Privacy policy

Privacy Policy

PRIVACY POLICY AND COOKIES

The purpose of this privacy and cookie policy is to inform you about our collection and processing of your personal data when you visit and use the website www.nycha.ch and when you interact with www.nycha.ch and @nychakombucha on social media.

9.1 PRIVACY POLICY

9.1.1 COLLECTION AND PROCESSING OF PERSONAL DATA

Here you can read more about how we handle your personal data in different contexts:

9.1.2 WEBSITE VISITS

Purpose: We process your personal data for the following purposes: to administer, optimise and develop the website to ensure that the content is relevant and presented in the most effective way for you and your device and that you as a visitor get a positive experience. The website uses cookies; see the separate section on cookies below.

Types of personal data we process:

• IP address
• Unique user ID

Basis for processing: Our processing of your personal data is based on our legitimate interest in administering, optimising and developing the website (Article 6(1)(f) of the GDPR and Article 13(1) of the FADP).

Retention period: We store your personal data for 5 years from the time of your visit to the website.

9.1.3 PURCHASES ON THE WEBSHOP

Purpose: We process your personal data for the following purposes: to complete your purchases, to comply with the purchase agreement with you, and to carry out order processing and delivery as well as handling any customer inquiries and complaints.

Types of personal data we process:

• Your purchases and invoices
• Name, address, email address, and telephone number
• Payment information

Basis for processing: Our processing of your personal data is necessary for the performance of the purchase agreement (Article 6(1)(b) of the GDPR and Article 13(2)(a) of the FADP).

Shopify: Our store is hosted on Shopify. They provide us with the online e-commerce platform that allows us to sell our products and services to you. Your data is stored through Shopify's data storage, databases, and the general Shopify application. They store your data on a secure server behind a firewall.

Payment: If you choose a direct payment gateway to complete your purchase, then Shopify stores your credit card data. It is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase transaction data is only stored for as long as necessary to complete your purchase transaction. Once complete, your purchase transaction information will be deleted. All direct payment gateways comply with the standards set by PCI-DSS, which is managed by the PCI Security Standards Council, which is a joint effort of brands such as Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers. For more insights, you can also read Shopify's privacy policy at Shopify Privacy Policy.

Retention period: We store the collected personal data in connection with purchases for 2 years from the time of purchase. After a specific assessment, we may store the information for up to 5 years from the time of purchase if necessary for legal claims to be established, asserted, or defended. We store invoice information and any complaint information for 5 years after the end of the year in which the purchase or complaint was made.

9.1.4 MARKETING

Purpose: If you have given us your consent, we process your personal data for the purpose of conducting personalised marketing, including abandon cart emails and retargeting via Facebook, Instagram, Google, and YouTube.

Types of personal data we process:

• IP address
• Device information
• Online identifiers
• Operating system and browser information
• Website behaviour

Basis for processing: Our processing of your personal data is based on your consent to marketing cookies (Article 6(1)(a) of the GDPR and Article 13(1) of the FADP). You have the right to withdraw your consent at any time and can do so by following the procedure described in the cookies section below.

Recipients of personal data: Data about your behaviour on the website is forwarded to Meta/Facebook/Instagram, Google, and YouTube for personalised marketing, including real-time bids from third-party advertisers. Personal data may also be transferred to external partners who process the personal data on our behalf. We use external partners to help us with data collection for marketing and ongoing maintenance of our website. When data about your behaviour on the website is forwarded to Facebook, Instagram, Google, and YouTube, we use the EU Commission's standard contractual clauses in accordance with Article 46(2)(c) of the GDPR and the necessary safeguards under the FADP to ensure the protection of personal data transmitted to data controllers in third countries.

Retention period: We store your personal data for 3 months after the time of your consent to the use of marketing cookies.

9.1.5 INTERACTION WITH NŸCHA KOMBUCHA ON SOCIAL MEDIA

We market our products digitally on social media. Here you can interact with our advertising and/or fill out contact forms if you want to be contacted by us. The information you provide and its processing are described below:

Data Responsibility In relation to the collection and processing of personal data through your interaction with nÿcha kombucha on social media, the data responsibility is shared between nÿcha kombucha, Meta (Facebook/Instagram), and Google/YouTube (the "Services"), which have the following contact information:

NYCHA AG Klosterstrasse 40 5430 Wettingen, Aargau Email: kontakt@nycha.ch

Meta/Facebook/Instagram: Facebook Ireland Ltd. 4 GRAND CANAL SQUARE, GRAND CANAL HARBOUR D2 Dublin IRELAND

Google/YouTube: Google Ireland Ltd. 4 Gordon House, Barrow St. Dublin IRELAND

Collection and Processing of Personal Data when Interacting with nÿcha kombucha on Social Media NYCHA AG is the data controller in relation to the following: When you interact with our advertising or social media posts, you may provide personal data. This can be done, among other things, by visiting our pages, commenting on or "liking" our advertising and your behaviour on our pages. You can also actively provide personal data if you fill in one of our contact forms. It is possible to interact directly with nÿcha kombucha via the Services, e.g. by sending a message via Instagram.

