Privacy Policy

This Privacy Policy explains the nature, scope and purpose of the processing of personal data (hereinafter referred to as ‘data’) in connection with the provision of our services, as well as within our online platform and the websites associated with it, features and content, as well as external online presences, such as our social media profiles (hereinafter collectively referred to as the ‘online offering’). With regard to the terms used, such as ‘processing’ or ‘controller’, we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

Data controller

Sana Swiss Services AG
Niedermattstrasse 8c
4528 Zuchwil

Email address: [email protected]
Chairman of the Board of Directors: Konstantin Satushev
Link to the legal notice: sana.swiss/imprint

Types of data processed

• Master data (e.g. personal master data, names or addresses).
• Contact details (e.g. email, telephone numbers).
• Content data (e.g. text entries, photographs, videos).
• Usage data (e.g. websites visited, interest in content, access times).
• Meta/communication data (e.g. device information, IP addresses).

Categories of data subjects

Visitors and users of the online service (hereinafter, we shall collectively refer to the data subjects as ‘users’).

Purpose of the processing

• To provide the online service, its functions and content.
• To respond to enquiries and communicate with users.
• Security measures.
• Audience measurement/marketing

Terminology used

‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’); a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. ‘Processing’ means any operation or set of operations which is carried out on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data. ‘Pseudonymisation’ means the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures that ensure the personal data is not attributed to an identified or identifiable natural person. ‘Profiling’ means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements of that natural person. The term ‘controller’ refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. ‘Data processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Relevant legal bases

In accordance with Article 13 of the GDPR, we hereby inform you of the legal bases for our data processing activities. For users within the scope of the General Data Protection Regulation (GDPR), i.e. the EU and the EEC, the following applies unless the legal basis is specified in the privacy policy: The legal basis for obtaining consent is Article 6(1)(a) and Article 7 of the GDPR; The legal basis for processing carried out to fulfil our services, implement contractual measures and respond to enquiries is Article 6(1)(b) of the GDPR. The legal basis for processing to fulfil our legal obligations is Article 6(1)(c) of the GDPR. Where the vital interests of the data subject or another natural person necessitate the processing of personal data, Article 6(1)(d) of the GDPR serves as the legal basis. The legal basis for processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is Article 6(1)(e) of the GDPR. The legal basis for processing to safeguard our legitimate interests is Article 6(1)(f) of the GDPR. The processing of data for purposes other than those for which it was collected is governed by the provisions of Article 6(4) of the GDPR. The processing of special categories of data (in accordance with Article 9(1) of the GDPR) is governed by the provisions of Article 9(2) of the GDPR.

Safety measures

We implement, in accordance with the statutory requirements and taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk. These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access to, input of, disclosure of, and safeguarding the availability of the data, and ensuring its segregation. Furthermore, we have established procedures to ensure that data subjects’ rights are upheld, that data is deleted and that we respond to any data breaches. Furthermore, we take the protection of personal data into account right from the development and selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Cooperation with data processors, joint controllers and third parties

Where, in the course of our data processing, we disclose data to other individuals and organisations (data processors, joint controllers or third parties), transfer it to them or otherwise grant them access to the data, this is done solely on the basis of a legal authorisation (e.g. where the transfer of data to third parties, such as payment service providers, is necessary for the performance of a contract), where users have given their consent, where a legal obligation requires it, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.). Where we disclose, transfer or otherwise grant access to data to other companies within our group, this is done in particular for administrative purposes as a legitimate interest and, beyond that, on a basis that complies with statutory requirements.

Transfers to third countries

Where we process data in a third country (i.e. outside Switzerland, the European Union (EU) and the European Economic Area (EEA)), or where this occurs in connection with the use of third-party services or the disclosure or transfer of data to other individuals or organisations, this only takes place if it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests.

