1. Controller and scope

The controller responsible for the processing described in this notice is:

This notice covers the Swiss DynaTag webshop at shop.dynatag.ch and shop.dynatag.com/ch and the associated order processing and communication.

The international information website, European shop and registration, activation or use of the DynaTag/Thync.it platform are subject to the privacy information provided there. In particular, this shop notice does not comprehensively describe the processing of online profiles, emergency information or access to QR-code profiles.

Personal data means information relating to an identified or identifiable natural person. Processing includes, in particular, collecting, storing, using, disclosing and deleting such data.

2. Data we process and its sources

2.1 Information you provide

• First and last name and, where applicable, company and business contact details
• Billing and delivery address, email address and, where applicable, telephone number
• Ordered products, variants, order numbers, prices, invoices and returns
• Shop account details and settings you select
• Texts, designs, files and approvals submitted for personalisation
• Messages, support requests, complaints and voluntary reviews
• Consent to optional technologies and withdrawals of consent

2.2 Technical and usage data

When you access the shop, we may collect your IP address, date and time, pages or files requested, response status, browser, operating system, device information and previously visited page. Depending on your consent and the service used, this may also include cookie identifiers, session data, interactions and information about advertising contacts.

2.3 Information from third parties

We also receive data from payment and delivery providers, such as payment confirmations, transaction references and delivery information. If someone else orders for you, they may provide us with your delivery and contact details.

Please provide information about other people only if you are authorised to do so, and inform them about the intended use.

3. Purposes and legal grounds

We process personal data to provide the shop, handle enquiries and orders, arrange payment and delivery, manage returns and warranty claims, prevent misuse, keep accounts and comply with legal obligations, as well as for the analytics and marketing purposes described below.

3.1 Swiss data protection law

We comply with the Swiss Federal Act on Data Protection (FADP) and related provisions. In particular, we observe purpose limitation, proportionality, transparency and data security. Where processing requires consent or another justification, we rely on the relevant ground. GDPR legal bases are not applied indiscriminately to all processing under Swiss law.

3.2 Where the GDPR applies

• Contract and pre-contractual steps: Article 6(1)(b) GDPR, particularly for orders and related enquiries.
• Consent: Article 6(1)(a) GDPR, particularly for analytics and personalised advertising configured on that basis.
• Legal obligations: Article 6(1)(c) GDPR, where a relevant obligation provides a basis under that provision.
• Legitimate interests: Article 6(1)(f) GDPR, particularly in operating a secure shop, preventing misuse, handling general business enquiries, enforcing rights and meeting Swiss obligations not already covered by another applicable basis. We take your rights and interests into account.

The GDPR may apply particularly to offers directed at people in the European Economic Area, including Liechtenstein, or to monitoring their behaviour. You may withdraw consent with effect for the future.

3.3 Required and optional information

Certain information is required for ordering, payment or delivery. Without it, we may be unable to provide the service concerned. Optional information and consent to advertising or analytics do not become mandatory merely because you shop with us.

4. Hosting and technical provision

Shop content, databases and technical logs are processed on the hosting systems used to operate the shop. Technical data serves to deliver pages, resolve errors and protect against unauthorised access.

Further information: cyon privacy notice.

Exclusive hosting in Switzerland concerns the shop infrastructure operated by cyon. It does not mean that all payment, analytics, advertising or communication services used in the shop process data exclusively in Switzerland. Their processing is explained in the relevant sections and in section 11.

Technical provision serves to fulfil your request to visit the website and ensure secure operation. Where the GDPR applies, it is based particularly on Article 6(1)(f) and, for specific contract negotiations or performance, on Article 6(1)(b).

5. Orders, customer account and personalisation

We use order and contact data to accept orders, allocate payments, deliver products, issue invoices and handle returns, complaints and warranty claims. Related confirmations and status messages are contractual communications and do not require consent to advertising.

If you use a shop customer account, we process the data needed for access, administration and order history. A shop customer account is distinct from an account for digital DynaTag profiles, even where services may be linked.

For engraving and other personalisation, we process the content and approvals submitted for that purpose. Engraving is performed directly by DynaTag in Switzerland. Design data for this engraving is not passed to an external production partner abroad.

Please provide only the information needed for the requested result. Health data and information about children can be particularly sensitive. Arrange for its publication or visible engraving on a product only after careful consideration and with the necessary authorisation. Our own data protection obligations remain in place.

6. Payment processing and delivery

6.1 Payment services

Depending on the payment method selected, data needed for the transaction is transmitted to the payment service concerned or collected directly by it. This may include identification and contact data, invoice amount, currency, order references, technical data and payment information. We receive information particularly about payment allocation and status.

