Privacy Policy Verein claro Büren

Controller

The controller within the meaning of data protection law, in particular the EU General Data Protection Regulation (GDPR), is:

Verein claro Büren
Hauptgasse 57
3294 Büren, Switzerland
Email: clarobueren@gmail.com

1. General information

Under Article 13 of the Swiss Federal Constitution and the federal data protection provisions (Data Protection Act, FADP), everyone has the right to protection of their privacy and to protection against misuse of their personal data. The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Together with our hosting providers, we strive to protect our databases as well as possible against unauthorised access, loss, misuse or falsification.

Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

By using this website, you consent to the collection, processing and use of data as described below. This website can generally be visited without registration. Data such as pages accessed or names of files retrieved, date and time are stored on the server for statistical purposes without being directly linked to you. Personal data, in particular name, address or email address, is collected on a voluntary basis wherever possible. Data is not passed on to third parties without your consent.

2. Processing of personal data

Personal data is any information relating to an identified or identifiable person. A data subject is a person about whom personal data is processed. Processing includes any handling of personal data, regardless of the means and procedures used, in particular storing, disclosing, obtaining, deleting, saving, modifying, destroying and using personal data.

We process personal data in accordance with Swiss data protection law. In addition, where and insofar as the EU GDPR applies, we process personal data on the following legal bases under Art. 6(1) GDPR:

• (a) processing of personal data with the consent of the data subject;
• (b) processing of personal data to perform a contract with the data subject;
• (c) processing of personal data to comply with a legal obligation to which we are subject under any applicable EU law or the applicable law of a country in which the GDPR applies in whole or in part;
• (d) processing of personal data to safeguard our legitimate interests or those of third parties, unless overridden by the fundamental rights, freedoms and interests of the data subject. Legitimate interests include in particular our business interest in providing our website, information security, enforcing our own legal claims and complying with Swiss law.

We process personal data for as long as necessary for the relevant purpose or purposes. Where longer retention is required by legal or other obligations to which we are subject, we restrict processing accordingly.

3. Cookies

This website uses cookies. These are small text files that make it possible to store specific information relating to the user on the user's device while they use the website. Cookies make it possible in particular to determine how often the pages are used and by how many users, to analyse how the pages are used, and to make our offering more customer-friendly. Cookies remain stored after the end of a browser session and can be retrieved when you visit the site again. If you do not want this, you should set your browser to refuse cookies.

4. Contact form

If you send us enquiries via the contact form, your details from the form, including the contact details you provide, are stored by us to handle the enquiry and in case of follow-up questions. We do not pass this data on without your consent.

5. Newsletter

If you would like to receive the newsletter offered on this website, we need your email address and information that allows us to verify that you own that address and agree to receive the newsletter. No further data is collected. We use this data solely to send the requested information and do not pass it on to third parties. You can withdraw your consent to the storage of the data and email address and their use for sending the newsletter at any time, for example via the "unsubscribe" link in the newsletter.

6. Plugins

6.1. Google Maps. This website uses Google Maps. This allows us to show you interactive maps directly on the website and lets you use the map function conveniently. When you visit the website, Google receives the information that you have accessed the relevant subpage of our website. This happens regardless of whether Google provides a user account you are logged into or whether no user account exists. If you are logged in to Google, your data is assigned directly to your account. If you do not want it assigned to your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for advertising, market research and/or tailoring its website. Such analysis is carried out in particular (even for users who are not logged in) to provide tailored advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise it, you must contact Google. Further information on the purpose and scope of data collection and processing by Google, as well as your rights and privacy settings, is available at www.google.de/intl/de/policies/privacy.

