Legal
Privacy Policy
Which data we process, why, and what your rights are.
This English version is provided for convenience. The German version is the legally binding one.
1. Controller
Nedjat Nuhi, Bahnhofstrasse 5a, 5210 Windisch, Switzerland, info@nedjatnuhi.com. The Swiss Federal Act on Data Protection (FADP) applies. For persons in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR) and the UK GDPR apply in addition.
2. Which data we process and why
Orders. When you buy a print, we process your name, delivery address, e-mail address, phone number (for the carrier), the ordered motif with finish and size, the amount and the payment reference. Purpose: performance of the contract – production, shipping, order confirmation, queries – and statutory retention. Legal basis under the GDPR: Art. 6 (1) (b) and (c).
Payment. Payment is processed by Stripe. You enter card and payment details directly with Stripe; we neither see nor store them. Stripe tells us whether the payment succeeded and passes on the name, e-mail address and delivery address you enter at checkout.
Contact form. Name, e-mail address, subject and message are delivered to us by e-mail and kept as long as needed to answer. Legal basis under the GDPR: Art. 6 (1) (b) and (f).
Use of the website. When pages are requested, technical data such as IP address, date and time, requested page and browser type are processed so that the site can be delivered and kept secure. In addition we use Google Analytics to measure reach (see section 3).
Login. The login area of the website is reserved for the operator. Visitors cannot register.
3. Recipients and service providers
We use the following service providers, which process data on our behalf:
- Google Ireland Ltd. / Google LLC – Firebase and Google Cloud. Hosting of the website, database for order data (stored in Belgium, EU), file storage, server functions for checkout and order processing.
- Google – Google Analytics 4. Statistical evaluation of usage (page views, origin, device type) with shortened IP addresses – only if you agreed in the cookie banner. Without consent no Google script is loaded and no cookie is set. You can change your choice at any time: .
- Google Fonts. The website's fonts are loaded from Google servers; your IP address is transmitted to Google in the process.
- Stripe Payments Europe Ltd. (Ireland) / Stripe Inc. (USA). Payment processing. Privacy notice: stripe.com/privacy.
- Gelato ASA (Norway) and its production partners. Production and shipping of the prints. Gelato receives name, delivery address, e-mail address, phone number and the print file; depending on the delivery country, production takes place in Switzerland, Germany, the United Kingdom or the USA.
- Resend (USA). Sending of order confirmations, shipping notifications and messages from the contact form.
4. Transfer of data abroad
Some of these providers process data in the USA or in other countries outside Switzerland and the EEA. The transfer relies on the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the standard contractual clauses of the European Commission. Order data is passed on only to the extent needed for production, shipping and payment.
5. Cookies and local storage
The website itself sets no cookies. It only keeps your language choice, your chosen delivery country and your cookie decision in your browser's local storage; this information never leaves your browser. Google Analytics sets cookies to recognise returning visits (lifetime up to 14 months) only after your consent. Stripe sets cookies during payment to prevent fraud.
6. Retention
We keep order data for ten years, as long as statutory retention duties require it. Contact requests are deleted once the matter is settled. Analytics data is deleted after 14 months.
7. Your rights
You have the right to information about your data, to rectification, erasure and restriction of processing, to data portability and the right to object to processing. You may withdraw consent at any time. Contact info@nedjatnuhi.com for this. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EEA or the United Kingdom, with the supervisory authority there.
8. Changes
We adapt this policy when the website or the services used change. The version published here applies.
Last updated: 4 September 2026