Privacy notice of www.lapa.ch
Last updated: 16 October 2026.
Here we explain how LAPA processes the data of people who visit the website, purchase in our e-shop, contact us or apply to work with us. Our business is the wholesale of Italian food products to B2B customers. Even in business-to-business relationships we process personal data, for example those of business owners, purchasing contacts and people responsible for receiving deliveries.
The main reference is the Swiss Federal Act on Data Protection (FADP), in the version in force since 1 September 2023. The GDPR applies when the conditions of its Art. 3 are met, in particular for an offer directed at persons in the EU or for the monitoring of their behaviour in the EU. The mere possibility of opening the website from the EU is not sufficient. Reference: Art. 3 GDPR.
1. Who is responsible and how to contact us
The data controller is LAPA - finest italian food GmbH.
- Address: Industriestrasse 18, 8424 Embrach ZH, Schweiz.
- UID: CHE-357.325.599.
- Email: [email protected].
- Telephone and WhatsApp: +41 76 361 70 21.
- Website: www.lapa.ch.
You can also use these contact details for questions about privacy or to exercise your rights.
2. What data we process
Browsing. When you open the website, technical data such as IP address, requested pages, date and time, browser, device and error information are exchanged. They are used to make the pages available and to manage the website. With the consent provided via the banner, statistical and advertising tools also collect identifiers, visited pages and interactions, for example clicks and views. The categories and preferences are described in the cookie policy.
Contacts and B2B customers. We process name, role, company, professional contact details, billing and delivery addresses, relevant tax details, enquiries, quotes, orders, invoices and information on payments, deliveries and returns. This data comes from you or from the company you work for, for example when a colleague names you as a contact person.
Account and e-shop. We process registration and login data, profile information, the shopping basket and purchase history. The data required for an order make it possible to identify the recipient, deliver the goods and issue invoices. If this information is missing, we may not be able to complete the request. Card payments in the e-shop are handled by Stripe Payments Europe Limited, which receives the card details and processes them as an independent controller; LAPA receives only the outcome of the payment.
Job applications. If you send us an application, we process the contact details, CV, experience, qualifications, documents and messages you provide to us in order to assess the application and communicate with you. Please send only information relevant to the position. Any retention for future recruitment processes requires separate consent.
Email, telephone, WhatsApp and chat. We process contact details, the content of messages, attachments and the information required to reply or prepare an order. For WhatsApp, your profile name and picture, telephone number and message timestamps may also be present. For telephone calls, we process the information you communicate to us and any notes useful for the request. Telephone calls are not recorded.
3. Why we use data and on what grounds
We use data for specific purposes and to the extent necessary. The FADP does not impose on private persons the same system of legal bases as the GDPR: it requires compliance with the processing principles and, in the event of an infringement of personality rights, a justification provided for by law. Contract, legal obligations, overriding interests and consent must therefore be read in the Swiss context. FDPIC guidance.
| Purpose | Basis for processing |
|---|---|
| Replying to enquiries, preparing quotes and orders, managing accounts, deliveries and support | Preparation and performance of the contract. For contact persons of a customer company, also legitimate interest in managing the business relationship. |
| Invoicing, accounting and statutory compliance | Applicable legal obligations, including accounting retention. |
| Assessing a job application | Pre-contractual steps and interest in staff recruitment; separate consent for future opportunities. |
| Protecting the website, resolving issues and defending rights in a dispute | Legitimate interest in security, service continuity and the protection of rights, taking into account the interests of the persons concerned. |
| Sending newsletters and promotions via email or WhatsApp | Consent where required; any exception for existing customers only within the limits of applicable law, with the option to object. |
| Analysing browsing and measuring or personalising advertising | Consent via the banner for statistical and marketing tools. |
You can withdraw your consent at any time. To stop receiving promotions, you can use the unsubscribe link, where provided, or write to us. Withdrawal does not affect the lawfulness of processing already carried out and does not prevent communications necessary for an order.
Where the GDPR applies, the references are Art. 6(1)(a), (b), (c) and (f), depending on the purpose. Point (c) concerns obligations based on EU or Member State law: an exclusively Swiss obligation does not automatically become a basis under this provision. For business contacts who are not personally party to the contract, legitimate interest normally applies. Art. 6 GDPR.
