Legal

Privacy Policy

1. Data Protection at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website or shop with us. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in the privacy policy below.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. Its contact details can be found in the section "Notice concerning the responsible party" in this privacy policy.

How do we collect your data?

Web analytics with Matomo

To improve our offering we use the self-hosted analytics software Matomo. The analysis works without cookies; your IP address is truncated (anonymised) before it is stored, so that it cannot be traced back to you. The data never leaves our servers and is not passed on to third parties; raw data is deleted automatically after 180 days. If your browser sends the «Do Not Track» signal, your visit is not recorded.

Some data is collected because you provide it to us, e.g. when creating a customer account, placing an order, filling in the contact form, or signing up for the newsletter.

Other data is collected automatically when you visit the website, in particular technical data (e.g. browser type, operating system, page visited, time of the visit). This is collected in anonymised form as part of our self-hosted web analytics (Matomo) and without the use of cookies.

What do we use your data for?

Some data is collected to ensure the website is provided without errors. Other data is used for anonymised analysis of user behaviour. Order data is used to fulfil the contract, process payment, deliver the goods, and maintain a customer account. With your consent, we also use your email address to send our newsletter.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction, deletion or restriction of the processing of this data, and to object to processing. If you have given consent to data processing, you may revoke this consent at any time with effect for the future. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC / EDÖB).

For this and any further questions on data protection, you may contact us at any time at info@deluxe-sleep.ch.

2. Hosting

We host the content of our website and the associated database with the following provider:

Hetzner Online GmbH

This website is hosted externally by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Personal data collected on this website is stored on Hetzner's servers within the EU. This may in particular include IP addresses, order and account data, contact inquiries, meta and communication data, and other data generated via the website.

External hosting is carried out for the purpose of fulfilling our contracts with customers and in the interest of a secure, fast and efficient provision of our online shop. Hetzner processes your data only to the extent necessary to fulfil its service obligations and exclusively on our instructions. A corresponding data processing agreement is in place with Hetzner.

3. General Information and Mandatory Disclosures

Data protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations — in particular the revised Swiss Federal Act on Data Protection (FADP/revFADP, "DSG/revDSG") — as well as this privacy policy.

When you use this website or place an order with us, various pieces of personal data are collected. This privacy policy explains what data we collect, what we use it for, and how and for what purpose this happens.

Please note that data transmission over the internet (e.g. when communicating by email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Notice concerning the responsible party

The party responsible for data processing on this website is:

Deluxe Moebel GmbH

Fabrikstrasse 26a

CH-9220 Bischofszell

Phone: +41 71 230 10 70

Email: info@deluxe-sleep.ch

The responsible party is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

Retention period

Unless a more specific retention period is stated within this privacy policy, your personal data will remain with us until the purpose for the processing no longer applies. Invoicing and accounting-related data is retained for ten years due to statutory commercial retention requirements under Swiss law. Raw data from our web analytics (Matomo) is automatically deleted after 180 days. If you assert a legitimate request for deletion or revoke your consent, your data will be deleted unless we have other legally permissible reasons for retaining it.

Recipients of personal data

In the course of our business activities we work with carefully selected external service providers who process data on our behalf (processors) or to whom we transmit data for the performance of a contract. We only pass on personal data to external parties where this is necessary for contract performance, where we are legally obliged to do so, where we have a legitimate interest in the disclosure, or where another legal basis permits the disclosure. Corresponding data processing agreements are in place with all processors.

We use in particular the following service providers:

- **Stripe** (Stripe Payments Europe, Limited resp. Stripe, Inc.) — for processing payments in our online shop (including credit card, TWINT, Apple Pay, Google Pay). This may involve a transfer of data to the USA.

- **Brevo** (Sendinblue GmbH) — for sending order confirmations and other transactional emails (sent from orders.deluxe-sleep.ch) and, with your consent, for sending our newsletter (double opt-in procedure).

- **Hetzner Online GmbH** (Germany/EU) — hosting of our online shop and the associated database, see section 2.

- **Cloudflare, Inc.** — content delivery network (CDN), reverse proxy and security services (including protection against attacks) for our website. This may involve a transfer of data to the USA.

- **Matomo** (self-hosted on our own infrastructure) — web analytics. Matomo runs on our own servers; no data is shared with third parties. See section 6 for details.

- **OpenAI** (OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland) — for measuring the effectiveness of our advertising in ChatGPT (the "OpenAI Ads Measurement Pixel" and OpenAI Conversions API) and for displaying product ads based on our product catalogue. See section 6, "OpenAI Ads (Conversion Measurement)", for details. This may involve a transfer of data to the USA.

- **Meta** (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) — for measuring the effectiveness of our advertising on Facebook and Instagram (the "Meta Pixel" and Meta Conversions API). See section 6, "Meta (Facebook) Ads (Conversion Measurement)", for details. This may involve a transfer of data to the USA.