We only disclose data to a third country if the Swiss Federal Council has found that this country provides adequate data protection (Art. 16 para. 1 FADP and Annex 1 to the Data Protection Ordinance) or the European Commission has adopted an adequacy decision (Art. 45 GDPR), or if appropriate safeguards are in place, in particular the European Commission's standard contractual clauses with the adaptations for Switzerland (Art. 16 para. 2 FADP and Art. 46 GDPR). For the USA, adequate protection exists for companies certified under the Swiss-U.S. Data Privacy Framework (recognised by the Federal Council since 15 September 2024). For individuals in the EU, the EU-U.S. Data Privacy Framework applies accordingly (since 10 July 2023). The list of certified companies is available at https://www.dataprivacyframework.gov/list. The former "Privacy Shield" is no longer a valid basis. Where none of these conditions is met, we only disclose data with your express consent or in the other exceptional cases provided for by law (Art. 17 FADP and Art. 49 GDPR).

Rights of data subjects

You have the right to request confirmation as to whether the data in question is being processed, and to request access to this data, as well as further information and a copy of the data, in accordance with the statutory requirements. In accordance with the statutory provisions, you have the right to request that the data relating to you be completed or that any inaccurate data relating to you be rectified. You have the right, in accordance with the statutory provisions, to request that the relevant data be erased without delay or, alternatively, in accordance with the statutory provisions, to request a restriction on the processing of the data. You have the right to request that the data concerning you, which you have provided to us, be returned to you in accordance with the statutory provisions and to request that it be transferred to other data controllers. You also have the right, in accordance with the statutory provisions, to lodge a complaint with the relevant supervisory authority.

Right of withdrawal

You have the right to withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of the processing carried out until the withdrawal. The easiest way to change or withdraw your consent to cookies and similar technologies is the cookie icon at the bottom left of every page of our online service. It opens the cookie settings. Withdrawing is as easy as giving consent there.

Right to object

You may object at any time to the future processing of your personal data in accordance with the relevant legal provisions. In particular, you may object to the processing of your data for the purposes of direct marketing.

Cookies and the right to object to direct marketing

"Cookies" are small files that are stored on users' devices. A cookie is used to store information about a user (or about the device on which it is stored) during or after a visit to an online service. Temporary cookies ("session cookies") are deleted when the browser is closed, for example those that store the contents of a shopping basket or a login status. Permanent cookies remain stored afterwards, for example to remember the chosen language or your cookie choice, or to record usage for statistical or marketing purposes. "Third-party cookies" are set by providers other than us, "first-party cookies" by us. What applies to cookies here also applies to similar technologies such as pixels or the browser's local storage.

On your first visit, a notice at the bottom of the screen asks you which cookies we may use. We always use necessary cookies because our online service does not work without them (login, shopping basket, security, language selection, storing your cookie choice). The legal basis is our legitimate interest (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR). We group all other cookies and similar technologies into three categories, which you can accept individually: "Interaction history" (chat history, recently viewed products, search with Algolia, origin from campaigns), "Statistics" (Google Analytics) and "Marketing" (LinkedIn Insight Tag, Google advertising features, Meta pixel, TikTok pixel). We only use them once you have consented to the respective category (Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR). Before that, we load neither Google Tag Manager nor the services integrated through it. The "Only necessary" and "Accept all" buttons are equivalent. Under "Settings" you choose each category individually, and none is preselected.

We store your choice for 12 months in the cookie "website_cookies_bar". After that, or if this information changes significantly, we ask you again. To be able to demonstrate your consent, we also store a randomly generated identifier, the time, the language and your choice, but no IP address. We delete these entries after three years. You can change or withdraw your choice at any time via the cookie icon at the bottom left of every page. It opens the cookie settings. Our cookie policy shows in detail which cookies we use, with their purpose and provider: https://sana.swiss/en/cookie-policy

Disabling cookies may result in this website not functioning properly. A general objection to the use of cookies for online marketing purposes can be lodged for a wide range of services, particularly in the case of tracking, via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. Furthermore, you can prevent cookies from being stored by disabling them in your browser settings. Please note that, in this case, you may not be able to use all the features of this website.

Deletion of data

The data we process will be deleted or its processing restricted in accordance with statutory requirements. Unless expressly stated otherwise in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing its deletion. Where data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted. This means that the data will be blocked and not processed for any other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

Changes and updates to the privacy policy

We ask that you check the content of our privacy policy regularly. We will update the privacy policy as soon as changes to the data processing activities we carry out make this necessary. We will inform you as soon as the changes require any action on your part (e.g. consent) or any other individual notification.

