Privacy

Version: October 2025

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

Vision Consulting AG
Compliance
Bächausstrasse 61
CH-8806 Bäch SZ
Switzerland

E-mail: dataprotection@vision.ch
Phone: +41 44 560 94 30
Website: www.betterwalls.nl

Note: Vision Consulting AG has not appointed a data protection officer as there is no legal obligation to do so.

1b. Data Transfer to Switzerland

The processing of your data is partly carried out by the controller in Switzerland. Switzerland has an adequacy decision from the European Commission (Decision 2000/518/EC as amended by Implementing Decision (EU) 2024/1159), ensuring an adequate level of data protection.

2. General Information on Data Processing

2.1 Scope of Processing Personal Data

We process personal data of our users generally only to the extent necessary to provide a functional website as well as our content and services. The processing of personal data regularly takes place only after the user's consent. An exception applies in cases where prior consent is not possible for practical reasons and the processing of the data is permitted by legal provisions.

2.2 Legal Bases for Processing

To the extent that we obtain consent from the data subject for processing operations of personal data, Art. 6(1)(a) GDPR serves as the legal basis.

For the processing of personal data necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.

To the extent that processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.

If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party and if the interests, fundamental rights and fundamental freedoms of the data subject do not override the first-mentioned interest, Art. 6(1)(f) GDPR serves as the legal basis for processing.

2.2a Data Processing Agreement

We engage external service providers to deliver our services (e.g. Shopify, Google Analytics, payment service providers, shipping service providers). We have concluded agreements in accordance with Art. 28 GDPR (data processing agreements) with all processors who process personal data on our behalf. These agreements ensure that processing only takes place according to our instructions and that an appropriate level of protection is guaranteed.

2.3 Data Deletion and Storage Duration

The personal data of the data subject are deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Blocking or deletion of the data also takes place when a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

3. Provision of the Website and Creation of Log Files

3.1 Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data are collected:

Information about the browser type and version used
The user's operating system
The user's Internet service provider
The user's IP address
Date and time of access
Websites from which the user's system reaches our website (referrer URL)
Websites accessed by the user's system through our system
Transferred data volume
Notification of successful retrieval

The data are also stored in the log files of our system. These data are not stored together with other personal data of the user.

3.2 Legal Basis and Purpose of Data Processing

The legal basis for the temporary storage of the data and log files is Art. 6(1)(f) GDPR.

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. Storage in log files takes place to ensure the functionality of the website. In addition, the data serve us to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

These purposes also constitute our legitimate interest in data processing according to Art. 6(1)(f) GDPR.

3.3 Storage Duration

The data are deleted as soon as they are no longer necessary for achieving the purpose for which they were collected. In the case of collecting data for providing the website, this is the case when the respective session has ended. In the case of storing data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or anonymized so that an assignment of the accessing client is no longer possible.

3.4 Possibility of Objection and Removal

The collection of data for providing the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection for the user.

4. Use of Cookies

4.1 Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that enables unique identification of the browser when the website is accessed again.

We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can also be identified after a page change.

4.2 Cookie Categories

We use the following cookie categories on our website:

Necessary Cookies (technically required)

Purpose: Basic functionality of the website, session management, shopping cart, checkout
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
Storage duration: Session cookies (deleted after closing the browser) or up to 30 days

Preference Cookies

Purpose: Storage of user settings (language, region)
Legal basis: Art. 6(1)(a) GDPR (consent)
Storage duration: Up to 12 months

Statistics Cookies

Purpose: Analysis of user behavior, website optimization
Legal basis: Art. 6(1)(a) GDPR (consent)
Storage duration: Up to 24 months

Marketing Cookies

Purpose: Display of personalized advertising, cross-website tracking
Legal basis: Art. 6(1)(a) GDPR (consent)
Storage duration: Up to 24 months

4.3 Specific Cookie List

The following cookies are used on our website:

Shopify Cookies (necessary):

_shopify_s: Session ID, 1 day
_shopify_y: Permanent shop ID, 1 year
cart: Shopping cart information, 14 days
cart_sig: Shopping cart signature, 14 days
secure_customer_sig: Customer login signature, 20 years
storefront_digest: Shop authentication, 2 years

