Privacy policy
HOMELYA Privacy and Cookie Policy
Last updated: 19 August 2026
1. Who is responsible for your personal data
The controller is:
Natalia Bogdan
Sole proprietor
Alte Obfelderstrasse 31, 8910 Affoltern am Albis, ZH -Switzerland
Trading as: HOMELYA
Email: hellohomelya@gmail.com
This policy is based primarily on the Swiss Federal Act on Data Protection (FADP) and the Ordinance on Data Protection. If HOMELYA actively offers services to, or monitors the behaviour of, people in the European Economic Area, the EU General Data Protection Regulation may also apply.
2. Personal data we process
Depending on how you use the website and services, HOMELYA may process:
- identity and contact data, such as name, email address, telephone number, billing address and account details;
- order data, such as package, order number, price, payment status, refund information and transaction references;
- design-brief data, including room use, household needs, style preferences, colour preferences, budget and information about existing furniture;
- room photographs, floor plans, room and furniture measurements, and inspiration images;
- consultation and appointment data, including booking details, attendance and information shared during a video consultation;
- communications, including emails, enquiries, complaints and revision requests;
- website and device data, such as IP address, browser, device identifiers, pages viewed, referring page and cookie choices;
- marketing data, such as newsletter subscriptions, campaign interactions and opt-out choices; and
- any other information you choose to provide.
Payment providers process the information required to authorise and settle payments. HOMELYA does not receive or store complete card numbers when those numbers are handled by Shopify or the selected payment provider.
Please avoid submitting sensitive personal data or photographs showing people, private documents, security systems or other information that is not needed for the design.
3. How and why we use personal data
HOMELYA processes personal data to:
- operate the website and respond to enquiries;
- create and administer customer accounts, if accounts are enabled;
- receive, confirm and fulfil orders;
- review design briefs and create personalised design deliverables;
- arrange consultations, communicate about projects and manage revisions;
- process payments, cancellations, refunds, accounting and fraud prevention;
- provide customer support and handle complaints;
- secure, maintain and improve the website and services;
- comply with legal, tax, accounting and regulatory obligations;
- establish, exercise or defend legal claims; and
- send marketing where permitted and measure it where lawful.
Under Swiss law, processing is carried out in accordance with the FADP’s principles and, where a justification is required, may be based on your consent, performance of or steps relating to a contract, legal obligations, or overriding private or public interests. If the GDPR applies, the corresponding bases are generally contract performance, legal obligation, legitimate interests and consent where required.
HOMELYA does not use room photographs, floor plans or completed designs in a public portfolio, advertising, social media or case studies without the customer’s separate permission.
4. Shopify
The online shop is hosted on Shopify. Shopify processes store, customer, order, device and transaction data to provide the storefront, checkout, security, hosting and related commerce functions. Shopify may process data through affiliated companies and service providers in several countries.
Shopify’s own notices provide further information about its processing.
5. Payments
Depending on the method selected, payment-related data may be processed by Shopify and by Apple Pay, Google Pay, Klarna, Mastercard, PayPal or Visa, as applicable. Each provider may act as an independent controller for parts of its processing and applies its own privacy notice.
6. Design, communication and other service providers
HOMELYA discloses personal data only as needed to providers that support the service. Complete the following before publication:
- Design-brief/form provider: https://tally.so
- Video-consultation provider: https://meet.google.com
- Email-marketing provider: Google Gmail
- Email hosting/provider for hellohomelya@gmail.com: Google Gmail
Providers may use data only for the agreed service unless they disclose that they act as an independent controller. HOMELYA may also disclose data where required by law, to protect legal rights, or in connection with a reorganisation or transfer of the business, subject to applicable safeguards.
7. Cookies and similar technologies
Cookies and similar technologies store or read information on a device. HOMELYA may use these categories:
- **Strictly necessary:** required for storefront operation, checkout, security, fraud prevention, network management and privacy choices.
- **Preferences:** remember settings such as language or region.