Business-related processing

In addition, we process: - Contract data (e.g. subject matter of the contract, term, customer category). - payment data (e.g. bank details, payment history) from our customers, prospective customers and business partners for the purposes of providing contractual services, customer service and support, marketing, advertising and market research.

Order processing in the online shop and customer account

We process our customers’ data as part of the ordering process in our online shop to enable them to select and order the products and services of their choice, as well as to facilitate payment, delivery and fulfilment. The data processed includes personal details, communication data, contractual data and payment data, and the data subjects affected by this processing include our customers, prospective customers and other business partners. The processing is carried out for the purpose of providing contractual services in connection with the operation of an online shop, billing, delivery and customer services. In doing so, we use session cookies to store the contents of the shopping basket and persistent cookies to store the login status. The processing is carried out to fulfil our services and implement contractual measures (e.g. processing orders) and to the extent required by law (e.g. the legally required archiving of business transactions for commercial and tax purposes). The information marked as ‘required’ is necessary for the conclusion and fulfilment of the contract. We disclose data to third parties only in connection with delivery, payment or in accordance with statutory permissions and obligations, as well as where this is based on our legitimate interests, about which we inform you in this privacy policy (e.g. to legal and tax advisers, financial institutions, freight forwarders and public authorities). Users may optionally create a user account, which allows them, in particular, to view their orders. During registration, users are informed of the mandatory details required. User accounts are not public and cannot be indexed by search engines. Once users have closed their user account, their data relating to that account will be deleted, unless retention is necessary for commercial or tax law reasons. Information in the customer account remains until it is deleted, after which it is archived in the event of a legal obligation or to safeguard our legitimate interests (e.g., in the event of legal disputes). It is the users’ responsibility to back up their data prior to the end of the contract following cancellation. When users register, log in again or use our online services, we store their IP address and the time of the respective user action. This data is stored on the basis of our legitimate interests, as well as the users’ interest in protection against misuse and other unauthorised use. As a general rule, this data is not disclosed to third parties, unless such disclosure is necessary to pursue our legal claims as a legitimate interest or there is a legal obligation to do so. The data is deleted once statutory warranty periods and other contractual rights or obligations have expired (e.g. payment claims or performance obligations arising from contracts with customers), with the necessity of retaining the data being reviewed every three years; in the case of retention due to statutory archiving obligations, the data will be deleted once these obligations have expired.

External payment service providers

For payments by credit or debit card, PayPal, PostFinance and TWINT, we use the payment service provider Wallee Group AG, Neuwiesenstrasse 15, 8400 Winterthur, Switzerland ("wallee"). You enter your payment details directly on the payment page of wallee. We do not receive complete card or account details, but the confirmation of the payment with the amount, date and payment method.

Depending on the means of payment, wallee passes the necessary details on to the card organisations and the banks involved, to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, to PostFinance AG, Mingerstrasse 20, 3030 Bern, or to TWINT AG, Stauffacherstrasse 31, 8004 Zurich. These providers process the data in accordance with their own data protection provisions.

When you buy on invoice or with payment in advance, no payment service provider is involved. You transfer the amount directly to our bank account.

The legal basis is the performance of the contract (Art. 31 para. 2 let. a FADP and Art. 6 (1) (b) GDPR). Privacy policy of wallee: https://wallee.com/legal/privacy-policy

Administration, financial accounting, office organisation, contact management

We process data in connection with administrative tasks, the organisation of our business, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in the course of providing our contractual services. The legal bases for processing are Article 6(1)(c) of the GDPR and Article 6(1)(f) of the GDPR. This processing affects customers, prospective customers, business partners and website visitors. The purpose of, and our interest in, the processing lies in administration, financial accounting, office organisation and the archiving of data – in other words, tasks that serve to maintain our business activities, fulfil our duties and provide our services. The erasure of data relating to contractual services and contractual communication is in accordance with the information provided in relation to these processing activities. In this context, we disclose or transfer data to the tax authorities, advisers such as tax advisers or auditors, as well as other fee-charging bodies and payment service providers. Furthermore, based on our business interests, we store information on suppliers, event organisers and other business partners, e.g. for the purpose of contacting them at a later date. We generally store this data, which is predominantly company-related, on a permanent basis.