Google Analytics Cookies (statistics, only with consent):

_ga: Client ID to distinguish users, 2 years
_gid: Client ID to distinguish users, 24 hours
_gat: Request rate throttling, 1 minute

Facebook Cookies (marketing, only with consent):

_fbp: Facebook Pixel tracking, 3 months
fr: Facebook advertising ID, 3 months

Google Ads Cookies (marketing, only with consent):

_gcl_au: Google Ads conversion tracking, 90 days
IDE: Google DoubleClick, for ad targeting and remarketing, 13 months
test_cookie: Test browser cookie support, 15 minutes
Conversion cookie: Specific cookie for each conversion action, 30 days

4.4 Legal Basis and Purpose of Data Processing

The legal basis for processing personal data using technically necessary cookies is Art. 6(1)(f) GDPR. The legal basis for processing personal data using cookies for analysis purposes in the presence of corresponding user consent is Art. 6(1)(a) GDPR.

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

The user data collected through technically necessary cookies are not used to create user profiles. The use of analysis cookies serves the purpose of improving the quality of our website and its content. Through analysis cookies, we learn how the website is used and can thus continuously optimize our offering.

These purposes also constitute our legitimate interest in processing personal data according to Art. 6(1)(f) GDPR.

4.5 Storage Duration, Possibility of Objection and Removal

Cookies are stored on the user's computer and transmitted from there to our website. Therefore, as a user, you also have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transfer of cookies. Cookies already stored can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, it may no longer be possible to use all functions of the website to their full extent.

You can adjust your cookie settings at any time via our cookie banner.

5. Google Analytics

5.1 Scope of Processing Personal Data

We use Google Analytics, a web analytics service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), on our website. Google Analytics uses cookies that enable an analysis of your use of the website.

The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. We have activated IP anonymization on this website. As a result, your IP address is shortened by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activities and to provide other services related to website usage and Internet usage to the website operator.

5.2 Legal Basis for Processing Personal Data

The legal basis for using Google Analytics is Art. 6(1)(a) GDPR (consent). Usage only takes place if you have previously given your consent via our cookie banner.

5.3 Purpose of Data Processing

The use of Google Analytics serves the purpose of analyzing our website and optimizing our Internet presence.

5.4 Storage Duration

The data we send and that are linked to cookies are automatically deleted after 14 months. Deletion of data whose retention period has been reached occurs automatically once a month.

5.5 Possibility of Objection and Removal

You can prevent the storage of cookies by setting your browser software accordingly. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout

As an alternative to the browser plugin, you can revoke your consent via our cookie banner or click on this link to prevent future collection by Google Analytics within this website (the opt-out only works in this browser and only for this domain). An opt-out cookie will then be placed on your device. If you delete your cookies in this browser, you must click this link again.

5.6 Data Transfer to Third Countries

Google processes your data in the USA. The USA has an adequacy decision from the European Commission (EU-US Data Privacy Framework). Google LLC is certified under the EU-US Data Privacy Framework. More information at: https://www.dataprivacyframework.gov/

More information about data protection at Google Analytics: https://support.google.com/analytics/answer/6004245

6. Social Media Plugins

6.1 Facebook Social Plugins

So-called social plugins ("plugins") of the social network Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook"), are used on our website.

The plugins are marked with a Facebook logo (white "f" on blue tile or a "thumbs up" sign) or are marked with the addition "Facebook Social Plugin".

When you access a page of our website that contains such a plugin, your browser establishes a direct connection with Facebook's servers. The content of the plugin is transmitted by Facebook directly to your browser and integrated into the website by it.

Through the integration of the plugins, Facebook receives the information that you have accessed the corresponding page of our website. If you are logged into Facebook, Facebook can assign the visit to your Facebook account. When you interact with the plugins, for example by pressing the "Like" button or posting a comment, the corresponding information is transmitted by your browser directly to Facebook and stored there.

