Legal

Privacy policy

Last updated: 1 November 2026

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, for example to visitors from the EU, we also comply with it. This page explains which data we process and why. This is a translation; in case of doubt, the German version applies.

Controller

El Pastelazo, Loah Mannale (sole proprietorship), Herbergsgasse 2, 4051 Basel, Switzerland, cakeart@elpastelazo.ch. Please send all data protection questions and requests to this address.

Visiting the website and hosting

The website runs on Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg; parent company Amazon.com Inc., USA). Pages are delivered via the Amazon CloudFront network, i.e. from a server near you. Form, image and newsletter data are stored in the Europe region (Stockholm, Sweden). When you visit, these servers process technically necessary information such as IP address, date and time, the page requested and your browser. We do not analyse this information or create profiles. Error logs of our interface (without form content) are deleted after 30 days. Legal basis under the GDPR: legitimate interest in a secure, working website (Art. 6(1)(f)).

Inquiry form and email

For an inquiry we process your name, email address, optionally your phone number and company, as well as product, preferred date, occasion, the delivery address for deliveries, your wishes, uploaded images and any voucher code. We use this data only to answer your inquiry, send you a quote and process the order. The confirmation email and our notification are sent via Amazon SES (Stockholm region). Inquiries are deleted automatically two years after the preferred date, uploaded images after one year. If the inquiry becomes an order, we keep invoices for as long as the law requires (usually ten years). Legal basis under the GDPR: steps prior to and performance of a contract (Art. 6(1)(b)).

Class registration

If you register for a scheduled class, we process your name, email address, optionally your phone number, the number of people, your note (e.g. allergies, only if you provide it), any voucher code and the status (registered, waiting list, cancelled) with the date. We use this information to run the class, manage places and the waiting list, send you confirmations and the cancellation link, and invoice the class. We delete registrations no later than two years after the class date; accounting records are kept for as long as the law requires. Legal basis under the GDPR: performance of a contract (Art. 6(1)(b)).

Spam protection

To prevent automated inquiries, the inquiry form uses Cloudflare Turnstile (Cloudflare Inc., USA). Turnstile checks technical characteristics such as IP address and browser to determine whether a human is filling in the form, and does not set advertising or tracking cookies. Legal basis under the GDPR: legitimate interest in preventing abuse (Art. 6(1)(f)). Cloudflare privacy policy: cloudflare.com/privacypolicy

If you subscribe to the newsletter, we store your email address, the chosen language and the time of subscription and confirmation (Amazon Web Services, Stockholm region). The subscription only becomes valid once you click the link in the confirmation email (double opt-in). Unconfirmed subscriptions are deleted automatically after 30 days. The newsletter is sent via Amazon Simple Email Service (Amazon Web Services, Stockholm region). To respect unsubscriptions, Amazon SES keeps a list with your email address and subscription status. We do not track whether you open a newsletter. You can unsubscribe at any time: via the link in every newsletter or with a short email to cakeart@elpastelazo.ch, and we will delete your address. Legal basis under the GDPR: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Statistics (Google Analytics)

Only if you choose “Accept” in the cookie notice do we use Google Analytics 4 (Google Ireland Limited, Ireland, and Google LLC, USA). Google then sets cookies (e.g. “_ga”, lifetime up to two years) and records which pages you visit and how you use the website, for example whether an inquiry was sent or whether you came to us via an advertisement. If you arrive via a Google ad, Google also transmits a click identifier so that we can see in Google Ads (Google Ireland Limited) whether the ad led to an inquiry or sign-up. Personalised advertising is switched off. We only see aggregated reports, not individual people. Without your consent Google Analytics is not loaded and no data is sent to Google. You can change your choice at any time via “Cookie settings” in the footer. Legal basis under the GDPR: your consent (Art. 6(1)(a)). Google privacy policy: policies.google.com/privacy

Google reviews

On the home page and the Weddings & events page we show reviews from our Google business profile. Our server retrieves them via the Google Places API (Google Ireland Limited or Google LLC, USA); no data about you is sent to Google in the process. Your browser loads the reviewers’ profile pictures directly from Google servers, which gives Google your IP address and technical information about your browser. Legal basis under the GDPR: legitimate interest in showing genuine customer opinions (Art. 6(1)(f)). Google’s privacy policy (policies.google.com/privacy) and the Google Maps terms (maps.google.com/help/terms_maps) apply.

Maps

On the contact page and for events you first only see a map image served by this website itself (map data © OpenStreetMap contributors). Only when you click “Load map” is the interactive Google Maps map (Google Ireland Limited / Google LLC, USA) loaded. Google then receives your IP address and technical information about your browser and may set cookies. If you choose “Always load maps directly”, your browser remembers this choice; you can delete it at any time via your browser data. Legal basis under the GDPR: your consent given by clicking (Art. 6(1)(a)).

Translations

Current content such as offers, events and the gallery is translated automatically with Amazon Translate. Only these texts are transmitted, no visitor data.

Cookies and browser settings

Without your consent we only store what the website needs in your browser: your cookie choice, the chosen language (cookie “pz_sprache”, one year), whether you have already closed a notice, whether maps should load directly and, only until you close the tab, the summary of your inquiry for the thank-you page. You can delete this information at any time in your browser settings.

Transfers abroad

Our data is stored in Sweden (EU); under Swiss law the EU provides adequate data protection. Amazon, Google and Cloudflare are companies based in the USA or with a US parent company, so access from the USA cannot be ruled out. These companies are certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework, which Switzerland and the EU recognise as adequate; standard contractual clauses also apply. Delivery via CloudFront uses servers worldwide.

Disclosure

We do not sell data or pass it on for advertising. Recipients are only the service providers named above, who process data on our behalf, and authorities where the law requires it.

Your rights

You can at any time request information about your data, have incorrect data corrected and data deleted, object to processing, request a copy of your data in a common format and withdraw consent you have given. A short email to cakeart@elpastelazo.ch is enough. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, if you live in the EU, with the data protection authority of your country.

Changes

We update this privacy policy when our website or the law changes. The version published here applies.