Since 14 September 2026 we use the OpenAI Ads Measurement Pixel and the OpenAI Conversions API to measure the effectiveness of our advertising in ChatGPT (see section 6, "OpenAI Ads (Conversion Measurement)", for details), as well as the Meta Pixel and Meta Conversions API to measure the effectiveness of our advertising on Facebook and Instagram (see section 6, "Meta (Facebook) Ads (Conversion Measurement)", for details). Beyond that, we do not use any third-party advertising trackers or marketing cookies (e.g. Google Analytics, Google Ads).

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent (e.g. sending the newsletter). You may revoke consent already given at any time. The lawfulness of data processing carried out prior to the revocation remains unaffected.

Right to data portability

You have the right to receive data that we process automatically on the basis of your consent or in fulfilment of a contract, in a common, machine-readable format, or to have it transferred to a third party, insofar as this is technically feasible.

Access, rectification, deletion and objection

Under applicable data protection law (DSG/revDSG), you have the right at any time to obtain free information about your personal data stored by us, its origin and recipients, and the purpose of the processing. You also have the right to rectification, deletion or restriction of the processing of your data, as well as a right to object to certain processing. For this and any further questions regarding personal data, you may contact us at any time at info@deluxe-sleep.ch.

You also have the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), Feldeggweg 1, CH-3003 Bern (www.edoeb.admin.ch).

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders, payment data or inquiries, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from "http://" to "https://" and by the lock icon in your browser bar.

4. Data Collection on This Website

Cookies

Our online shop is designed to be largely cookie-free. Our web analytics (Matomo, see section 6) operates entirely without cookies.

We use exclusively technically necessary cookies required to operate the shop, in particular for:

- the shopping cart function,

- logging in to your customer account (session cookie),

- security functions (e.g. protection against form abuse).

These necessary cookies are automatically deleted at the end of your session or after a short time. We do not use any third-party marketing, advertising or tracking cookies.

Customer account and registration

When you create a customer account, we collect and store the data you provide (e.g. name, address, email address, password in encrypted form, and your order history). We use this data to process your orders and to provide the functions of your customer account. You may request deletion of your customer account at any time, provided no statutory retention obligations apply.

Order, billing and delivery data

When you place an order, we collect the data necessary to fulfil the contract, in particular name, billing and delivery address, email address, phone number, and details of the ordered goods. This data is passed on for order processing, invoicing and delivery to logistics partners commissioned by us, to the extent necessary for contract performance. Invoice data is retained for ten years due to statutory retention obligations.

Payment processing — Stripe

Payment processing in our online shop is carried out via the payment service provider Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin, Ireland, resp. Stripe, Inc., USA). Via Stripe you can pay by, among others, credit card, TWINT, Apple Pay or Google Pay. Data you enter during the payment process (e.g. card details) is transmitted directly to Stripe and processed there; we ourselves do not receive or store complete payment card data. Data transmission may also take place to the USA. Stripe processes your data as an independent responsible party resp. as our processor, in accordance with applicable law and the agreements concluded with Stripe. For more information, see Stripe's privacy policy at https://stripe.com/ch/privacy.

Product reviews

If you review a product with us, we process the data you provide (e.g. name or display name, review text, rating) for the purpose of publishing the review in our shop. Providing this data is voluntary. You may request deletion of a review you have written from us at any time.

Contact form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provide, are stored by us for the purpose of processing the inquiry and for any follow-up questions. We do not pass on this data without your consent. The data remains with us until you ask us to delete it, revoke your consent, or the purpose for storing the data no longer applies; mandatory statutory retention periods remain unaffected.

Inquiries by email or telephone

If you contact us by email or telephone, your inquiry, including all resulting personal data (name, inquiry), is stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

5. Newsletter and Order Emails

Sending via Brevo

For sending order confirmations and other transactional emails (e.g. shipping notifications), we use the Brevo service provided by Sendinblue GmbH, Köpenicker Strasse 126, 10179 Berlin, Germany. These emails are sent from the address orders.deluxe-sleep.ch. Processing is carried out to fulfil the purchase contract concluded with you.

If you would like to subscribe to our newsletter, we need your email address. Registration takes place via a double opt-in procedure: after signing up, you will receive a confirmation email; by confirming it, you give us your consent to send the newsletter. Newsletter delivery is also carried out via Brevo.

Your data remains with us resp. with Brevo until you unsubscribe from the newsletter and is then deleted from the mailing list, unless other purposes (e.g. contract data) require retention. You may unsubscribe at any time via the unsubscribe link in each newsletter email or by writing to info@deluxe-sleep.ch.

6. Web Analytics and Other Tools

Matomo (self-hosted)

We use the web analytics service Matomo to analyse the use of our website. Matomo is self-hosted by us — no data is transmitted to third parties, and all data remains on our own servers.

Our Matomo implementation is configured so that:

- no cookies are set,

- your IP address is truncated resp. anonymised before storage,

- visits from browsers sending the "Do Not Track" signal are not recorded,

- the collected raw data is automatically deleted after 180 days.

