Privacy Policy
Last updated: July 2026 — Compliant with the Swiss FADP (in force since 1 September 2023)
01. Data controller
The controller responsible for processing your personal data is:
Institut Bellarte
Daniel Jean-Richard 13a, 2400 Le Locle, Switzerland
Email: info@boutique-bellarte.ch
Phone: +41 78 743 76 57
02. Data collected and purposes
Account and order data
Last name, first name, email address, delivery address, phone number. Collected when creating an account or making a purchase to manage your orders, send you confirmations and invoices, and provide after-sales service.
Payment data
Payment processing is entirely delegated to Payrexx AG (Thun, Switzerland). Institut Bellarte never stores your banking details. Only a transaction identifier and the delivery details entered on the payment page (name, address, email) are kept in our database for order fulfilment.
Skin and hair diagnostic
The results of your diagnostic are processed locally in your browser and are not transmitted to our servers. If you choose to receive your results by email, only the address you provide is used for this single send.
Newsletter
Your email address and preferences, collected with your explicit consent, to send you our offers and news. You can unsubscribe at any time via the link included in every email.
Contact messages
The information entered in our contact form (name, email, message) is kept in order to process your request and follow up.
Technical data
IP address (used temporarily for abuse protection and rate limiting), anonymized error logs. This data is not used to personally identify visitors.
03. Legal basis for processing
Contract performance — order management, delivery, invoicing, gift cards.
Consent — newsletter, marketing cookies (Facebook Pixel). You may withdraw your consent at any time.
Legitimate interest — fraud prevention, site security, improvement of our services, sending transactional emails.
Legal obligation — retention of accounting records and proof of transactions (10 years under the Swiss Code of Obligations).
04. Processors and recipients
We use the following providers as part of our services. No data is sold to third parties for commercial purposes.
05. International transfers
Some of our providers are based in the United States (Vercel, Resend, Google, Sentry, Meta); payment processing is handled in Switzerland by Payrexx AG. These transfers are governed by appropriate safeguards: the providers concerned are certified under the EU–US Data Privacy Framework recognized by the European Commission and the Swiss FDPIC, or are bound by standard contractual clauses. Your database data is hosted within the European Union (Frankfurt, Germany) via Supabase.
06. Retention period
Customer account and orders — retained for the duration of the business relationship, then 10 years for accounting records (legal obligation under the Swiss Code of Obligations).
Newsletter — until unsubscription, then deleted within 30 days.
Contact messages — 3 years from the last interaction.
Technical data (logs, IP) — 90 days maximum.
Inactive account — we may delete an account with no activity for more than 3 years after prior notification.
07. Cookies and trackers
Essential cookies (no consent required)
User session, shopping cart, authentication token. These cookies are essential to the operation of the site and cannot be disabled.
Marketing cookies (consent required)
The site uses the Facebook Pixel (Meta) to measure the effectiveness of our advertising and track conversions. This tracker places cookies on your device and transmits data to Meta Platforms Inc. (United States). You can refuse this tracking via your browser settings or via Meta's privacy preference management tools.
You can also configure your browser to block or delete cookies. Disabling essential cookies may disrupt the operation of the site.
08. Your rights (Swiss FADP)
In accordance with the Federal Act on Data Protection (FADP), you have the following rights:
Right of access — obtain a copy of the data we hold about you.
Right of rectification — correct inaccurate or incomplete data.
Right to erasure — request deletion of your data (subject to legal retention obligations).
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to the processing of your data for direct marketing purposes.
Withdrawal of consent — withdraw your consent at any time for processing based on it (newsletter, marketing cookies).
We will respond to your request within 30 days. If you believe your rights are not being respected, you may file a complaint with the Federal Data Protection and Information Commissioner (FDPIC).
09. Data security
We implement appropriate technical and organizational measures to protect your data: encryption of communications (HTTPS/TLS), password hashing (bcrypt), optional two-factor authentication, access restricted to authorized personnel only. Payments are secured by Payrexx AG, a PCI-DSS certified Swiss provider.
10. Minors
Our services are intended for individuals aged 16 or older. We do not knowingly collect personal data concerning children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately so we can delete it.
11. Changes to this policy
We reserve the right to modify this privacy policy at any time to reflect legal changes or changes to our practices. The last update date is shown at the top of this page. In the event of a substantial change, we will inform you by email or via a notification on the site. We encourage you to consult this page regularly.
Questions about your data? Contact us or see our legal notice.