I. General
NovuTrade AG (hereinafter «goodvibe.ch/we/us») attaches great importance to compliance with the relevant data protection regulations.
When using our website goodvibe.ch We, as the data controller, will process your personal data and store it for as long as is necessary to fulfil the specified purposes and statutory obligations.
We process your personal data in accordance with the processing principles set out in Articles 6 to 8 of the Data Protection Act (DSG). Protecting your privacy is important to us, and we attach great importance to complying with the relevant data protection regulations. In this privacy policy, we provide you with comprehensive information on how we handle your personal data and explain your rights in relation to the processing of personal data within our company. We regulate the processing of personal data relating to our employees and suppliers exclusively within the framework of the specific contracts.
You will find information on any relevant right to object in our section «VI. Your Rights».
A. Scope
This privacy policy applies to all processing activities relating to personal data via our website, in particular:
- Visit our website
- Getting in touch and various contact forms
- Application
- Newsletter
- Setting up and using a customer account
- Orders and Payments
- Cookies
- Social media
This privacy policy does not cover linked websites operated by other providers or websites that link to our website.
B. Contact details of the data controllers
a. Data controller
NovuTrade AG
26 Räffelstrasse
8045 Zurich
Email: [email protected]
b. Contact details of the Data Protection Officer for goodvibe.ch
NovuTrade AG
26 Räffelstrasse
8045 Zurich
Email: [email protected]
C. Contact details of the supervisory authorities
Federal Data Protection and Information Commissioner
Feldeggweg 1
3003 Bern
Switzerland
Telephone: +41 58 462 43 95
Website: https://www.edoeb.admin.ch/edoeb/de/home.html
II. Processing activities
Depending on your relationship with us, we process different categories of personal data about you for different purposes and on different legal bases.
A. Visiting our website
| Data processing | When you visit our website, the browser used on your device automatically sends information to our website’s server. This information is temporarily stored in what is known as a log file. |
| Personal data | The following data is collected automatically without any action on your part and is stored until it is automatically deleted:
|
| Purpose | The data in question is processed for the following purposes:
|
| Order processor | Our website is hosted on CloudWays by DigitalOcean, LLC, 105 Edgeview Drive, Ste., CO 80021, 425 Broomfield, USA («DigitalOcean»), hosted. The cloud is hosted on DigitalOcean servers in the USA. DigitalOcean may have access to the website – and therefore to your personal data – in the event that support is required. |
| Ensuring data protection | The transfer of personal data to DigitalOcean may result in this data being transferred to the USA or to third parties in a country that does not have an equivalent level of data protection. We have agreed with DigitalOcean that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should this be declared invalid, in accordance with so-called standard contractual clauses, as well as appropriate and proportionate technical and organisational measures. By submitting your enquiry, you also consent to your personal data being transferred to non-compliant third countries in accordance with Article 17 of the DSG. |
| Privacy Policy of the Data Processors | DigitalOcean: https://www.digitalocean.com/legal/privacy-policy |
| Legal basis | There is an overriding private interest in the processing of your personal data in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This information is necessary for the website to function properly. |
| Retention period | Once your session has ended, the data will be deleted; however, we will retain the log file in accordance with legal requirements. |
B. Making contact
| Data processing | On our website, we offer you the option of contacting us directly via email, telephone or WhatsApp. Reasons for getting in touch may include, for example, enquiries about product information or services, questions on other topics, or even feedback. We do not record conversations. |
| Personal data | The following details can be provided:
|
| Purpose | The data in question is processed for the following purposes:
|
| Order processor | Our email system is powered by Google’s Gmail, Gordon House, Barrow Street, Dublin 4, Ireland («Gmail»).
Our telephone system runs on the Aircall telephone software provided by Aircall DE GmbH, Neue Schönhauserstrasse 3–5, 10178 Berlin, Germany («Aircall»). You can contact us via WhatsApp, provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland («WhatsApp») Get in touch. |
| Ensuring data protection | Your personal data may be processed by Google processed. We have agreed with Google that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should this be declared invalid or inapplicable, in accordance with the so-called standard contractual clauses, as well as appropriate and proportionate technical and organisational measures. By submitting your enquiry, you also consent to your personal data being transferred to non-secure third countries in accordance with Article 17 of the DSG.
The transfer of Swiss personal data to Aircall may result in this data being transferred to its US parent company in the USA or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Aircall that any transfer to the US will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses, as well as appropriate and proportionate technical and organisational measures. By submitting your enquiry, you also consent to your personal data being transferred to non-compliant third countries in accordance with Article 17 of the DSG. Your personal data is processed by WhatsApp is generally processed in Ireland. The transfer of Swiss personal data to WhatsApp may result in this data being transferred to its US parent company, Meta (1 Meta Way, Menlo Park, California, 94025) in the USA, or to third parties in a country that does not have an equivalent level of data protection. We have agreed with WhatsApp that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By submitting your enquiry, you also consent to your personal data being transferred to non-secure third countries in accordance with Article 17 of the Swiss Data Protection Act (DSG). |
| Privacy policies of data processors | Google: https://policies.google.com/privacy?hl=en
Aircall: https://aircall.io/privacy/ WhatsApp: https://www.whatsapp.com/legal/privacy-policy-eea?lang=de_DE |
| Legal basis | This data processing is carried out on the basis of contractual or pre-contractual measures in accordance with Article 31(2)(a) of the DSG. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Data stored for the purpose of establishing contact will be deleted once processing has been completed, provided that we are not subject to a statutory retention period of 5 or 10 years for such data. |
C. Contact forms
| Data processing | Under our «friends with benefits» section, you can receive a discount voucher in return for a referral. To do this, simply share a referral link with a friend via WhatsApp, Instagram or Facebook. |
| Personal data | Depending on the form, the following details must be provided:
|
| Purpose | The data in question is processed for the following purposes:
|
| Order processor | Our contact form is powered by Gravity Forms, provided by Rocketgenius, Inc., 1620 Centerville Turnpike, Suite 102, Virginia Beach VA 23464-6500, USA («Gravity Forms»). |
| Ensuring data protection | Gravity Forms is not a participant in the Swiss-US Data Privacy Framework. Your data is therefore not subject to a level of data protection in the USA that is comparable to that in Switzerland or the EU. By submitting your enquiry, you therefore also consent to your data being transferred to the USA in accordance with Article 17 of the DSG. |
| Privacy Policy of the Data Processors | Gravity Forms: https://www.gravityforms.com/privacy/ |
| Legal basis | This data processing is carried out on the basis of contractual or pre-contractual measures in accordance with Article 31(2)(a) of the DSG. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Any data stored for the purpose of participating in our «friends with benefits» loyalty programme will be deleted – provided we are not subject to a statutory retention obligation of 5 or 10 years – as soon as you also delete your customer account with us. |
D. Customer Portal
| Data processing | You have the option of setting up a password-protected online customer account with us for placing and processing orders. This also includes enquiries and comments relating to orders and deliveries. The customer account allows you to manage your orders. You can also manage previous orders, your account details and your newsletter preferences. However, you can still place orders with us without an online customer account. |
| Personal data | In particular, the following personal data may be processed during this procedure:
|
| Purpose | The purpose of this data processing is to fulfil the contract and to ensure that services are provided in a simpler, more efficient and more customer-friendly manner. |
| Legal basis | We process the data on the basis of your consent in accordance with Article 31(1) of the Data Protection Act. Furthermore, it is processed on the basis of contractual or pre-contractual measures in accordance with Article 31(2)(a) of the Data Protection Act. |
| Necessity | This processing is necessary for the provision of our services. However, creating a customer account is not necessary or required in order to use our website. |
| Retention period | We will retain the data required to process your order for at least the duration of the contract. We are legally obliged to retain business records and accounting documents for 10 years. We reserve the right to retain such data for a longer period in order to assert our rights. |
E. Age verification and credit checks
| Data processing | We are legally obliged to verify your age when you purchase age-restricted products. We also reserve the right to carry out a credit check for certain payment methods (e.g. purchase on account). For age verification, we use the services of FRASPY (TOOLPIXX, Andreas van Loock, Nettetalstrasse 24, 56745 Rieden, Germany, www.fraspy.com) and Intrum AG, Eschenstrasse 12, 8603 Schwerzenbach (www.intrum.ch). Your personal data will be transmitted to these providers and may be stored there. Intrum AG also carries out a credit check for certain payment methods. Data is transferred exclusively for the stated purposes where there is a legitimate interest. The legal basis is Article 31 of the DSG. You have the right to access, rectify and erase your data. Further information can be found in the providers’ privacy policies at www.fraspy.com and www.intrum.ch. |
F. Customer Management
| Data processing | For customer management on our website, we use the WordPress CRM solution provided by Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland («WordPress») and by HubSpot, Inc., Two Canal Park, Cambridge, USA («HubSpot»).
