Privacy policy

Privacy Policy – Revitera / Alparis GmbH

1. Introduction and Scope

We, Alparis GmbH (hereinafter "we", "us" or "controller"), operate the online shop revitera.ch and take the protection of your personal data very seriously. This privacy policy explains which personal data we collect from visitors and customers ("you") and how we process it in accordance with the Swiss Data Protection Act (DSG) and – where applicable – the EU General Data Protection Regulation (GDPR). Please read the following information carefully to understand how we handle your personal data.

2. Controller

The controller responsible for data processing on this website is:

Alparis GmbH Müligässli 1 8598 Bottighofen TG Schweiz

E-mail: hallo@revitera.ch Phone: +41 76 710 53 76

You may address questions or concerns regarding data protection at any time to the address stated above.

Representative

We value your privacy and your rights as a data subject and have therefore appointed the Prighter Group, with its local partners, as our data protection representative and point of contact for the following regions:

  • European Union (EU)

iuro Rechtsanwälte GmbH t/a Prighter, Schellinggasse 3, 1010 Wien, Österreich

Prighter offers you an easy way to exercise your data protection rights (e.g. requests for access or erasure). If you wish to contact us via our representative Prighter or exercise your rights as a data subject, please visit the following website: https://app.prighter.com/portal/17184033144

3. Collection and Use of Personal Data

We collect personal data only where this is permitted (e.g. for the performance of a contract) or where you have given your consent. Depending on how you interact with our website, different data is generated:

a) Visiting the website

When you access our website, technical access data is automatically stored in so-called log files. This includes, for example, the IP address of the requesting device, date and time of access, pages/files accessed, browser type and version, and the operating system. We need this information to deliver the website, to ensure security and stability, and for statistical analyses to improve our offering. As a rule, this usage data does not allow any direct conclusions to be drawn about your identity and is not combined with other data. Where applicable, we use cookies and similar technologies to make our website user-friendly and to provide certain functions (see Section 4 on tracking and analytics tools).

b) Ordering a product

When you place an order in our online shop, we collect the data necessary to process the order. This includes in particular: surname, first name, billing and delivery address, e-mail address, telephone number where applicable (if necessary for delivery), products ordered and payment information. We process this data for the purpose of contract performance, i.e. to process your order, ship the goods, handle payments and process any statutory warranty or reversal claims. Without this data, a contract cannot be concluded. Providing your telephone number or e-mail also enables us to inform you about the status of the delivery or to contact you with any queries.

c) Customer account

You have the option of creating a customer account. In this case, we store the registration data you provide (name, e-mail, password, etc.) to enable a faster checkout on your next purchase and to give you access to your order history. This data is processed at your request and is covered by your registration (and thus your consent). You can delete your customer account at any time; in this case, your profile data will be deleted, unless statutory retention obligations exist.

d) Contacting us

If you contact us by e-mail or via any contact forms that may be available, we process the information you provide (e.g. name, e-mail, request) in order to handle the enquiry and for possible follow-up questions. This communication generally takes place with your consent or at your request.

e) Newsletter and e-mail marketing

If you sign up for our newsletter, we use your e-mail address to regularly send you our newsletter with information about our products, health tips and offers. For the sign-up, we use the double opt-in procedure, i.e. you will only receive our newsletter after confirming your e-mail address.

The data processing is based on your consent. You can unsubscribe from the newsletter at any time via the unsubscribe link in the newsletter or by sending us a message.

For sending and managing our newsletter, we use the service Klaviyo, provided by Klaviyo, Inc. (USA). In this process, your e-mail address and, where applicable, other data you have provided (e.g. name, purchase history) are stored on Klaviyo's servers in the USA. Klaviyo uses this information on our behalf to send, personalise and statistically evaluate the newsletter (e.g. open and click rates). Data transfers to the USA are based on appropriate safeguards (in particular standard contractual clauses and/or certification under the EU-U.S. Data Privacy Framework). Your e-mail address is used by us exclusively for the newsletter and related communication and is not passed on to uninvolved third parties. When you unsubscribe from the newsletter, your e-mail address will be deleted from the distribution list or blocked from further use.

