Privacy Policy

Last updated: 27 September 2026

1. Data controller

The personal data collected via bhproducts.ch is processed by:

2. Data collected and purposes

2.1 Orders and delivery

• Purpose: order processing, invoicing, delivery, after-sales service, management of returns and warranties.
• Legal basis: performance of the sales contract (Art. 31 revFADP / Art. 6.1.b GDPR).
• Data collected: first name, last name, company name (for business customers), delivery and billing address, email address, phone number, order history.
• Recipients: Beauty Hair Products Sàrl, partner carriers (Swiss Post and private carriers), Infomaniak (website hosting).

2.2 Online payment

• Purpose: secure payment processing, fraud prevention.
• Legal basis: performance of the contract.
• Data: payment information is transmitted directly to certified providers. We never store credit card numbers.
• Payment providers:
  • Stripe Payments Europe Ltd. (Ireland) — Stripe Privacy Policy
  • Wallee AG (Winterthur, Switzerland) — Wallee Privacy Policy

2.3 Customer account

• Purpose: manage your customer area, view your order history, save your delivery addresses.
• Legal basis: consent given when creating the account.
• Data: email, encrypted password, addresses, any preferences.
• Particularity: account creation is open to everyone (businesses and individuals), with no prior status verification.

2.4 Visit statistics (Google Analytics)

• Purpose: count visits and purchases, and see which pages are viewed and from which type of device, for our statistics.
• Legal basis: prior consent via our cookie banner (“Visit statistics” purpose).
• Tool and providers: Google Analytics 4 — Google Ireland Limited (Ireland) and Google LLC (United States).
• Data: visitor identifier stored in a cookie (_ga), pages viewed, source of the visit, device and browser type, approximate location derived from your IP address and, when you place an order, the order number and amount as well as the products purchased.
• Settings: the tag on our site is configured with Google signals and ad personalisation switched off.
• Without your consent: Google Analytics is not activated and no data is sent to Google Analytics.
• Find out more: How Google uses information from sites or apps that use its services.

2.5 Ad measurement (Google Ads) and Google Shopping listings

• Purpose: find out whether a visit or an order follows a click on one of our Google ads, in order to measure the effectiveness of our ads.
• Legal basis: prior consent via our cookie banner (“Ad measurement” purpose).
• Tools and providers: Google Ads — Google Ireland Limited (Ireland) and Google LLC (United States); WooCommerce Order Attribution, on our site. Google processes this data as an independent controller, under its own rules (How Google uses information from sites or apps that use its services).
• Data sent to Google: ad click identifier (gclid, gbraid or wbraid), _gcl_au, _gcl_aw and _gcl_gb cookies, IP address (since 2026, Google may use it to measure conversions), pages viewed, order number and amount. Enhanced conversions (hashed email address) are not enabled. If you have accepted ad measurement and arrived via a Google ad, we may also report your order to Google Ads ourselves (click identifier, order date and amount, without name or email address).
• Order attribution: WooCommerce Order Attribution (sbjs_* cookies) records on your order, on our site, the source of the visit (ad, search engine, direct link, campaign), the landing page, the number of pages viewed and of visits, the device type and your browser information (user-agent).
• Without your consent: Google Ads is not activated, no data is sent to Google Ads and the source of the visit is not recorded on the order.
• Free Shopping listings: these rely on a product feed sent by our server to Google Merchant Center, independent of cookies and individual browsing tracking.

2.6 Personalised advertising (Google Ads, Meta)

• Purpose: allow Google and Meta (Facebook, Instagram) to show you our ads on other websites and apps based on your visit. This is profiling: Google and Meta may combine your visit with other data they hold to choose the ads they show you.
• Legal basis: prior consent via our cookie banner (“Personalised advertising” purpose, which includes ad measurement).
• Providers: Google Ireland Limited (Ireland) and Google LLC (United States); Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (United States). Google and Meta may also use this data for their own purposes, under their own responsibility.
• Joint controllership with Meta: for the collection of this data on our site and its transmission to Meta (Meta Pixel and Conversions API), we are joint controllers with Meta Platforms Ireland Limited, under Meta’s agreement (Controller Addendum). You can exercise your rights with us or with Meta. Meta alone is responsible for how it then uses this data.
• Cookies: for Google Ads remarketing lists, cookies set on Google’s domains (e.g. IDE on doubleclick.net and NID, 6 to 13 months); for the Meta Pixel, _fbp and _fbc cookies (3 months).
• Meta Pixel: it sends Meta, from your browser, the pages viewed and your actions in the shop (for example product viewed, add to cart, purchase and its amount), together with your IP address, your browser information and the _fbp and _fbc identifiers. If you are logged in to Facebook or Instagram in this browser, Meta may link this data to your account.
• Meta Conversions API: our server sends the following events directly to Meta: product page viewed, add to cart, checkout started and purchase. These transmissions contain, in plain text, your IP address and your browser information (user-agent), the _fbp and _fbc identifiers, the page and products concerned and, for a purchase, its amount. When you place an order, they also contain your email address, phone number, first name and last name, city, postcode and country, in hashed form (SHA-256): Meta does not receive this data in plain text, but can compare it with its users’ data to recognise you if you have a Facebook or Instagram account.
• Without your consent: neither the Meta Pixel nor the Conversions API is used and nothing is sent to Meta; Google is not allowed to use your visit for personalised advertising.
• Find out more: How Google uses information from sites or apps that use its services; Meta privacy policy.

