz.ch. The association's details are published in the Imprint.

Authorised representative: Patrick Stark, President. [Confirm whether a data-protection officer or an EU representative under Article 27 GDPR is required; publish their contact details here if applicable.]

3. Data we process

• Account data: email address, password hash, role, account status, email-verification status, and account creation, update, and last-login timestamps.
• Session and cart data: a PHP session identifier, a security token, the test product and quantity in the cart, and temporary status messages. These are used to keep the site working and to protect forms.
• Technical data: when the site is accessed, web-server and security systems may process technical information such as IP address, date and time, requested page, browser or device information, and referrer information where supplied by the browser.
• Messages you enter: the help and contact forms save your email address, message, form source, and submission time (UTC) in the website database for staff to read and handle your request. No email confirmation or notification is sent. We do not store your IP address in the support table. Do not use the forms for confidential, sensitive, or urgent information. A support-message retention period and deletion process still need to be set before public launch.

Please do not provide special-category or otherwise sensitive personal data through this site. We do not intentionally request it.

4. Purposes and legal grounds

We use these data to operate and protect the website, in particular to:

• create and administer accounts, authenticate users, and provide the requested account and cart functions;
• prevent fraud, misuse, and attacks; maintain security; and diagnose technical problems;
• meet legal obligations or establish, exercise, or defend legal claims where necessary.

Where the GDPR applies, the legal bases are performance of a contract or steps taken at your request (Article 6(1)(b)), compliance with legal obligations (Article 6(1)(c)), and our legitimate interests (Article 6(1)(f)). Those legitimate interests are protecting the website, accounts, and visitors against misuse and attacks; maintaining reliable operation; and establishing, exercising, or defending legal claims. We will ask for consent before processing that requires it, such as non-essential cookies or marketing technologies. Under Swiss law, we process personal data in accordance with the FADP, including its transparency, purpose-limitation, proportionality, and data-security requirements.

Account email and a password are needed to create an account; without them we cannot provide sign-in. The legal and development pages can be read without an account. Preview access to the other pages is currently restricted to authorised staff. We do not obtain account data from data brokers or public sources.

Newsletter signup requests

You can voluntarily leave your email address for future EmberNails launch news, nail products and offers without creating an account. We record your email, signup date and time (UTC), the consent wording and its version, privacy-notice version, signup source, subscription status, and a protected cancellation token. We do not store your IP address or browser details in the newsletter table; ordinary hosting logs may still record website requests.

Our newsletter is not sending emails yet. New subscriptions become active immediately with your explicit consent, without a confirmation email. Ownership of the email address is not verified. Under the GDPR, where applicable, this processing relies on your consent (Article 6(1)(a)). Signing up is optional and has no effect on access to the website.

Save the private cancellation link shown after signup. You can use it at any time to withdraw your request and delete the newsletter entry without an account or fee. You may also write to the controller at the postal address above. Withdrawal does not affect processing carried out before withdrawal. New subscriptions are retained until you unsubscribe. Older pending requests collected under the previous confirmation process remain unchanged and expire after 30 days; expired entries are removed when newsletter requests are processed or by newsletter cleanup. Backups and hosting logs follow the separate retention arrangements described below.

Only authorised staff and the hosting/database providers described in this notice can access signup data. Before connecting an email provider, we will update this notice with its identity, processing locations and applicable transfer safeguards. Future newsletters must include a free unsubscribe option. No email tracking is used.

5. Cookies and similar technologies

The current application uses a technically necessary PHP session cookie (normally named PHPSESSID). It keeps a user signed in, protects forms, and stores the test cart during the session. It is not used for advertising or cross-site tracking. Its actual expiry is determined by the deployed session configuration; [confirm cookie lifetime and server-side session retention]. You can delete or block it in your browser, but sign-in, cart, and protected forms may stop working.

We do not currently use analytics, advertising, social-media, or other non-essential cookies, pixels, SDKs, or tracking scripts. If those are introduced, they will be blocked by default until valid consent is collected where required, and this policy and the cookie settings will identify the provider, purpose, data, storage period, and any international transfer.

6. Recipients and international transfers

We do not sell personal data. Authorised association staff can access the data necessary for their tasks. Hosting and database service providers process website data on our behalf. We may disclose data to authorities or professional advisers where legally required or necessary to handle claims.

• Hosting, database, logs, and backups: [provider legal name; storage countries; countries from which support can access data].

The current checkout uses Stripe test mode and has no live payment or delivery integration. The contact form has no email delivery integration. Newsletter signup requests are stored in our website database; no email delivery provider is connected. No analytics or advertising integration is present in the application. Any additional hosting-level services must be verified and disclosed before public launch.

[Confirm each international disclosure, its destination country, and the applicable adequacy decision or safeguards, including how a copy may be obtained.] Swiss rules also apply to disclosures to the EEA or UK; these destinations must not simply be omitted from this assessment. Where required, transfers rely on an applicable adequacy decision or recognised contractual safeguards with supplementary measures. Where the GDPR applies, its international-transfer requirements also apply.

7. Retention and security

We keep personal data only for as long as needed for the stated purposes, unless a longer period is required by law or necessary to handle a legal claim. Before launch, set and verify the following periods, then replace the bracketed examples with the periods actually used:

• Account data: [for the lifetime of the account, then X days/months after closure].
• Session and cart data: [until browser session ends / X hours or days].
• Security and access logs: [X days; for example, 30 days].
• Backups: [X days; for example, 14 days].

The test checkout stores sandbox payment records. Support form submissions are stored in the website database. A support-message retention period and deletion process are still to be defined before public launch; there is no automatic support-message deletion yet.

We use measures appropriate to the risk, including password hashing, access controls, prepared database queries, session renewal on login, and CSRF protection. No security measure can guarantee absolute security; we review safeguards when the service changes.

8. Your rights

Under the FADP and subject to its conditions and limits, you may request information about personal data processed about you and request correction or deletion of inaccurate or unlawfully processed data. Where the statutory conditions are met, you may request delivery or transfer of your data in a commonly used electronic format. You may also request the prohibition of a particular disclosure where the legal requirements are met.

Where the GDPR applies, you may request erasure where its conditions are met, including where data are no longer necessary, as well as restriction of processing and, where the conditions are met, portability of data processed by automated means on the basis of consent or contract. You may withdraw consent at any time for future processing. Where we rely on legitimate interests, you may object to that processing on grounds relating to your particular situation.

We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects. To exercise a right, contact the controller using the contact details in the Imprint. We may need proportionate information to verify your identity. We generally respond within 30 days under Swiss law, or within one month under the GDPR; we will explain any legally permitted extension. Requests are normally free, subject to statutory exceptions. You may object to direct marketing at any time. Under the GDPR, you may also complain to the data-protection authority in your habitual residence, workplace, or the place of the alleged infringement. In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC).

9. Children

This site is not designed to collect personal data from children. We will put an age-appropriate account process in place before public launch if the service is offered to children or relies on consent. If you believe a child has provided personal data without the required authorisation, contact the controller so we can assess and address the request. A purchase or account does not create association membership; member administration is outside this website notice.

10. Changes to this policy

We may update this policy when the service or applicable law changes. The current version will be published on this page with its revision date. Material changes will be communicated in an appropriate way before they take effect where required by law.