For individual functions of our business system, we use services of Odoo S.A., Chaussée de Namur 40, 1367 Ramillies, Belgium. With them we supplement company details based on the company name or e-mail domain, search for companies as potential customers and extract the data from supplier invoices. For this, Odoo receives only the information needed in each case, for example the e-mail domain of a company or the document. The legal basis is our legitimate interest in efficient administration (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR).

Business Analysis and Market Research

In order to run our business efficiently and to identify market trends and the requirements of our contractual partners and users, we analyse the data available to us relating to business transactions, contracts, enquiries, etc. In doing so, we process master data, communication data, contract data, payment data, usage data and metadata on the basis of Article 6(1)(f) of the GDPR, whereby the data subjects include contractual partners, prospective customers, customers, visitors and users of our online services. The analyses are carried out for the purposes of business evaluation, marketing and market research. In doing so, we may take into account the profiles of registered users, including details such as the services they have used. The analyses help us to improve user-friendliness, optimise our services and enhance operational efficiency. The analyses are used solely by us and are not disclosed externally, unless they are anonymous analyses based on aggregated data. Where these analyses or profiles contain personal data, they will be deleted or anonymised upon termination of the user’s account, or otherwise after two years from the date the contract was concluded. Furthermore, overall business analyses and general trend assessments are carried out anonymously wherever possible.

Microsoft Cloud Services

We use the cloud services provided by Microsoft and its cloud-based software services (known as Software as a Service, e.g. Microsoft Office) for the following purposes: document storage and management, calendar management, sending emails, spreadsheets and presentations, sharing documents, content and information with specific recipients, or publishing web pages, forms or other content and information, as well as chatting and participating in audio and video conferences. In doing so, users’ personal data is processed insofar as it forms part of the documents and content processed within the services described, or forms part of communication processes. This may include, for example, users’ master data and contact details, as well as data relating to transactions, contracts, other processes and their content. Microsoft also processes usage data and metadata, which Microsoft uses for security purposes and to optimise its services. When users access publicly available documents, web pages or other content, Microsoft may store cookies on their computers for the purposes of web analytics or to remember their settings. We use Microsoft Cloud Services on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR in efficient and secure administrative and collaborative processes. Furthermore, the processing is carried out on the basis of a data processing agreement with Microsoft. Further information can be found in Microsoft’s Privacy Statement (https://privacy.microsoft.com/de-de/privacystatement) and the security information on Microsoft Cloud Services (https://www.microsoft.com/de-de/trustcenter). You may object to the processing of your data in the Microsoft Cloud in accordance with the statutory provisions. Furthermore, the deletion of data within Microsoft’s cloud services is governed by the other processing procedures under which the data is processed (e.g. deletion of data no longer required for contractual purposes, or retention of data required for tax purposes). The Microsoft Cloud Services are provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Where data is processed in the USA, the information under "Transfers to third countries" applies. Microsoft Corporation is certified under the Swiss-U.S. and the EU-U.S. Data Privacy Framework.

For online appointment booking we use Microsoft Bookings. The booking page only loads once you have consented to the "Marketing" category or request it in the notice. Microsoft then sets cookies, for example "MC1", "MS0" and "ClientId", and receives usage data from the booking page. What you enter when booking is processed by Microsoft on our behalf as a processor.

Registration function

Users can create a user account. During the registration process, users are informed of the required mandatory details, which are processed on the basis of Article 6(1)(b) of the GDPR for the purpose of providing the user account. The data processed includes, in particular, login details (name, password and an email address). The data entered during registration is used for the purposes of using the user account and in accordance with its intended purpose. Users may be notified by email of information relevant to their user account, such as technical changes. Once users have terminated their user account, their data relating to that account will be deleted, subject to any statutory retention obligations. It is the users’ responsibility to back up their data prior to the termination of the contract. We are entitled to irrevocably delete all user data stored during the term of the contract. When users make use of our registration and login functions, as well as when using their user account, we store the IP address and the time of the respective user action. This data is stored on the basis of our legitimate interests, as well as the users’ interests in protection against misuse and other unauthorised use. This data is not, as a matter of principle, disclosed to third parties, unless this is necessary to pursue our claims or there is a legal obligation to do so in accordance with Article 6(1)(c) of the GDPR. IP addresses are anonymised or deleted after 7 days at the latest.