2.7 Trade events and shows

• Purpose: if you meet us at a trade show or professional event (BaByliss, Elgon demonstrations, etc.), we may collect your contact details with your agreement to send you a quote or sales follow-up.
• Legal basis: explicit consent given on site (form or business card voluntarily provided).
• Data: name, company name, professional email, phone.
• Retention: maximum 3 years without further interaction on your part.

2.8 Record of your cookie choices

• Purpose: prove that your cookie choice is respected, check that our sales are measured correctly (for example, to understand a missing conversion) and report to Google Ads only those orders for which you accepted ad measurement.
• Legal basis: our obligation to be able to demonstrate your consent (Art. 6.1.c GDPR, in conjunction with Art. 7.1) and our legitimate interest in checking that your choice is respected and that our sales are measured correctly (Art. 31 revFADP / Art. 6.1.f GDPR).
• Data: never an IP address, browser information (user-agent) or visitor identifier. The counters and the log cannot be used to identify you. The note on the order is attached to your order, and therefore to you.
  • Anonymous daily counters: language, mobile or computer (determined at the time, without storing the user-agent), banner display or type of choice, purposes accepted.
  • Log of choices: date and time rounded to the minute (UTC), version and fingerprint of the banner text, language, choice.
  • Note on each order: the choice in force at the time of the order (purposes accepted, type of choice, day of the choice).
• Cookie: your choice is stored in the bh_consent cookie (6 months), which our server also sets, with the same value, when you make your choice; a copy is kept in your browser’s local storage.
• Retention: counters 25 months; log of choices 13 months; note on the order deleted after 13 months.

2.9 Demo videos (YouTube)

• Purpose: show a product in use (appliances, hair care) on its product page.
• How it works: the video only loads if you click “Play video”. Before that click, no data is sent to YouTube.
• Legal basis: your consent, given by that click.
• Tool and providers: YouTube in privacy-enhanced mode (youtube-nocookie.com), a service of Google Ireland Limited (Ireland) and Google LLC (United States).
• Data: when you click, YouTube receives your IP address, information about your browser and the page address, and may store data in your browser under its own rules.

3. Data transfers outside Switzerland

Our providers Google Ireland Limited, Meta Platforms Ireland Limited and Stripe Payments Europe Ltd. are established in Ireland (European Union), a country recognised by the Swiss Federal Council as providing an adequate level of protection.

Some of your data may also be transferred to providers located in the United States: Google LLC (Google Analytics, Google Ads), Meta Platforms, Inc. (advertising on Facebook and Instagram) and Stripe, Inc. (certain payment-related processing). For Google and Meta, this only happens with the consent you give in our cookie banner. These transfers are governed by:

• The Data Privacy Framework (DPF) EU / Switzerland – United States, recognised by the European Union and by Switzerland as providing an adequate level of protection for certified companies;
• Standard contractual clauses where the DPF does not apply;
• Additional technical measures (TLS encryption, pseudonymisation) where necessary.

4. Retention periods

5. Your rights

In accordance with the new Swiss Federal Act on Data Protection (revFADP) and, for residents of the European Union, the General Data Protection Regulation (GDPR), you have the following rights:

Right of access

Obtain a copy of the personal data we hold about you.

Right to rectification

Correct inaccurate or incomplete data concerning you.

Right to erasure

Request the deletion of your data, subject to our legal obligations (in particular accounting obligations).

Right to object

Object to certain processing, in particular for commercial prospecting purposes.

Right to data portability

Retrieve your data in a structured, commonly used format.

Right to withdraw your consent

At any time, without having to justify your decision, via the “Cookie settings” link at the bottom of every page of the site or the small round button at the bottom left of the screen. Withdrawal applies to the future: it does not affect processing carried out before it.

Right to lodge a complaint

• In Switzerland: Federal Data Protection and Information Commissioner (FDPIC)
• In France: Commission Nationale de l’Informatique et des Libertés (CNIL)
• Other EU countries: the supervisory authority of your country of residence.

6. How to exercise your rights

To exercise any of your rights, you can contact us by:

We respond to any legitimate request within a maximum of 30 days. You may be asked for proof of identity to verify who you are and prevent a malicious person from accessing your data.

7. Data security

We implement appropriate technical and organisational measures to protect your data:

• HTTPS/TLS encryption across the entire site (permanent SSL certificate);
• Hosting in Switzerland with Infomaniak (Geneva) — ISO 27001-certified data centres;
• Payments are processed exclusively by PCI-DSS certified providers (Stripe, Wallee) — we store no banking information;
• Restricted data access, limited to authorised staff of Beauty Hair Products Sàrl;
• Regular encrypted backups of the entire website.

8. Cookies and trackers

Our site uses different types of cookies, some strictly necessary (cart, login), others subject to your consent (audience measurement, advertising).

For full details on each cookie, its purpose, duration and issuer, see our Cookie Policy.

9. Changes to this policy

This policy may be updated to reflect legal, technical or organisational developments. The date of the last update appears at the top of this page. In the event of a substantial change affecting your rights, you will be informed clearly and visibly (banner, email).