This Privacy Policy explains how Vignettes (“we”, “us” or “our”) collects, uses, stores and discloses personal data when you visit [www.vignettes.site], contact us, or purchase an artwork or other item through our website. We are based in Switzerland and process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and its ordinance. Where applicable, we also comply with data protection laws that apply to customers in other countries, including the EU General Data Protection Regulation (GDPR).
Please read this policy together with our Terms of Service and any information displayed during checkout. The exact data we process depends on the features and third-party services enabled on our website.
1. Who is responsible for your personal data?
The controller responsible for the personal data described in this policy is:
If you have questions about this policy or wish to exercise your data protection rights, please contact us using the details above.
2. What personal data do we collect?
Depending on how you interact with us, we may collect the following categories of personal data:
• Contact and delivery information: name, billing and delivery address, email address and telephone number. • Order and transaction information: the artwork purchased, order value, order number, delivery details, and records of returns, cancellations, warranty claims and other order-related communications. • Account information: if you create a customer account, your login details and order history. • Payment-related information: payment status, transaction references and limited payment details provided to us by the payment provider. Payment card details are handled by the payment provider and are not stored by us. • Identification and compliance information: where necessary to comply with Swiss law (for example anti-money laundering and sanctions rules), we may ask for proof of identity or further information about a purchase. • Enquiries and correspondence: information you provide when you contact us by email, website form, telephone or social media. • Reviews and feedback: content you submit to us as feedback or as a review. • Technical and usage information: IP address, browser and device information, approximate location derived from technical data, pages viewed, referral information and interactions with the website. This may be collected through Squarespace and through cookies or similar technologies. • Marketing preferences: whether you have subscribed to or opted out of newsletters or other marketing communications.
Please do not send us sensitive personal data (for example health data) unless it is necessary for your enquiry.
3. How do we collect personal data?
We collect personal data directly from you when you place an order, create an account, complete a form, contact us, subscribe to our communications or otherwise provide information to us. Some technical information is collected automatically when you visit the website.
We may also receive relevant information from service providers involved in website hosting, payment processing, delivery, fraud prevention or website analytics.
4. Why do we use personal data?
We use personal data for the following purposes:
• operating, maintaining and securing our website and online shop; • responding to enquiries and communicating with customers; • processing orders for artworks, arranging payment, preparing shipments and delivering purchases; • handling returns, warranty claims and other after-sales matters; • maintaining business, accounting, tax and transaction records and meeting legal obligations, including anti-money laundering and sanctions requirements; • managing disputes, preventing fraud, protecting our rights and ensuring website security; • understanding website use and improving our website, artworks and customer experience, where analytics tools are enabled; and • sending newsletters and other promotional communications (see below).
Newsletters and marketing. We send promotional emails only with your consent or, if you are an existing customer, for similar artworks and with a simple way to opt out, as permitted by the Swiss Federal Act against Unfair Competition. You can unsubscribe at any time using the link in each message or by contacting us.
Legal basis. Under the Swiss Federal Act on Data Protection (FADP), we process personal data in accordance with the principles of lawfulness, good faith, proportionality and purpose limitation, and we ask for your consent where it is required. Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: performance of a contract or steps prior to a contract (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c)), our legitimate interests in running, securing and improving our business (Art. 6(1)(f)), and your consent (Art. 6(1)(a)). You may withdraw consent at any time; this does not affect processing carried out before the withdrawal.
No automated decisions. We do not use automated individual decision-making, including profiling, that produces legal effects for you or significantly affects you.
5. Squarespace, payment providers and other service providers
Our website is built and hosted using Squarespace, a platform operated by Squarespace, Inc. (United States) and its affiliates (“Squarespace”). Squarespace processes personal data on our behalf to provide website hosting, shop and checkout functionality, forms, security and related services. Squarespace may also process certain technical information as an independent controller for its own purposes, as described in its privacy policy: www.squarespace.com/privacy.
Depending on the services we use, personal data may also be disclosed to:
• payment providers that process payments and help prevent fraud e.g. Stripe, PayPal; • shipping, courier and fulfilment providers that deliver artworks Swiss post; • analytics, email, newsletter, IT, security and customer-support providers; • professional advisers, insurers, banks, auditors and fiduciaries; and • authorities, courts and other bodies where required by law or necessary to establish, exercise or defend legal claims.