Legal basis: Art. 6(1)(a) GDPR (consent via cookie banner)

Purpose: Integration of social media functions, enabling content sharing

Data transfer: Facebook processes data partly in the USA. Meta Platforms is certified under the EU-US Data Privacy Framework.

Objection: If you do not want Facebook to collect data about you via our website, you must log out of Facebook before visiting our website. You can also completely block Facebook plugins with add-ons for your browser.

More information about the purpose and scope of data collection and its processing by Facebook in Facebook's privacy policy: https://www.facebook.com/about/privacy/

6.3 Google Tag Manager

We use Google Tag Manager, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

Description and scope: Google Tag Manager is a tag management solution that allows us to manage so-called website tags via an interface. Tags are small code elements on our website that serve, among other things, to measure traffic and visitor behavior, to record the impact of online advertising and social channels, to use remarketing and targeting to audiences, and to test and optimize websites.

Google Tag Manager itself (which implements the tags) is a cookieless domain and does not record any personal data. The Tag Manager triggers other tags, which may in turn collect data. This collection is done by the tools integrated via the Tag Manager (e.g. Google Analytics, Facebook Pixel).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient management and optimization of our marketing tools)

Purpose: Central management and implementation of analysis and marketing tags without direct code changes

Data transfer: The Tag Manager can transfer technical information (IP address, browser, device) to Google servers in the USA. Google is certified under the EU-US Data Privacy Framework.

Objection: You cannot directly deactivate the Tag Manager, but you can deactivate the individual services integrated via the Tag Manager (e.g. Google Analytics, Facebook Pixel) via our cookie banner.

More information about Google Tag Manager: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/

6a. Meta Pixel (Facebook Pixel)

We use the "Meta Pixel" (formerly "Facebook Pixel"), a service of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta"), on our website.

6a.1 Description and Scope of Data Processing

The Meta Pixel is a code fragment integrated on our website that records various visitor actions. The following data are collected and transmitted to Meta:

Technical information: IP address, browser type, operating system, device type
Visited URLs and timestamps
Interactions on the website (page views, clicks, products added to cart, purchases)
HTTP referrer (previous website)
Cookie data and device IDs
For logged-in Facebook users: assignment to your Facebook profile

The Meta Pixel places cookies (see section 4.3: _fbp, fr), which enable recognition of your browser during subsequent visits.

6a.2 Purposes of Using the Meta Pixel

We use the Meta Pixel for the following purposes:

Conversion tracking: Measuring the effectiveness of our Facebook and Instagram advertising campaigns by recording conversions (e.g. purchases, registrations)

Custom Audiences: Creating audiences based on website visitors for targeted advertising on Facebook and Instagram

Remarketing: Displaying personalized ads to people who have already visited our website

Lookalike Audiences: Creating audiences similar to our existing customers

Optimization of advertising campaigns: Automatic optimization of the delivery of our ads to people likely to perform the desired action

6a.3 Legal Basis

The legal basis for using the Meta Pixel is Art. 6(1)(a) GDPR (consent). Processing only takes place when you have given your consent via our cookie banner.

6a.4 Data Transfer to Third Countries

Meta also processes the collected data on servers in the USA. Meta Platforms is certified under the EU-US Data Privacy Framework. More information: https://www.dataprivacyframework.gov/

In addition, we have concluded standard contractual clauses with Meta in accordance with Art. 46 GDPR.

6a.5 Storage Duration

Meta stores the data collected via the Pixel for different periods:

Event data (e.g. page views, purchases): 90 days
Custom Audiences: Up to 180 days after last activity or until deletion by us
Cookies: Up to 90 days (cookie _fbp)

6a.6 Objection and Opt-out Options

You have various options to prevent data collection by the Meta Pixel:

1. Cookie banner: Reject marketing cookies in our cookie banner or revoke your consent.

2. Facebook settings: If you have a Facebook account, you can deactivate the display of personalized ads in your ad settings:

Facebook: https://www.facebook.com/settings?tab=ads
Instagram: Via the app under Settings → Ads

3. Browser settings: Block cookies from Meta in your browser settings or use browser add-ons like "Facebook Container" (Firefox).