We use the following payment services or methods:

• Stripe: According to the provider's information, relevant entities may include Stripe Payments Europe, Limited and Stripe Technology Company Limited in Ireland and, for certain payment services, Stripe Payments UK, Ltd. in the United Kingdom. Processing in the USA is possible. Further information: Stripe privacy policy and Stripe Privacy Center.
• PayPal: The responsible entity depends particularly on the country of the PayPal account. PayPal identifies PayPal Pte. Ltd., Singapore, for Switzerland, and PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, for Liechtenstein. Processing within the PayPal group, including in the USA, is possible. Further information: PayPal privacy statement.
• TWINT: TWINT privacy information
• Bank transfer: We process information needed to allocate the transfer, particularly the payer's name, amount, payment date, reference and account information contained in the bank record. The banks concerned participate in processing the transfer.

Payment services may also process data as independent controllers, for example to prevent fraud or fulfil their own legal obligations. Their privacy information explains this. Not every recipient acts solely as our processor.

6.2 Delivery

For delivery, we pass necessary details such as name, delivery address and, where appropriate, email address or telephone number for delivery updates to the delivery provider used. This serves to fulfil the ordered delivery.

Delivery provider: Swiss Post, Switzerland. Information about processing is available in Swiss Post's privacy information for its services.

7. Contact and communication

If you contact us by email, contact form or telephone, we process the information, content and related communication data you provide to answer and follow up your enquiry. An enquiry does not automatically sign you up for advertising.

Email services: We use Microsoft 365 to receive, send and manage business emails. Sender and recipient details, message content, attachments and technical delivery and connection data are processed on the Microsoft systems used for this purpose. This serves communication, handling enquiries and orders, and secure operation of email services.

The agreed data protection terms for Microsoft products and services govern the business services Microsoft provides on our behalf. Further information: Microsoft Data Protection Addendum for business services and Microsoft Privacy Statement.

Shop hosting at cyon and email processing through Microsoft 365 are separate services. The Microsoft 365 data location display reviewed for our organisation lists “European Union/EFTA” as the current geography for Exchange Online and “Switzerland” as the committed geography. For Exchange Online Protection, both the current and committed geographies are “European Union/EFTA”.

These entries concern customer data at rest as specified by Microsoft for each service. The current regional designation does not identify an individual storage country and does not by itself establish that data is already stored exclusively in Switzerland. The committed geography must be distinguished from the geography currently displayed.

Microsoft entities, particularly Microsoft Ireland Operations Limited in Ireland and Microsoft Corporation in the USA, and their service providers may be involved in Microsoft 365. Storage of mailbox content must be distinguished from processing of operational, security or support data. The data location display does not confirm that all such processing takes place exclusively in Switzerland. Relevant international transfers are subject to contractual data protection and transfer safeguards.

If you use a WhatsApp contact option, communication also takes place through the WhatsApp services concerned. Telephone numbers, communication content and technical communication data are processed as described by the provider. Alternatively, you can contact us by email or telephone. Please do not send passwords, complete card details or unnecessary health information.

Where the GDPR applies, general enquiries are processed on the basis of Article 6(1)(f); contract-related enquiries particularly on the basis of Article 6(1)(b). The subject of an enquiry may give rise to other legal bases.

8. Cookies, consent settings and Google Fonts

We use cookies and similar technologies, such as local browser storage, pixels and identifiers. They may support the basket, login, language and consent choices, or serve analytics and advertising purposes.

8.1 Necessary functions

Technically necessary storage and access serve the function you request, such as managing a basket or session. Classification depends on the actual purpose; a technology is not necessary merely because of its name.

8.2 Optional analytics and advertising

The consent management system blocks Google Analytics 4, Google Ads/remarketing and the Meta Pixel until you give the corresponding consent. We obtain your consent before activating these optional analytics and advertising functions. Refusing them does not prevent purchases. Accepting the terms and conditions or simply continuing to visit the website does not replace such consent.

You can change your choices and withdraw consent for the future through the shop's cookie settings. You may also delete or block cookies in your browser; this can affect necessary functions too.

Consent management: We use Cookiebot, a service of Usercentrics A/S, Denmark, to obtain, store and demonstrate your choices regarding optional technologies. This may involve processing consent status, time, an associated identifier and necessary technical information.

Where the GDPR applies, this processing serves to demonstrate required consent and provide the shop lawfully. The basis is Article 6(1)(c) where a relevant legal obligation exists, and otherwise particularly Article 6(1)(f). Using the consent management system does not itself constitute consent to the analytics and advertising services offered through it.

Further information: Cookiebot privacy information.

The supplementary cookie overview and cookie settings specify the lifetimes of browser entries and further information about providers and purposes. Consent records are retained as needed to manage your choices and provide necessary evidence of their lawfulness, then deleted or anonymised.