f) Product reviews and customer feedback

We offer you the opportunity to review products and leave testimonials. For this purpose, we use the services Trusted Shops / eTrusted (Trusted Shops GmbH, Germany), Trustpilot (Trustpilot A/S, Denmark) and the Shopify app Trustoo (Opinew Ltd.). When you submit a review, your review data (name or pseudonym, review text, star rating, e-mail address for verification) is transmitted to and processed by the respective service provider. The processing is carried out for the purpose of displaying authentic customer reviews and thus improving our offering, based on our legitimate interest (Art. 6 para. 1 lit. f GDPR). Where required, we have concluded data processing agreements with the providers.

g) Cookie consent management

We use Consentmo (provider: Consentmo Ltd.) as our cookie consent tool. Consentmo serves to obtain, manage and document your consents for cookies and tracking technologies on our website. The following data is processed: consent status, time of consent and an anonymous identifier. The processing is based on our legitimate interest in demonstrating that consents have been obtained in compliance with data protection law (Art. 6 para. 1 lit. f GDPR; Art. 31 DSG).

4. Tracking and Analytics Tools

In order to continuously improve our website and optimise marketing measures, we use analytics tools and tracking technologies. These services may store cookies or similar technologies on your device and collect personal data (in particular your IP address and usage data). However, we only use these tools within the legally permitted framework. Where required, we obtain your consent via the cookie banner. You can revoke any consent you have given at any time via the cookie settings on the website or deactivate the storage of cookies in your browser (in which case not all functions may be fully available).

Specifically, we currently use the following third-party tools:

Google Analytics (GA4)

This web analytics tool from Google LLC (USA) is used to evaluate user behaviour on our website. Google Analytics uses cookies to collect information about your use of the website (including a truncated IP address) and to transmit it to and store it on a Google server (possibly in the USA). We have configured Google Analytics so that IP addresses are anonymised (IP anonymisation), so that direct identification of individuals is excluded. Google uses the information collected on our behalf to compile reports on website activity and to provide us with other services related to website use and internet use. You can prevent the collection of your data by Google Analytics by installing the browser add-on for deactivating Google Analytics or by adjusting your cookie settings accordingly.

Legal basis: consent (Art. 6 para. 1 lit. a GDPR).

Google Tag Manager

We use Google Tag Manager (a service of Google LLC) to centrally manage website tags and scripts. The Tag Manager itself does not collect any personal data, but it can trigger other tags that in turn collect data (such as Google Analytics or the Meta Pixel). If you have deactivated tracking (opt-out), this is taken into account by Google Tag Manager.

Legal basis: consent (Art. 6 para. 1 lit. a GDPR; Sec. 25 TDDDG).

Meta Pixel (Facebook Pixel)

This technology of Meta Platforms Ireland Ltd. (for users in Europe) or Meta Platforms, Inc. USA (for users outside Europe) helps us to track the behaviour of users after they have seen or clicked on one of our Facebook or Instagram advertisements. This allows us to evaluate the effectiveness of our Facebook/Instagram advertising for statistical and market research purposes. The data collected (e.g. pages visited, purchases, IP address, browser information) is anonymous to us, i.e. we do not see any personal data of individual users. However, this data is processed by Meta to establish the connection to the respective Facebook/Instagram profile and may be used by Meta for its own advertising purposes. If you have a Facebook/Instagram account, you can influence Meta's use of cookies and pixels in your account settings. You can also deactivate the Meta Pixel on our site via our cookie settings.

Legal basis: consent (Art. 6 para. 1 lit. a GDPR).

Microsoft Clarity

We use Microsoft Clarity, a web analytics service of Microsoft Corporation (USA), on our website. Microsoft Clarity records user sessions (so-called session recording) and creates heatmaps that show us how visitors use our website (e.g. mouse movements, scrolling behaviour, click behaviour). In this process, usage data such as IP address (truncated), device and browser information, pages visited and interaction data is collected and transmitted to Microsoft servers (possibly in the USA). Personal entries in forms (e.g. passwords, credit card details) are automatically masked according to the provider.

Microsoft Clarity uses cookies and similar technologies. It is used exclusively with your prior consent via our cookie banner. You can revoke your consent at any time via the cookie settings. Further information can be found in Microsoft's privacy statement: https://privacy.microsoft.com/de-de/privacystatement

Legal basis: consent (Art. 6 para. 1 lit. a GDPR).

