Data Controller
Within the meaning of art. 5 let. j of the Federal Act on Data Protection (nFADP), the data controller is:
Company DAVILA — La Galerie Numismatique Sàrl
Address Rue du Petit-Chêne 32, 1003 Lausanne, Switzerland
Email galnum@bluewin.ch
Data Protection Advisor [Name and contact details, if appointed]
Data Collected
We collect the following categories of data:
- Identification data — name, first name, postal address, email, telephone
- Transaction data — purchase history, invoices, auction orders
- Payment data — processed exclusively by our service providers (Stripe, PostFinance, banks); the Gallery stores no banking data
- Technical data — IP address, browser type, pages visited, visit duration
- AML data — copy of identity document for transactions subject to art. 7 of the Anti-Money Laundering Act
Purposes and Legal Bases
Your data is processed for the following purposes:
- Performance of contract (art. 31 para. 2 let. a nFADP) — processing of orders, deliveries, invoices, support
- Legal obligation (art. 31 para. 2 let. b nFADP) — bookkeeping (10 years, CO art. 958f), AML, taxation
- Legitimate interest (art. 31 para. 2 let. d nFADP) — site security, fraud prevention, service improvement
- Consent (art. 6 para. 7 nFADP) — sending of the newsletter, new item alerts
No automated profiling is carried out within the meaning of art. 5 let. f nFADP.
Retention Periods
Client data 10 years after the last transaction (accounting obligation)
AML data 10 years (art. 7 para. 3 AMLA)
Newsletter Until withdrawal of consent
Technical logs 12 months maximum
Analytics cookies 13 months maximum
Transmission and International Transfers
Your data may be shared with our sub-processors: hosting provider, payment processors, carriers (DHL, FedEx), accountant, legal counsel. All are bound by a sub-processing agreement within the meaning of art. 9 nFADP.
In the event of a transfer outside Switzerland to a country not providing adequate protection (art. 16 nFADP), we implement the standard contractual clauses recognised by the FDPIC, or obtain your explicit consent. The list of adequate countries is published in Annex 1 of the DPO.
Your Rights
In accordance with arts. 25 to 29 nFADP (and the GDPR if you reside in the EEA), you have the following rights:
- Right of access to your data (art. 25 nFADP)
- Right of rectification and updating (art. 32 nFADP)
- Right to erasure subject to statutory retention obligations
- Right to object to processing and to prospecting
- Right to data portability (art. 28 nFADP)
- Right to withdraw consent at any time
Any request may be sent to galnum@bluewin.ch. We will respond within 30 days. A copy of an identity document may be requested to verify your identity.
Supervisory Authority
If you believe that the processing of your data infringes the nFADP, you may file a complaint with:
Authority Federal Data Protection and Information Commissioner (FDPIC)
Address Feldeggweg 1, 3003 Berne, Switzerland
Website www.edoeb.admin.ch
If you reside in the EEA, you may also contact the data protection authority of your country of residence.
Security
We implement appropriate technical and organisational measures (art. 8 nFADP), including TLS encryption, daily backups, access controls, staff training and two-factor authentication for sensitive accounts. As no system is entirely infallible, we cannot however guarantee absolute security against all threats.