4. Artificial intelligence-based assistants
On WhatsApp and in the website chat we use AI assistants to answer questions about products, prices and availability and to prepare orders. You are therefore communicating with an automated system when one of these assistants responds.
Messages are processed by Anthropic PBC, an AI provider based in the United States. The content sent may include personal data, for example your name, contact details or order details contained in the conversation. LAPA staff may review the responses and step in to provide support. Voice messages are first transcribed into text using the Gemini service of Google LLC (United States).
The AI may misunderstand a request or give an inaccurate response. You can ask at any time to speak to a person, within the conversation itself or by contacting us via email or telephone. Avoid sending passwords, full payment card details or sensitive information not necessary for the request.
This processing is used to handle your request and manage the business relationship, on the grounds set out above. Consent to advertising cookies is not the basis for replying to a message you send us.
To answer correctly, the assistant may use the customer data held in our management system, for example the order history. Anthropic and Google process the content in accordance with their own terms and privacy notices, listed in section 5.
We do not take decisions based solely on automated processing that have legal effects or significant consequences for you: orders, payment terms and credit are always decided by a person at LAPA.
5. Who receives the data and which services we use
Data may be processed by LAPA staff for their work and by the providers that make the services described here possible. Those acting on our behalf must receive appropriate instructions and contractual commitments. Some platforms also process data for their own purposes, in accordance with their privacy notices. The provider’s registered office does not necessarily coincide with all the locations where it processes data.
| Service | Provider | Registered office | Purpose |
|---|---|---|---|
| Odoo.sh hosting and Odoo ERP | Odoo S.A. | Belgium, EU | Hosting the website and e-shop; managing accounts, customers, orders and documents. |
| Google Workspace | Google Ireland Limited | Ireland, EU | Email, documents and company collaboration. |
| Google Analytics 4 | Google Ireland Limited | Ireland, EU | Statistics on visits and website usage, with consent. |
| Google Ads (conversion tracking) | Google Ireland Limited | Ireland, EU | Measuring the effectiveness of Google ads, with consent. |
| Microsoft Clarity | Microsoft Corporation | United States | Analysis of clicks and scrolling, interaction heatmaps and session replay, with consent. |
| Meta pixel | Meta Platforms Ireland Limited | Ireland, EU | Measuring campaigns and linking visits to Meta advertising, with consent. |
| TikTok pixel | TikTok Technology Limited | Ireland, EU (with possible transfers outside the EU) | Measuring campaigns and creating advertising audiences, with consent. |
| LinkedIn Insight Tag | LinkedIn Ireland Unlimited Company | Ireland, EU | Measuring campaign conversions and audiences, with consent. |
| YouTube | Google Ireland Limited | Ireland, EU | Displaying embedded videos, with consent in the marketing category. |
| Google Maps | Google Ireland Limited | Ireland, EU | Displaying the map on the contact page. |
| Google Fonts | Google Ireland Limited | Ireland, EU | Loading the fonts used on the pages. |
| WhatsApp Business | WhatsApp Ireland Limited | Ireland, EU (with possible transfers to the United States) | Messages, support and order preparation. |
| Online payments | Stripe Payments Europe Limited | Ireland, EU | Card payments in the e-shop (card details are processed by Stripe, not LAPA). |
| Website chat | Odoo S.A.; Anthropic PBC for the AI assistant | Belgium and United States | Managing conversations, enquiries and order preparation. |
| AI assistant also on WhatsApp | Anthropic PBC | United States | Processing messages and generating responses. |
| Transcription of voice messages | Google LLC (Gemini API) | United States | Transcribing voice messages sent on WhatsApp into text. |
| Consent management | Odoo S.A. (website cookie banner) | Belgium, EU | Collecting and remembering cookie preferences. |
| Couriers and carriers | Die Schweizerische Post AG; Galliker Transport AG (outside the LAPA van delivery area) | Switzerland | Receiving the data necessary for delivery: recipient, address and contact details. |
| Fiduciary and external accounting | Fiduciary appointed by LAPA | Switzerland | Accounting, tax compliance and administrative support. |
Clarity makes it possible to reconstruct interactions with the pages. Some Microsoft identifiers may also be used for advertising purposes. Clarity is loaded only after consent and masks sensitive fields according to Microsoft’s standard settings. Microsoft documentation.