Triple Pixel (TripleWhale)

We use the Triple Pixel of the provider Triple Whale, Inc. (USA). This marketing attribution tool serves to measure the effectiveness of our advertising campaigns across various channels and to improve the attribution of orders to advertising measures. In this process, usage data such as IP address, browser information, pages visited and purchase data is collected and transmitted to Triple Whale servers in the USA. The processing is based on your consent via our cookie banner. Data transfers to the USA are based on appropriate safeguards (in particular standard contractual clauses).

Legal basis: consent (Art. 6 para. 1 lit. a GDPR).

Google Ads Conversion Tracking / Remarketing

We use Google Ads Conversion Tracking and Remarketing (provider: Google LLC, USA / Google Ireland Ltd.). These services enable us to measure the effectiveness of our Google Ads campaigns and to show you relevant advertisements based on your previous usage behaviour (remarketing). In this process, your IP address, browser data and conversion data (e.g. purchases, page views) are collected and transmitted to Google servers (possibly in the USA). Data transfers to the USA are based on appropriate safeguards. These services are used exclusively with your prior consent via our cookie banner. You can revoke your consent at any time via the cookie settings.

Legal basis: consent (Art. 6 para. 1 lit. a GDPR).

Outbrain Pixel

We use the Outbrain Pixel (provider: Outbrain Inc., USA). This tracking tool serves to measure the effectiveness of our native advertising campaigns via the Outbrain network. In this process, your IP address, browser data and conversion data are collected and transmitted to Outbrain servers in the USA. The processing is based on your consent via our cookie banner. Data transfers to the USA are based on appropriate safeguards.

Legal basis: consent (Art. 6 para. 1 lit. a GDPR).

Taboola Pixel

We use the Taboola Pixel (provider: Taboola Inc., USA). This tracking tool serves to measure the effectiveness of our native advertising campaigns via the Taboola network. In this process, your IP address, browser data and conversion data are collected and transmitted to Taboola servers in the USA. The processing is based on your consent via our cookie banner. Data transfers to the USA are based on appropriate safeguards.

Legal basis: consent (Art. 6 para. 1 lit. a GDPR).

Notes on data transfers to the USA

Please note that the third-party tools mentioned may transfer data to the USA. From a Swiss and EU data protection perspective, the USA is considered a country without a comprehensively adequate level of data protection. We have agreed appropriate safeguards with the respective providers (in particular standard contractual clauses and/or certifications under the EU-U.S. Data Privacy Framework or the corresponding Swiss data protection framework) in order to establish an adequate level of protection for your data. Nevertheless, in the case of a transfer to the USA, there remains a residual risk that US authorities may access the data without effective legal remedies being available against this in the EU/Switzerland. Your consent (via our cookie banner) also covers the possible transfer of data to the USA. You may, of course, also make use of the opt-out options to avoid data collection by these tools.

5. Use of Payment Service Providers

As part of the ordering process, we offer various payment methods. Depending on which payment method you select, we pass on certain data to the corresponding payment service provider that processes the payment. This includes, for example, the value of the goods, your IP address for fraud prevention and other details necessary for the payment – but no credit card numbers or payment information that you enter directly with the payment service provider. We use the following payment services:

Shopify Payments / Stripe

Credit card payments (Visa, MasterCard, etc.) and TWINT payments are processed via Shopify Payments or Stripe. The provider is Stripe Payments Europe Ltd. (Ireland) in cooperation with Stripe, Inc. (USA). Stripe receives the payment information (e.g. credit card number, validity, amount) directly via the input form at checkout. The privacy policies of Stripe/Shopify Payments apply. Your payment data is processed and stored by Stripe for the purpose of payment processing. We ourselves do not store any complete credit card data.

Privacy notices: https://stripe.com/de/privacy & https://www.shopify.com/de/legal/datenschutz

PayPal

If you select the payment method PayPal, you will be redirected to the pages of PayPal (Europe) S.à.r.l. et Cie, S.C.A. There you can log in with your PayPal credentials and authorise the payment. We subsequently receive from PayPal only the information that the payment has been made (or cancelled). PayPal's privacy principles apply.

Privacy notices: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

TWINT

TWINT is a mobile payment system in Switzerland. If you pay with TWINT, the payment is processed via TWINT AG. You will be directed to the TWINT app or website, where you confirm the payment. We subsequently receive a confirmation or an error message. TWINT processes the data required for the payment under its own privacy policy.

