1. Scope

This privacy policy applies to the information website dynatag.com and the global shop selection at shop.dynatag.com. It explains which personal data we process when you visit these offerings, contact us or register for the newsletter.

The global shop selection leads to the regional offerings for Switzerland and Liechtenstein or for Europe. The regional shops at shop.dynatag.com/ch/, shop.dynatag.ch/, shop.dynatag.com/eu/ and dynatag.shop/ have their own separate privacy policies. Order, payment and shipping processing in those shops is outside the scope of this policy.

The DynaTag data platform is independent of the shops. No data is exchanged between the shops and the data platform. Registration, activation, profiles and QR/NFC functions are subject to the data platform’s separate privacy notices.

We comply with the Swiss Federal Act on Data Protection (FADP) and, where applicable to the processing concerned, the General Data Protection Regulation (GDPR).

2. Controller and contact

You can use this contact to ask questions about data processing, withdraw consent and exercise your data protection rights.

3. Data, purposes and legal bases

We receive data from you when you complete a form or send us a message. Technical information from your browser or device is also processed when you visit the website. This may include your IP address, access time, requested page, referring page, browser, operating system, language, and status and error data.

When you select a shop, we process your chosen region and language to display the access you requested. Selecting a region does not, by itself, result in the transfer of a complete customer or platform profile.

References to Article 6 GDPR apply only where the GDPR is applicable. Under Swiss law, we observe transparency, purpose limitation and proportionality in particular, as well as any necessary grounds for justification. Any required consent is obtained separately; visiting the website or agreeing to terms of use does not replace it.

You are not required to send an enquiry or subscribe to a newsletter. Without the necessary information, however, we cannot process the enquiry or registration you request.

4. Hosting and technical logs

Both websites are hosted by cyon AG, Brunngässlein 12, 4052 Basel, Switzerland. As part of hosting, cyon processes data necessary to operate the servers and provide our websites. Form data and newsletter registrations are stored in the PrestaShop installation we operate.

Technical logs serve page delivery, stability, troubleshooting and security. According to cyon’s standard information, raw web server access logs are deleted daily. They may be used to generate server-side usage statistics retained for longer. Other operational, error and security data are retained for as long as needed for their respective purpose.

According to its own information, cyon creates daily backups and retains them for a maximum of two weeks. This information about cyon backups is separate from retention in our email system.

Further information: cyon privacy information, Log data and Backups.

5. Cloudflare

We use Cloudflare for DNS management. dynatag.com is also delivered through the Cloudflare proxy. Cloudflare may process technical connection, request and security data, such as IP addresses, requested URLs, timestamps and browser information. This serves to deliver, accelerate and protect the website.

For shop.dynatag.com, Cloudflare is used solely for DNS management, without a proxy. Website traffic is therefore not routed through the Cloudflare proxy merely because of this DNS management.

Cloudflare, Inc., USA, operates an international network and uses affiliated companies and service providers. Processing and access may take place outside Switzerland and the EEA, particularly in the USA. Information on the entities and countries involved is available in the Cloudflare list of subprocessors. The explanations in section 11 apply to transfers.

Further information: Cloudflare privacy information and Data processing agreement.

6. Cookies and Cookiebot

On both websites, we use Cookiebot by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, to manage your cookie and tracking choices. Data processed includes your choice, its timestamp, the page visited, browser information, a consent identifier and technical connection data.

Necessary storage access serves the functions you expressly request and the management of your choices. Optional statistics and advertising functions are activated in accordance with your consent. You can reject optional categories and change or withdraw your choices later. Regional shop selection remains available without consenting to optional analytics or advertising.

The individual cookies, their providers, purposes and lifetimes are listed in the cookie overview available on the respective website. Cookiebot’s consent cookie stores your choice for up to twelve months by default; a shorter configured or browser-imposed period is possible. A cookie’s lifetime is separate from the retention of related evidence.

Cookiebot describes storage of CMP data in the EU, particularly in Ireland and the Netherlands. Additional service providers may be involved in technical delivery; the current agreement including the subprocessor list explains their roles and processing locations, including the USA depending on the service.

Further information: Cookiebot privacy information.

The cookie settings button in the footer of the respective website lets you reopen and change your choices at any time and withdraw optional consent with effect for the future.

7. Google Analytics 4

We use Google Analytics 4 (GA4) on dynatag.com and on the global shop selection at shop.dynatag.com. GA4 serves statistical usage analysis and improvement of our offering. Data is sent to GA4 only after you consent through Cookiebot. Google Signals is disabled.

Page views, interactions, visits to a regional shop, pseudonymous identifiers, and browser and device information may be processed. Pseudonymous identifiers do not automatically make data anonymous. Regional purchases are outside the scope of this global policy.

Retention of user and event data is set to 14 months. The “Reset on new activity” option is enabled: the retention period for the user identifier starts again upon new activity. This setting does not automatically apply to all aggregated statistical reports.

For users in the EEA and Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is involved in particular. Data may also be processed by Google LLC in the USA and other Google service providers. This does not guarantee processing exclusively in Switzerland or the EU.

You can withdraw your consent at any time with effect for the future through the cookie settings. Further information: Google privacy information and GA4 data retention.

8. Planned Google Ads conversion tracking

We are setting up Google Ads conversion tracking for both global websites. The setup is still in progress. It is intended to attribute actions following ad clicks to a campaign in order to measure the effectiveness of our ads.

Measurement is planned only after the appropriate consent through Cookiebot. Depending on the configured measurement, an ad click identifier, the triggered event, timestamp and technical browser and device information may be processed. Remarketing is not planned for this global version.

