Privacy Policy
Last updated: May 2026
1. Data Controller
MappaMuse Sole Proprietorship Email: mappamuse.hesitant135@passmail.com For questions regarding data protection, please contact us by email.
2. Overview of Data Processing
We only process personal data to the extent necessary for providing our website and services. Processing is based on the Swiss Data Protection Act (nDSG/FADP) and, where applicable, the GDPR. Legal bases for processing: • Contract performance (Art. 31 para. 2 lit. a nDSG) — for order processing • Legitimate interest (Art. 31 para. 1 nDSG) — for technical website operation and security • Consent (Art. 6 para. 6 nDSG) — for newsletter and optional services • Legal obligation — for tax-related retention of order data
3. Hosting
Our website is hosted by Vercel Inc. (USA). When visiting our website, your requests are processed through Vercel's servers. Your IP address may be transmitted to Vercel. Vercel processes this data as a data processor in accordance with our instructions. More information: https://vercel.com/legal/privacy-policy
4. Data Collection When Visiting the Website
When you visit our website, technical data is automatically collected (IP address, browser type, operating system, referrer URL, time of access). The legal basis is our legitimate interest in the secure and stable operation of the website. This data is deleted after 30 days. We do not use tracking cookies and do not employ any analytics tool with personal tracking.
5. Orders and Payment Processing
When you place an order, we collect: • Name and delivery address • Email address • Order details (product, size, color theme) The legal basis is contract performance (Art. 31 para. 2 lit. a nDSG). Payment processing is handled by Stripe (Stripe Payments Europe, Ltd.). Your payment data (card number, expiration date, CVV) is processed directly by Stripe and never stored on our servers. Stripe is PCI DSS Level 1 certified. More information: https://stripe.com/privacy We transmit to Stripe: email address, order amount, and currency. Stripe processes this data as an independent data controller.
6. Order Fulfillment and Printing
For production and shipping of your poster, we use Gelato ASA (Norway) as our fulfillment platform. We share only data required to perform your order: • Name and delivery address • Email address (optional for delivery/service notifications) • Order details (product, size, print file reference) Gelato processes end-customer order data as a processor under our instructions for order fulfillment. Gelato may engage local print providers as subprocessors. Logistics carriers may act as independent controllers for transport events, depending on their role. Relevant Gelato legal documents: • Privacy Policy: https://www.gelato.com/legal/privacy • Data Processing Terms: https://www.gelato.com/legal/data-processing-terms • API/Service Terms: https://www.gelato.com/legal/api-terms
7. Map Data
The maps displayed on our website are based on data from OpenStreetMap (© OpenStreetMap contributors, ODbL). Map tiles are provided by third parties (OpenFreeMap, Stadia Maps, ESRI, Amazon Web Services). When loading map tiles, your IP address may be transmitted to these providers.
8. Cookies
We exclusively use technically necessary cookies for payment processing (Stripe) and the shopping cart function. No tracking, marketing, or analytics cookies are used. The legal basis is our legitimate interest in operating the website.
9. Newsletter
If you subscribe to our newsletter, we store your email address and the date of your consent. The legal basis is your consent (Art. 6 para. 6 nDSG). You can unsubscribe at any time by using the unsubscribe link in the newsletter or by contacting us by email. After unsubscription, your email address is deleted without delay.
10. Data Storage and Retention Periods
Our database is hosted with Neon (Neon Inc., USA). Appropriate safeguards apply pursuant to Art. 16 nDSG/FADP. Retention periods: • Order data: 10 years (legal retention obligation per Art. 958f CO) • Server log data: 30 days • Newsletter data: until withdrawal of consent • Customer data without orders: deletion after 12 months of inactivity
11. Your Rights
You have the right to: • Access your stored data (Art. 25 nDSG) • Rectify inaccurate data (Art. 32 nDSG) • Delete your data (unless legal retention obligations apply) • Request surrender or transfer of your data (Art. 28 nDSG) • Object to processing Where GDPR applies, you additionally have rights to restriction of processing, data portability, and withdrawal of consent at any time with future effect. We process your request within 30 days. To exercise your rights, contact us by email: mappamuse.hesitant135@passmail.com
12. User Account and Session Cookies
If you create a user account, we store a signed session cookie (HMAC) that maintains your login. This cookie does not contain personal data, only an encrypted reference to your account. The cookie is deleted upon logout.
13. Web Analytics
We use Vercel Web Analytics. Vercel Web Analytics does not use third-party cookies and identifies visitors via a daily-reset hash. Only aggregated, anonymous usage statistics are collected. More information: https://vercel.com/docs/analytics/privacy-policy
14. Data Transfer Abroad
Some of our service providers are based outside Switzerland and/or the EEA: • Vercel (USA) — Website hosting • Stripe (Ireland/USA) — Payment processing • Neon (USA) — Database hosting • Cloudflare (USA) — Image storage (R2) • Gelato ASA and its print/fulfillment network (global, depending on production and delivery destination) Where personal data is transferred to countries without an adequate level of protection, we rely on appropriate safeguards (in particular Standard Contractual Clauses) and/or transfers to recipients certified under applicable Data Privacy Framework programs. Transfers only occur to the extent necessary for contract performance or the provision of our services (Art. 17 para. 1 lit. b nDSG/FADP; Art. 6(1)(b) GDPR).
15. Right to Complain
You have the right to file a complaint with the competent data protection supervisory authority: Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1 3003 Bern https://www.edoeb.admin.ch
16. Changes
We reserve the right to amend this privacy policy at any time. The current version is always available on our website. In case of material changes, we will notify registered users by email.