We therefore use the cloud-based ERP systems bexio.ch, provided by bexio AG, Alte Jonastrasse 24, 8640 Rapperswil, Switzerland, to manage our business processes («bexio.ch») and JTL Wawi from JTL-Software-GmbH, Rheinstr. 7, 41836 Hückelhoven, Germany («JTL»). |
| Personal data | In particular, the following personal data may be processed during this procedure:
|
| Purpose | The purpose of this data processing is to fulfil the contract and to ensure that services are provided in a simpler, more efficient and more customer-friendly manner. Data processing is also carried out for the purposes of managing customer data, invoicing, bookkeeping and general business communication. |
| Order processor | Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland
HubSpot, Inc., Two Canal Park, Cambridge, USA bexio AG, Alte Jonastrasse 24, 8640 Rapperswil, Switzerland JTL-Software-GmbH, Rheinstr. 7, 41836 Hückelhoven, Germany |
| Ensuring data protection | Aut O’Mattic, HubSpot and JTL may process your personal data outside the EEA (e.g. by other members of their group of companies or by data processors). In this case, Aut O’Mattic, HubSpot or JTL will ensure that appropriate safeguards are in place (e.g. the Standard Contractual Clauses approved by the European Commission) and that the data subject has enforceable rights and effective remedies available. By consenting to this privacy policy, you also consent to your personal data being transferred to non-EEA countries in accordance with Article 17 of the Data Protection Act. |
| Data Protection Statement of the Data Processor | Aut O’Mattic: https://automattic.com/privacy/
HubSpot: https://legal.hubspot.com/de/privacy-policy/ Bexio.ch: https://www.bexio.com/de-CH/richtlinien/datenschutz |
| Legal basis | We process the data on the basis of your consent in accordance with Article 31(1) of the Data Protection Act. Furthermore, it is processed on the basis of contractual or pre-contractual measures in accordance with Article 31(2)(a) of the Data Protection Act. |
| Necessity | This processing is necessary for the provision of our services. However, creating a customer account is not necessary or required in order to use our website. |
| Retention period | We will retain the data required to process your order for at least the duration of the contract. We are legally obliged to retain business records and accounting documents for 10 years. We reserve the right to retain such data for a longer period in order to assert our rights. |
G. Newsletter
| Data processing | You can sign up for a personalised newsletter on our website. Your subscription to the newsletter is only finalised via a double opt-in process: after you have signed up on our website, you will receive an email in which you must click to confirm that you wish to receive the newsletter. If you do not wish to do so, simply ignore the confirmation email.
If you wish to unsubscribe from the newsletter at a later date, you can either click on the unsubscribe link included in every email newsletter, or contact us via the email address [email protected]. Once consent has been withdrawn, the email address will initially be blocked and deleted after approximately 14 days, provided there is no other legal obligation to retain it. To ensure that no further newsletters are sent, the email address may be added to a so-called blacklist. |
| Personal data | Our online shop is technically hosted by Klaviyo Inc., 125 Summer St, Floor 6, MA 02111, Boston, USA («Klaviyo») integrated. Klaviyo offers us a range of features:
We collect the following information for the purpose of subscribing to and sending the newsletter:
We then process data that enables us to determine whether a newsletter message has been opened and, where applicable, which links have been clicked. Technical information is also collected, such as:
|
| Purpose | The data in question is processed for the purposes of sending out and analysing the newsletter, and to encourage you to subscribe to our newsletter or place an order. The product review request is intended to enable us to analyse our product range from the customer’s perspective. |
| Order processor | Klaviyo Inc., 125 Summer St, 6th Floor, MA 02111, Boston, USA |
| Ensuring data protection | Your personal data may be processed by Klaviyo. We have agreed with Klaviyo that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should that framework be declared invalid or inapplicable, in accordance with so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent here, you also agree that your personal data may be transferred to non-secure third countries in accordance with Article 17 of the DSG. |
| Privacy Policy of the Data Processors | https://www.klaviyo.com/legal/privacy/privacy-notice |
| Legal basis | The provision of your data is voluntary and subject to your express consent in accordance with Article 31(1) of the Data Protection Act, which you give via the double opt-in process. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | We will retain the data stored for the purpose of your newsletter subscription until you unsubscribe from the newsletter. Once you have unsubscribed, your data will be deleted from our servers and from Klaviyo’s servers, unless we hold the data in connection with other lawful processing activities. |
H. Advertising
| Data processing | We also use your contact details for marketing purposes, for example for postal marketing and direct marketing of our own similar goods and services within existing customer relationships. |
| Personal data | The following personal data is processed in this context:
|
| Purpose | The purpose of processing the personal data we have received from you in connection with your order is to enable us to send printed advertising to the address you have provided and to deal with any enquiries you may have regarding the receipt of such advertising. |
| Legal basis | Your personal data is processed on the basis of our overriding legitimate interest, in accordance with Article 31(1) of the Data Protection Act, in customer care and the provision of information about our products and services. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | We will process your data until you opt out of receiving marketing communications. You can do this by sending an email to [email protected]. |
I. Using our online shop
| Data processing | We process the data you provide in order to fulfil your order. This includes enquiries, orders, returns, deliveries, processing by our customer service team, as well as for the purposes of debt collection or legal enforcement.
