Privacy policy

1. Controller

Hoti Enterprise (sole proprietorship), Schächlistrasse 6, 8953 Dietikon, Switzerland – email: info@dulutscher.ch

2. Which data we process

• Sender data: name, billing address, email, optional phone number, payment information (processed by Stripe or TWINT).
• Recipient data: the recipient’s name and delivery address, and the relationship chosen by the sender. This data comes from the sender, not from the recipient.
• Order data: order number, chosen box, personal message, delivery window, stop code, payment status.
• Security data: risk assessments, block lists (as an address hash), abuse reports, IP-based access limits.
• Usage and measurement data (optional): if tracking is not turned off – see section 8.

3. Why we process it

• fulfilling and delivering the order;
• preventing abuse (harassment, stalking, threats) – this is our overriding legitimate interest in storing the recipient’s address without their consent;
• enforcing address blocks that recipients set themselves;
• meeting legal duties, in particular towards prosecution authorities;
• audience measurement and marketing (only if tracking has not been turned off).

4. Anonymity and its limits

Parcels are anonymous to the recipient. The sender’s identity is stored internally and disclosed to authorities on a lawful order. Recipients who send a “Revanche” box back do not learn who the original sender is; the platform carries out the delivery.

5. Sharing with third parties

• Payment providers: Stripe Payments Europe Ltd. or TWINT AG – to process the payment.
• Delivery partners: receive only the recipient data needed for delivery.
• Analytics and marketing services (if tracking is on): Google LLC (Google Tag Manager / Google Analytics), Meta Platforms Ireland Ltd. (Meta Pixel), TikTok Technology Limited / TikTok Information Technologies UK Limited (TikTok Pixel). Technical data (for example an IP address in shortened or processed form, device and browser information, page views, conversion events) may be transferred to countries outside Switzerland – in particular the United States. The providers commit to appropriate safeguards (including standard contractual clauses).
• Authorities: where there is a reasonable suspicion of criminal behaviour and a legal duty.

We do not sell data to third parties.

6. Retention

We keep order and sender data for as long as abuse prevention and statutory retention require (as a rule 10 years for business records). Address blocks stay in place until the recipient asks for them to be lifted. Tracking data held by the providers follows their own deletion periods.

7. Your rights

You have the right to access your personal data, to have it corrected or deleted, and to receive a copy, unless overriding interests (in particular abuse prevention and the protection of others) or legal duties stand in the way. Requests: info@dulutscher.ch.

8. Cookies, sessions and tracking

The platform uses technically necessary cookies and storage (session, CSRF protection, saving the order form). They are required to run the website and cannot be turned off.

Unless you opt out, we also use Google Tag Manager (container ID GTM-MWP57DVF) to load optional analytics and marketing tags, in particular:

• Google Analytics 4 (measurement ID G-B86EWPX448) – audience, page views, conversions;
• Meta Pixel – audience and conversion measurement for Meta ads (if enabled in Tag Manager);
• TikTok Pixel – audience and conversion measurement for TikTok ads (if enabled in Tag Manager).

Swiss data-protection law does not require a consent cookie banner of the kind used in the EU. We explain it here, and you can turn optional tracking off at any time. The choice is stored locally in your browser (localStorage and a cookie dulutscher_tracking_opt_out) so that Google Tag Manager and the marketing tags above are not loaded.

9. Contact

Privacy questions: info@dulutscher.ch