Privacy notices: https://www.twint.ch/datenschutzerklaerung-twint-id-ubs/

Klarna

Where applicable, we offer payment options via Klarna (Klarna Bank AB, Sweden), e.g. invoice purchase or instalment payment. If a Klarna payment method is selected, personal data (e.g. name, address, date of birth, e-mail, IP address, order data) is transmitted to Klarna for the purpose of processing the payment and performing an identity and credit check. In this case, Klarna is an independent controller for the data processing.

Privacy notices: https://www.klarna.com/de/datenschutz/

We use these payment service providers in order to offer you a secure and convenient payment option. The legal basis for passing on the data is contract performance (processing of the purchase contract, Art. 31 DSG) and our legitimate interest in ensuring a reliable payment process. Please note that the payment service providers are independent controllers with respect to your payment data. Information on data processing by these providers can be found in the respective privacy policy of the service.

6. Disclosure of Data to Third Parties and Processors

We never disclose your personal data to third parties without authorisation. However, in order to provide our services, we work with several external service providers to whom we make data available to the extent necessary (or who themselves have access to it), exclusively for the purposes stated here. These service providers are contractually obliged to process personal data exclusively on our behalf and in accordance with our instructions (so-called "commissioned processors" within the meaning of the DSG or processors under the GDPR), or they act as independent controllers where this is indicated. Specifically, the recipients are as follows:

Hosting and shop platform

Our online shop is operated on the e-commerce platform Shopify (provider: Shopify International Ltd., Ireland, or Shopify Inc., Canada). Shopify provides us with the online shop infrastructure and stores the data collected in our shop in its data centres. We have concluded a data processing agreement with Shopify. Shopify may use subcontractors (e.g. cloud providers) to provide its services, including those outside Switzerland/the EU. Further information can be found in Shopify's privacy policies.

The domain revitera.ch is registered via IONOS (1&1 IONOS SE, Germany). IONOS processes only technical domain data (e.g. DNS records) and no customer data of the shop.

Shopify apps and extensions

Within our Shopify shop, we use various apps and extensions that may have access to certain shop data as processors. This includes in particular:

  • GemPages (GemPages, Inc.): Page builder for designing our shop pages. Access to shop data in the context of page creation.
  • Kaching Bundles (Kaching Appz): Bundle and shopping cart management. Access to product data and shopping cart contents.
  • Trustoo (Opinew Ltd.): Product ratings and reviews. Access to order data and customer information for the verification of reviews.
  • Kaching Subscription (Kaching Appz): Management of subscriptions. Storage of customer data (name, e-mail, address, order history, payment information) for the execution of recurring deliveries.
  • Kaching Upgrade (Kaching Appz): Upsell functionality at checkout. Access to shopping cart contents and order data.
  • Kaching Cart (Kaching Appz): Shopping cart optimisation. Access to shopping cart contents.
  • Trusted Shops / eTrusted (Trusted Shops GmbH, Germany): Customer reviews and trust seal. After a purchase, a review invitation may be sent by e-mail. In this process, order data (order number, e-mail address) is transmitted to Trusted Shops. The processing is based on our legitimate interest in quality assurance and building trust (Art. 6 para. 1 lit. f GDPR).
  • Trustpilot (Trustpilot A/S, Denmark): Customer reviews. After a purchase, a review invitation may be sent by e-mail. In this process, order data (name, e-mail address) is transmitted to Trustpilot. The processing is based on our legitimate interest in quality assurance (Art. 6 para. 1 lit. f GDPR).

These apps process data exclusively within the scope of their respective functionality and, as Shopify partners, are subject to Shopify's data protection requirements. Where required, we have concluded data processing agreements with the providers.

Communication and project management

ClickUp (provider: Mango Technologies Inc., USA): We use ClickUp as an internal tool for task management and support ticket management. In this context, customer names, e-mail addresses and the contents of enquiries may in some cases be recorded in ClickUp as part of support processing. The processing is based on our legitimate interest in efficient customer service (Art. 6 para. 1 lit. f GDPR). Data transfers to the USA are based on appropriate safeguards.