You can place an order via your customer account or as a guest. When ordering as a guest, the same data is collected as when ordering via a customer account. In this case, however, no customer account is created. We may pass on your data to our data processors and third parties. Your data will be passed on to a data processor or third party falling into one or more of the following categories:
When you make an online payment, we collect your details and send them to the payment service providers to process the payment. We then store only the transaction number, not your full card details. When a purchase is made on account, we obtain a credit reference from a credit reference agency, based on mathematical and statistical methods, in order to safeguard our legitimate interests. As we sell products via our online shop that may only be supplied to adults, we may compare our customers’ details with the database of the credit reference agency CRIF AGW, Hagenholzstrasse 81, 8050 Zurich, in order to verify that they are of legal age. In doing so, only the identification details – first name, surname, address and email address – are disclosed to CRIF. Once the data has been cross-checked, CRIF deletes our customers’ data immediately. |
| Personal data | In order to process your order, we process the following data:
|
| Purpose | The purpose of processing your data is to process and fulfil your order, as well as to enforce any legal claims that may arise. |
| Order processor | We use the WooCommerce e-commerce system to operate our online shop. This service is provided by Aut O’Mattic A8C Ireland Ltd, Business Centre, No. 1 Lower Mayor Street, International Financial Services Centre, Dublin 1, Ireland («Aut O’Mattic»). The system is managed by Aut O’Mattic. In the event that support or maintenance is required, this involves access to the shop and, consequently, to your personal data.
Then Furthermore, we use the TWINT payment platform, provided by TWINT AG, Stauffacherstrasse 41, 8004 Zurich, Switzerland, to process your online payments («TWINT») and Wallee of Wallee Group AG, Neuwiesenstrasse 15, 8400 Winterthur, Switzerland («Wallee») and CembraPay AG, Bändliweg 20, 8048 Zurich, Switzerland («CembraPay»). In doing so, your order and payment details will be transmitted to the named payment providers. We pass on the personal data required for the credit check to the Credit reference agency CembraPay AG, Bändliweg 20, 8048 Zurich, Switzerland («CembraPay»), and use the information obtained regarding the statistical probability of default to make a considered decision on whether to enter into, maintain or terminate the contractual relationship. For the purpose of age verification (checking that a person has reached the age of majority), we may transfer personal data to the credit reference agency CRIF AG, Hagenholzstrasse 81, 8050 Zurich, and receive information from them regarding our customers’ age of majority. |
| Ensuring data protection | Aut O’Mattic may process your personal data outside the EEA (e.g. by other members of its group of companies or by data processors). In this case, Aut O’Mattic will ensure that appropriate safeguards are in place (e.g. the Standard Contractual Clauses approved by the European Commission) and that the data subject has enforceable rights and effective remedies available to them. By consenting to this privacy policy, you also consent to your personal data being transferred to non-EEA countries in accordance with Article 17 of the DSG.
Processing by TWINT, Wallee, CRIF AG and CembraPay takes place in Switzerland and the EU. We have entered into a data processing agreement with our data processors. |
| Privacy Policy of the Data Processors | Aut O’Mattic: https://automattic.com/privacy/
TWINT: https://www.twint.ch/datenschutz-app/ Wallee: https://wallee.com/legal/datenschutzhinweise CembraPay: https://cembrapay.ch/de/privacy |
| Legal basis | This data processing is carried out on the basis of contractual or pre-contractual measures in accordance with Article 31(2)(a) of the DSG. Once you have consented to this privacy policy, we will also process your personal data on the basis of your explicit consent in accordance with Article 31(1) of the Data Protection Act. Furthermore, we have an overriding interest in carrying out a credit check in accordance with Article 31(2)(c) of the Data Protection Act.
By consenting to this privacy policy, you also consent, within the meaning of Article 31(1) of the Data Protection Act, to your personal data being processed by CRIF AG for the purpose of age verification by means of data matching. |
| Necessity | The processing of this data is not necessary for the website to function. |
| Retention period | We will retain the data required to process your order for at least the duration of the contract. We are legally obliged to retain business records and accounting documents for 10 years. We reserve the right to retain such data for longer in order to assert our rights. |
J. E-commerce Analysis
| Data processing | We use the SaaS solution Metorik from UJU Pty Ltd trading as Metorik, Caulfield Junction, Australia («Metorik») to analyse and evaluate e-commerce data. Metorik is used, in particular, to generate reports on sales figures, repeat customers, return rates and products in high demand. |
| Personal data | The following data in particular is processed via Metorik:
|
| Purpose | Your data is processed for the purposes of analysing sales processes, managing customer records, generating reports and optimising our e-commerce offering. |
| Order processor | UJU Pty Ltd trading as Metorik, Caulfield Junction, Australia |
| Ensuring data protection | Metorik may process your personal data outside the EEA (e.g. by other members of its group of companies or by data processors). In this case, Metorik will ensure that appropriate safeguards are in place (e.g. the Standard Contractual Clauses approved by the European Commission) and that the data subject has enforceable rights and effective remedies at their disposal. By consenting to this privacy policy, you also consent to your personal data being transferred to non-EEA countries in accordance with Article 17 of the Data Protection Act. |
| Privacy Policy of the Data Processors | https://metorik.com/privacy |
| Legal basis | This data processing is carried out on the basis of contractual or pre-contractual measures in accordance with Article 31(2)(a) of the DSG. Once you have consented to this privacy policy, we will also process your personal data on the basis of your explicit consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | The processing of this data is not necessary for the website to function. |
| Retention period | We will retain the data required to process your order for at least the duration of the contract. We are legally obliged to retain business records and accounting documents for 10 years. We reserve the right to retain such data for longer in order to assert our rights. |
K. Reviews by Trusted Shops
| Data processing | The Trusted Shops service provided by Trusted Shops GmbH, Subbelrather Strasse 15c, 50823 Cologne, Germany, is used for the collection and publication of customer reviews and for comment functions in the online shop («Trusted Shops») is used. |
| Personal data | The following personal data is processed in this context:
|
| Purpose | The data is processed in order to verify and publish genuine customer reviews, and to ensure transparency and quality assurance in the online shop. |
| Order processor | Trusted Shops GmbH, Subbelrather Strasse 15c, 50823 Cologne, Germany |
| Ensuring data protection | Trusted Shops may process your personal data outside the EEA (e.g. by other members of its group of companies or by data processors). In this case, Trusted Shops will ensure that appropriate safeguards are in place (e.g. the Standard Contractual Clauses approved by the European Commission) and that the data subject has enforceable rights and effective remedies at their disposal. By consenting to this privacy policy, you also consent to your personal data being transferred to non-EEA countries in accordance with Article 17 of the Data Protection Act. |
| Privacy Policy of the Data Processors | https://business.trustedshops.de/impressum#a0_content |
| Legal basis | We process the data on the basis of your consent in accordance with Article 31(1) of the DSG. |
| Necessity | The processing of this data is not necessary for the functionality of our website. |
| Retention period | The data is only stored for as long as is necessary for the purpose of the review or as required by statutory retention obligations. Review data remains publicly visible for as long as it is relevant to the shop’s presentation and no request for deletion has been made. |
L. Application
| Data processing | You can apply by post or by email. You can also apply using an online form on our website. For this purpose, we use Google Forms, the online form service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland («Google»).
