Privacy Policy
PRIVACY AT A GLANCE
We collect personal data to process your orders, manage your account, respond to your queries, maintain our business operations, and — where required by law — send you marketing information tailored to your preferences and interests, with your consent.
We may share your personal data with our service providers and affiliates for the purposes mentioned above. We may also disclose your data to Swiss regulatory or law enforcement authorities if legally required to do so. We do not share your personal data with third parties for their own direct marketing purposes.
Under Swiss data protection law, you have specific rights regarding your personal data, such as the right to access, correct or delete it, and to object to certain processing activities. To learn more about how we use your personal data and your rights, please consult our full Privacy Notice below.
1. INTRODUCTION
Welcome to Graff’s Privacy Notice.
Graff Diamonds SARL (“Graff”, “we”, “us” or “our”) respects your privacy and is committed to processing your personal data in accordance with Swiss data protection law, in particular the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”) and its Ordinance (OFADP). We aim to ensure that you clearly understand our data protection practices.
This Privacy Notice describes the personal data we collect through our website (the “Site”), how we use it, to whom we may disclose it, and the rights you have regarding your data. It also applies, as appropriate, to other interactions you may have with us in the context of our business activities.
Where we process personal data of individuals located in the European Economic Area (“EEA”), certain principles of the EU General Data Protection Regulation (“GDPR”) may also apply, to the extent required by law and provided they are compatible with Swiss law.
2. WHO IS GRAFF?
Graff Diamonds SARL is the data controller responsible for the processing of your personal data as described in this Privacy Notice.
Graff Diamonds SARL
Rue du Rhone 29
1204 Geneve, Switzerland
Email: info.hq@graff.com
If you have any questions regarding this Privacy Notice, or if you wish to exercise your rights under applicable Swiss data protection law, you may contact us using the details above.
3. WHAT PERSONAL DATA DO WE COLLECT FROM YOU?
We collect and use personal data that is necessary for the purposes outlined in this Privacy Notice, in accordance with the principles of proportionality and transparency under Swiss data protection law.
The types of personal data we may collect include:
• Information you provide directly, such as when you fill in enquiry forms, create an account with us, or place an order. This may include your name, home and/or business address, email address, telephone number, and other contact details. We may also collect demographic information such as age and any other details that may identify you as an individual.
• Information you provide when you contact us for support, submit an enquiry, or report a problem with our Site. We may keep a record of such correspondence for administrative and legal purposes.
• Technical and usage information collected during your visits to our Site, such as IP address, browser type, device identifiers, access times, referring website addresses, and data about the pages you access, the time you spend on them, and how you navigate the Site. This information may be collected through cookies or similar technologies. Please refer to the section "Digital Advertising & Analytics" for more information.
• Anonymous or aggregated demographic information, such as age, gender, preferences, interests, and favourites. Such data is not considered personal data under Swiss law if it does not allow you to be identified.
We do not intentionally collect sensitive personal data (e.g., data concerning health, religious beliefs, or biometric data) unless it is strictly necessary for a specific purpose and you have given your explicit consent, or another legal basis under Swiss law applies.
4. WHY DO WE USE YOUR PERSONAL DATA AND WHAT BASIS DO WE RELY ON?
We process your personal data only for purposes that are lawful, proportionate, and necessary to achieve defined objectives, in accordance with the Swiss Federal Act on Data Protection (“FADP”). These purposes include:
| Purpose of Processing | Justification |
|---|---|
| Processing and delivering your orders, including handling payments, shipping, and related communications. | Necessary for the execution of a contract between you and us. |
| Managing your customer relationship, including account management, after-sales support, and communications regarding changes to our services or terms. | Necessary for fulfilling our contractual obligations and maintaining customer service. |
| Responding to your enquiries or requests for information before you make a purchase. | Necessary for taking steps at your request prior to entering into a contract. |
| Ensuring the proper administration of our business, including maintaining internal records, handling complaints, and managing commercial opportunities. | Necessary for our legitimate interest in ensuring the efficiency and continuity of our business operations, in accordance with Swiss law. |
| Detecting, investigating, and preventing fraud or unlawful activities, including monitoring usage patterns and securing our systems. | Based on our legitimate interest in protecting our systems and users. Sending you marketing communications, including promotional offers and newsletters. |
| Based on your consent where required. If you are an existing customer, we may send relevant information about similar products or services based on our legitimate interest. You may unsubscribe at any time using the link in our communications. | Conducting limited profiling to ensure that the marketing content you receive is relevant to your preferences. Based on your explicit consent. No automated decision-making with legal or significant effects is conducted. |
| Fulfilling legal obligations, such as complying with tax, regulatory, or anti-money laundering requirements, or responding to official requests from competent authorities. | Required to comply with legal obligations under Swiss law. |
| Ensuring safety and security at our retail outlets, including the use of CCTV systems for crime prevention and investigation. | Based on our legitimate interest in safeguarding our premises, staff, and clients, provided this does not override your rights and freedoms. |
We only collect and process personal data that is necessary for the purposes described above and retain it only for as long as required by law or justified by business needs.