E-mail and cloud services

Google Workspace (provider: Google LLC, USA / Google Ireland Ltd.): We use Google Workspace for e-mail communication (including customer communication) and document management (Google Drive). In this context, e-mail contents, attachments, contact details and documents are processed. The processing is based on contract performance (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in efficient communication (Art. 6 para. 1 lit. f GDPR). Data transfers to the USA are based on appropriate safeguards.

Accounting and tax advice

DATEV (provider: DATEV eG, Nürnberg, Deutschland): We use DATEV for the accounting and financial accounting of our German business operations. In this context, invoice data and, where applicable, customer names and order numbers from Shopify exports are processed. The legal basis is the fulfilment of statutory accounting obligations (Art. 6 para. 1 lit. c GDPR).

Topal (provider: Topal Solutions AG, Switzerland): We use Topal for the accounting of our Swiss business operations. In this context, invoice data and, where applicable, customer names from Shopify exports are processed. The legal basis is the fulfilment of statutory accounting obligations.

Tax advisors / fiduciaries: Our external tax advisors (in DE and CH) may, in the course of their work, have access to invoices and business documents that may occasionally contain customer names. They are bound to professional secrecy. The legal basis is the fulfilment of statutory accounting obligations (Art. 6 para. 1 lit. c GDPR).

Logistics and shipping

For the purpose of fulfilling your order, we pass on your delivery address and contact details to our logistics and shipping partner. The delivery of our products is carried out via the fulfilment service provider Cross Border Fulfillment GmbH (Blumenfeldstrasse 16, 9403 Goldach, Schweiz) for deliveries to Switzerland and Agro-Norm Vertriebs GmbH (Am Industriepark 1a, D-84453 Mühldorf, Deutschland) for deliveries to Germany and the EU. Shipping is carried out via Die Schweizerische Post AG (Post) or corresponding German parcel service providers. These receive only the information necessary for delivery (name, address, possibly e-mail/telephone for shipping notifications). These service providers do not make any further use of the data.

E-mail marketing

For sending our newsletter and transactional e-mails, we use Klaviyo (Klaviyo, Inc., USA). Further information can be found in Section 3 lit. e).

Service providers for marketing and analytics

Insofar as we use tools such as Google Analytics, Meta Pixel, Microsoft Clarity, Triple Pixel or Klaviyo (see above), the service providers named in Section 4 become recipients of your data. Some of these service providers are located abroad (e.g. USA); see Section 4 on data transfers abroad and the protective measures taken. We have concluded data processing agreements with all providers, where required by law.

Review platforms

We work with Trusted Shops / eTrusted (Trusted Shops SE, Germany) to give you the opportunity to review our shop and our products after your purchase. For this purpose, your e-mail address and the order reference may be transmitted to Trusted Shops so that you receive a review invitation. Trusted Shops processes this data as an independent controller or on our behalf. Details can be found at: https://www.trustedshops.de/impressum/#datenschutz

Authorities and legal obligations

In certain cases, we are legally obliged to disclose data to third parties. This may be the case, for example, where a statutory duty to provide information exists or where we must provide information in the context of legal proceedings or official requests. In such cases, we disclose data only to the extent required by law and only after careful review.

7. AI-Assisted Data Processing

7.1 Use of artificial intelligence

To improve our services, in particular in the area of customer service and internal data processing, we use systems with artificial intelligence (AI). These systems support us in analysing and responding to customer enquiries, drafting communications, analysing business data and in other operational processes.

7.2 Services and service providers used

We use the following AI services, which may process personal data within the scope of the purposes stated:

  • Anthropic (Claude) – Anthropic, PBC, San Francisco, USA: Analysis of customer enquiries, assistance in drafting e-mails and data evaluations.
  • OpenAI – OpenAI, L.L.C., San Francisco, USA: Generation of text embeddings for intelligent search and matching of enquiries.
  • OpenClaw – AI agent platform, operated on our own server in the EU: Orchestration and control of the aforementioned AI services.

7.3 Categories of data processed

The following personal data may be affected in the context of AI-assisted processing:

  • Contents of customer enquiries (e-mails, contact forms, voice messages)
  • Name and e-mail address
  • Order information and customer number
  • Other data you provide to us in the course of your communication

Sensitive data (e.g. health data in the context of food supplements) is processed only insofar as you voluntarily provide it to us and the processing is necessary to respond to your enquiry.