We also use the Software-as-a-Service platform Join.com, provided by JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ, Switzerland, for recruitment and applicant management («JOIN»). |
| Personal data | When you apply for a job, the following information about you may be processed:
|
| Purpose | Data is processed for the purpose of publishing job vacancies, receiving and managing applications, and handling the communication and organisational aspects of the recruitment process. |
| Order processor | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ, Switzerland |
| Ensuring data protection | Google LLC is a participant in the EU-US and Swiss-US Data Privacy Frameworks. This means that your personal data may be transferred to Google LLC in the US without the need for further safeguards.
Google and JOIN may process your personal data outside the EEA (e.g. by other members of their group of companies or by data processors). In this case, Google and JOIN will ensure that appropriate safeguards are in place (e.g. the standard contractual clauses approved by the European Commission) and that the data subject has enforceable rights and effective remedies available. By consenting to this privacy policy, you also consent to your personal data being transferred to non-EEA countries in accordance with Article 17 of the Data Protection Act. |
| Data Protection Statement of the Data Processor | Google https://policies.google.com/privacy?hl=de |
| Legal basis | This data processing is carried out on the basis of contractual or pre-contractual measures in accordance with Article 31(2)(a) of the DSG and Article 6(1), first sentence, (b) of the GDPR. Furthermore, the processing of your personal data for the purpose of establishing, exercising or defending legal claims is in our overriding private interest in accordance with Article 31(1) of the DSG and Article 6(1), first sentence, point (f) of the GDPR. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | The data stored for the purposes of your application will be retained in accordance with the relevant legal provisions and for as long as is necessary to fulfil the aforementioned purposes. In the event that your application is unsuccessful, we will retain your personal data for 3 months for the purpose of establishing, exercising or defending our legal claims. |
M. Cookies
a. General
| Data processing | We use Cookies on our website. These are small files that your browser creates automatically and which are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. |
| Personal data | A cookie does not necessarily mean that we can identify you. |
| Purpose | The Cookies is used to collect statistical data on the use of our website and to analyse this data for the purposes of optimisation and improving user-friendliness. |
| Legal basis | We process Cookies on the basis of our overriding private interest in accordance with Article 31(1) of the Data Protection Act. We process Cookies data that is not technically necessary as soon as you have given your consent to this privacy policy, additionally on the basis of your consent in accordance with Section 31(1) of the Data Protection Act. |
| Necessity | By default, most web browsers automatically accept Cookies. If you do not wish to store Cookies from our websites on your device, you can configure your browser settings so that you receive a warning before certain Cookies are stored. Please note that disabling Cookies, either partially or completely, may mean that you are unable to use all the features of our websites. |
| Retention period | Cookies items have different retention periods. If the Cookies items are from third-party manufacturers, we have no control over the retention period. |
b. Technically necessary Cookies
| Data processing | We use a tracking cookie to save your personal user settings for Cookies on our website. |
| Personal data | No personal data is processed. Only the current status of your chosen cookie and language settings is stored. |
| Purpose | This processing is carried out to re-identify your personal cookie settings on our website. |
| Legal basis | The processing is carried out on the basis of our overriding private interest in accordance with Article 31(1) of the Data Protection Act. Once you have consented to this privacy policy, we will also process your personal data on the basis of your explicit consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This cookie is essential for the website to function properly. |
| Retention period | The cookie will be automatically deleted from your system after 12 months at the latest. |
c. «Cookiefirst» cookie banner»
| Data processing | We use the CookieFirst consent management platform provided by Digital Data Solutions B.V., Plantage Middenlaan 42a, Amsterdam, Netherlands («CookieFirst»), to organise the collection and management of consent for the use of Cookies and similar technologies. |
| Personal data | The following personal data is processed:
|
| Purpose | The purpose of data processing is to collect, document and manage consent in accordance with the law for Cookies and tracking technologies on our website. |
| Ensuring data protection | CookieFirst may process your personal data outside the European Union (e.g. by other members of its group of companies or by data processors). In this case, CookieFirst will ensure that appropriate safeguards are in place (e.g. the Standard Contractual Clauses approved by the European Commission) and that the data subject has enforceable rights and effective remedies available to them. By consenting to this privacy policy, you also consent to your personal data being transferred to non-EEA countries in accordance with Article 17 of the Data Protection Act. |
| Data Protection Statement of the Data Processor | https://cookiefirst.com/legal/privacy-policy/ |
| Legal basis | The use of CookieFirst is based on our overriding legitimate interest in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Consent data is stored for a period of up to 12 months and is then automatically deleted, provided there are no statutory retention requirements to the contrary. Once this period has expired, consent may be requested again. |
d. Matomo Analytics
| Data processing | We use the cloud-hosted Matomo Analytics service provided by InnoCraft Limited, 7 Waterloo Quay, PO625, 6140 Wellington, New Zealand («Matomo Analytics»), for the analysis and statistical evaluation of the use of our website. |
| Personal data | The following data is processed in this context:
|
| Purpose | Data processing is carried out solely for the purposes of analysing user behaviour, optimising our website and evaluating our reach statistically. |
| Ensuring data protection | Matomo Analytics may process your personal data outside the European Union (e.g. by other members of its group of companies or by data processors). In this case, Matomo Analytics will ensure that appropriate safeguards are in place (e.g. the Standard Contractual Clauses approved by the European Commission) and that the data subject has enforceable rights and effective remedies available. By consenting to this privacy policy, you also consent to your personal data being transferred to non-EU countries in accordance with Article 17 of the Data Protection Act. |
| Data Protection Statement of the Data Processor | https://matomo.org/privacy-policy/ |
| Legal basis | The use of Matomo Analytics is based on our overriding private interest in accordance with Article 31(1) of the Data Protection Act. Once you have given your consent to this privacy policy, we will also process your data on the basis of your consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Your data will be stored on the device for up to 12 months, unless it is updated. |
e. Google Tag Manager
| Data processing | We use Google Tag Manager on our website («GTM») by Google Ireland Limited («Google»), Gordon House, Barrow Street, Dublin 4, Ireland. GTM is a tag management system that allows tags to be integrated consistently via a single user interface. Tags are short sections of source code that track activity and can access other systems to centrally control when specific systems are triggered. Integrated into GTM are Google Marketing Platforms (DoubleClick and Google Analytics 4), Google Ads remarketing, and Meta Pixel. GTM therefore acts simply as an intermediary between the website and the analytics software. You can prevent tags from being set in your browser settings at any time. Further information on these systems and their data processing can be found in the following chapters. |
| Personal data | GTM activates other tools, which in turn collect personal data. Depending on the tool integrated, GTM collects the IP addresses of website visitors and passes them on to the analytics programmes. You can find more information on the individual data processing operations in the following sections. |
| Purpose | We process your personal data for marketing and analytical purposes. In doing so, we analyse your user behaviour, carry out conversion tracking, compile statistics and optimise our advertising channels and messaging. |
