Privacy

Controller

The controller under the General Data Protection Regulation (GDPR) is Bonsana AG, Hubrainweg 19, 8124 Maur, Switzerland.

For privacy questions: sales@bonsana.ch. [Draft – check whether a data protection officer must be appointed]

Hosting and server logs

The website is hosted by Vercel Inc. When you visit, the server processes technically necessary connection data (e.g. IP address, timestamp, requested page, browser type) in logs. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

The website's server functions run in the Vercel region “fra1” (Frankfurt am Main, Germany).

[Draft – access by Vercel Inc. (USA) and the basis for it to be reviewed by counsel]

[Draft – enter the log retention period under the contract with Vercel]

Cookie and browser storage

Without your consent this website stores only what is strictly necessary for it to work. Analytics cookies are set only once you choose “Accept” in the cookie notice. You can delete all of these entries at any time in your browser settings.

• Cookie “NEXT_LOCALE”: your chosen language; no personal data, kept for one year.
• Storage “carmex:motion”: whether you paused videos and animations.
• Storage “carmex:announce:<id>”: which notices at the top of the page you closed.
• Storage “carmex:list”: your shopping list; it stays on your device.
• Storage “carmex:consent”: your choice in the cookie notice; it stays on your device.
• Cookies “_ga” and “_ga_*” (Google Analytics, only with your consent): a random ID to tell visits apart; kept for up to two years.

Links to retailers, the shop and social media

Links to retailers, the online shop and social media lead to external websites with their own privacy policies. Your browser connects to the other website only when you click such a link.

Some of these links carry campaign parameters (utm_source, utm_medium, utm_campaign). They only tell the destination that the visit comes from this website and contain no information about you.

Contact by email

When you email us, we process your email address, your name and the content of your message in order to reply (Art. 6(1)(b) or (f) GDPR).

When you report a problem with a product (including through the “Report a product problem” page), we also process the product and batch details and any photos to resolve the case and meet our product safety obligations (Art. 6(1)(c) GDPR). [Draft – decide on passing reports to the manufacturer Carma Laboratories, Inc. (USA) and the basis for that transfer]

The “Report a product problem” page stores nothing on this website and sends nothing to its server. It prepares an e-mail that you check in your mail program and send yourself. Only that e-mail reaches us: the product with its EAN, the lot number, where and when you bought it, your description, any photos you attach, your e-mail address and the name your mail program sends with it. We keep it with the case in our inbox for product reports.

Retention: [Draft – set the period for general enquiries] [Draft – set the period for product problem reports; none has been set yet]

Audience measurement

We use Google Analytics 4 from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to see how the site is used, for example pages viewed, clicks on retailer and shop links, scrolling, language, device type, approximate region and how you reached us. Cookies with a random ID recognise a returning visit. Google does not store your IP address; Google signals and all advertising features are switched off. The data is kept for at most 14 months. Google may also process it in the USA; Google LLC is certified under the Data Privacy Framework. Measurement only starts once you choose “Accept” in the notice; you can change your choice at any time.

Measurement runs only with your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future.

[Draft – provider, data location, legal basis and retention to be confirmed by counsel]

Your rights

Under the GDPR you have these rights. Contact sales@bonsana.ch.

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent at any time, with effect for the future
• A complaint to the supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Retention

We keep personal data only as long as its purpose requires or statutory retention obligations demand, and delete it afterwards.

[Draft – enter the periods per category (logs, emails, product problem reports)]

Last updated

This notice was last updated on 26 September 2026.