🇨🇭 Order by 5 PM for next business day delivery
Free shipping from CHF 50
Bunaroba

Privacy Policy

This privacy policy explains what personal data we (Bunaroba GmbH, Zugerstrasse 6, 6330 Cham, Switzerland – "Bunaroba", "we") process in connection with our website bunaroba.ch, our online shop and the partner & ambassador programme. It fulfils the information obligations of the revised Swiss Data Protection Act (revDSG) and – where applicable – the General Data Protection Regulation (GDPR).

1. Data Controller & Responsible for Data Protection Matters

1.1 Data Controller
Bunaroba GmbH
Zugerstrasse 6, 6330 Cham, Switzerland

1.2 Responsible for data protection matters
Roger Giese

2. Categories of Data Subjects & Data Types

Customers & Shop Users

Name, address, email, phone number, payment & order data, IP address, device and usage data

Website Visitors

Truncated IP, device ID, browser/system info, cookie IDs, click path

Affiliate Partners / Ambassadors

Name, company, email, social handles, payout data (bank/PayPal), tax ID, affiliate ID, performance statistics, UGC content

Newsletter Subscribers

Email, open & click behaviour

Support Requests

Communication content, metadata

3. Purposes & Legal Bases of Processing

  • Contract performance (purchases, deliveries, partner commissions) – Art. 31(1) revDSG / Art. 6(1)(b) GDPR
  • Website operation & security / fraud prevention – Legitimate interest, Art. 31(1) revDSG / Art. 6(1)(f) GDPR
  • Marketing emails, newsletter – Consent, Art. 30(1) revDSG / Art. 6(1)(a) GDPR
  • Affiliate tracking, cookie placement – Consent (for non-essential cookies) or legitimate interest for purely technical cookies
  • Accounting, tax & commercial obligations – Legal obligation, Art. 31(1) revDSG / Art. 6(1)(c) GDPR
  • Publication of UGC on our channels – Licence per partner T&Cs + legitimate interest in marketing

4. Affiliate Programme – Specifics

4.1 Registration data – To participate we collect name, contact and payment data as well as social media profiles.

4.2 Tracking – When a partner link is clicked, we set a 30-day cookie with the anonymous affiliate ID. The cookie is only set after the user's consent (consent banner).

4.3 Performance data – Purchases, conversion rates, revenue and commission status are stored in our affiliate dashboard.

4.4 Order details in the affiliate dashboard – When an order is attributed to a partner via an affiliate link or discount code, order details may be visible in the partner/affiliate dashboard for commission settlement purposes (in particular first name, last name, ordered products/line items and quantities, as well as order value and commission status).

4.5 We do not transmit contact data such as email address, phone number or delivery address to the affiliate partner.

4.6 Payouts – For bank transfers or PayPal payments we transmit payment data to financial or payment service providers.

4.7 UGC usage – Content created by a partner within the programme may be used by us without time or territorial limitation in accordance with our T&Cs. Where customary, we credit the creator's account name.

4.8 Referral forwarding – When visiting via a partner link, the referral ID is stored in the browser session (sessionStorage) and forwarded to shop links. This storage is not persistent and is deleted when the browser is closed. It is based on our legitimate interest in correct commission attribution.

4.9 Partner responsibility – Affiliates warrant that their advertising activities comply with all data protection, food and competition regulations and that advertising is clearly identified as such. Violations may result in suspension of the partner account.

5. Recipients & Data Sharing

We only share personal data to the extent necessary for contract performance, operation of our services or fulfilment of legal obligations.

a) Shop Platform & Order Processing

Shopify Inc. (Canada)
Purpose: Operation of the online shop, processing of order, customer and payment data.
Legal basis: Contract performance (Art. 31(1) revDSG / Art. 6(1)(b) GDPR).
Transfer mechanism: Standard Contractual Clauses (SCC).
Shopify Privacy Policy

b) Fulfilment & Shipping

Fulfilment provider (Switzerland)
Purpose: Warehousing, picking and packing of orders.
Data: Name, delivery address, order details, phone number where applicable.
Legal basis: Contract performance. No third-country transfer.

Swiss Post AG (Switzerland) and, where applicable, additional carriers (e.g. DPD)
Purpose: Parcel transport and shipment tracking.
Data: Name, delivery address, order reference.
Legal basis: Contract performance. No third-country transfer.

c) Subscription Management

Appstle Inc. (USA)
Purpose: Management of delivery subscriptions, intervals and payment data.
Legal basis: Contract performance.
Transfer mechanism: Standard Contractual Clauses (SCC).
Appstle Privacy Policy

d) Affiliate & Partner Programme

UpPromote (Secomapp) (Vietnam/USA)
Purpose: Commission calculation and order attribution within the ambassador and active lifestyle partner programme. UpPromote is also used for cookie-based affiliate tracking (see Section 6).
Data: Order value, ordered products/line items and quantities, partner attribution, and – for attributed orders – first name and last name (no email address, no delivery address, no phone number).
Legal basis: Contract performance / legitimate interest.
Transfer mechanism: Standard Contractual Clauses (SCC).
UpPromote Privacy Policy

Note: Order details for attributed orders may be displayed to the respective affiliate partner in the partner dashboard so that commissions can be settled transparently.