| Ensuring data protection | Your personal data is generally processed by Google in Ireland. The transfer of European or Swiss personal data to Google may result in this data being transferred to its US parent company, Google LLC, in the USA, or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Google that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. By giving your consent here, you also agree that your personal data may be transferred to non-compliant third countries in accordance with Article 17 of the DSG. |
| Data Protection Statement of the Data Processor | Google https://policies.google.com/privacy?hl=de |
| Legal basis | The use of GTM is based on your explicit consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Your data will be stored on the device for up to two years, unless it is updated. |
f. Google Analytics 4
| Data processing | On our website, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited («Google»), with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Cookies is used to create pseudonymous user profiles. In this process, the data is stored on the end device, anonymised and analysed in the form of statistics. |
| Personal data | In connection with the Google Analytics 4 web analytics service, the following data relating to you is processed: ·
Expansion of demographic characteristics and interests:
To this end, three permanent Cookies cookies from Google Analytics 4 are used (_gat, _gid, _ga), which are automatically deleted after a predefined period. |
| Purpose | We use Google Analytics 4 to analyse errors and to continuously improve the content on our websites through statistical analysis. |
| Ensuring data protection | Your personal data is generally processed by Google in Ireland. The transfer of European or Swiss personal data to Google may result in this data being transferred to its US parent company, Google LLC, in the USA or to third parties in a country that does not have equivalent data protection standards. We have agreed with Google that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. By consenting to this privacy policy, you also consent to your personal data being transferred to non-compliant third countries in accordance with Article 17 of the DSG. |
| Data Protection Statement of the Data Processor | Google: https://support.google.com/google-ads/answer/12929169?hl=de |
| Legal basis | Data processing is carried out on the basis of your explicit consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Your data will be stored on your device for up to 2 years. |
g. Google Ads
| Data processing | We use Google Ads, including Google Remarketing, provided by Google Ireland Limited («Google»), Gordon House, Barrow Street, Dublin 4, Ireland. These online advertising services enable advertisers to place adverts both in Google’s search engine results and on Google’s advertising networks («conversion tracking»). Google Ads enables an advertiser to specify certain keywords in advance, so that an advert is displayed in Google’s search engine results only when a user enters a search query relevant to those keywords. Within the Google Display Network, adverts are distributed across topic-relevant websites using an automated algorithm and in accordance with the pre-defined keywords. With Google Ads remarketing (GA Audience), visitors to our website are added to lists, which we can use to target you again as a potential customer. As users on the remarketing lists, we can show you targeted adverts. |
| Personal data | The Conversion-Cookies tool is used to store personal data, such as the websites visited by the data subject. Consequently, the following personal data is processed each time our website is visited:
|
| Purpose | The purpose of these advertising services is to promote our website by displaying interest-based adverts on third-party websites and in Google search results, and to display third-party adverts on our website. |
| Ensuring data protection | Your personal data is generally processed by Google in Ireland. The transfer of European or Swiss personal data to Google may result in this data being transferred to its US parent company, Google LLC, in the USA, or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Google that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. By giving your consent here, you also agree that your personal data may be transferred to non-compliant third countries in accordance with Article 17 of the DSG. |
| Data Protection Statement of the Data Processor | Google: https://support.google.com/google-ads/answer/12929169?hl=de |
| Legal basis | Data processing is carried out on the basis of your explicit consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | The data mentioned is not required for the website to function. |
| Retention period | The retention period is generally 13 months. |
h. Microsoft Advertising (or «Microsoft Ads»)
| Data processing | We have incorporated Microsoft Advertisement (formerly Bing Ads) from Microsoft Ireland Operations Ltd. on our website («Microsoft»), South County Business Park, One Microsoft Place, D18P521, Leopardstown, Ireland. These online advertising services allow advertisers to place adverts both in Microsoft Bing’s search engine results and on the Microsoft Bing advertising networks («conversion tracking»). Microsoft Advertising (formerly Bing Ads) enables an advertiser to specify certain keywords in advance, so that an advert is displayed in Microsoft Bing’s search engine results only when a user retrieves a search result relevant to those keywords using the search engine. Within the Bing advertising network, adverts are distributed across topic-relevant websites using an automated algorithm and in accordance with the pre-defined keywords. |
| Personal data | The Conversion-Cookies tool is used to store personal data, such as the websites visited by the data subject. Consequently, the following personal data is processed each time our website is visited:
|
| Purpose | The purpose of these advertising services is to promote our website by displaying interest-based adverts on third-party websites and in Bing search results, and by displaying third-party adverts on our website. |
| Ensuring data protection | Your personal data is generally processed by Microsoft in Ireland. The transfer of European or Swiss personal data to Microsoft may result in this data being transferred to its US parent company, Microsoft Corp., in the USA, or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Microsoft that any transfer to the US will be carried out in accordance with the EU–US or Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. By giving your consent via the cookie banner, you also consent to your personal data being transferred to non-compliant third countries in accordance with Article 17 of the DSG and Article 49(1)(a) of the GDPR. |
| Data Protection Statement of the Data Processor | https://www.microsoft.com/de-de/privacy/privacystatement/ |
| Legal basis | Data processing is carried out on the basis of your explicit consent in accordance with Article 31(1) of the DSG and Article 6(1), first sentence, point (a) of the GDPR. |
| Necessity | The data mentioned is not required for the website to function. |
| Retention period | The retention period for Microsoft Ads is generally 13 months. |
i. Meta Pixel
| Data processing | We have installed Meta Pixels (including Facebook Custom Audience) from Meta Platforms Ireland Ltd. on our website («Meta»), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. This online advertising service enables advertisers to place adverts both on Facebook’s platforms and on the Meta advertising networks («conversion tracking»). The advertising campaigns are planned and managed via Meta Ad Manager and optimised using Meta Advantage+. Meta Pixel enables us to run targeted advertising on the Facebook platform and reach a relevant target audience. This may include Sponsored Content, Sponsored Messaging, Dynamic Ads or Text Ads. With Facebook Custom Audience, visitors to our website are added to lists, which we can use to re-engage with you as potential customers. As users on the remarketing lists, we can show you targeted adverts. |
| Personal data | The Conversion-Cookies tracks personal data, such as the websites visited by the data subject. Consequently, the following personal data is processed each time our website is visited:
|
| Purpose | The purpose of these services is to promote our website by displaying adverts tailored to users’ interests on third-party websites and on the Facebook platform, and to display third-party adverts on our website. |
| Ensuring data protection | The transfer of European or Swiss personal data to Meta may result in this data being transferred to its parent company in the USA or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Meta that any transfer to the USA will take place on the basis of the Swiss – US Data Privacy Framework (hereinafter the ‘Data Privacy Framework’) or, should it be declared invalid or inapplicable, on the basis of so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. By submitting your enquiry, you also consent to your personal data being transferred to non-secure third countries in accordance with Article 17 of the DSG. |
| Data Protection Statement of the Data Processor | https://www.facebook.com/privacy/policy/ |