4. Log out of Facebook: Log out of Facebook before visiting our website to prevent direct assignment to your profile.

More information about Meta Pixel and privacy:

Meta privacy policy: https://www.facebook.com/privacy/explanation
Meta Pixel data usage: https://www.facebook.com/business/help/742478679120153
Meta cookie policy: https://www.facebook.com/policies/cookies/

6b. Google Ads Conversion Tracking

We use Google Ads conversion tracking, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), to measure the effectiveness of our Google Ads advertising campaigns.

6b.1 Description and Scope of Data Processing

When you click on one of our Google ads, a conversion tracking cookie is stored on your device. These cookies lose their validity after 30 days and do not serve personal identification.

If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognize that you clicked on the ad and were redirected to this page.

Collected data:

Cookie ID
Timestamp of ad click
Pages visited on our website
Actions performed (e.g. purchases, registrations)
IP address (shortened)
Technical information (browser, device, operating system)

Each Google Ads customer receives a different cookie. Cookies can therefore not be tracked across the websites of Google Ads customers.

6b.2 Purpose of Use

The information obtained using the conversion cookie serves to:

Create conversion statistics (e.g. how many users make a purchase after clicking on an ad)
Measure the success of our advertising campaigns
Optimize our advertising campaigns
Calculate the cost per conversion

6b.3 Legal Basis

The legal basis for using Google Ads conversion tracking is Art. 6(1)(a) GDPR (consent). Processing only takes place when you have given your consent via our cookie banner.

6b.4 Data Transfer to Third Countries

Google also processes your data on servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework. More information: https://www.dataprivacyframework.gov/

6b.5 Storage Duration

The conversion cookies have a storage duration of 30 days. The conversion statistics are stored by Google for different periods, usually for 90 days.

6b.6 Objection and Opt-out Options

You can prevent participation in conversion tracking in various ways:

1. Cookie banner: Reject marketing cookies in our cookie banner or revoke your consent.

2. Browser settings: Set your browser to block cookies from the domain "googleadservices.com".

3. Google Ads settings: Deactivate personalized ads in your Google account settings:
https://adssettings.google.com/

4. Browser plugin: Install the Google Analytics opt-out browser add-on:
http://tools.google.com/dlpage/gaoptout

5. Other opt-out options:
- Digital Advertising Alliance: http://www.aboutads.info/choices/
- Network Advertising Initiative: http://www.networkadvertising.org/choices/

More information about Google Ads and privacy:

Google Ads privacy policy: https://policies.google.com/privacy
Google Ads conversion tracking: https://support.google.com/google-ads/answer/1722022

7. Shopify E-commerce Platform

Our website is hosted on the Shopify e-commerce platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (or if you are located in North America, Shopify Inc., 151 O'Connor Street, Ground floor, Ottawa, Ontario, K2P 2L8, Canada).

7.1 Scope of Data Processing

Shopify processes the following data to provide the e-commerce infrastructure:

Order data (products, quantities, prices)
Customer data (name, address, email, phone number)
Payment information (however not permanently stored by us)
Technical data (IP address, browser, device)
Usage behavior (visited pages, clicks, dwell time)

7.2 Legal Basis and Purpose

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in reliable hosting and e-commerce infrastructure)

Purpose: Provision of the online shop, order processing, payment processing, shipping handling, customer support

7.3 Shopify Analytics

Shopify automatically collects analytics data about the use of our shop:

Number of visitors and page views
Dwell time and bounce rates
Conversions and cart abandonments
Product views and purchases
Geographic origin of visitors

These data serve to optimize our shop offering and improve the user experience.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in shop optimization)

7.4 Storage Duration

Shopify stores your data as long as you have a customer account with us or we are legally obliged to store them (e.g. tax retention obligations of up to 10 years).

7.5 Data Transfer to Third Countries

Shopify processes data on servers in Canada and the USA. Shopify is certified under the EU-US Data Privacy Framework and has concluded standard contractual clauses with us.