8.3 Externally embedded fonts: Google Fonts

We embed Google Fonts through Google servers to display fonts consistently. When retrieving the relevant font definitions and files, your browser connects to Google. Your IP address and technical request information, such as browser details and the requested resource, are transmitted to Google. Depending on browser settings, the referring page's address may also be transmitted.

Relevant Google entities may include Google Ireland Limited in Ireland and Google LLC in the USA. Processing in the USA is possible. External font delivery is distinct from Swiss shop hosting and from Google Analytics or Google Ads; it can trigger data transfers even without analytics or advertising cookies. Section 11 applies to international transfers.

Where this integration requires consent, particularly where the GDPR applies accordingly, external retrieval requires prior consent; in that case the legal basis is Article 6(1)(a) GDPR. Mentioning it in this privacy notice does not replace required consent.

Further information about Google's processing and retention and your rights is available in the Google Privacy Policy and the Google Fonts information.

9. Google Analytics 4

We use Google Analytics 4 (GA4) to analyse shop usage statistically and improve our offering. The provider is Google Ireland Limited, Ireland; Google LLC in the USA and other Google service providers may be involved in processing.

Data collected may include page views, sessions, interactions, device and browser information, visit sources and pseudonymous identifiers. If purchase measurement is configured accordingly, order events, product information and order values may also be processed. Data is not anonymous merely because a name is absent.

The use described here is based on consent; where the GDPR applies, on Article 6(1)(a). Google may process data outside Switzerland and the EEA. See section 11.

User and event data retention: GA4 data retention is set to 14 months. This concerns the user- and event-level data covered by that setting. The period does not apply to all Google data; aggregated reports in particular may be subject to different retention rules.

Further information: Google Privacy Policy and GA4 data retention.

10. Google Ads and Meta Pixel

10.1 Google Ads and remarketing

We use Google Ads to measure advertising performance and for remarketing. The provider is Google Ireland Limited, Ireland; processing by Google LLC in the USA is possible.

With your consent, advertising and device identifiers, information about ad contacts, shop pages visited and selected actions such as purchases may be processed. This helps attribute ads, create audiences and show interest-based advertising on other services. Association with a Google account also depends on your account settings and the functions used.

10.2 Meta Pixel

We use the Meta Pixel to measure advertising performance and create audiences on Meta services, particularly Facebook and Instagram. The relevant provider for Europe is Meta Platforms Ireland Limited, Ireland; data may also be processed in the USA.

Following the corresponding consent, technical identifiers, IP address, browser information, URLs visited and configured events such as purchases may be transmitted to Meta. Meta may link this information to an existing user account and use it for advertising.

Where the GDPR applies, collection and transmission of event data captured by the Meta Pixel are subject to joint controllership under the relevant Meta terms. Meta's subsequent processing for its own purposes is distinct. You can exercise your rights with us or Meta; we help direct your request appropriately.

Information about roles: Meta Controller Addendum. Further information: Meta Privacy Policy.

10.3 Consent and withdrawal

The advertising functions described rely on your consent, under Article 6(1)(a) where the GDPR applies. You can withdraw it through the cookie settings.

Health information, children's profiles, passwords and individual engraving content are unnecessary for these advertising purposes and must not be transmitted as such to advertising services.

11. Recipients and international transfers

11.1 Categories of recipients

Necessary data may be received particularly by employees and appointed hosting, IT, email, payment, delivery, font delivery, analytics and marketing providers. Depending on the circumstances, this may also include accounting, legal advisers, authorities and courts.

We do not sell personal data. This does not mean that no data is transmitted to third parties. In particular, the transfers to analytics and advertising services described above are subject to the conditions explained for each service.

Where providers act as processors, the necessary agreements and instructions apply. Independent or joint controllers are subject to their respective roles and their own data protection obligations.

11.2 Countries and safeguards

The recipients and services described concern particularly the following countries:

• Switzerland: shop hosting at cyon, in-house engraving by DynaTag, and Swiss payment or delivery recipients.
• Ireland and USA: relevant Google and Meta entities; Stripe processing in Ireland and the USA is also possible.
• Microsoft 365: The data location display currently lists “European Union/EFTA” for Exchange Online, with “Switzerland” as the commitment. For Exchange Online Protection, both entries are “European Union/EFTA”. Relevant Microsoft entities are located particularly in Ireland and the USA. The storage region for customer data at rest must be distinguished from possible additional operational, security and support processing.
• United Kingdom: particularly the entity involved in certain payment services according to Stripe's provider information.
• Denmark: provider of Cookiebot consent management.
• Singapore or Luxembourg: the entities identified by PayPal for Swiss or Liechtenstein accounts respectively.

The payment service selected and provider functions used influence which recipients are involved in each case. The linked privacy information explains providers' own processing and international recipient structures. A Swiss location for our shop servers does not exclude these separate transfers.

