1. Controller
Responsible for the processing of personal data on this website:
Kantilu — Lucie Benz
Riedstrasse 74
8604 Volketswil
Switzerland
Contact: via the contact form on this website or [email protected]
2. What data we collect and why
We only collect data that you actively provide. We use no tracking cookies, analytics tools, or advertising scripts.
- Contact form: Name, email, message — used solely to respond to your inquiry. Legal basis: Art. 6(1)(b) GDPR / legitimate interest under Swiss DSG.
- Order form: Name, postal address, email, optional phone — used solely to process and ship your order. Legal basis: Art. 6(1)(b) GDPR (contract performance) / Swiss DSG.
We do not collect data for marketing, do not create user profiles, and do not sell or share your data with third parties, except as described in section 3.
3. Third-party service providers
Form submissions are transmitted securely via Web3Forms (web3forms.com/privacy). Web3Forms processes your data solely to deliver it to us and does not store it beyond what is technically necessary.
This website is hosted by MvA Internet Services GmbH, Im Brünneli 12, 8307 Effretikon, Switzerland (mva.ch). Server log files (IP address, browser type, access time) may be stored temporarily on MvA servers for security, error analysis and basic, anonymised visitor statistics (using AWStats). They are deleted according to MvA's retention policy and not used for user profiling.
If you subscribe to the newsletter, your email address is processed by MailerLite, UAB MailerLite, Paupio g. 28, Vilnius, LT-11341, Lithuania (mailerlite.com/legal/privacy-policy). MailerLite acts as a data processor on behalf of Kantilu. Data collected: email address, subscription date, confirmation status. Newsletter emails may contain an invisible tracking pixel that records whether the email was opened (open rate tracking). No personally identifiable information beyond your email address is collected through this. Additionally, this website uses the MailerLite Universal script to display a newsletter signup popup to visitors. This script does not set tracking cookies and does not collect personal data unless you actively submit the signup form. Legal basis: your explicit consent (Art. 6(1)(a) GDPR / Art. 6 DSG). Data is stored on servers within the EU. You may unsubscribe at any time via the link in any newsletter email.
4. Data retention
We retain your personal data only as long as necessary to fulfil the purpose for which it was collected — typically the duration of correspondence or order processing — and no longer than required by law (Swiss OR: 10 years for commercial records).
5. Your rights
Under the Swiss DSG and, where applicable, the EU GDPR, you have the right to: access, rectification, erasure, restriction of processing, objection, and data portability. To exercise these rights, contact us via the contact form. We will respond within 30 days.
You may also lodge a complaint with the Swiss FDPIC at edoeb.admin.ch, or with your EU data protection authority.
6. Data security
All form data is transmitted encrypted via HTTPS. We take reasonable technical and organisational measures to protect your data.
7. Cookies & tracking
This website uses no tracking or analytics cookies. The only browser storage used is a single local flag that remembers whether you acknowledged this privacy notice. No data from this flag is transmitted to any server.
8. Purchase Terms
Orders placed via this website are binding once you receive an email confirmation from Kantilu. Payment is due within 10 days of confirmation by bank transfer to the details provided in the confirmation email. Shipping follows upon receipt of payment, within 5–10 business days.
Prints are produced to order and are therefore excluded from the right of withdrawal under Art. 40d OR (Swiss law), unless the item arrives damaged or defective. In the event of a defect, please contact us within 14 days of receipt.
Original artworks are one-of-a-kind and sold as-is. No right of withdrawal applies to uniquely personalised or one-of-a-kind items.
9. Third-party links
This website links to Instagram and Ko-fi. Their own privacy policies apply once you navigate to those sites.
10. Changes
This policy may be updated occasionally. The current version is always accessible via the Privacy Policy link on this website.
Last updated: March 2026 · Swiss DSG & EU GDPR
