Privacy policy
Privacy Policy
Last updated: September 2026 — Barnaby Bright / AlphaSaphir, Switzerland
This Privacy Policy explains how Barnaby Bright (operated by AlphaSaphir, Switzerland) collects, uses, and protects your personal data when you visit our website or purchase our books. We take your privacy seriously and comply with all applicable data protection laws worldwide, including GDPR (EU/EEA), UK GDPR, the Swiss Federal Act on Data Protection (nDSG), CCPA (California), PIPEDA (Canada), and the Australian Privacy Act.
1. Who We Are (Controller)
Barnaby Bright is operated by AlphaSaphir, Switzerland.
Data protection contact: info@alphasaphir.ch
2. What Personal Data We Collect
| DATA | PURPOSE | LEGAL BASIS (EU/UK GDPR) |
|---|---|---|
| Name, email, shipping address, billing address | Fulfil and deliver your order | Contract performance (Art. 6(1)(b)) |
| Payment information | Process payment securely (we never store card numbers) | Contract performance (Art. 6(1)(b)) |
| Order history | Customer service, legal compliance | Legal obligation / Legitimate interest (Art. 6(1)(c)(f)) |
| IP address, browser, device data | Website security and analytics | Legitimate interest (Art. 6(1)(f)) |
| Email address (newsletter) | Marketing communications | Consent (Art. 6(1)(a)) — opt-in only |
3. How We Use Your Data
- To process and fulfil your order via our print fulfilment partner Lulu Direct
- To send order confirmations, shipping updates, and customer service replies
- To send our newsletter (only if you have opted in — you may unsubscribe at any time)
- To comply with legal obligations (e.g. accounting, tax records)
- To improve website performance and security
4. Who We Share Your Data With
We share only the minimum necessary data with trusted service providers operating as our data processors:
- Lulu Direct (MagCloud Inc.) — print and fulfilment. Your name and delivery address are shared to produce and ship your book. Lulu Privacy Policy
- Shopify Inc. — e-commerce platform hosting our store. Shopify Privacy Policy
- Payment processors (e.g. Stripe, PayPal) — secure payment handling only. We never see or store your full card details.
- Shipping carriers — name and address forwarded by Lulu Direct for delivery.
We do not sell, rent, or trade your personal data to any third party for marketing purposes.
5. International Data Transfers
Our store is operated from Switzerland, which the European Commission recognises as providing an adequate level of data protection (Adequacy Decision). When data is transferred to Lulu Direct (USA) or Shopify (Canada), such transfers are governed by Standard Contractual Clauses (SCCs) or equivalent safeguards. For Australian and Canadian customers, data handling complies with the Australian Privacy Act and PIPEDA respectively.
6. Your Rights
| RIGHT | WHO IT APPLIES TO |
|---|---|
| Access your personal data | EU, UK, Switzerland, Australia, California (CCPA), Canada |
| Correct inaccurate data | EU, UK, Switzerland, Australia, Canada |
| Delete your data (“right to be forgotten”) | EU, UK, Switzerland, California, Canada |
| Restrict or object to processing | EU, UK, Switzerland |
| Data portability | EU, UK |
| Opt out of sale of personal data | California (CCPA) — note: we do not sell data |
| Lodge a complaint with a supervisory authority | EU, UK, Switzerland (FDPIC), Australia (OAIC) |
To exercise any right, email info@alphasaphir.ch. We will respond within 30 days (or within the statutory period applicable in your country).
7. Cookies
We use essential cookies (required for the store to function), analytics cookies (to understand site usage), and marketing cookies (only if you consent). You can manage or withdraw consent via your browser settings or our cookie banner. We do not use cookies to track you across third-party websites for advertising purposes.
8. Data Retention
- Order data: retained for 10 years to comply with Swiss accounting law (OR Art. 958f)
- Newsletter subscribers: data deleted promptly on unsubscription
- Support enquiries: retained for 3 years
- Website analytics: aggregated data retained for 26 months maximum
9. Children’s Privacy
Our website is directed at adults purchasing on behalf of children. We do not knowingly collect personal data from children under 16 (or under 13 in the USA). If you believe a child has submitted personal data to us, please contact us immediately at info@alphasaphir.ch.
10. California Residents (CCPA)
California residents have the right to know what personal information we collect, to request deletion, and to opt out of the sale of their personal information. We do not sell personal information. To submit a CCPA request, email hello@barnabybright.com.
11. Changes to This Policy
We may update this policy from time to time. The current version is always published here with the date above. For material changes, we will notify customers by email where possible.
Supervisory authorities: EU residents may contact their national DPA. UK residents may contact the ICO (ico.org.uk). Swiss residents may contact the FDPIC (edoeb.admin.ch). Australian residents may contact the OAIC (oaic.gov.au).