1. Controller and contact

DynaTag AG is responsible for the processing of Swiss shop data described here. Its contact details are provided above.

2. Data we process

For orders and customer accounts, we process names, company details where applicable, billing and delivery addresses, email addresses, telephone numbers, account and authentication data, ordered products, contractual details, payment status, amounts and transaction references.

For contact and support enquiries, we process correspondence and necessary order information, photographs and documents. For reviews, we process their content and the information needed for the agreed publication.

Shop visits may generate IP addresses, access times, pages visited, technical request information, browser, operating system and device details, session information, and error, security and server logs. Additional analytics and marketing data depend on the services actually used and your settings.

3. Purposes of processing

We use data to handle orders, payments, deliveries and refunds, administer customer accounts, respond to enquiries and reviews, and send necessary order and service communications.

Other purposes include secure technical operation, prevention of misuse, statutory retention and documentation obligations, and the establishment or defence of legal claims. Analytics and advertising measurement take place only to the extent permitted and in line with the actual configuration. We currently do not send newsletters.

4. Legal framework

We comply with the Swiss Federal Act on Data Protection (FADP), including transparency, purpose limitation, proportionality and data security. Where justification is required, this may include consent, overriding interests or a statutory basis.

Where the GDPR applies, orders and accounts are based on performance of a contract or pre-contractual steps (Article 6(1)(b)), legal obligations on Article 6(1)(c), and necessary security measures and protection of legal claims on legitimate interests (Article 6(1)(f)), following an appropriate balancing assessment. Those interests are secure shop operation, prevention of misuse and enforcement of rights. Consent-dependent analytics and marketing are based on Article 6(1)(a).

5. Cookies, analytics and marketing

Strictly necessary cookies and similar storage technologies support sessions, shopping carts and security functions. Cookiebot by Usercentrics manages and documents your cookie choices, processing in particular your selection, consent identifier, time, version and technical information.

You can change or withdraw consent for the future through the cookie settings. Individual technologies and cookie lifetimes are described in the cookie policy.

Status of the new Swiss shop: GA4 is planned but not yet configured. Google Ads has not yet been configured for the new shop either. The use of Meta Pixel and the connection to Stape in the new shop still need to be checked. The previous shop’s configuration must not automatically be treated as the new shop’s configuration.

According to the information currently available, the previous shop uses GA4, Google Ads conversion tracking, Meta Pixel and Stape. These services support usage analytics and advertising measurement; events and identifiers may be sent to Google or Meta. Stape provides infrastructure for server-side processing and forwarding. Server-side processing does not automatically mean anonymisation or processing exclusively within the EU.

The confirmed settings of the existing GA4 property are: event data 2 months, user data 14 months, with the user-data retention period reset on new user activity. These periods concern the relevant user and event data, not all reports or data held by Google. Google Signals and user-provided data collection in GA4 are disabled there. The use of User-ID, Google Ads Enhanced Conversions, Meta advanced matching or Meta Conversions API has not yet been established.

You can also block or delete cookies in your browser. This may limit shop functions and does not automatically delete data already held by service providers.

6. Recipients and service providers

We do not sell personal data. Necessary data may be disclosed to hosting, IT and support providers, payment providers, Swiss Post, advisers and authorities, and the analytics, marketing and consent services actually used.

• Hosting: cyon GmbH, Switzerland.
• Payments: PayPal, Stripe, UBS for bank transfers, and TWINT through a separate direct integration using a shop module.
• Shipping: exclusively Swiss Post.
• Consent management: Cookiebot, Usercentrics A/S, Denmark.
• Analytics and marketing: Google, Meta and Stape, where used in the relevant shop.

Processors act within their agreed instructions. Some payment and platform providers may be controllers for their own processing. Specific contracting entities and processing countries will be added before launch approval.

7. Hosting and processing abroad

Shop data hosted by cyon are stored on servers in Basel, Switzerland. The confirmed region of the existing Stape infrastructure is EU South (Italy). Its use in the new Swiss shop still needs to be configured or checked.

Payment, analytics and other providers may process data outside this infrastructure, potentially in the United States. Actual recipient countries and applicable safeguards still need to be completed. Transfers to countries without recognised adequate protection require a lawful safeguard or statutory exception, for example applicable standard contractual clauses with necessary supplementary measures. Contact us for information about a specific transfer.

8. Data security

We implement appropriate technical and organisational measures against unauthorised access, loss and misuse, including HTTPS and role-based access restrictions. Complete security cannot be guaranteed. Protect your credentials and inform us if you suspect misuse.

9. Retention and deletion

We retain data for as long as needed for its purpose or as required by law or other lawful retention grounds. Accounting books and records subject to statutory retention are generally kept for ten years from the end of the relevant financial year.

Account and support retention depends on use, handling, deletion requests and necessary evidence. Technical logs support operation and security; consent records document choices. Specific periods and backup deletion cycles remain to be added. Data are deleted or anonymised when the retention ground ends. Deleting an account does not automatically delete invoices that must legally be retained.

10. Children’s data

This notice concerns purchases and contact in the Swiss shop, not the management of profiles for children or persons receiving care. Those matters are covered by a separate platform privacy notice. For shop enquiries, limit children’s information to what is necessary and only share data you are authorised to disclose.

11. Your rights

Subject to legal requirements, you may request access, correction, deletion or cessation of certain processing and, where applicable, release or transfer of data. You may withdraw consent for the future and object to direct marketing. Where the GDPR applies, rights to restriction and objection also apply under its conditions.

Withdrawal does not retrospectively invalidate prior lawful processing. Statutory exceptions and retention obligations may limit rights. Send requests to support@dynatag.com; proportionate identity verification may be required.

12. Supervisory authorities

You may contact the Swiss Federal Data Protection and Information Commissioner: www.edoeb.admin.ch. Where the GDPR applies, you may also complain to the competent data protection authority, particularly where you habitually reside, work or where the suspected infringement occurred.

13. External content and changes

External websites are governed by their providers’ privacy notices. Embedded external content may receive data when a page loads and must be described and controlled appropriately where actually used.

We update this notice when processing or legal requirements change and give appropriate notice of significant changes. Updated information does not replace any required consent.