e) Product Reviews

Judge.me Ltd (United Kingdom)
Purpose: Collection and display of product reviews. Data: name, email address, review content.
Legal basis: Legitimate interest in product transparency.
Transfer mechanism: Adequacy decision (UK recognised as adequate level of data protection).
Judge.me Privacy Policy

f) Web Analytics & Search Engine Optimisation

Google Search Console – Google Ireland Ltd (Ireland)
Purpose: Aggregated search performance data. No personal visitor data is transmitted.
Google Privacy Policy

g) Marketing & Advertising

Google Merchant Center / Google Shopping – Google Ireland Ltd (Ireland)
Purpose: Transmission of product catalogue data for Google Shopping ads. No customer data is transmitted.
Google Privacy Policy

Meta Commerce Manager / Product Catalogue – Meta Platforms Ireland Ltd (Ireland)
Purpose: Transmission of catalogue data for dynamic ads on Facebook and Instagram. No customer data is transmitted.
Meta Privacy Policy

h) Other Recipients

Depending on the situation, personal data may also be shared with other recipients, for example:

  • Payment providers for payment processing
  • Tax and accounting service providers
  • Legal advisors for legal matters
  • Authorities in the case of legal obligations

i) Hosting & Content Delivery

Vercel Inc. (USA)
Purpose: Website hosting, content delivery, edge functions.
Data: IP address, HTTP request metadata, server logs.
Transfer mechanism: Data Processing Addendum (DPA) with Standard Contractual Clauses (SCC).
Vercel Privacy Policy

Transfers to third countries (e.g. USA, Canada) are based on Standard Contractual Clauses (SCC) or adequacy decisions. We note that US authorities may potentially access data (Art. 17 revDSG).

6. Cookies & Tracking Technologies

Essential Cookies

We use technically necessary cookies for the operation of the website. These are used to store language settings and cookie consent. They are processed on the basis of our legitimate interest in operating the website.

  • bunaroba_consent – Stores the user's cookie settings (cookie + localStorage). Valid for 1 year.
  • Session cookie – Login session, shopping cart. Valid until browser close.

Analytics Cookies (with consent)

The following analytics services are only activated with the user's explicit consent:

Google Analytics 4
We use Google Analytics 4 for web analytics. Anonymised usage data is collected to understand and improve the use of our website. Cookie duration: max. 13 months. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data transfer to the USA based on the EU-US Data Privacy Framework (DPF).
Google Privacy Policy

Hotjar
Hotjar helps us understand user behaviour on our website – through heatmaps, click behaviour and scroll depth. No personal data is shared with third parties. Provider: Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta.
Hotjar Privacy Policy

Marketing Cookies (with consent)

The following marketing services are only activated with the user's explicit consent:

Meta Pixel (Facebook/Instagram)
The Meta Pixel is used for conversion tracking for Facebook and Instagram advertising. Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Data transfer to the USA possible.
Meta Privacy Policy

Google Ads
Google Ads is used for conversion tracking and remarketing. Provider: Google Ireland Limited. Data transfer to the USA based on the EU-US Data Privacy Framework (DPF).
Google Privacy Policy

UpPromote Affiliate Tracking
UpPromote enables tracking of affiliate partners and their commissions. Cross-domain tracking takes place between bunaroba.ch and shop.bunaroba.ch. Cookie duration: 30 days.
UpPromote Privacy Policy

Google Consent Mode v2

We use Google Consent Mode v2. This means that Google services (Analytics, Ads) automatically respect the user's cookie settings. Without the user's consent, no analytics or marketing cookies are set. Google Consent Mode enables statistical modelling to extrapolate aggregated data without processing personal data of users who have not given consent.

Manage Consent

Cookie settings can be changed at any time. Click the following link to do so:

7. Data Retention

  • Contract & accounting data: 10 years (statutory retention)
  • Affiliate performance logs: 10 years after programme end (tax/evidence obligations)
  • Cookie IDs / web analytics: 13 months (GA4); 30 days (affiliate)
  • Marketing consents: until withdrawal + 3 years for evidence
  • Support tickets: 3 years after case closure

8. Data Security

  • Transport encryption: TLS 1.3
  • Storage encryption: AES-256
  • Access control: Role-based, 2-factor authentication
  • Penetration tests: Annually by external specialists
  • Incident response: Notification to FDPIC & affected persons within 72 h in case of high risk

9. Data Subject Rights

Under the Swiss Data Protection Act (revDSG) and the GDPR, the user has the following rights:

  • Right of access: The user has the right to obtain information about the personal data processed by Bunaroba.
  • Right to rectification: The user may request the correction of inaccurate or incomplete data.
  • Right to erasure: The user may request the deletion of personal data, provided no legal retention obligations exist.
  • Restriction of processing: Under certain conditions, the user may request the restriction of the processing of personal data.
  • Data portability: The user has the right to receive personal data in a commonly used, machine-readable format.
  • Right to object: The user may object to the processing of personal data for direct marketing purposes at any time.
  • Withdrawal: Consent may be withdrawn at any time with effect for the future.
  • Right to complain: The user has the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

To exercise data subject rights, please contact:

10. Profiling & Automated Decisions

We do not carry out profiling with legal effect. Affiliate tracking serves solely for commission allocation, not for automated decision-making.

11. Children's Data

Our services are not directed at persons under 16 years of age. We do not knowingly collect data from minors.

12. Changes to this Policy

We update this privacy policy as needed. Material changes will be communicated via banner or email. The current version is always available at bunaroba.ch/en/legal/privacy.

13. Contact

Responsible for data protection matters:
Roger Giese, Responsible for data protection matters

Bunaroba GmbH, Zugerstrasse 6, 6330 Cham, Switzerland

Authoritative Language Version

These legal provisions were written in German. In the event of translations into other languages, in case of discrepancies or ambiguities, only the German version shall be authoritative and binding.

Version: 21 February 2026