- **Analytics:** measure website use and performance. Analytics provider: Shopify
- **Advertising:** measure campaigns or personalise advertising. Advertising tools or pixels: Google
Non-essential technologies will be used only as permitted by applicable law and, where consent is required, only after a valid choice. Users must be able to reject non-essential cookies as easily as accepting them and later change their choice.
Personalised-advertising cookies or other tracking capable of high-risk profiling must not be activated without the consent required by Swiss law. If the GDPR or EEA e-privacy rules apply, HOMELYA must also apply their consent requirements.
Browser controls can block or delete cookies, but blocking necessary cookies may prevent parts of checkout or the website from working. Cookie names, providers, purposes and lifetimes should be listed in the live cookie settings or a current cookie table.
8. Marketing
HOMELYA sends marketing emails only where permitted. You may unsubscribe at any time through the link in a marketing email or by writing to hellohomelya@gmail.com. Service messages about an order or project are not marketing and may still be sent.
HOMELYA does not sell personal data.
9. International data transfers
Some providers may process data outside Switzerland. Where a destination does not provide an adequate level of protection under Swiss law, HOMELYA will use an available lawful safeguard or exception, such as recognised standard contractual clauses with Swiss-law adaptations where required, and will carry out any necessary transfer-risk assessment.
If the GDPR applies, HOMELYA will also use a transfer mechanism recognised under that law where required. You may contact HOMELYA for information about the applicable safeguards, subject to legitimate confidentiality restrictions.
10. Data security
HOMELYA takes technical and organisational measures appropriate to the nature of the data and the risks, and requires relevant providers to protect personal data.
No internet transmission or storage system is completely secure. Customers should use secure transfer methods offered by HOMELYA and should not email unnecessary sensitive material.
11. Retention
HOMELYA keeps personal data only for as long as needed for the purpose for which it was collected, legal retention duties, and the establishment or defence of claims.
- Order, invoice and accounting records are generally retained for ten years from the end of the relevant financial year where Swiss accounting law requires this.
- Design briefs, room photographs, floor plans, measurements, deliverables and project communications are retained for 1 year then deleted or anonymised unless needed for a dispute, legal duty or separately authorised portfolio use.
- Uncompleted enquiries are retained for 6 months.
- Marketing data is retained until opt-out or 1 years; a minimal suppression record may be retained to respect the opt-out.
- Consultation recordings, if any: No
- Cookie and analytics data: No
Backups may retain residual copies for a limited period before they are overwritten. 1 year
12. Your rights
Subject to applicable conditions and exceptions, you may ask HOMELYA to:
- confirm whether personal data about you is processed and provide access to it;
- correct inaccurate or incomplete data;
- delete or destroy data, or restrict or object to processing;
- provide certain data in a commonly used electronic format or transfer it to another controller where the statutory portability right applies; and
- withdraw consent for future processing where processing relies on consent.
You may object to direct marketing at any time. Withdrawing consent does not affect processing already carried out lawfully.
Send requests to hellohomelya@gmail.com. HOMELYA may request information necessary to verify identity and will respond within the period required by applicable law. Rights can be limited where, for example, legal retention duties, third-party rights or legal claims apply.
13. Complaints and the FDPIC
Please contact HOMELYA first so that the concern can be addressed. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC):
Federal Data Protection and Information Commissioner
Feldeggweg 1
3003 Bern
Switzerland
https://www.edoeb.admin.ch
If another data-protection law applies, you may also have the right to contact the competent supervisory authority in that jurisdiction.
14. Children
The website and services are not directed to people under 18. A minor may order only with the consent of a legal representative where required. If you believe a child has provided personal data without appropriate consent, contact HOMELYA so the data can be reviewed and, where appropriate, deleted.
15. Changes to this policy
HOMELYA may update this policy to reflect changes in processing, providers or law. The current version will be posted on the website with its “Last updated” date. Material changes will be communicated in an appropriate way where required.
16. Privacy contact
Email: hellohomelya@gmail.com