Privacy Policy

Controller

Aalya AG, Route Principale 101, 1642 Sorens, Switzerland — office@aalya.ch.

What we process and why

Enquiries: when you use the contact form we process what you enter (name, email, phone, country, city, project details and your message) to answer your enquiry, prepare a proposal and, if you ask, send our catalogue.
Orders: when you buy from the textile shop we process your name, email, phone, shipping address and order details to fulfil the order, send confirmations and meet our accounting obligations.

Legal bases

Where the GDPR applies: pre-contractual steps and performance of a contract (Art. 6(1)(b) GDPR), legal obligations such as accounting (Art. 6(1)(c)) and our legitimate interest in operating and securing the site (Art. 6(1)(f)). In Switzerland we process data in line with the Federal Act on Data Protection (revDSG).

Payments

Payments are processed by Stripe on Stripe's own secure checkout page. Your card details go directly to Stripe and never reach our server. Stripe processes payment data as an independent controller under its own privacy policy (stripe.com/privacy).

Email delivery

Enquiry and order emails are sent through Resend (Resend, Inc., USA). Data may therefore be transferred to the USA. [Replace: confirm the safeguard from Resend's data processing agreement, e.g. EU standard contractual clauses.]

Hosting

The site is hosted by Railway Corporation (USA) on servers located in the Netherlands. The host records technical data (IP address, date, pages visited) to operate and secure the site. Railway is bound by a data processing agreement including the European Commission's standard contractual clauses.

Cookies and storage

This site uses no cookies and no analytics or tracking tools. Your cart is saved only in your own browser (local storage) so it is still there when you return; it is not sent to us until you check out. Fonts and images are served from our own server.

Retention

Enquiries are kept as long as needed to handle them and any resulting business relationship. Order records are kept for 10 years as required by Swiss accounting law. Then data is deleted.

Your rights

You may request access to, correction or deletion of your data, object to its processing and, where the GDPR applies, request restriction or portability, by writing to office@aalya.ch. You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (www.edoeb.admin.ch) or, where the GDPR applies, with the authority of your country of residence.

Last updated: 4 October 2026