More information about privacy at Shopify: https://www.shopify.com/legal/privacy

8. Payment Service Providers

8.1 PayPal

On our website, we offer payment via PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you pay with PayPal, your entered payment data are transmitted to PayPal. Data transfer to PayPal takes place on the basis of Art. 6(1)(b) GDPR (contract performance) and only to the extent necessary for payment processing.

PayPal can also transfer data to the USA. PayPal is certified under the EU-US Data Privacy Framework.

More information about data processing by PayPal in PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

8.2 Shopify Payments

We use Shopify Payments as an additional payment service provider. Shopify Payments is provided by Shopify International Limited resp. Shopify Inc. and works with various payment service providers (e.g. Stripe).

When paying via Shopify Payments, your payment data are transmitted encrypted via a secure connection. We do not store credit card data ourselves. Payment data are directly transmitted to the payment service providers and processed there.

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Purpose: Secure processing of online payments

Data transfer: Shopify Payments can transfer data to the USA and Canada. Shopify is certified under the EU-US Data Privacy Framework.

More information: https://www.shopify.com/legal/privacy

9. Shipping Service Providers

For shipping processing, we pass on your data to the following shipping service providers:

9.1 DHL (Deutsche Post DHL Group)

Provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

Transmitted data: Name, delivery address, phone number (optional), email address (for track & trace), package contents (product description)

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Purpose: Delivery of ordered goods

Storage duration: According to legal retention obligations in transport law

9.2 DPD (DPD Deutschland GmbH)

Provider: DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany

Transmitted data: Name, delivery address, phone number (optional), email address (for track & trace)

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Purpose: Delivery of ordered goods

9.3 Swiss Post

Provider: Die Schweizerische Post AG, Wankdorfallee 4, 3030 Bern, Switzerland

Transmitted data: Name, delivery address, phone number (optional), email address (optional)

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Purpose: Delivery of ordered goods

10. Newsletter

10.1 Description and Scope of Data Processing

You have the option to subscribe to our newsletter via our website. Newsletter dispatch is done via Shopify. For this purpose, the following data are transmitted to us during registration:

Email address (mandatory)
IP address of the accessing computer
Date and time of registration

For data processing, your consent is obtained during the registration process and reference is made to this privacy policy.

After your registration, you will receive an email to confirm your registration (double opt-in procedure). Only after confirmation by clicking the link in this email will you be added to the newsletter mailing list.

10.2 Legal Basis and Purpose of Data Processing

The legal basis for processing data after newsletter registration by the user in the presence of consent is Art. 6(1)(a) GDPR.

The collection of the email address serves to deliver the newsletter. The collection of the IP address and time of registration serves to be able to trace possible misuse of the email address of a data subject at a later time and as proof of the consent given.

10.3 Storage Duration

The data are deleted as soon as they are no longer necessary for achieving the purpose for which they were collected. The user's email address is therefore stored as long as the newsletter subscription is active.

10.4 Possibility of Objection and Removal

The newsletter subscription can be terminated by the affected user at any time. For this purpose, there is a corresponding link in each newsletter. This also enables revocation of consent to the storage of personal data collected during the registration process.

11. Registration and Customer Account

11.1 Description and Scope of Data Processing

You have the option to register on our website and create a customer account. The following data are collected:

Email address (mandatory)
Password (stored encrypted)
Salutation, first and last name
Address (billing address, optional delivery address)
Phone number (optional)
IP address and time of registration

During the registration process, your consent to the processing of this data is obtained.

11.2 Legal Basis and Purpose of Data Processing

The legal basis for processing data in the presence of consent is Art. 6(1)(a) GDPR. If registration serves contract performance or implementation of pre-contractual measures, the additional legal basis is Art. 6(1)(b) GDPR.

Registration is necessary for providing certain content and services on our website. A customer account enables you in particular to:

Place orders without having to enter your data again
View your order history
Manage your address data
Save your settings

11.3 Storage Duration

The data are deleted as soon as they are no longer necessary for achieving the purpose for which they were collected. This is the case when you delete your customer account. Further storage may occur if we are legally obliged to store (e.g. commercial or tax retention obligations of up to 10 years for order data).

11.4 Possibility of Objection and Removal

You have the option at any time to delete your customer account. Contact us for this via the contact details provided or use the account deletion function in your customer area.