7.4 Data transfers to the USA

The aforementioned AI service providers (with the exception of OpenClaw, which is operated on a server in the EU) are based in the USA. When these services are used, personal data may be transferred to servers in the USA. From the perspective of the Swiss DSG and the GDPR, the USA does not have an adequate level of data protection.

We have taken appropriate protective measures, in particular:

  • Agreement of appropriate safeguards with the respective providers (standard contractual clauses and/or certifications under the EU-U.S. Data Privacy Framework)
  • Restriction of the data transferred to the necessary minimum
  • Contractual obligation of the providers to process data only for the specified purposes

A residual risk remains that US authorities may access the data in the context of surveillance programmes.

7.5 No solely automated individual decisions

We do not make any decisions based solely on automated processing – including profiling – which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR, Art. 21 DSG). AI systems serve us exclusively as support tools. All decisions affecting your rights or interests (e.g. handling of complaints, goodwill decisions, refunds) are always reviewed and accounted for by a human employee.

7.6 Legal basis

The AI-assisted processing of your data is based on our legitimate interest (Art. 6 para. 1 lit. f GDPR; Art. 31 DSG) in efficient and high-quality customer service and data processing. In the balancing of interests, we have taken into account that the AI systems are used only in a supporting capacity and do not make independent decisions. Insofar as the processing is necessary for the fulfilment of our contractual obligations (e.g. processing your order or enquiry), we additionally base it on contract performance (Art. 6 para. 1 lit. b GDPR; Art. 31 DSG).

7.7 Your rights

You may at any time object to the AI-assisted processing of your personal data. In this case, we will no longer process your data by means of AI systems, unless compelling reasons prevent this. Please contact us at hallo@revitera.ch for this purpose.

8. Duration of Data Storage

We process and store your personal data only for as long as is necessary for the respective purpose. Specifically, this means:

Order data: We generally retain the data collected for contract processing (customer account, orders, invoices, etc.) for the duration of the contractual relationship. After complete processing of the contract or deletion of your customer account, the data continues to be stored in restricted form for as long as statutory retention periods apply. Under Swiss law, we are obliged to retain business records (invoices, accounting documents, etc.) for 10 years. During this period, however, the data is blocked from any other use. After expiry of the retention obligations, we permanently delete the data.

Newsletter data: The data registered for the newsletter is stored for as long as the newsletter subscription is active. After unsubscribing from the newsletter (revocation of your consent), your e-mail address is placed on a suppression list to prevent further mailings and is then completely deleted after a reasonable period of time.

Log files: The automatically collected access data (server log files) is stored only for a limited period of time and then routinely deleted. Longer storage may occur for security reasons (e.g. to investigate misuse or fraud), in which case deletion takes place once the reason for storage no longer applies.

AI-assisted processing: Data transferred to third-party providers in the context of AI-assisted processing is stored there in accordance with the respective data processing agreements and deleted after expiry of the contractually agreed periods. Details can be found in the privacy policies of the respective providers.

Contact enquiries: If you contact us, the communication data is retained for as long as is necessary to handle your request. We delete corresponding e-mails as soon as no further communication is to be expected and any statutory archiving obligations have been fulfilled.

Depending on their type, cookies have different storage periods (session cookies until the browser is closed, persistent cookies from a few months to years). Details can be found in our cookie settings on the website. Analytics and tracking data is deleted or anonymised by the respective service providers in accordance with their own specifications.

9. Legal Bases of Data Processing

We base the processing of your personal data on the applicable legal bases. Under Swiss data protection law, processing is permissible if it is carried out lawfully, i.e. justified by the consent of the data subject, by law, by contract or by an overriding private or public interest. In particular, we process your data on the basis of the following principles:

Contract performance: The processing of data that we require for your order, payment and delivery is carried out for the performance of the purchase contract with you (Art. 31 DSG; corresponds to Art. 6 para. 1 lit. b GDPR). Without this data, we could not perform the contract.

Consent: Insofar as we ask you for consent (e.g. for the newsletter, for setting certain cookies/tracking tools such as Microsoft Clarity, Triple Pixel), we base the data processing on your voluntary consent (Art. 31 DSG; Art. 6 para. 1 lit. a GDPR). You have the right to revoke any consent given at any time with effect for the future. The revocation does not affect the lawfulness of the processing carried out before the revocation.