5. WHO DO WE SHARE YOUR PERSONAL DATA WITH?
We may disclose your personal data to third parties, strictly for the purposes described in this Privacy Notice and in compliance with applicable Swiss data protection law, including the principles of necessity, proportionality, and confidentiality.
Specifically, we may share your personal data with the following categories of recipients:
• Service providers (data processors) who process personal data on our behalf to provide services such as website hosting, IT and infrastructure support, data analytics, or customer communication tools. Such providers are contractually bound to process personal data only on documented instructions from us and to provide adequate technical and organisational measures to ensure data protection.
• Our affiliates, subsidiaries, and business divisions, for internal administrative and operational purposes, where such access is necessary and subject to appropriate confidentiality safeguards.
• Swiss or foreign public authorities, courts, regulators or enforcement agencies, where disclosure is required by applicable law, a lawful request, or judicial order, or where it is necessary to protect our legal rights or comply with our obligations.
• Third parties involved in corporate transactions, including potential or actual buyers, investors, or merger partners, in connection with a merger, acquisition, reorganisation, or sale of all or part of our business or assets, including insolvency proceedings. In such cases, personal data will be shared only to the extent necessary and subject to appropriate confidentiality undertakings.
• Other recipients of anonymised or aggregated data, which cannot reasonably be used to identify you. Such data is not considered personal data under Swiss law and may be shared without restriction.
We do not sell your personal data to third parties and do not allow third parties to use your personal data for their own marketing purposes.
6. DIGITAL ADVERTISING & ANALYTICS
We use cookies and similar tracking technologies on our website to enhance your browsing experience, to analyse usage patterns, and, where permitted, to personalise content and advertisements.
Some of these tools may involve third-party providers, such as advertising networks and analytics services, who collect information about your interaction with our Site and other websites or applications over time. This may include your IP address, browser type, device identifiers, referring URLs, and browsing behaviour. When such data allows you to be identified or tracked, it is treated as personal data under Swiss law.
Where required under the Swiss Federal Act on Data Protection and its Ordinance, we obtain your consent before placing non-essential cookies or engaging in tracking for marketing or analytics purposes. You may withdraw your consent or manage your preferences at any time using our cookie management tool, or by adjusting your browser settings.
We may use Google Analytics and similar services to monitor and improve the performance of our Site and to better understand our audience. These services may use cookies and other identifiers to collect aggregated statistical data. For more information on how Google uses such data, please visit Google’s Privacy & Terms. To opt out of Google Analytics, you can install the Google Analytics Opt-out Browser Add-on.
Please note that restricting or disabling cookies may affect the proper functioning of our Site.
7. THIRD-PARTY LINKS AND TOOLS
Our Site may contain links to third-party websites, applications, or platforms. These external services operate independently from Graff and are not governed by this Privacy Notice. We do not control their content, terms of use, or privacy practices, and we do not accept any responsibility or liability for their data processing activities.
We encourage you to review the privacy notices of any third-party websites or services you access, especially before providing them with any personal data.
Our Site may also integrate social media tools or plug-ins (such as “like” or “share” buttons), which are operated by third parties such as Meta, Instagram, or X. When you use these features, those third-party platforms may collect personal data about you, including your interaction with our Site, and may combine it with other data they hold about you. These interactions are governed by the privacy notices of the respective providers and may result in data transfers to countries outside Switzerland.
We recommend that you review the applicable privacy settings and data protection notices of these third-party providers before interacting with their features on our Site.
8. DO WE TRANSFER YOUR PERSONAL DATA OUTSIDE OF YOUR COUNTRY?
We do not generally transfer your personal data outside Switzerland unless such a transfer is strictly necessary for the purposes described in this Privacy Notice.
When we transfer personal data to countries that do not provide an adequate level of data protection as defined by the Swiss Federal Data Protection and Information Commissioner (FDPIC), we implement appropriate safeguards in accordance with Articles 16 to 18 of the Swiss Federal Act on Data Protection (FADP).