11a. Order Processing and Contract Performance

11a.1 Description and Scope of Data Processing

When purchasing products in our online shop, the following personal data are collected and processed as part of order processing:

Mandatory information:

Salutation, first and last name
Billing address (street, house number, postal code, city, country)
Email address
Order data (ordered products, quantities, prices, order number, order date)

Optional information:

Different delivery address
Phone number
Company details (for business orders)

Automatically collected data:

IP address
Date and time of order
Payment information (however not permanently stored by us, but directly transmitted to payment service providers)

The information is required for processing your purchase contract. Without this information, we cannot process your order.

11a.2 Legal Basis of Data Processing

The legal basis for processing data as part of order processing is Art. 6(1)(b) GDPR (contract performance). Processing is necessary for fulfilling the purchase contract.

11a.3 Data Disclosure

Your order data are disclosed to the following recipients to the extent necessary for contract performance:

Shipping service providers (DHL, DPD, Swiss Post): Name, delivery address, phone number (optional), email address (for track & trace)
Payment service providers (PayPal, Shopify Payments): Name, billing address, email address, payment information
Shopify (e-commerce platform): All order data for technical processing (see section 7)

Disclosure to other third parties does not take place unless we are legally obliged to do so (e.g. to tax authorities) or you have expressly consented.

11a.4 Storage Duration

Your order data are stored for the duration of contract processing. After conclusion of the contract, data are stored for the duration of legal retention obligations:

Commercial retention obligations (§ 257 HGB): 10 years for commercial books, inventories, opening balance sheets, annual financial statements, accounting documents
Tax retention obligations (§ 147 AO): 10 years for invoices and accounting documents

After expiration of these periods, data are deleted unless you have consented to further storage or we are obliged for legal reasons to longer storage.

11a.5 Possibility of Objection and Removal

The collection and processing of data are absolutely necessary for fulfilling the purchase contract. Without this data, we cannot process your order. An objection to data processing as part of contract performance is therefore not possible as long as the contractual relationship exists.

After expiration of legal retention periods, you can request deletion of your order data at any time.

12. Contact Form and Email Contact

12.1 Description and Scope of Data Processing

A contact form is available on our website, which can be used for electronic contact. If a user takes advantage of this option, the data entered in the input screen are transmitted to us and stored. These data are typically:

Name
Email address
Subject
Message
IP address and time of sending

Alternatively, contact is possible via the provided email address. In this case, the user's personal data transmitted with the email are stored.

In this context, no disclosure of data to third parties takes place. The data are used exclusively for processing the conversation.

12.2 Legal Basis and Purpose of Data Processing

The legal basis for processing data in the presence of consent is Art. 6(1)(a) GDPR. The legal basis for processing data transmitted during email sending is Art. 6(1)(f) GDPR. If email contact aims at contract conclusion, the additional legal basis is Art. 6(1)(b) GDPR.

The processing of personal data serves us solely for handling the contact. In case of contact by email, this also constitutes the required legitimate interest in data processing.

12.3 Storage Duration

The data are deleted as soon as they are no longer necessary for achieving the purpose for which they were collected. For personal data from the input screen of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been finally clarified.

Further storage may occur if legal retention obligations exist.

12.4 Possibility of Objection and Removal

The user has the option at any time to revoke consent to the processing of personal data. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. Contact us for this via the contact details provided.

All personal data stored in connection with the contact are then deleted, to the extent that no legal retention obligations oppose this.

13. Product Reviews

If you post a product review on our website, the following data are stored:

Your name or pseudonym (as provided by you)
Email address (not published)
Review text
Review stars
Date of review
IP address (for abuse prevention)

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest in genuine customer reviews)

Purpose: Publication of customer opinions, improvement of product quality, building trust

Storage duration: Reviews are stored permanently until you request deletion or we must delete the review for legal reasons.

13a. IMPORTANT: Your Right to Object

You have the right to object at any time to the processing of your personal data!

According to Art. 21 GDPR, you can particularly object to:

Objection to direct marketing: If your data are processed for advertising purposes, you can object at any time and without giving reasons. After your objection, we will no longer use your data for advertising purposes.