Information on cookies, videos, maps and external fonts is in the cookie policy. Further details are available in the privacy notices of Odoo, Google, Microsoft, Meta, TikTok, LinkedIn, WhatsApp and Anthropic.
We may also disclose data to authorities or advisers where necessary for a legal obligation or a dispute.
6. Transfers abroad
The use of the services listed above may involve disclosures of data to the EU/EEA and the United States, including through support services or sub-processors. For EU/EEA countries recognised as adequate by Switzerland, the transfer is based on adequacy under Swiss law.
For the USA, the Swiss-U.S. Data Privacy Framework allows transfers to organisations with valid certification covering the relevant data and processing. Certification must be verified for the specific entity: it does not automatically extend to every company within a group. In the absence of such coverage, other permitted safeguards are required, such as standard contractual clauses recognised by the FDPIC, adapted to Switzerland, together with an assessment of the conditions in the destination country and any supplementary measures. FDPIC guidance on transfers.
The US-based providers listed (including Microsoft, Meta, Google, LinkedIn, TikTok and Anthropic) may process data in the United States or in other countries; the transfer is based on the provider’s Swiss-U.S. Data Privacy Framework certification, where applicable, or on standard contractual clauses.
You can ask us for information about the safeguards using the contact details above. Where the GDPR applies, its rules on transfers must also be complied with: the Swiss-U.S. DPF alone does not replace the mechanism required for data subject to the EU regime.
7. How long we keep data
We keep data for as long as needed for the purpose for which we collected them or for as long as required by law. In particular:
- Accounting: accounting books and records, including invoices and the contractual documentation supporting them, for 10 years from the end of the financial year, in accordance with Art. 958f CO. We do not automatically extend this period to every message or piece of browsing data. Guidance from the Swiss Confederation SME Portal.
- Accounts and business relationships: for the management of the relationship; after closure, only for still-justified needs, legal obligations or disputes.
- Marketing: until consent is withdrawn or an objection is made, or earlier if the purpose ceases to apply. We may retain the minimum necessary to respect your choice not to receive further promotions.
- Job applications: for the recruitment process and for any period necessary to handle claims; retention for future recruitment processes requires a separate agreement.
- Browsing and tracking: in accordance with the cookie policy and the settings of the services. The lifetime of a cookie does not necessarily coincide with that of the data already collected.
In addition: conversations and attachments (email, WhatsApp, chat) for 2 years after the last contact, unless they are needed as accounting records or for a dispute; job applications for 6 months after the end of the selection process; Microsoft Clarity session recordings for 30 days. In backup copies, deleted data remain at most for the retention period of the copies, about 3 months.
At the end of the relevant period, the data must be deleted or anonymised, unless there is an obligation or a documented need to retain them further.
8. Your rights
Under Art. 25 et seq. FADP, you can ask whether we process data relating to you and receive the information provided for by law. You can also request the rectification of inaccurate data, the deletion or cessation of unlawful processing, and object to processing. These requests are assessed in accordance with the statutory conditions, including any retention obligations.
Where the conditions of Art. 28–29 FADP are met, you can obtain the data you have disclosed to us in a commonly used electronic format or request their transfer: in particular, for automated processing based on consent or directly connected with a contract. Transmission to another controller is also subject to the limits provided for by law.
Write to [email protected]. We may request what is necessary to verify your identity. For access requests, we generally respond free of charge within 30 days; any restrictions or delays must be justified. Right of access: FDPIC.
You can report a potential issue to the Federal Data Protection and Information Commissioner (FDPIC) via www.edoeb.admin.ch. Judicial remedies remain available. Where the GDPR applies, you also have the rights set out in Art. 15–22, within their respective limits, and the right to lodge a complaint with the competent supervisory authority. You can always object to direct marketing.
9. Security
Data protection requires technical and organisational measures appropriate to the risks, access restricted to work requirements and attention to the security of providers. No system can guarantee zero risk. We use personal accounts with access restricted to what is necessary, providers that ensure the security of their services and backup copies of business management data.
If a breach is likely to result in a high risk to individuals, the obligations to notify the FDPIC and, where required, to inform the data subjects under Art. 24 FADP apply.
10. Updates
We will update this privacy notice when the processing activities, the services or the applicable rules change, indicating the new date. If a change requires new consent, we will ask for it before the relevant processing takes place. The current version is dated 16 October 2026.