In short

The website runs on servers in Switzerland.
There are no advertising or tracking cookies, no social media plug-ins and no Google services. Fonts and scripts are served from my own server.
Visitor statistics run on my own server, without cookies and with shortened IP addresses.
Course bookings and vouchers are handled by Bookeo, shop payments by Stripe. This involves transfers abroad (see below).
I don’t sell data, and I only pass it on where it is needed for your booking, order or enquiry.

Who is responsible

FERRUM D Gentile
Daniel Gentile
Delsbergerstrasse 177
4242 Laufen
Switzerland
E-mail: info@ferrum-d.com

This policy covers ferrum-d.com and schmiedekurs.ch. It is based on the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, for example for orders from the EU, the notes in the last section apply as well.

Visiting the website and server log files

The website is hosted by cyon AG in Basel; the servers are in Switzerland. With every request the server records technically necessary information: IP address, date and time, the page requested, the amount of data transferred, the previous page (referrer), and browser and operating system. These log files are used for secure operation and troubleshooting. They are not combined with other data and are deleted automatically after a short time.

For safekeeping I regularly make backup copies of orders and form enquiries. They are transferred from the server in encrypted form and end-to-end encrypted before they are stored, so only I can open them. I keep them on my own computer and with a cloud storage provider in the EU, and only ever keep the two most recent.

Cookies and browser storage

The website only sets technically necessary cookies:

statamic-session keeps your session (e.g. the basket),
XSRF-TOKEN protects the forms against misuse.

Both expire after a few hours. In addition, your browser remembers locally (localStorage) whether you have closed the language notice or a promotion notice. This information never leaves your device. There are no advertising or tracking cookies, so no cookie banner is needed.

On the booking page and at checkout, Bookeo and Stripe set their own cookies that their services need (see below).

Visitor statistics

To see which pages are read, I use Matomo, statistics software that runs on my own server. Here, Matomo works without cookies, IP addresses are shortened before they are stored, and no data is passed to third parties. The reports are anonymous; individual visitors cannot be recognised.

Contact by e-mail, WhatsApp or SMS

When you write to me, I process the details you give (name, contact details, the content of your message) to answer your enquiry. My e-mail is stored with e-mail providers, currently in Switzerland and the EU; backup copies may also be held in other countries. I usually keep messages for up to two years; correspondence about orders and bookings for as long as the statutory retention periods require (see below).

WhatsApp belongs to Meta Platforms. If you write to me on WhatsApp, WhatsApp’s privacy policy applies as well. If you would rather avoid that, e-mail is best.

Forms (visits, enquiries, value vouchers)

The forms let you request a workshop visit, a bespoke piece, a sword course or a value voucher. I receive your details and any uploaded files by e-mail; a copy is stored on the web server in Switzerland. I use the details only for your enquiry. The copies on the server are deleted automatically after two years.

Course booking and vouchers via Bookeo

Courses and course vouchers are handled by the Bookeo booking system (Bookeo Pty Ltd, Macquarie Park NSW, Australia). The booking form is loaded directly from Bookeo. Bookeo receives the details you enter there (e.g. name, e-mail, phone, participants, chosen course, payment details) and sets its own technically necessary cookies. The data is processed in Australia or by Bookeo’s service providers. It is transferred abroad because this is necessary for the booking, i.e. for performing the contract with you. Bookeo’s privacy policy applies as well.

Shop: orders and payment

For an order from the knife shop I need your name, e-mail address, delivery and billing address and, where needed, your phone number. The order is stored on my own web server in Switzerland, not with a shop provider. For delivery, I pass your name and address to the carrier (usually Swiss Post).

Payments are processed by Stripe (Stripe Payments Europe Ltd, Ireland; parent company Stripe Inc., USA), including TWINT and cards. You enter your payment details directly with Stripe; I never see them. Stripe sets its own cookies to prevent fraud. For transfers to the USA, Stripe is certified under the Swiss-U.S. Data Privacy Framework. Stripe’s privacy policy applies as well.

I keep order and booking records for ten years, as Swiss law requires for business records and receipts.

Feedback from course participants

The website shows selected feedback that participants gave after their course, shortened and with first name and the initial of the surname only. If you would like your feedback removed, a short e-mail is enough.

Links to other services

The website links to Instagram, Google Maps, Apple Maps and WhatsApp. These are plain links; nothing is embedded. The provider’s terms only apply once you click a link.

Your rights

You can ask at any time what data I hold about you, have it corrected or deleted, and object to its processing, unless a statutory retention obligation prevents this. An e-mail to info@ferrum-d.com is enough; I may ask you to confirm your identity. You also have the right to complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Notes for people in the EU

Where the GDPR applies, I process your data to perform a contract or answer your enquiry (Art. 6(1)(b) GDPR), to meet legal obligations (Art. 6(1)(c)), and for the secure operation of the website and anonymous statistics (legitimate interest, Art. 6(1)(f)). You also have the right to restrict processing and to data portability, and the right to complain to the data protection authority in your country of residence. The European Commission recognises Switzerland as providing an adequate level of data protection.

Changes

I update this policy when something changes on the website or in the services used. The version published here applies.