We do not use services such as Google Analytics. We use third-party advertising or marketing trackers only in the form described in the following section.

OpenAI Ads (Conversion Measurement)

Since 14 September 2026 we use the "OpenAI Ads Measurement Pixel" and the associated OpenAI Conversions API on every page of our online shop to measure the effectiveness of our advertising in ChatGPT.

What is collected: A script from bzrcdn.openai.com is loaded when you visit our website. If you arrive at our website via an ad in ChatGPT, a click reference ("oppref") is read from the landing-page URL and stored in a first-party cookie named `__oppref` so it can be reused on later page views. When you complete an order, we send a purchase event — order number, gross value in CHF, and the product IDs of the items purchased — to OpenAI both from your browser (the pixel) and from our own server (the Conversions API). The server-side event additionally includes your email address, but this is never transmitted in clear text — it is hashed beforehand using the one-way SHA-256 algorithm. If the pixel's "Automatic Advanced Matching" is enabled, it may also automatically hash further customer data you enter into forms in your browser using SHA-256 and include it; your raw (plain-text) data is never sent to OpenAI.

Purpose: Measuring the effectiveness, i.e. the conversion success, of our advertising in ChatGPT — establishing whether an ad click led to a purchase in our shop.

Legal basis: We rely on our overriding interest in measuring the effectiveness of our advertising spend, and on our duty to inform under the revised Swiss Data Protection Act (DSG/revDSG), which this section fulfils. Where consent is required in an individual case — for instance for visitors from the EEA, to whom the GDPR additionally applies — we obtain it separately.

Recipient / country: OpenAI (OpenAI Ireland Ltd., Dublin, Ireland, and OpenAI OpCo, LLC, San Francisco, USA) processes the data partly on servers in the USA. This transfer to the USA takes place on the basis of Standard Contractual Clauses provided by OpenAI.

Retention period: OpenAI's pixel documentation (developers.openai.com/ads/measurement-pixel) does not state a fixed retention period for the `__oppref` cookie or the transmitted event data. What applies is set out in OpenAI's advertiser terms.

Objection: You can prevent the `__oppref` cookie from being set using your browser's tracking-protection features, or delete it afterwards in your browser settings. We do not use a cookie consent banner for our shop; instead, you can object to the use of the OpenAI Ads Measurement Pixel via our opt-out page, "Disable ad measurement" (https://deluxe-sleep.ch/en/werbe-opt-out).

Ads on ChatGPT: To display product ads in ChatGPT, we also share data from our product catalogue (including product name, price, image and a link to the product page) with OpenAI.

Meta (Facebook) Ads (Conversion Measurement)

Since 14 September 2026 we use the "Meta Pixel" and the associated Meta Conversions API on every page of our online shop to measure the effectiveness of our advertising on Facebook and Instagram.

What is collected: A script from connect.facebook.net is loaded when you visit our website, which sets first-party cookies named `_fbp` (and, if you arrive at our website via an ad, `_fbc`) so your browser can be recognised on later page views. When you complete an order, we send a purchase event — order number, gross value in CHF, and the product IDs of the items purchased — to Meta both from your browser (the pixel) and from our own server (the Conversions API). These product IDs are our own internal product numbers; as of 14 September 2026 we have not connected a product catalogue with Meta, so these identifiers are not matched to any product listing or catalogue entry on Meta's side. The server-side event additionally includes, where available, your email address, first name, last name, city and postal code, as well as the country ("CH") — but these are never transmitted in clear text; they are hashed beforehand using the one-way SHA-256 algorithm. We additionally transmit your IP address and browser user agent unencrypted, as Meta requires these for deduplication and fraud prevention.

Purpose: Measuring the effectiveness, i.e. the conversion success, of our advertising on Facebook and Instagram — establishing whether an ad click led to a purchase in our shop.

Recipient / country: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, processes the data partly on servers in the USA. This results in a transfer of data to the USA.

Retention period: According to Meta, the `_fbp` cookie is stored for 90 days by default; Meta's documentation available to us does not state a fixed retention period for `_fbc` or the transmitted event data. What applies is set out in Meta's current advertiser/Business Tools Terms.

Objection: You can prevent the `_fbp`/`_fbc` cookies from being set using your browser's tracking-protection features, or delete them afterwards in your browser settings. We do not use a cookie consent banner for our shop; instead, you can object to the use of the Meta Pixel via our opt-out page, "Disable ad measurement" (https://deluxe-sleep.ch/en/werbe-opt-out) — the same link you can use to object to the OpenAI Ads Measurement Pixel.

Cloudflare

We use the service Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a content delivery network (CDN), reverse proxy, and to protect our website against attacks (e.g. DDoS protection). Cloudflare routes traffic between your browser and our servers; in doing so, technical data such as your IP address may be processed. This may involve a transfer of data to the USA. Cloudflare acts as our processor in this context. For more information, see Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.

Last updated: 14 September 2026