| Legal basis | Data processing is carried out on the basis of your explicit consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | The retention period for Meta Pixel is generally 90 days. |
j. Google Maps
| Data processing | On our website, we use Google Maps (API) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland («Google»). Google Maps is a web service for displaying interactive (map) views, designed to present geographical information visually. By using this service, our location is displayed to you, making it easier for you to find your way here. |
| Personal data | When you use our website, personal data such as your IP address is transferred to Google’s servers in the USA and stored there. This occurs regardless of whether you are logged in via a Google user account or do not have a user account. If you are logged in to Google, your data will be directly associated with your account. If you do not wish your data to be associated with your Google profile, you must log out before clicking the button. Google stores your data (even for users who are not logged in) as usage profiles and analyses them. |
| Purpose | The integration of Google Maps directly onto our website is intended to make it easier for customers to find our business premises and to get in touch with us. For Google, the processing of data serves the purpose of displaying personalised advertising, conducting market research and/or tailoring the design of its website to users’ needs. We have no influence over the processing of personal data on third-party websites. |
| Ensuring data protection | Your personal data is generally processed by Google in Ireland. The transfer of European or Swiss personal data to Google may result in this data being transferred to its US parent company, Google LLC, in the USA, or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Google that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. By giving your consent here, you also agree that your personal data may be transferred to non-compliant third countries in accordance with Article 17 of the DSG. |
| Data Protection Statement of the Data Processor | https://policies.google.com/privacy?hl=de&gl=de |
| Legal basis | Data processing is carried out on the basis of our overriding interest in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | The data mentioned is not required for the website to function. |
| Retention period | The retention period is determined by the information regarding the various data types set out in Google’s Privacy Policy, available at https://policies.google.com/privacy?hl=de&gl=de#inforetaining |
k. Use of Hotjar
| Data processing | To optimise our website and gain a better understanding of user behaviour, we use the Hotjar service provided by Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta («Hotjar»). Hotjar enables us to analyse the behaviour of our website users using heatmaps, thereby allowing us to make improvements. The data collected in this process is transmitted to and stored by Hotjar. In the event of a support enquiry, Hotjar has access to the personal data mentioned below. |
| Personal data | The following personal data is processed in this context:
|
| Purpose | The data in question is processed for the purpose of analysing user behaviour and optimising our website. |
| Order processor | Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta |
| Ensuring data protection | In principle, data processing by Hotjar takes place within the European Union. No data is transferred to third countries without an adequate level of data protection, or only subject to suitable safeguards, e.g. under a contractual obligation to maintain a sufficient level of data protection (EU Standard Contractual Clauses). Personal data will only be transferred to third countries if the data protection requirements set out in Article 6 of the DSG are met. By giving your consent here, you also agree that your personal data may be transferred to third countries deemed unsafe in accordance with Article 17 of the DSG. |
| Data Protection Statement of the Data Processor | https://www.hotjar.com/legal/policies/privacy/de/ |
| Legal basis | Data processing is carried out on the basis of your explicit consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Your data will be stored on the device for up to two years, unless it is updated. |
1. HubSpot marketing tool
| Data processing | On our website, we use the web tracking tool provided by HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA («HubSpot») to analyse user behaviour on our website. |
| Personal data | The following personal data is processed in this context:
|
| Purpose | The data is processed in order to analyse user behaviour on our website and to optimise our service and tailor it more effectively to users’ needs. |
| Order processor | HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA |
| Ensuring data protection | HubSpot generally processes your data in the USA. We have agreed with HubSpot that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent here, you also agree that your personal data may be transferred to non-compliant third countries in accordance with Article 17 of the DSG. |
| Data Protection Statement of the Data Processor | https://legal.hubspot.com/privacy-policy |
| Legal basis | Data processing is carried out on the basis of your explicit consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | The data collected via the web tracking tool is stored in accordance with the relevant legal provisions and for as long as is necessary to fulfil the aforementioned purposes, or until you withdraw your consent to the processing of this personal data. |
N. Social media
a. Integration of Facebook and Instagram
| Data processing | To enable you to communicate with us, we run a social media profile on Instagram under goodvibes_ch and a Facebook Profile on goodvibes.ch, both of which are platforms operated by Meta Platforms Ireland Ltd. («Meta»), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
You can get in touch with us via these profiles. We have also placed an Instagram social media button on our website so that you can easily be redirected to our respective profile. This is not a plugin, but simply an icon with a link embedded in it. In this context, Meta does not process any of your personal data on our website. |
| Personal data | If you contact us via our social media profile or click on a social media button, the following information about you will be collected:
Clicking on the social media button will redirect you to the provider’s website. We have no control over the processing of personal data on third-party websites. |
| Purpose | If you contact us via our social media profile, we will process your data for the purpose of responding to your enquiry. The social media buttons are used to organise our website. |
| Ensuring data protection | The transfer of European or Swiss personal data to Meta may result in this data being transferred to its parent company in the USA or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Meta that any transfer to the USA shall be based on the Swiss – US Data Privacy Framework (hereinafter the ‘Data Privacy Framework’); or, should the Data Privacy Framework be declared invalid or not (yet) in force, on the basis of so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. By using our social media profiles, you also consent to your personal data being transferred to non-compliant third countries in accordance with Article 17 of the DSG. Meta is solely responsible for the subsequent processing of this information. |
| Data Protection Statement of the Data Processor | Instagram: https://help.instagram.com/155833707900388
Facebook: https://www.facebook.com/privacy/policy/ |
| Legal basis | If you contact us via one of our social media profiles, we will process your data on the basis of our overriding private interest in accordance with Section 31(1) of the Data Protection Act (DSG) in order to provide a means of communication. By making an enquiry, you also consent to the processing of your data in accordance with Article 31(1) of the Data Protection Act and, pursuant to Article 17 of the Data Protection Act, to the transfer of your data to non-secure third countries. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Data processed in connection with your enquiry will be deleted after one year, provided that we are not subject to a retention obligation of five or ten years for the purposes of communication. The retention period applied by Meta is governed by its privacy policy. |
b. Integration with LinkedIn
| Data processing | To enable you to communicate with us, we maintain a social media profile on LinkedIn, operated by LinkedIn Ireland Unlimited Company («LinkedIn»), Wilton Place, Dublin 2, Ireland. You can get in touch with us via this profile. |
| Personal data | If you contact us via our social media profile, the following information will be collected from you:
We have no control over the processing of personal data on third-party websites. |
| Purpose | If you contact us via LinkedIn, we will process your data for the purpose of responding to your enquiry. |