These safeguards may include:
• The use of standard contractual clauses (SCCs) approved or recognised by the FDPIC;
• The inclusion of specific data protection obligations in our contracts with the recipients;
• Other legally permitted mechanisms under Swiss law.
We also assess, where required, whether additional measures are needed to ensure that your personal data remains adequately protected during and after the transfer.
If you would like to receive further information about the safeguards we apply to international transfers of personal data, please contact us using the details provided in Section 2.
9. HOW LONG DO WE KEEP YOUR PERSONAL DATA FOR?
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, as outlined in this Privacy Notice, and in accordance with the principles of proportionality and data minimisation under Swiss data protection law.
The specific retention period may depend on various factors, including:
• The nature of the products or services we provide to you;
• Legal and regulatory obligations that require us to retain data for a certain period (e.g., commercial and tax law requirements);
• The need to retain data for the establishment, exercise, or defence of legal claims;
• Security, fraud prevention, and business continuity considerations;
• Legitimate business needs, provided they are compatible with the original purposes of collection.
Once the retention period expires, we either securely delete or anonymise your personal data, unless we are required by law to retain it for a longer period.
If you would like more specific information about our data retention periods, or if you wish to request the deletion of your personal data, please contact us using the details provided in Section 2.
In addition, for purposes of ensuring the security of our website and IT infrastructure, we may retain technical logs of access to our systems (such as IP addresses, time of access, and actions performed) for a limited period of time. These records are kept strictly for security and compliance purposes and are automatically deleted or anonymised once no longer needed.
10. YOUR RIGHTS
Under the Swiss Federal Act on Data Protection (FADP), you have the following rights in relation to your personal data:
• Right of access: You may request confirmation as to whether we process personal data about you, and, if so, obtain a copy of your personal data and related information.
• Right to rectification: You may request the correction of inaccurate or incomplete personal data we hold about you.
• Right to erasure: You may request the deletion of your personal data if it is no longer necessary for the purposes for which it was collected, or if the processing is unlawful, subject to any legal obligations to retain the data.
• Right to data portability: Where the processing is based on your consent or a contract and is carried out by automated means, you may request to receive your personal data in a commonly used electronic format or ask us to transfer it to another controller, where technically feasible. Please note that this right applies only to personal data that you have provided to us directly and does not extend to data derived or inferred from other information.
• Right to object: You may object to the processing of your personal data where such processing is not required by law or contract, particularly in the context of direct marketing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of any processing carried out prior to your withdrawal.
You may exercise these rights at any time by contacting us using the details provided in Section 2. We may ask you to verify your identity before processing your request. In certain cases, we may decline your request where permitted by law, for example where the request is manifestly unfounded, excessive, or impacts the rights of others.
If you have concerns about how we process your personal data, you may contact us directly. You may also file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).
11. WHAT COOKIES AND SIMILAR TECHNOLOGIES DO WE USE?
We use cookies and similar technologies on our Site to provide core functionality, analyse usage, and – where permitted – personalise content and advertisements.
Some of these technologies are necessary for the proper functioning of the Site, while others are used for analytics and marketing purposes and require your prior consent under the Swiss Federal Act on Data Protection (FADP) and the Ordinance on Data Protection (OFADP).
For detailed information about the types of cookies we use, their purpose, and how you can manage or withdraw your consent, please consult our Cookies Policy for more information about the types of cookies we use, their purposes, and your choices. You can also manage your preferences using the cookie settings tool available on our Site, or by adjusting your browser settings.
Please note that disabling certain cookies may affect the performance or availability of some features on the Site.
12. CONTACT US
If you have any questions about this Privacy Notice, how we handle your personal data, or if you wish to exercise your rights under Swiss data protection law, please contact us at:
• Email: data@graff.com
• Postal address:
Graff Diamonds SARL
28–29 Albemarle Street
London, W1S 4JA
United Kingdom
Please indicate that your request concerns data protection so that it may be directed to the appropriate contact person. We will respond in accordance with applicable Swiss data protection law and may ask you to verify your identity before fulfilling certain requests.
13. CHANGES TO THIS PRIVACY NOTICE
We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. If we make material changes, we will take appropriate measures to inform you, consistent with the significance of the changes and applicable legal obligations.
The revised Privacy Notice will be published on our website with a new effective date. We encourage you to review this page periodically to stay informed about how we process your personal data.
Effective date: June 2025