6.2. Google reCAPTCHA. This website uses the reCAPTCHA service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland, "Google"). The check serves to distinguish whether input is made by a human or by automated processing. It involves sending your IP address and any other data Google requires for reCAPTCHA to Google. For this purpose, your input is transmitted to Google and used further there. However, Google first shortens your IP address within member states of the European Union or other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of this service. The IP address transmitted by your browser as part of reCAPTCHA is not merged with other Google data. Your data may also be transferred to the USA. For data transfers to the USA, an adequacy decision of the European Commission, the "Privacy Shield", exists. Google participates in the "Privacy Shield" and has submitted to its requirements. By triggering the check, you consent to the processing of your data. Processing is based on your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

6.3. Facebook. This website uses features of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. When you open our pages with Facebook plug-ins, a connection is established between your browser and Facebook's servers, and data is already transferred to Facebook. If you have a Facebook account, this data may be linked to it. If you do not want this data linked to your Facebook account, please log out of Facebook before visiting our site. Interactions, in particular using a comment function or clicking a "Like" or "Share" button, are also passed on to Facebook. Learn more at de-de.facebook.com/about/privacy.

6.4. Instagram. Our website includes features of the Instagram service, provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. If you are logged in to your Instagram account, you can link the content of our pages to your Instagram profile by clicking the Instagram button. This allows Instagram to associate your visit to our pages with your user account. Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or its use by Instagram. For more information, see Instagram's privacy policy: instagram.com/about/legal/privacy.

7. Changes

We may amend this privacy policy at any time without prior notice. The current version published on our website applies. Where this privacy policy forms part of an agreement with you, we will inform you of any update by email or in another suitable way.

8. Questions

If you have any questions about data protection, please email us or contact the controller named at the beginning of this privacy policy directly.

9. claro Access app & membership management

The claro Access app (powered by ByteKey) gives registered members access to the claro shop via a personal QR code. The app is operated by HumanByte GmbH, Basel, on behalf of claro fair trade AG.

9.1. Data collected. When you register for and use the claro Access app, we collect the following personal data:

• Full name (required)
• Phone number (required)
• Email address (required)
• Home address (optional)
• Entry timestamps – date and time of each entry to the shop using your QR code
• Personal QR code – a unique access code tied to your identity for claro shop locations

9.2. Purpose of data collection. We collect and process this data exclusively for the following purposes:

• Phone number: to verify your identity at registration and login using a one-time SMS code (OTP)
• Name, email address and optional home address: to create and manage your membership
• Entry timestamps: to manage shop access, detect unauthorised use and support security investigations
• Personal QR code: as unique, non-transferable proof of access

Your data is not used for advertising, profiling or any purpose other than those listed above.

9.3. Third-party providers & transfers abroad. To operate the claro Access app, we work with the following processors:

• HumanByte GmbH (Basel, Switzerland) – operates the claro Access app on behalf of claro fair trade AG
• Supabase (contracting party: Supabase Pte. Ltd., Singapore; hosted in the EU, Ireland) – cloud database provider storing member data, including name, phone number, email address, optional address and entry data
• Cloudflare, Inc. (USA) – infrastructure provider running the app's backend processing
• Twilio Inc. (USA) – communications provider sending one-time SMS codes (OTP) to your phone number at registration and login

Some of these providers are based outside Switzerland and the EU/EEA. Transfers to these countries, in particular the USA, are based on standard contractual clauses, the Swiss-U.S. or EU-U.S. Data Privacy Framework, or equivalent safeguards under applicable data protection law. These providers are contractually obliged to process your data only on our instructions and in accordance with applicable regulations.

9.4. Data retention. We store your personal data for as long as your claro Access account is active. After your account is deleted or deactivated, your data is handled in accordance with applicable Swiss data protection law and any statutory retention obligations. Entry timestamps and security-related records may be retained beyond account deletion where this is necessary for legitimate security, operational or legal reasons.

9.5. Your rights. You have the right to obtain information about the data stored about you, to have incorrect data corrected, and to request deletion of your account and associated data. You can delete your account directly in the claro Access app (My Profile → ··· → Delete account) or contact us by email at clarobueren@gmail.com. In the event of a data breach, we will inform you in accordance with applicable law.

Büren, 29 October 2026