Shop hosting and hosting backups operated by cyon are located exclusively in Switzerland.

Engraving is carried out by DynaTag itself in Switzerland. No additional foreign production partners are used for this processing.

Transfers rely on an applicable adequacy decision or appropriate safeguards, particularly applicable standard data protection clauses with necessary additions and supplementary measures. Statutory exceptions apply only where their respective conditions are met.

For US recipients, a relevant Data Privacy Framework can provide a basis only if the specific organisation is appropriately certified and the transfer concerned is covered. A company's location in the USA alone is insufficient. The respective rules for data from Switzerland and the EEA must be distinguished.

You may request information from us about the safeguards used for a specific transfer. When providing it, we take account of third parties' protected information.

12. Retention and deletion

We retain personal data for as long as needed for its purpose or justified by legal obligations or the protection of legitimate legal claims. We then delete or anonymise it unless another lawful ground remains.

• Invoices and accounting records: generally ten years from the end of the relevant financial year, insofar as covered by a statutory obligation.
• Order, return and warranty data: for processing and necessary evidence; not automatically all content for ten years.
• Shop customer account: for use and administration; following deletion, only necessary contractual, evidential or retention data remains.
• Personalisation files: for the order, complaints and necessary evidence, then deletion once these purposes and necessary evidential interests cease.
• Server and security logs: only as long as needed for operation, troubleshooting and security monitoring; possibly longer to investigate specific security incidents.
• Communication: until the enquiry is handled and thereafter only as needed for contractual performance, necessary evidence, legal claims or statutory duties.
• Cookies and analytics data: according to actual lifetimes and system settings in the cookie overview and section 9.

Deleting an account does not automatically remove all accounting records or data from every backup immediately. After deletion, data may temporarily remain in backups until overwritten or deleted under the scheduled backup cycle. It is then no longer available for ordinary operational use; legally required retention remains reserved.

The five-year digital product term beginning at first activation is not a blanket retention period for all shop data. Storage of platform profiles is explained separately in the platform privacy information.

13. Data security

We take technical and organisational measures appropriate to the risk to prevent unauthorised access, loss and unlawful processing. These include encrypted connections for transmission through the webshop and access restricted to authorised persons.

Further measures depend on the systems and risks involved. Absolute security of every data transmission or storage operation cannot be guaranteed.

Please use secure login credentials and do not send passwords or complete credit card details through ordinary messaging channels.

14. Children and sensitive information

DynaTag products may also be intended for children. Buying such a product does not automatically require a child profile to be created in the webshop.

Processing children's, health and emergency data on the digital platform requires separate assessment and is described in its privacy information. However, such information may already arise in the shop context through engraving or support enquiries.

Parents or other authorised persons should provide only necessary information and consider the consequences of visible engraving or publication. A parental declaration does not release us from our own obligations. Where consent is required, it must satisfy statutory requirements; additional conditions apply to special categories of data.

If you suspect unauthorised processing of a child's data, contact us. We investigate and take necessary measures, including deletion unless another legal obligation prevents it.

15. Your rights and supervisory authorities

15.1 Data protection rights

Subject to applicable law, you may request information about processing and stored data, rectification and deletion. Subject to statutory conditions, you may also obtain or transfer data, object and, where the GDPR applies, restrict processing.

You can withdraw consent at any time for the future. Where the GDPR applies, you may object at any time to direct marketing and related profiling. For other processing based on legitimate interests, objections are subject to statutory conditions.

Write to support@dynatag.com. We may request reasonable additional information to verify your identity and respond within statutory deadlines. Rights may be subject to legal restrictions, for example due to retention duties or other people's rights.

Customer account functions may help you exercise your rights but do not replace your right to contact us directly. We do not make a blanket promise of full data export or deletion of all data with one click.

15.2 Rights concerning automated decisions

If you are subject to a solely automated decision with legal or similarly significant effects, you have the information and review rights provided by law. These may include expressing your views and requesting review by a natural person. Decisions made by a payment provider as an independent controller are also subject to its privacy information and contact options. We help direct requests concerning processing related to our shop.

15.3 Supervisory authorities

For privacy matters, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you also have the right to complain to a competent data protection authority, particularly in your habitual place of residence, workplace or the place of the alleged infringement. In Liechtenstein, this is the Liechtenstein Data Protection Authority.

16. External services and changes

Following an ordinary external link takes you away from our offering. The destination site's controller provides the applicable information. Services already embedded in the shop that transfer data are distinct and are not exempted from our obligations by this notice about links.

We update this notice when processing or legal requirements change. The current version is published in the shop. Where a change requires new consent or specific information, we provide that additionally; publication alone does not replace required consent.

17. Privacy contact

For questions about this notice or to exercise your rights, contact us at: