Privacy policy

1. What this is about

In this privacy policy, Petro-Handels GmbH explains which personal data we process in connection with our website www.petrohandels.ch, our online shop, the chat and our enquiry and contact channels, why we do so and what rights you have.

We comply with the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). Where the EU General Data Protection Regulation (GDPR) applies to you – for example if you contact us or order from a country in the EU or EEA – the information on legal bases and rights in this policy applies in addition.

Additional information may apply to individual contracts, quotations or services, e.g. in our general terms and conditions or in an order confirmation.

2. Controller and contact

The controller responsible for the processing described in this policy is:

• Petro-Handels GmbH, Tösstalstrasse 5, 8360 Wallenwil, Switzerland
• Email: info@petrohandels.ch
• Phone: +41 71 973 75 75

For questions about data protection and to exercise your rights, the easiest way to reach us is by email to info@petrohandels.ch (subject "Data protection") or by post to the address above.

3. What data we process

• Contact details: name, company, address, email address, phone number and, for companies, possibly the UID (company identification) number.
• Content of your enquiries and messages: from the contact form, the chat, emails and information from our configurators and checks (e.g. about your fuel station or installation).
• Order and contract data: products ordered, delivery and billing address, delivery and payment method, payment status, correspondence.
• Customer account and newsletter data: for a customer account (B2B login), customer number, company, stored email addresses, addresses, customer discount and orders; for the newsletter, email address, optionally first name and company, language and the time of subscription and confirmation.
• Technical data: IP address, date and time of access, page requested, browser and operating system, referring page.
• Application data: information and documents you send us with a job application.

As a rule, we only process data that you provide to us yourself or that arises technically when you visit the website. Please do not send us sensitive personal data (e.g. health data) via forms or the chat unless this is necessary.

4. Visiting the website and server log files

When you visit our website, our hosting provider's server infrastructure automatically processes the technical data transmitted by your browser (see section 3). This is necessary to deliver the pages, ensure stable and secure operation and detect and fend off misuse such as attacks or spam.

These server log files are kept only as long as necessary for these purposes and are then deleted or anonymised. We do not combine them with other data or analyse them for marketing purposes.

We serve fonts and images from our own website; no connections are made to third parties such as Google Fonts, map services or video platforms for this purpose when you load a page (for the chat, see section 7). Links to external websites – e.g. manufacturers' sites or the TeamViewer QuickSupport download – only open when you click them; the privacy policy of the respective provider applies there.

5. Cookies and local storage – no tracking

We do not use analytics, tracking or advertising cookies and do not use any third-party tracking tools (such as Google Analytics or social media pixels). Your browsing behaviour is neither used for advertising nor passed on. For anonymous visitor statistics, we count on our own server in Switzerland which pages are viewed (page, search term in the shop, referring website, campaign tag from the link, device class and language) – without cookies, without storing the IP address and without user profiles. To count visits per day, a non-reversible checksum that changes daily is formed from the IP address and browser data and deleted after 48 hours at the latest. If “Do Not Track” or “Global Privacy Control” is enabled in your browser, nothing is counted.

We only use storage that is technically necessary for the functions you request:

• Language choice (cookie "NEXT_LOCALE"): remembers the language you selected if it differs from your browser's language setting. The cookie is only valid for the current browser session.
• Shopping cart (your browser's local storage, "ph_cart_v2"): contains only item numbers and quantities so that your cart is kept. It stays on your device until you empty it or delete your browser data.
• Chat (only once you open the chat): only after you click the chat button does the chat window store an identifier in a cookie or your browser's local storage so that an ongoing conversation can be continued when you change pages or visit again later. As long as you do not open the chat, nothing is stored.
• Customer account (only after login, cookie "__Host-ph_kunde"): after you log in via the login link, we set a technically necessary, signed session cookie containing your customer number and email address so that you remain logged in. It is valid for a maximum of 30 days and is deleted when you log out.

You can delete or block cookies and local storage in your browser settings at any time. The website remains usable, but your language choice, shopping cart, ongoing chats and customer account login will then no longer be saved.

6. Contact form, quotation requests and configurators

When you contact us via the contact form or a quotation or callback request, we process your name, email address, topic and message and – optionally – your company and phone number. Our configurators and checks (e.g. dispenser configurator, solution finder, renovation check, fault reporter) run in your browser; their result is only transmitted when you send it as an enquiry via the contact form. Via the “Report a fault” form we also process the location, details of the installation and any photos or documents you upload; they are transmitted encrypted (HTTPS) and forwarded by email to our support team.

For the callback form, we process your name, phone number, the preferred time window for the callback and – optionally – your company, email address and request. We use this information solely to call you back as requested and to handle your request.

We use this information to answer your enquiry, prepare a quotation and continue communicating with you. Enquiries are stored in our customer communication platform so that our team can handle them in one place. A control field that is invisible to visitors helps us filter out automated spam submissions; no additional data is collected for this.

7. Chat and AI assistant

You can write to us via a chat window on our website. The chat window is only loaded when you open the chat, i.e. when you click the chat button – before that, no connection is made to the chat server and no chat cookies are set. Only from that click onwards is the chat window loaded from our customer communication platform's server; technical data such as your IP address and browser information are transmitted to that server, and an identifier is stored (see section 5).

Initial replies in the chat are given by an AI assistant. Its replies are generated automatically on the basis of our website content and our shop range. They may contain errors and are non-binding; quotations, appointments and commitments are given exclusively by our staff.

So that the assistant can reply, the history of your conversation (your messages and previous replies) is transmitted to our AI provider Anthropic PBC in the USA and processed there to generate the reply. Under Anthropic's contractual terms for commercial use, this content is not used to train AI models. For disclosure abroad, see section 14.

Please do not enter sensitive data, passwords, payment details or confidential business information in the chat.

If you would like to speak to a person, or if a quotation, an appointment or customer-specific information is needed, the assistant hands the conversation over to our team. For this purpose it may ask you, on a voluntary basis, for your name and phone number or email address and write a short internal summary for our staff. From the handover onwards, only staff members reply. Chat histories are stored in our customer communication platform so that we can handle your request and trace it if questions arise.

8. Online shop: order, payment and shipping

For an order or order request we need your first and last name, address, email address and phone number, optionally your company, UID number and comments, as well as the selected items, delivery and payment method. We use this information to process your order, keep you informed of its status, deliver, invoice and handle any warranty cases.

Your order is stored in our order system and in our customer communication platform. You receive an order confirmation by email, for which we use an email delivery service. You can check the status of your order via a personal, non-public link.

Payment

For payment by invoice or in advance, we process the payment data as part of our accounting. Purchase on invoice is only offered to companies – after our review or for activated customer accounts (GTC § 3 para. 3); for this review we use the information in your order and our previous business relationship.

For online payment with TWINT or card, we use the Swiss payment service provider Payrexx AG. If you choose this payment method, we transmit to Payrexx the order number, amount, your name, email address and – if provided – company and phone number. You enter your card or TWINT details directly on Payrexx's payment page; we do not receive them, only confirmation of whether the payment has been made. To process payments, Payrexx works with TWINT, card schemes and acquirers, whose privacy policies also apply.

Shipping

For delivery, we pass your name, company, delivery address and phone number to the commissioned carrier (DPD for parcels or freight forwarder) to the extent necessary for delivery and advance notice. For freight shipments (e.g. pallets), we calculate freight costs via our freight partner (Switzerland/Liechtenstein); for this we transmit the delivery address, company or name, phone number, email address and shipment details (weight, dimensions). If you collect your order in Wallenwil, no data is passed on.

Customer account (B2B login)

We can activate a customer account for business customers. For this we store the customer number, company, authorised email addresses, delivery and billing addresses, the agreed customer discount and the authorisation to purchase on invoice, as well as the orders placed via the account. Login works without a password: you enter your email address and, only if it belongs to an activated account, we send you a personal login link (valid for 15 minutes, single use). After login, a session cookie keeps you logged in (see section 5). To prevent misuse, we limit the number of login attempts per IP address and email address.

If you apply for a customer account, we store the details from the application form (company, UID, name, email address, phone, remarks, language) and our decision in order to review the application and set up the account. We delete rejected applications after 180 days and accepted ones after 2 years.

9. Ticket platform and remote support

You can apply for access to our ticket platform using the "Request access" form. For this we process the company, contact person, email address, phone number, requested users and your comments. The request reaches our inbox like a contact enquiry and is used to review and set up the accounts.

