Legal

Privacy policy

Last updated: October 2026

1. Controller

GRAVITA GmbH, Schaffhauserstrasse 369, 8050 Zürich, Switzerland, UID CHE-453.850.973.
Email: info@gravita-led.com

2. Purposes of data processing

Personal data is processed to handle orders, operate the online shop, manage business customer accounts and quote requests, for communication, invoicing, shipping, compliance with legal obligations, system security and optimisation of our offering.

3. Categories of personal data

  • Identification and master data, e.g. name, billing and delivery address
  • Business customer data, e.g. company name, UID, contact person, agreed conditions
  • Contact data, e.g. email, telephone number
  • Order and transaction data, e.g. shopping cart, ordered products, quote requests, invoice amounts
  • Access data for business customer accounts (passwords are stored exclusively as a cryptographic hash)
  • Communication data, e.g. enquiries via the contact form or by email
  • Technical data and cookies, e.g. IP address, log files, device and browser data

4. Legal bases

Processing takes place in accordance with Swiss data protection law (FADP). Insofar as the GDPR applies (e.g. in connection with the EEA), processing is additionally based on the performance of a contract, legal obligations, legitimate interests and, where necessary, consent.

5. Cookies and similar technologies

The website uses cookies and comparable technologies (e.g. localStorage). Technically necessary cookies are required for the shop to work — for example for the shopping cart, the login session and storing your cookie consent. Optional cookies and services – convenience (Google Maps map on the contact page), statistics (Google Analytics) and marketing (Google Ads) – are only activated with your consent. Consent can be withdrawn at any time with effect for the future.

Details of all cookies used can be found in the cookie policy. The cookie settings can be adjusted at any time in the footer of the website. Withdrawal does not affect the lawfulness of processing carried out up to that point.

6. Payment and shipping

Payment is made on invoice. No credit card or other payment data is collected via the website and no payment service providers are integrated. Shipping takes place within Switzerland; for delivery, the necessary address and contact data is transmitted to the commissioned shipping or transport company.

7. Google Maps

A Google Maps map (Google Ireland Limited or Google LLC, USA) may be displayed on the contact page. The map is only loaded after you have given your consent. When loading, data (including your IP address) is transmitted to Google; Google may set cookies in the process. Further information can be found in Google’s privacy policy.

8. Google Tag Manager and Google Analytics

This website uses Google Tag Manager and Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Google LLC, USA. Google Tag Manager is a tool for managing the measurement codes embedded on the website; it does not set any cookies itself. Google Analytics is only activated if you consent to the “Statistics” category in the cookie settings.

Google Analytics records how the website is used, such as pages viewed, length of visit, device used and approximate location, as well as shop events such as viewing products, the shopping cart and completed orders (without your contact details). IP addresses are not stored by Google Analytics 4. The data is used to improve our offering. It is stored in accordance with the retention period set in Google Analytics, for a maximum of 14 months.

9. Google Ads and conversion tracking

We place advertisements via Google Ads (Google Ireland Limited or Google LLC). With your consent in the “Marketing” category, we measure whether a visit via an advertisement leads to an order, an enquiry or a registration (conversion tracking). In addition, Google may recognise visitors to the website for the delivery of advertisements (remarketing).

For more accurate measurement (so-called enhanced conversions), when you place an order, submit a contact or product enquiry or register as a business customer, we transmit your email address and telephone number to Google, and for orders additionally your first and last name, postcode and country. This information is already converted in your browser into an irreversible string of characters (hash) using the SHA-256 method; Google does not receive it in plain text. Google matches the hash with signed-in Google accounts in order to attribute conversions and only passes on aggregated, statistical results to us. This transmission takes place exclusively with your consent to the “Marketing” category.

10. Google reCAPTCHA

To protect the forms (contact, enquiries, registration, login) against misuse by automated programs, we use Google reCAPTCHA (Google Ireland Limited or Google LLC). reCAPTCHA is only loaded when you use a form and evaluates technical characteristics such as IP address, browser data and mouse movements. Processing is based on our legitimate interest in the security of the website. Google’s privacy policy and terms of service apply.

11. Hosting and security

Hosting is provided by specialised providers in Switzerland or the EEA; the database is operated in a data centre in the EEA (Frankfurt, Germany). Metadata and log files are processed to ensure technical operation and to defend against attacks. Appropriate technical and organisational measures are used, including access restrictions, encrypted transmission (TLS) and password hashing (bcrypt).

12. Recipients of data and transfer abroad

Data is passed on to service providers who support us in operating the website and processing orders, e.g. IT, hosting and shipping service providers, and – within the scope of the services described above – to Google. Data is only transferred abroad if an adequate level of data protection exists or appropriate safeguards are in place. For Google LLC in the USA, the transfer is based on certification under the EU-U.S. and Swiss-U.S. Data Privacy Framework and on standard contractual clauses.

13. Retention period

Personal data is retained for as long as is necessary for the stated purposes and as required by statutory retention obligations, in particular commercial and tax law obligations (usually 10 years).

14. Rights of data subjects

Within the scope of applicable law, data subjects have the right to information, rectification, erasure, restriction of processing and data portability. Requests should be addressed to info@gravita-led.com.

15. Changes to this policy

This privacy policy may be amended at any time. The version published on the website is authoritative.

16. Contact

GRAVITA GmbH, Schaffhauserstrasse 369, 8050 Zürich, Switzerland
Email: info@gravita-led.com