Legitimate interest: Some data processing is carried out to safeguard our legitimate interests (Art. 31 DSG; Art. 6 para. 1 lit. f GDPR), for example the analysis of user behaviour to improve our offering, personalised advertising to existing customers, fraud prevention in payment processing, the storage of log data to ensure IT security, or the use of AI systems for efficient customer service. In these cases, we have carried out a careful balancing of interests. We process personal data on this basis only insofar as your fundamental rights and freedoms do not prevail. You have the right to object to such processing at any time on grounds relating to your particular situation (see Section 10).

10. Your Rights as a Data Subject

As a person affected by data processing, you have various rights under the Swiss Data Protection Act – and, where applicable, also under the GDPR. These are in particular:

Right of access: You have the right to request information as to whether we process personal data about you. If so, you can obtain information about this data (incl. a copy of the data) as well as information about the purpose of the processing, the categories of data processed, the recipients, the planned storage period and your further rights. (Art. 25 et seq. DSG; Art. 15 GDPR)

Right to rectification: Should your data be inaccurate or incomplete, you may request its rectification or completion. We will correct inaccurate information immediately. (Art. 32 DSG; Art. 16 GDPR)

Right to erasure ("right to be forgotten"): You are entitled to request the erasure of your personal data, provided the legal requirements are met. This is the case, for example, if the data is no longer necessary for the purposes for which it was collected, if you have revoked your consent, or if the processing is unlawful. Please note that the Swiss DSG does not provide for an express right to erasure, but we will comply with your erasure request insofar as no statutory retention obligations or overriding interests stand in the way. (Art. 13 DSG; Art. 17 GDPR)

Right to restriction of processing: Under certain circumstances, you may request that we restrict the processing of your data (so that the data is only stored but not used further). (Art. 15 DSG; Art. 18 GDPR)

Right to data release / data portability: You have the right to request the release of the personal data you have provided in a commonly used electronic format, insofar as the processing is carried out by automated means. Upon request, we will also transfer this data – where technically feasible – directly to a third party designated by you. (Art. 28 DSG; Art. 20 GDPR)

Right to object: You may object to the future processing of your personal data if we process it on the basis of a legitimate interest. In particular, you may object at any time to the processing of your data for direct marketing. In the event of an objection, we will no longer process your data for these purposes. (Art. 31 DSG; Art. 21 GDPR)

Right regarding automated individual decisions: You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR; Art. 21 DSG). As set out in Section 7.5, we use AI systems exclusively in a supporting capacity; all relevant decisions are made by human employees.

Revocation of consents: If you have given us consent (e.g. for the newsletter or for tracking), you may revoke it at any time (as described above). An informal message to us (e.g. by e-mail) is sufficient for this.

Please note that some of the rights mentioned may be subject to restrictions under the DSG. For example, the right of access may be refused or restricted if it would impair the interests of third parties or violate statutory confidentiality obligations (Art. 26 DSG). In such a case, we will inform you of the reasons for the refusal.

To exercise your rights, you may contact us at any time via the contact channels stated in Section 2. Please provide sufficient information to enable us to clearly identify you (e.g. name, e-mail address on file with us, order number where applicable). We will review your request as quickly as possible and respond at the latest within 30 days (statutory period under the DSG). Should it exceptionally take longer, we will inform you accordingly.

In addition, if you are of the opinion that the processing of your personal data violates applicable law, you have the right to lodge a complaint with the competent data protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) (address: Feldeggweg 1, CH-3003 Bern, www.edoeb.admin.ch). Where the GDPR applies, you may also contact the supervisory authority in the EU member state of your place of residence.

11. Data Security

We employ appropriate technical and organisational security measures to protect the data stored with us against manipulation, loss, unauthorised access or unauthorised alteration. Our security measures are continuously improved in line with technological developments. For example, we use secure transmission methods (SSL encryption) for payment and order data, restricted access to data (authorised persons only) and regular updates and backups of our systems. Nevertheless, no internet transmission can ever be 100% secure. We point out that the transmission of information over the internet is at your own risk.

12. Changes to this Privacy Policy

We review this privacy policy regularly and adapt it as soon as changes in our data processing or the legal situation require it. We will clearly announce material changes on our website and – where necessary – obtain your renewed consent. At the end of this policy you will find the information on when the text was last updated.

Version of this privacy policy: March 2026