The ticket platform (tech.petrohandels.ch) is a separate application. The data processed there – user accounts, tickets and fault reports – is used to provide our service and support.

For remote support, you can download TeamViewer QuickSupport. The download is provided directly by TeamViewer, whose privacy policy also applies to the remote support session. We only access your system during a session you have approved.

10. Job applications

We accept job applications via the application form on our website or by email to bewerbungen@petrohandels.ch. Details and documents from the form are transmitted encrypted (HTTPS) to our server and forwarded from there by email to our applications mailbox; the channel you select (e.g. Instagram, LinkedIn) only tells us how you heard about us. If you provide an email address, you will receive a confirmation of receipt. We process your information and documents solely for the application process and make them accessible only to the people involved in the decision. Please note that emails are transmitted without additional encryption.

If you are not hired, we generally delete your documents no later than six months after the process has ended, unless you consent to longer retention (e.g. for future vacancies). If you are hired, the documents are transferred to your personnel file.

11. Contact by email and phone, business relationships, newsletter

When you contact us by email or phone or have a business relationship with us (e.g. as a customer, supplier or partner), we process the resulting information to answer enquiries, conclude and perform contracts, prepare quotations and invoices and maintain the business relationship. We only send advertising emails if you have subscribed to the newsletter (see below).

Newsletter

For our newsletter (news, products, offers and tips) we only need your email address; first name and company are optional, and the language is taken from the website. Subscription uses the double opt-in procedure: after submitting the form you receive an email with a confirmation link, and you are only added to the mailing list once you have clicked it. We store the time of subscription and confirmation as proof of your consent. An invisible control field and a limit on subscription attempts protect against misuse.

For subscription, management and delivery we use the Brevo service of Brevo SAS, Paris, France (EU). Brevo processes the data on our behalf and may record statistically whether a newsletter was opened and which links were clicked so that we can improve the newsletter. You can unsubscribe at any time – via the unsubscribe link in every newsletter or by sending us a message. You will then no longer receive the newsletter; we only keep your address on a suppression list for as long as necessary to respect and document your withdrawal.

12. Legal bases (GDPR)

Under Swiss law, we process personal data in accordance with the principles of the FADP; consent is only required in the cases provided for by law. Where the GDPR applies, we rely on the following legal bases:

• Contract and pre-contractual measures (Art. 6(1)(b) GDPR): enquiries and quotations, orders, delivery and payment, service and support, customer account (B2B login), access to the ticket platform, application process.
• Legal obligation (Art. 6(1)(c) GDPR): retention of business records and accounting vouchers, tax obligations.
• Legitimate interests (Art. 6(1)(f) GDPR): secure and stable operation of the website (server log files, spam and abuse protection), prompt answers to enquiries via the chat and AI assistant, technically necessary cookies and local storage for the requested functions, communication with contact persons at business customers, establishing or defending legal claims.
• Consent (Art. 6(1)(a) GDPR): where we expressly ask you for it, in particular for the newsletter and e.g. for longer retention of your application. You can withdraw your consent at any time with effect for the future.

13. Recipients and service providers

We do not sell personal data or pass it on for advertising purposes. Within our company, only employees who need the data for their tasks have access to it. Outside the company, we only disclose data to:

• service providers who process data on our behalf (processors), e.g. for hosting, customer communication, AI chat, email and newsletter delivery and data storage. We select them carefully and contractually oblige them to process the data only on our instructions and with appropriate security measures;
• partners who are independently involved in performing the contract, in particular payment service providers, the parcel service (DPD) and freight forwarders;
• authorities and courts where we are legally obliged or entitled to do so or where necessary to protect our rights, as well as advisers such as our fiduciary, auditors or legal counsel, who are bound by confidentiality.