| Ensuring data protection | The transfer of European or Swiss personal data to LinkedIn may result in this data being transferred to its parent company in the USA or to third parties in a country that does not have an equivalent level of data protection. We have agreed with LinkedIn that any transfer to the USA shall be based on the Swiss – US Data Privacy Framework (hereinafter the ‘Data Privacy Framework’); or, should the Data Privacy Framework be declared invalid or not (yet) apply, on the basis of so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. |
| Data Protection Statement of the Data Processor | https://de.linkedin.com/legal/privacy-policy |
| Legal basis | If you contact us via one of our social media profiles, we will process your data on the basis of our overriding private interest in accordance with Section 31(1) of the Data Protection Act (DSG) in order to provide a means of communication. By making an enquiry, you also consent to the processing of your data in accordance with Article 31(1) of the Data Protection Act and, pursuant to Article 17 of the Data Protection Act, to the transfer of your data to non-secure third countries. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Data processed in connection with your enquiry will be deleted after 1 year, provided that we are not subject to a 5- or 10-year retention obligation for the purposes of communication. The retention period applied by LinkedIn is governed by its privacy policy. |
c. Integration of TikTok
| Data processing | To enable you to communicate with us, we maintain a social media profile on TikTok, operated by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland («TikTok»). We have also placed a TikTok social media button on our website so that you can easily access our TikTok profile. This is not a plugin, but simply an icon with a linked URL. TikTok does not process any of your personal data on our website in this context. |
| Personal data | If you contact us via our social media profile or click on a social media button, the following information about you will be collected:
Clicking the button will redirect you to the provider’s website. We have no control over the processing of personal data on third-party websites. |
| Purpose | The TikTok social media button is used to help organise our website. If you contact us via TikTok, we will process your data for the purpose of responding to your enquiry. |
| Ensuring data protection | TikTok processes your data on its servers in the USA, Malaysia and Singapore, and may also transfer it to other affiliated companies. Neither TikTok nor its affiliated companies are participants in the EU-US or Swiss-US Data Privacy Frameworks. Your data is therefore not subject to a level of data protection in the USA that is comparable to that in Switzerland or the EU. Furthermore, your data is not subject to an adequate level of data protection when processed in Malaysia and Singapore. If you contact us via TikTok or click on the TikTok button, you therefore also consent to your data being transferred to unsafe third countries in accordance with Article 17 of the DSG and Article 49(1)(a) of the GDPR. |
| Data Protection Statement of the Data Processor | https://www.tiktok.com/legal/page/eea/privacy-policy/de |
| Legal basis | If you contact us via one of our social media profiles, we will process your data on the basis of our overriding private interest in accordance with Section 31(1) of the Data Protection Act (DSG) in order to provide a means of communication. By making an enquiry, you also consent to the processing of your data in accordance with Article 31(1) of the Data Protection Act and, pursuant to Article 17 of the Data Protection Act, to the transfer of your data to non-secure third countries. |
| Necessity | The data mentioned is not required for the website to function. |
| Retention period | Data processed in connection with your enquiry will be deleted after 1 year, provided that we are not subject to a 5- or 10-year retention obligation for the purposes of communication. The retention period applied by LinkedIn is governed by its privacy policy. |
d. Embedding YouTube videos
| Data processing | To enable you to communicate with us, we operate a social media profile under the name «goodvibe_ch» on YouTube, provided by Google Ireland Limited («Google»), Gordon House, Barrow Street, Dublin 4, Ireland. You can contact us via this profile. We have also embedded various YouTube videos on our website. These are not plugins, but simply videos with links embedded within them. Google (YouTube) does not process any of your personal data on our website. If you click on the link or the embedded video, you will be redirected to the Google (YouTube) website. We have no influence over the processing of personal data on third-party websites.
Google (YouTube) processes personal data in accordance with its privacy policies and statements: https://policies.google.com/privacy/ |
| Personal data | If you contact us via YouTube, the following information will be collected from you:
Clicking on a video on our website will redirect you to the provider’s website. We have no control over the processing of personal data on third-party websites. |
| Purpose | The embedded videos help to structure our website and are used to display other web content on our site. |
| Data transfers to third countries | Your personal data is generally processed by Google in Ireland. The transfer of European or Swiss personal data to Google may result in this data being transferred to its US parent company, Google LLC, in the USA, or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Google that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. By giving your consent here, you also agree that your personal data may be transferred to non-compliant third countries in accordance with Article 17 of the DSG. |
| Data Protection Statement of the Data Processor | https://policies.google.com/privacy/ |
| Legal basis | If you contact us via one of our YouTube profiles, we will process your data for the purpose of fulfilling the contract or taking pre-contractual measures in accordance with Art. 31(2)(a) of the DSG and on the basis of our overriding private interest pursuant to Article 31(1) of the DSG to provide a means of communication. |
| Necessity | This processing is not necessary for the website to function. |
| Retention period | Google (YouTube) stores your personal data in accordance with its privacy policies and statements: https://policies.google.com/privacy/
Data processed in connection with your enquiry will be deleted after one year, provided that we are not subject to a 5- or 10-year retention obligation for the purposes of communication. |
O. Search Tool
| Data processing | We use tools on our website to search for and index content, and to analyse your search query. To do this, we use the «Search & Suggest» tool from Luigi’s Box s.r.o., Tallerova 4, 811 02 Bratislava, Slovakia. |
| Personal data | The following data is processed in this context:
|
| Purpose | The purpose of processing this data is to display optimal and personalised search results in our online shop, to provide better and more relevant search results from our catalogue, and to ensure a user-friendly experience. |
| Order processor | Luigi’s Box s.r.o., Tallerova 4, 811 02 Bratislava, Slovakia |
| Data Protection Statement of the Data Processor | https://www.luigisbox.de/datenschutzrichtlinie/ |
| Legal basis | Your personal data is processed on the basis of our legitimate interest in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | This processing is not necessary for the website to function. |
| Ensuring data protection | Data processing by Luigi’s Box generally takes place within the European Union. We have also agreed with Luigi’s Box that any transfer to third countries will only take place on the basis of so-called standard contractual clauses, as well as appropriate and proportionate technical and organisational measures. By giving your consent here, you also agree that your personal data may be transferred to non-secure third countries in accordance with Article 17 of the DSG. |
| Retention period | Your data will be stored for up to twelve months. |
P. Widgets and fonts
| Data processing | Our website uses fonts from
|
| Personal data | Each time this website is accessed, files are loaded from a Google or Font Awesome server in order to display the text in a specific font. In doing so, your IP address may be transmitted to a Google or Font Awesome server and stored as part of the standard web log.
However, some of the fonts we use are also embedded locally on our website. No connection is established with Google or Font Awesome servers, which means that, in this context, your data is not processed by us, Google or Font Awesome. |
| Purpose | The purpose of this data processing is to ensure that the text is displayed correctly on the website. |
| Ensuring data protection | Your personal data is generally processed by Google in Ireland. The transfer of Swiss personal data to Google may result in this data being transferred to its US parent company, Google LLC, in the USA, or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Google that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures. By giving your consent here, you also agree that your personal data may be transferred to third countries with an inadequate level of data protection in accordance with Article 17 of the DSG.
The transfer of Swiss personal data to Font Awesome may result in this data being transferred to the USA or to third parties in a country that does not have equivalent data protection standards. We have agreed with Font Awesome that any transfer to the USA will be carried out in accordance with the Swiss–US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, in accordance with so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent here, you also consent to your personal data being transferred to non-compliant third countries in accordance with Article 17 of the Swiss Data Protection Act (DSG). |
| Data Protection Statement of the Data Processor | Google: https://policies.google.com/privacy?hl=de
Font Awesome: https://fontawesome.com/privacy |
| Legal basis | The processing is carried out with your explicit consent in accordance with Article 31(1) of the Data Protection Act. |
| Necessity | The data mentioned is not required for the website to function. |
| Retention period | The retention period is determined in accordance with the details set out in the relevant privacy policy:
Google: https://policies.google.com/privacy?hl=de#inforetaining Font Awesome: https://fontawesome.com/privacy |
Q. Use of artificial intelligence (AI)
| Data processing | We use AI-powered systems to process enquiries, improve our communications and create content. This may involve the processing of personal data. Results and suggestions generated by AI systems are reviewed by our staff before they are used. |
| Personal data | Title, first name and surname, address, email address, telephone number, the content of your enquiries and our correspondence, order and customer data, as well as usage data relating to our online shop. |
| Purpose |
|
| Order processor |
|
| Ensuring data protection | We have entered into data processing agreements with the data processors. The service providers are not permitted to use your personal data to train their own AI models. Where data is processed in the USA or in other countries outside Switzerland and the EEA, the transfer is based on the Swiss–US Data Privacy Framework or on so-called standard contractual clauses. |
| Privacy Policy of the Data Processors | Anthropic: https://www.anthropic.com/legal/privacy
OpenAI: https://openai.com/policies/row-privacy-policy/ Google: https://policies.google.com/privacy |
| Legal basis | The processing is carried out on the basis of our overriding legitimate interest, pursuant to Article 31(1) of the Data Protection Act, in providing efficient and high-quality customer service and in producing our content cost-effectively. Insofar as the processing takes place in connection with the newsletter, it is based on your consent. We do not make any decisions that have legal consequences for you or significantly affect you based solely on automated processing. |
| Necessity | The processing of this data is not strictly necessary for the use of our online shop. Please do not include any particularly sensitive personal data in your enquiries that is not required for the processing of your request. |
| Retention period | We process the data for as long as is necessary for the relevant purpose, but no longer than the statutory retention periods. Data entered into AI systems is deleted by the relevant provider in accordance with their retention periods. |
R. AI assistant over the phone
| Data processing | When you call us, your call may be answered by an AI-powered voice assistant. At the start of the call, we will inform you that you are speaking to an automated system. If you do not wish to speak to an automated system, we will, upon request, put you through to a member of staff, or you can contact us by email at [email protected]. |
| Personal data | Your telephone number, the time and duration of the call, the content of the conversation, and any recording and its transcript. If you provide any further details during the call, such as your name or an order number, we will process these as well. |
| Purpose | Receiving and processing your enquiry, forwarding it to the relevant department, documenting the conversation and ensuring quality assurance. |
| Order processor | verbalo (Medici Ventures), Hohlstrasse 335, 8004 Zurich, Switzerland |
| Ensuring data protection | We have entered into a data processing agreement with the data processor. According to the provider, data processing and storage take place exclusively on servers in Switzerland and the European Union. The provider uses specialist sub-processors for language processing. |
| Privacy Policy of the Data Processors | verbalo: https://www.verbalo.ch/datenschutz |
| Legal basis | A recording or transcript of the conversation will only be made with your consent, which we will seek at the start of the conversation. You may withdraw your consent at any time with effect for the future. Furthermore, the processing is based on our overriding legitimate interest, in accordance with Article 31(1) of the Data Protection Act, in providing accessible and efficient customer service. |
| Necessity | You are not obliged to speak to the voice assistant. You can also contact us at any time by email or via our contact form. |
| Retention period | We delete recordings and transcripts as soon as they are no longer required for the processing of your enquiry, and at the latest after 90 days, provided there are no statutory retention obligations to the contrary. |
III. Disclosure of data to third parties
Your personal data will not be disclosed to third parties for purposes other than those listed, nor to contractors other than those listed and their sub-contractors.
IV. Cross-border disclosure to third countries without an adequate level of protection
No data will be disclosed to third countries without an adequate level of data protection, or only subject to appropriate safeguards, e.g. a contractual obligation to maintain a sufficient level of data protection (known as standard contractual clauses). Personal data will only be transferred to third countries if the data protection requirements set out in Articles 9 and 16 of the Data Protection Act (DSG) are met.
A third country is defined as a country where there is no level of data protection equivalent to that provided by Swiss law. The Federal Council (Ordinance on Data Protection (DSV), SR 235.11, Annex 1) lists countries with an adequate level of data protection.
There is also a data privacy framework in place between Switzerland and the USA. The transfer of your data to the US is based on the Swiss–US Data Privacy Framework or, should it be declared invalid or inapplicable, on so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures.
In this privacy notice, we explain when and how we transfer personal data to the USA or to other non-secure third countries.
V. Data security
We take appropriate technical and organisational measures to ensure that your personal data cannot be accessed or stolen by unauthorised third parties. In particular, through appropriate technical (e.g. firewalls, password protection, SSL encryption, etc.) and organisational (e.g. restricting access to authorised personnel, training of authorised personnel, etc.) measures, we ensure that only authorised persons have access to this data. Our data processing and security measures are continuously improved in line with technological developments.
We use SSL encryption for security reasons and to protect the transmission of confidential information, such as the enquiries you send to us as the website operator. You can recognise an encrypted connection by the fact that the address bar in your browser changes from «http://» to «https://» and by the padlock symbol in your browser bar. When SSL encryption is enabled, the data you send to us cannot be read by third parties.
VI. Your rights
As a data subject, you may assert various claims against us in accordance with the applicable national and international law. In order to fulfil these claims, we may process your personal data again where necessary. Depending on the applicable law, data subjects may exercise the following rights:
| Right of access | To request information about your personal data processed by us. In particular, information provided under Article 25 et seq. of the DSG may include:
|
| Right to rectification | To request, without delay, the rectification of any inaccurate personal data or the completion of your personal data held by us (Article 32(1) of the Data Protection Act). |
| Right to restriction of processing | To request the restriction of the processing of your personal data where you contest the accuracy of the data, where the processing is unlawful but you object to its erasure, and where we no longer require the data but you require it for the purpose of asserting, exercise or defend legal claims, or you have objected to the processing in accordance with Article 21 of the GDPR (Article 32 of the DSG); |
| Right to access and transfer data | to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transferred to another data controller (Art. 28 of the Data Protection Act); |
| Right to erasure | To request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest, or to assert, exercise or defence of legal claims (Art. 32 of the Data Protection Act in conjunction with Art. 28 of the Swiss Civil Code); |
| Withdrawal of consent | To withdraw your consent, once given, at any time. This means that we may no longer continue to process data on the basis of that consent in future (Art. 30(2)(b) of the Data Protection Act); |
| Complaint to the supervisory authority | To lodge a complaint with a supervisory authority (see above) (Article 49 of the Data Protection Act). |
Where we use AI-based systems, you also have the right to state your case and request that a human being review the outcome. To do so, please contact us at the address given above.
VII. Validity and amendments to this privacy policy
We reserve the right to amend this privacy policy at any time or to adapt it to new data processing methods. The current privacy policy can be viewed here at any time.
As at 30 September 2025
