Privacy policy
This page explains which personal data we process when you visit chezrosa.ch or contact us, why, and what your rights are. It applies under the Swiss Federal Act on Data Protection (FADP) and, for visitors from the European Union, the General Data Protection Regulation (GDPR).
Last updated:
1. Data controller
La Fusión by Chez Rosa, exploitée par Chez Rosa Sàrl [À VALIDER : raison sociale exacte et numéro IDE CHE-…], Rue de Lausanne 91, 1202 Genève, Suisse — chezrosage@gmail.com — +41 78 220 11 30
For any question about your data, write to us at chezrosage@gmail.com.
2. Data we process
- Visit statistics (Google Analytics 4, via Google Tag Manager): pages viewed, duration, device type, approximate country and city, traffic source. These measurements are only enabled after you accept them in the cookie banner. Google Analytics 4 does not store full IP addresses.
- Contacts and bookings: when you message us on WhatsApp, call us, email us or book via TheFork, we process your name, phone number or email address, date, time, number of guests and any information you give us (allergies, occasion).
- Hosting provider technical logs (Vercel): IP address, date and time, requested page and browser, needed to run and secure the website.
- Preferences stored in your browser: your cookie choice and light or dark theme (local storage, never sent to third parties).
We do not sell any personal data and do not use any for advertising purposes.
3. Purposes and legal bases
- Answering your requests and managing your bookings: pre-contractual measures or performance of a contract (Art. 6(1)(b) GDPR).
- Measuring website traffic to improve it: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- Keeping the website secure and working: our legitimate interest (Art. 6(1)(f) GDPR).
Under Swiss law, this processing follows the principles of the FADP (lawfulness, proportionality, purpose limitation, transparency) and, for statistics, your consent.
4. Cookies and local storage
- chez-rosa-consent (local storage): remembers your cookie choice. Necessary.
- chez-rosa-theme (local storage): remembers the light or dark theme. Preference.
- _ga and _ga_* (Google Analytics cookies): distinguish visits. Only set if you accept; kept for up to 2 years [À VALIDER : durée de conservation réglée dans GA4].
Without your consent, Google Tag Manager runs in "consent mode": no measurement cookie is set and advertising cookies always remain disabled [À VALIDER : confirmer la configuration du conteneur GTM].
You can change your choice at any time with the "Manage cookies" link at the bottom of every page.
5. Recipients and processors
We use the following providers, who process data on our behalf or independently under their own terms:
- Vercel Inc. (United States): website hosting and technical logs.
- Google (Google Ireland Limited / Google LLC, United States): Google Tag Manager and Google Analytics 4, after consent.
- Sanity (Sanity AS, Norway / Sanity Inc., United States): website content management (menu, opening hours). No visitor data is sent to it.
- TheFork SAS (France): online bookings, if you use this service, under TheFork's privacy policy.
- WhatsApp Ireland Limited (Meta group): WhatsApp messages, if you contact us this way, under WhatsApp's policy.
6. Transfers outside Switzerland
Some providers process data in the European Union or the United States. Transfers to the United States rely on the Swiss-U.S. Data Privacy Framework where the provider is certified (Vercel is), or on standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) [À VALIDER : vérifier l'adhésion de chaque prestataire].
7. Retention
- Google Analytics statistics: 14 months at most [À VALIDER : paramètre de conservation GA4].
- Messages and bookings: as long as needed to handle your request, then 12 months at most [À VALIDER], unless the law requires longer (e.g. accounting).
- Hosting technical logs: a few days at most [À VALIDER : selon l'offre Vercel].
8. Your rights
You may at any time request access to, correction or deletion of your data, object to processing, request restriction or portability, and withdraw your consent without affecting processing already carried out.
To exercise these rights, write to chezrosage@gmail.com. We may ask you to prove your identity. We reply within 30 days.
You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, if you live in the European Union, with your national data protection authority.
9. Security
The website is served over HTTPS only. Access to the website administration is restricted to individually authorised accounts protected by Google sign-in.
10. Changes
We may update this policy to reflect changes to the website or the law. The last update date is shown at the top of this page.