For the website, we currently use the following service providers in particular – each only to the extent that the relevant function is used:

• Hosting provider in Switzerland: Infomaniak Network SA
  Purpose: Operating and delivering the website, server log files
  Location: Switzerland
• Customer communication platform (chat and inbox for enquiries and orders): Chatwoot (Open-Source-Software), betrieben auf Servern der Infomaniak Network SA
  Purpose: Receiving and handling contact enquiries, chat conversations, access requests and shop orders
  Location: Switzerland
• AI assistant in the chat: Anthropic PBC
  Purpose: Generating automated replies in the chat
  Location: USA
• Online payment (TWINT, card): Payrexx AG
  Purpose: Processing online payments in the shop
  Location: Switzerland
• Sending order emails: Microsoft (Microsoft 365)
  Purpose: Sending order confirmations, internal order copies and login links
  Location: Switzerland, EU/EEA or USA (see "Disclosure abroad")
• Newsletter delivery: Brevo SAS
  Purpose: Double opt-in subscription, managing the subscriber list, sending the newsletter and unsubscribing
  Location: France (EU)
• Email and office software: Microsoft (Microsoft 365)
  Purpose: Receiving and handling emails, including job applications
  Location: Switzerland, EU/EEA or USA (see "Disclosure abroad")

14. Disclosure abroad

We generally process your data in Switzerland and the EEA. The website, customer accounts and orders as well as the chat inbox are operated by a hosting provider in Switzerland; the newsletter service Brevo processes data in the EU (France), which offers adequate data protection under Swiss law. However, some other service providers have their registered office or servers in other countries, in particular the USA (e.g. our AI provider). Data may also be processed there if a provider operates servers in Europe, for example in the context of support or maintenance.

We only disclose data to countries without adequate data protection where the law permits – in particular if the recipient is certified under the Swiss-U.S. or EU-U.S. Data Privacy Framework, on the basis of the European Commission's standard contractual clauses with the adaptations required for Switzerland, or if the disclosure is necessary to perform a contract with you or you have consented. You can request a copy of the relevant safeguards from us.

Please note that US authorities may in certain circumstances access data without you having the same legal remedies as in Switzerland or the EU.

15. Retention

We store personal data for as long as necessary for the relevant purpose, as long as statutory retention obligations apply or as long as we have a legitimate interest (e.g. for evidence during limitation periods). We then delete or anonymise it.

• Business records, accounting vouchers, invoices and business correspondence: 10 years (Art. 958f Swiss Code of Obligations).
• Orders in the online shop's order system: 2 years from the order; accounting records additionally as above.
• Enquiries, chat histories and correspondence without a contract: as long as necessary for handling and any follow-up questions, as a rule no longer than 2 years after the last contact.
• Newsletter: until you unsubscribe; unconfirmed subscriptions are not added to the mailing list. After unsubscribing, the address remains only on the suppression list (see section 11).
• Customer account: for the duration of the business relationship; after the account is closed, we delete the account data unless retention obligations apply. Login links expire after 15 minutes, the session cookie after 30 days at most. Account applications: rejected 180 days, accepted 2 years.
• Server log files: short-term only, for the purposes set out in section 4.
• Application documents: see section 10.

16. Data security

We take appropriate technical and organisational measures to protect your data against loss, unauthorised access and misuse – including encrypted transmission (HTTPS) across the entire website, access rights on a need-to-know basis, protected credentials and careful selection of our service providers. However, no one can guarantee absolute security; emails in particular are transmitted without additional encryption.

17. Your rights

Within the scope of applicable data protection law, you have in particular the right to:

• information on whether and which personal data about you we process;
• rectification of inaccurate or incomplete data;
• erasure of your data, unless retention obligations or overriding interests prevent this;
• restriction of processing and objection to processing, in particular processing based on legitimate interests;
• receipt or transfer of your data in a commonly used electronic format;
• withdrawal of consent given, with effect for the future.

To exercise your rights, simply send a message to info@petrohandels.ch or to our postal address. To ensure that data does not reach unauthorised persons, we may ask you to prove your identity. As a rule, we respond within 30 days and free of charge, unless the law provides otherwise.

You also have the right to lodge a complaint with a data protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). If the GDPR applies to you, you may also contact the supervisory authority of your place of residence, place of work or the place of the alleged infringement.

18. No automated individual decisions

We do not make decisions based solely on automated processing that have legal effects for you or significantly affect you, and we do not carry out profiling. The AI assistant in the chat only answers questions; decisions on contracts, prices or your requests are made by people.

19. Changes

We may amend this privacy policy at any time, for example if we introduce new functions or legal requirements change. The version published on www.petrohandels.ch at any given time applies.