Privacy policy

Die Datenschutzerklärung in deutscher Sprache finden Sie hier.

Summary

We, the Open Home Foundation, Grabenstrasse 25, 6340 Baar, Switzerland, operate the merch store at https://store.openhomefoundation.org. We are responsible for the data processing described in this privacy policy, unless stated otherwise below.

Privacy is one of the Open Home Foundation's three fundamental principles. It is at the core of everything we do, including this merch store.

To fulfill your order, we need to collect some personal data from you. This includes your address (for delivery), your phone number and email (for delivery notifications), and your clothing size if you order apparel. The Open Home Foundation will never use this data for anything other than fulfilling orders, customer support and accounting.

We operate from Switzerland. We comply with the Swiss Federal Act on Data Protection (FADP), and with the EU General Data Protection Regulation (GDPR) for website visitors and customers in the European Economic Area (EEA).

This store runs on Shopify. Shopify sets the cookies needed for the cart and checkout to work. Optional cookies are only set if you accept them in the cookie banner. For our own visitor statistics, we use Plausible Analytics, which we host ourselves. It does not use cookies.

1. Data Processing Activities

a. Contacting us

When you contact us, we process your personal data. You may contact us by email, through the contact form on our website or through another channel. We process the data you provide, such as your name, email address, phone number, order number and your request. We also record when your request arrived. Mandatory fields in the contact form are marked with an asterisk (*).

We use this data to handle your request. For example, we may answer questions about our products, help with an order, return or refund, or use your feedback to improve our store.

Messages sent through the contact form are processed by Shopify, our online store provider. Shopify then delivers them to our support inbox.

For website users in the EEA, the legal basis is our legitimate interest in answering your request (Article 6(1)(f) GDPR). If your request relates to an order, the legal basis is the performance of a contract with you (Article 6(1)(b) GDPR).

b. Ordering on our website

When you buy something on this website, we collect personal information to enter into a sales contract with you and fulfill your order. This may include your:

  • Billing and shipping address
  • Details relating to your purchase (for example, your shirt size)
  • Email address
  • Name
  • Phone number

We store this information in Shopify together with your order details (time, order number) and information about fulfilling the contract (delivery details, product returns). Shopify is our online store provider. For customers outside North America, our contracting party is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland. Shopify processes this data on our behalf.

To pack and ship your order, we pass the order information to the fulfilment partner that serves your region:

  • Orders shipped within Europe and to most other countries: OGOship Ltd, Palkkatilanportti 1, 00240 Helsinki, Finland. OGOship ships from its warehouse in the Czech Republic.
  • Orders shipped to the United States: eFulfillment Service, Inc., 807 Airport Access Road, Traverse City, MI 49686, USA.

For website users in the EEA, the legal basis for this data processing is the performance of a contract with you (Article 6(1)(b) GDPR).

Our fulfilment partners may use some of the data they receive for their own purposes, such as statistical analysis. They are then the controller for that processing and must comply with data protection law. You can read more in the OGOship privacy policy and the eFulfillment Service privacy policy.

During checkout, Shopify may suggest your shipping and billing address as you type, to make checkout faster. Shopify may use third-party map services, such as Google Maps Platform, to provide these suggestions. Your input and IP address may then be sent to those services. For website users in the EEA, the legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR).

c. Payments

We use Shopify Payments to process payments on this website. Depending on the payment method you choose, your payment data is processed by:

  • Shopify and its payment processing partner Stripe. Stripe processes card payments and payments made with Apple Pay or Google Pay. You can read Stripe's privacy policy.
  • Apple or Google, if you pay with Apple Pay or Google Pay. You can read Apple's privacy policy and Google's privacy policy.
  • Shopify, if you pay with Shop Pay. Shop Pay saves your details so you can check out faster across Shopify stores. Shopify is the controller for your Shop Pay account. See the Shop privacy policy.

We never see or store your full card details.

To protect you and us against fraud, Shopify and its payment partners analyse order and payment data, such as your IP address, device information and order details.

For website users in the EEA, the legal basis for payment processing is the performance of a contract with you (Article 6(1)(b) GDPR). The legal basis for fraud prevention is our legitimate interest in preventing fraud (Article 6(1)(f) GDPR).

d. Order emails

We email you with messages about your order. For example, we may tell you that:

  • You have made a purchase
  • Your order has shipped
  • Your return or refund has been processed

You can't unsubscribe from these messages, because they are part of your order. Shopify sends these emails for us.

We do not send marketing emails to customers of this store. If you want news from the Open Home Foundation, you can sign up for our newsletter separately. The newsletter has its own privacy notice.