Objection to processing based on legitimate interests: If processing takes place on the basis of Art. 6(1)(f) GDPR (legitimate interest), you can object for reasons arising from your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds.

How to object:

Email: dataprotection@vision.ch
Phone: +41 44 560 94 30
In writing: Vision Consulting AG, Compliance, Bächausstrasse 61, CH-8806 Bäch SZ, Switzerland

In case of objection to newsletter: Click the unsubscribe link in each newsletter.

In case of objection to cookies and tracking: Adjust your settings in the cookie banner or use browser settings.

14. Rights of the Data Subject

If personal data concerning you are processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

14.1 Right of Access (Art. 15 GDPR)

You can request confirmation from us as to whether personal data concerning you are being processed by us. If such processing exists, you can request information from us about the following:

the purposes for which the personal data are processed
the categories of personal data being processed
the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed
the envisaged storage duration of the personal data concerning you
the existence of a right to rectification or erasure of the personal data concerning you
the existence of a right to restriction of processing or a right to object to such processing
the existence of a right to lodge a complaint with a supervisory authority
all available information about the origin of the data if the personal data are not collected from the data subject
the existence of automated decision-making including profiling and meaningful information about the logic involved as well as the scope and intended effects of such processing for the data subject

You have the right to request information about whether the personal data concerning you are transferred to a third country or to an international organization. In this connection, you can request information about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

14.2 Right to Rectification (Art. 16 GDPR)

You have a right to rectification and/or completion vis-à-vis the controller, insofar as the processed personal data concerning you are inaccurate or incomplete.

14.3 Right to Restriction of Processing (Art. 18 GDPR)

Under the following conditions, you can request restriction of processing of the personal data concerning you:

if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data
processing is unlawful and you oppose erasure of the personal data and instead request restriction of the use of the personal data
the controller no longer needs the personal data for the purposes of processing, but you need them for the establishment, exercise or defense of legal claims
if you have objected to processing pursuant to Art. 21(1) GDPR and it is not yet established whether the legitimate grounds of the controller override your grounds

14.4 Right to Erasure (Art. 17 GDPR)

You may request the controller to erase without undue delay the personal data concerning you, and the controller is obliged to erase these data without undue delay, provided one of the following grounds applies:

The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed
You withdraw consent on which processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for processing
You object to processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object to processing pursuant to Art. 21(2) GDPR
The personal data concerning you have been unlawfully processed
Erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the Member State to which the controller is subject

The right to erasure does not exist to the extent that processing is necessary:

for exercising the right of freedom of expression and information
for compliance with a legal obligation or for the performance of a task in the public interest
for the establishment, exercise or defense of legal claims

14.5 Right to Notification (Art. 19 GDPR)

If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.

14.6 Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. In addition, you have the right to transmit these data to another controller without hindrance from the controller to whom the personal data have been provided, provided:

processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and
processing is carried out by automated means

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible.

14.7 Right to Object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

14.8 Right to Withdraw Data Protection Consent (Art. 7(3) GDPR)

You have the right to withdraw your data protection consent declaration at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

14.9 Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority responsible for the Netherlands is the Autoriteit Persoonsgegevens:

Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ The Hague
Netherlands
Website: https://autoriteitpersoonsgegevens.nl/

15. Data Security

During website visits, we use the widespread SSL (Secure Socket Layer) procedure in combination with the highest encryption level supported by your browser. This is typically 256-bit encryption. If your browser does not support 256-bit encryption, we instead use 128-bit v3 technology. Whether an individual page of our Internet presence is transmitted encrypted is shown by the closed display of the key or lock symbol in the lower status bar of your browser.

Furthermore, we use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in accordance with technological development.

16. Currency and Amendment of this Privacy Policy

This privacy policy is currently valid and has the status of October 2025.

Due to the further development of our website and offers on it or due to changed legal or regulatory requirements, it may become necessary to change this privacy policy. The current privacy policy can be accessed and printed by you at any time on the website at https://www.betterwalls.nl/pages/privacy