We disclose only the data needed for the relevant purpose. Where a provider processes data on our behalf, we oblige it by contract to process the data only as instructed and to protect it appropriately. We do not sell your personal data.
6. Cookies and website analytics
Our website uses cookies and similar technologies. Some are necessary for core functions such as security, checkout, remembering your preferences and operating the website. Others may be used for analytics, performance measurement, embedded content or marketing, depending on the features we have enabled.
In line with Swiss law (Art. 45c of the Telecommunications Act), we inform you about the use of cookies and their purposes, and you can refuse them. You can manage cookies through the cookie banner or settings on our website and through your browser settings. Blocking certain cookies may affect how parts of the website work. Where the law requires consent for non-essential cookies (for example for visitors in the EU/EEA or UK), we obtain that consent before using them.
List of additional tools we use, e.g. Google Analytics, Meta Pixel or social-media embeds, and what data they receive.
7. To whom and where may personal data be disclosed?
Personal data may be made available to the recipients described above. Our service providers may be located in Switzerland, the EU/EEA, the United States and other countries where they or their sub-processors operate. Squarespace, Inc., in particular, is based in the United States.
If personal data is disclosed to a country that does not have a level of data protection recognised as adequate under Swiss law, we ensure appropriate protection. We do so, for example, by relying on the recipient’s certification under the Swiss-U.S. Data Privacy Framework, by concluding standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, in individual cases, on a statutory exception such as the performance of a contract with you. You may contact us to obtain further information about the safeguards in place.
8. How long do we keep personal data?
We keep personal data only for as long as necessary for the purposes described in this policy or as required by law:
• Order, invoice and accounting records: generally 10 years from the end of the relevant financial year, in accordance with Swiss accounting and tax law. • Identification records collected for compliance purposes: for the period required by law. • Enquiries and correspondence: as long as needed to handle the matter and, where relevant, to answer follow-up questions or warranty claims 3 years after last contact. • Newsletter data: until you unsubscribe. • Technical and usage data: for the period set by the relevant tool or provider, as needed for security and analysis.
When data is no longer required, we delete or anonymise it.
9. How do we protect personal data?
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No online transmission or electronic storage is completely secure. Please contact us promptly if you believe your personal data or your customer account has been compromised.
10. Your rights
Under the FADP, and subject to the applicable conditions and exceptions, you have the right to:
• request information about whether and how we process personal data about you, and access to that data; • request correction of inaccurate personal data; • request deletion of your personal data, or object to its processing or to its disclosure to third parties; • request that we hand over or transfer certain personal data in a commonly used electronic format; and • withdraw your consent at any time where processing is based on consent.
To exercise your rights, contact us at contact@vignettes.site We may ask you to verify your identity first. We aim to respond within 5 business days. These rights are not absolute; for example, we may need to keep certain information to comply with legal obligations or to establish, exercise or defend legal claims.
If the GDPR (or the UK GDPR) applies to our processing, you may also have the right to restrict processing, to object to processing based on our legitimate interests or for direct marketing, and to lodge a complaint with your competent supervisory authority.
11. Complaints and the Swiss supervisory authority
If you have concerns about how we handle your personal data, please contact us first so we can try to resolve them. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch.
If the GDPR applies to you, you may also lodge a complaint with the data protection authority in the place where you live or work, or where the alleged infringement took place.
12. Third-party websites and embedded content
Our website may contain links to third-party websites or embedded content such as social-media posts or videos. These services are operated by third parties, which may collect data about your interaction with them. We do not control their privacy practices; please consult their privacy policies.
13. Children
Our online shop is intended for persons aged 18 and over, and our website is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
14. Changes to this policy
We may update this Privacy Policy from time to time, for example when our business, website features, service providers or legal requirements change. The updated version will be published on this page with a revised “Last updated” date.
15. Contact
For questions about this Privacy Policy or to exercise your data protection rights, please contact:
Audrey Julien & Arno Mathies, Route de l’étraz 20A, 1260 Nyon, Switzerland