For website users in the EEA, the legal basis for this data processing is the performance of a contract with you (Article 6(1)(b) GDPR).

e. Shipping

To deliver your order, our fulfilment partners share your name, address, email address and phone number with the shipping carrier that delivers your parcel. Carriers use this data only for delivery and delivery notifications. Which carrier is used depends on your location. The carriers we use include:

For website users in the EEA, the legal basis for this data processing is the performance of a contract with you (Article 6(1)(b) GDPR).

f. Website hosting and analytics

Shopify hosts this website. When you visit it, Shopify automatically processes:

  • Your IP address
  • Information about your browser, network and device
  • The page you came from and the pages you view
  • Timestamps

This data is needed to show you the website and keep it secure and stable. Shopify also uses it to fix errors, improve performance and protect its platform. For website users in the EEA, the legal basis is our legitimate interest in running a secure and working website (Article 6(1)(f) GDPR).

We use Plausible Analytics to see how many people visit the store and which pages they view. We host Plausible on our own server, so this data is not shared with a third party. Plausible does not use cookies and does not store IP addresses or other personal data. It does not track you across websites or devices. All statistics are aggregated. For website users in the EEA, the legal basis is our legitimate interest in understanding how our store is used (Article 6(1)(f) GDPR).

If you accept analytics cookies in the cookie banner, Shopify also collects usage statistics, such as the pages you view and the products you add to your cart. Shopify uses these to show us store reports. For website users in the EEA, the legal basis for this is your consent (Article 6(1)(a) GDPR).

We do not use advertising or remarketing cookies, and we do not use tracking pixels from Meta, Google or other ad networks.

g. Cookies

This website uses cookies and similar technologies. Cookies are small text files that a website stores on your device.

Some cookies are strictly necessary, and are always set. Without them, your cart, checkout, currency and region selection, and security features would not work. For website users in the EEA, the legal basis is our legitimate interest in providing a working online store (Article 6(1)(f) GDPR).

All other cookies are only set if you agree in the cookie banner. These include Shopify's analytics and preference cookies. You can change or withdraw your consent at any time by clicking "Cookie preferences" at the bottom of the page. The legal basis is your consent (Article 6(1)(a) GDPR).

For a full list of the cookies Shopify uses, see Shopify's cookie policy.

You can also set your browser to block cookies, or to notify you whenever a cookie is set. These guides explain how to do this in common browsers:

If you disable cookies, some features of our website may stop working, such as the cart and checkout.

h. Fonts

We serve all fonts on this website from Shopify's servers. We do not load fonts from Google Fonts, Adobe Fonts or other font services.

i. Social media

Our website links to our profiles on the following platforms:

  • GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (privacy policy)
  • Bluesky Social, PBC, USA (privacy policy)
  • Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, for Facebook and Instagram (privacy policy)
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for YouTube (privacy policy)

These are plain links. No social media plugins are loaded on our website, and no data is sent to these platforms until you click a link.

When you click a link, you are taken to our profile on that platform. Your browser then connects directly to the platform's servers, and the platform learns your IP address and that you came from our website. This may involve transferring data to other countries, such as the USA. Section 2 explains how we handle international data transfers.

If you are logged in to the platform, it can link your visit to your user account. To prevent this, log out before you click the link. The platform is responsible for this data processing, so please see its privacy policy.

2. International Data Transfers

We operate from Switzerland. Some of our service providers are located in, or use subcontractors in, countries outside Switzerland and the EEA. This includes Shopify (Canada and the USA), Stripe (USA) and eFulfillment Service (USA). Some of these countries do not provide an adequate level of data protection from a Swiss or EU perspective.

Canada is recognized as providing adequate data protection by the European Commission and by Switzerland. For transfers to the USA, we rely on frameworks recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC) and the European Commission, such as the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework or Standard Contractual Clauses (SCCs). Where necessary, we put additional safeguards in place to protect your data adequately.

If your order ships to the United States, we have to transfer your data to the USA to deliver it to you (Article 49(1)(b) GDPR).

3. Retention Periods

We only store personal data for as long as we need it for the purposes described in this privacy policy.

The law requires us to keep business correspondence, contracts and accounting records for up to 10 years. When we no longer need your data to provide our services, we restrict it. Restricted data may only be used to meet these retention obligations or to defend and enforce our legal interests. We delete the data once we no longer have a legal obligation or a legitimate interest to keep it.

4. Your Rights

Under the GDPR and the FADP, you have the right to:

  • Access: Ask us at any time, free of charge, what personal data we store about you.
  • Correction: Ask us to correct inaccurate data.
  • Deletion: Ask us to delete your data. This right may not apply in some cases, for example where the law requires us to keep records.
  • Restriction: Ask us to limit how we use your data.
  • Portability: Receive your data in a structured, commonly used format.
  • Objection: Object to processing based on our legitimate interests (Article 6(1)(f) GDPR), for reasons relating to your particular situation.
  • Withdraw consent: Withdraw your consent at any time where we process your data based on consent. Processing that took place before you withdrew your consent remains lawful.

To exercise any of these rights, please contact us at [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). In the EEA, you can contact the supervisory authority in the country where you live or work.

5. Effective Date

This privacy policy was last updated on 2026-10-14.