Recipients are the Google companies involved, particularly Google Ireland Limited in Ireland and Google LLC in the USA. Where the GDPR applies, your consent under Article 6(1)(a) is the planned basis for conversion measurement involving personal data. You can withdraw it with effect for the future through the cookie settings.

Before launch, these notices will be adapted to the events, retention periods and data transfers actually configured. Cookie lifetimes planned for each website will be stated in the cookie overview.

9. Contact form and email

The contact form on both offerings collects your email address, your message and any attachment you include. Messages are stored in PrestaShop and also delivered by email. We use them to handle your enquiry, ask follow-up questions and carry out necessary follow-up work.

We use Microsoft 365 / Exchange Online to receive, send and store emails; messages are handled using Outlook, among other tools. Email addresses, messages, attachments and necessary technical communication data are processed. A contact enquiry does not result in newsletter registration.

Microsoft processes data under the terms applicable to its enterprise services. Microsoft Ireland Operations Limited in Ireland and Microsoft Corporation in the USA may be involved in particular. The hosting location of our websites does not determine where email mailboxes are stored; international processing and access must be taken into account.

We delete ordinary completed contact enquiries and attachments from PrestaShop and the email mailbox twelve months after completion. Longer retention remains possible where necessary for contract performance, specific legal claims or legal obligations; use is then restricted to those purposes.

Further information: Microsoft privacy information and Data protection agreement for Microsoft enterprise services.

10. Newsletter registration

You can register for a future newsletter on both websites. We are not sending newsletters yet. Registration is voluntary and uses double opt-in: you receive a confirmation email and confirm your registration using the link it contains.

Registrations currently remain stored in PrestaShop. We process your email address and the information necessary for confirmation and evidence. Unconfirmed registrations are deleted after seven days. Confirmed registrations are retained until you unsubscribe or withdraw consent, subject to any lawful and necessary separate retention of required evidence.

You can unsubscribe at any time by contacting support@dynatag.com and withdraw your consent with effect for the future. Processing carried out before withdrawal remains lawful. Where the GDPR applies, the legal basis for registration and subsequent sending is Article 6(1)(a) GDPR.

Mailchimp is planned for future sending. Registrations are not currently transferred there. Before such integration, we will update this policy with information on the provider, processing, international transfers and any effectiveness measurement.

11. Recipients and disclosure abroad

Access is limited to persons and entities that need data for the purposes described or to whom we must lawfully disclose it. This includes the relevant staff and the hosting, IT, communication, consent and analytics services described. Authorities and courts may be recipients where there is an appropriate legal basis.

We work with the providers used on the basis of their respective standard contracts and data protection terms.

The processing described particularly involves Switzerland (cyon), Denmark (Usercentrics), Ireland and the Netherlands (including Cookiebot infrastructure), and Ireland and the USA (Google and Microsoft). Cloudflare also uses its international network and the subprocessors linked in section 5. The contracting company, data storage and possible remote access must be distinguished.

Disclosures to countries recognised as providing an adequate level of protection are subject to the respective statutory adequacy arrangements. Other transfers require appropriate safeguards, particularly standard contractual clauses with the necessary Swiss adaptations and any additional protective measures, unless a statutory exception applies.

An applicable Data Privacy Framework adequacy decision may cover transfers to a specifically and validly certified US recipient company. It does not apply indiscriminately to any company or processing. Information about the safeguards used in a specific case and a copy or reference is available by contacting support@dynatag.com.

Simple links to other offerings, such as regional shops, social networks or WhatsApp, take you to the respective service when activated. The relevant provider’s information applies there.

12. Retention and deletion

We retain personal data only for as long as necessary for the stated purpose or while a legal obligation or a specific lawful reason for retention exists. We then delete it or effectively anonymise it.

• Contact enquiries and attachments: twelve months after completion; justified longer retention as described in section 9.
• Newsletter: unconfirmed registrations for seven days, confirmed registrations until unsubscription; required evidence may be retained longer to the extent necessary.
• GA4: 14 months for user and event data; resetting of the retention period for the user identifier upon new activity.
• Consent records: as needed to respect and demonstrate your choices; beyond that only for specific legal evidentiary reasons.
• Technical data: limited to operation, troubleshooting and security purposes; cyon’s standard information is explained in section 4. Data relating to a specific incident may be retained until its resolution and necessary follow-up.

Backups may contain deleted data until the end of their respective backup cycle. They serve restoration and are not reused for other purposes. If a backup is restored, deletions already initiated must be taken into account again.

13. Your rights

Under applicable law, you may request access, rectification, deletion, restriction of processing, the release or transfer of certain data, and cessation of processing or object to processing. Statutory conditions, exceptions and retention obligations remain applicable.

Where the GDPR applies, you may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time, including related profiling. You may withdraw consent at any time with effect for the future without affecting the lawfulness of previous processing.

Send your request to support@dynatag.com. A customer account is not required. If there are reasonable doubts about your identity, we may request appropriate additional information to identify you securely.

We generally handle GDPR requests within one month and notify you within that period of any permitted extension. Swiss access requests are generally subject to a 30-day deadline. Requests are generally handled free of charge, subject to statutory exceptions.

You can contact a competent supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you have a right to lodge a complaint, particularly with the authority at your habitual residence, place of work or the place of the alleged infringement. Judicial remedies remain available.

14. Security and changes

We take appropriate technical and organisational measures to protect confidentiality, integrity and availability. Absolute security for every internet transmission cannot be guaranteed.

We update this policy when our offerings or data processing change. Publishing a new version does not replace any required consent or permit a retrospective change of purpose.

Data protection contact