Purpose: We process your personal data for the purpose of being able to inform you about our products and the benefits you can obtain by purchasing our products (marketing).

Types of personal data that we collect and process in connection with marketing on social media:

• Name
• Address
• Telephone number

Basis for processing: We process your personal data in accordance with Article 6(1)(f) of the GDPR and Article 13(1) of the FADP (legitimate interests). If you actively provide your personal information by filling out one of our contact forms, we collect and process the information in accordance with Article 6(1)(a) of the GDPR and Article 13(1) of the FADP (consent).

Retention period: We store the personal data for 12 months from the time you first interact with nÿcha kombucha on social media. You have rights under the GDPR and the FADP in relation to the collection and processing for which NYCHA AG is the data controller, see more about your rights in the section "Rights under the GDPR and FADP" below.

Facebook and Google are data controllers in relation to the following: Facebook & Google collect different types of information about you when you use their services. This is done through the use of "cookies" or "pixels", small data programs that are stored on your device and track your activity. The Services may collect data about e.g. age, interests, purchase of goods and where you are located, etc. The services do this in order to pursue their own commercial interests, including improving their advertising. The services share data with NYCHA AG in order for us to improve our advertising.

As a user of Facebook, you can read more about how they as data controllers process your data, as well as your rights, including withdrawal of consent, here:

Facebook's privacy policy and other information:

• Facebook Privacy Policy
• Facebook Legal Terms

Google's privacy policy and other information can be found here:

• Google Privacy Policy

Appeal regarding services:

• Data Protection Commissioner

You can contact NYCHA AG at any time and request to exercise your rights under the GDPR and FADP (which you can read more about below).

9.1.6 RIGHTS UNDER THE GDPR AND FADP

9.1.6.1 RIGHT TO WITHDRAW CONSENT

If you have given consent, you can always contact us to hear about the scope, and you can also withdraw a given consent at any time. You can contact us at kontakt@nycha.ch. NYCHA AG may continue processing your personal data if we have another legitimate reason to do so. If you want to unsubscribe from our emails, you can unsubscribe via a link in the individual email.

9.1.6.2 RIGHT OF ACCESS TO YOUR PERSONAL DATA

You can request access to the personal data that we process about you. This includes the right to obtain information about, among other things, which data we have registered about you, the purposes of the processing, the categories of personal data in question, and the recipients of the data. You can request a copy of the personal data we process about you. The right of access may be restricted in consideration of other persons' rights and to comply with legal requirements.

9.1.6.3 RIGHT TO RECTIFICATION

You have the right to have incorrect personal data about you corrected. If you discover that there are errors in the data we have registered about you, you are encouraged to contact us in writing so that the data can be corrected.

9.1.6.4 RIGHT TO ERASURE ("RIGHT TO BE FORGOTTEN")

In certain cases, you have the right to have personal data about you deleted before the time of our general deletion. This applies, for example, if you withdraw your consent and we have no other basis for processing.

9.1.6.5 RIGHT TO RESTRICT PROCESSING

In certain cases, you have the right to have the processing of your personal data restricted. If you have the right to have processing restricted, we may in future only process the data - apart from storage - with your consent, or for the purpose of establishing, asserting, or defending legal claims, or to protect a person or important public interests.

9.1.6.6 RIGHT TO OBJECT

In certain cases, you have the right to object to our otherwise lawful processing of your personal data. You can also object to the processing of your personal data for direct marketing purposes.

9.1.6.7 DATA PORTABILITY

In certain cases, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to have these personal data transferred from one data controller to another without hindrance. This applies, for example, when our processing of your personal data is based on your consent or on a contract and when the processing is carried out automatically.

Contact Information for Supervisory Authorities:

Swiss Federal Data Protection and Information Commissioner (FDPIC): Feldeggweg 1, CH - 3003 Bern, Switzerland Website: FDPIC

EU Data Protection Authorities: A list of EU data protection authorities can be found here: EU DPAs

9.2 USE OF COOKIES ON THE WEBSITE

Our website uses cookies. We use cookies to personalise our content and ads, to show you social media features, and to analyse our traffic. We also share information about your use of our website with our social media partners, advertising partners, and analytics partners (see the section on "Recipients of personal data" above). Our partners may combine this data with other information you have provided to them or that they have collected from your use of their services.

Cookies are small text files that can be used by websites to make a user's experience more efficient.

The law states that we may store cookies on your device if they are strictly necessary to ensure the provision of the service you have expressly requested to use. For all other types of cookies, we only collect and process cookies if you give us prior consent to this. Our processing of your personal data through the use of cookies is thus based on your consent (Article 6(1)(a) of the GDPR and Article 13(1) of the FADP).

Cookies are stored for the period as described in the cookie declaration Cookie Information, to which reference is made to our Cookie Declaration.

You can withdraw your consent at any time by clicking on the small green icon at the bottom left corner of the website.

In case of discrepancy between the German, French, Italian, and English versions, the German version will prevail.