Getting in touch

When users contact us (e.g. via the contact form, email, telephone or social media), their details are processed for the purpose of handling the contact enquiry and its follow-up in accordance with Article 6(1)(b) (in the context of contractual or pre-contractual relationships), Article 6(1)(f) (other enquiries) of the GDPR. Users’ details may be stored in a Customer Relationship Management system (“CRM system”) or a comparable enquiry management system. We delete enquiries once they are no longer required. We review the necessity of retention every two years; furthermore, statutory archiving obligations apply.

Live chat

On our website you can write to us via the live chat. The chat runs on our own system. First, our chat assistant "Sanabot" answers with prepared questions and answers. Depending on your request, it asks for your e-mail address and passes the conversation on to our staff. A request or a ticket for our customer service may result from the chat (see "Getting in touch").

We store the chat history with the time and the information you give in the chat, for example your name and e-mail address. During the chat our staff see the country derived from your IP address, your language and the pages of our website you visited last (see "Visitor statistics in our shop system"). So that the chat stays open when you change pages, your browser stores technically necessary cookies for one week at most. If you have consented to the "Interaction history" category, your browser also remembers up to 15 visited pages for one day. Our staff can call up this list in the chat.

The legal basis is the initiation or performance of a contract or our legitimate interest in answering your request (Art. 31 para. 1 and para. 2 let. a FADP and Art. 6 (1) (b) and (f) GDPR). We keep the chat histories for as long as is necessary for your request and our customer relationship.

Newsletter

You receive our newsletter if you subscribe to it. You can subscribe with the form on our website and with the "Sign up for newsletter" button on the order confirmation. With a customer account you can also follow an author on the blog. We then add you to a separate list for that author's posts. What is said here about the newsletter also applies to these e-mails.

When you order in the shop, the "Subscribe to newsletter" box is already ticked as long as your e-mail address is not registered for the newsletter. Next to it, it says that you can unsubscribe at any time. If you untick the box, we do not register you.

Your e-mail address is enough to subscribe. Name and company are optional. For customers, we take the name, company and country from the customer account or from the order. We store when and how you subscribed so that we can prove the subscription.

The newsletter informs you about new products, special offers and news from our company. We record whether a newsletter was opened and which link was clicked, as described in the section "Newsletter - Measuring Success".

If you subscribe with the form, the button or on the blog, the legal basis is your consent (Art. 3 para. 1 let. o UCA, Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR). If you leave the box ticked when ordering, we send you the newsletter as long as you do not object. Because you buy from us and are told about the option to unsubscribe when ordering, we do not need separate consent for this (Art. 3 para. 1 let. o UCA). The legal basis is then our legitimate interest in maintaining our customer relationships (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR). Even without subscribing, customers receive information about similar products, as described in the section "Product information by e-mail".

You can unsubscribe from the newsletter at any time and free of charge, via the unsubscribe link in every newsletter, via the unsubscribe function of your e-mail program or by a message to [email protected]. After that we will not send you any more newsletters until you subscribe again. We note the unsubscription with your e-mail address. On request we delete the entry completely.

Newsletter - Sending

We send the newsletter and the other e-mails of our online service via Amazon SES, the e-mail sending service of Amazon Web Services. For this we use the Frankfurt am Main region in Germany. Amazon Web Services receives your e-mail address, the content of the e-mail and technical information about the sending.

Amazon Web Services processes this data on our behalf. The basis is the data processing agreement, which is part of the contract terms of Amazon Web Services (Art. 9 FADP and Art. 28 GDPR). We use the service because we have a legitimate interest in reliable e-mail delivery (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR).

Amazon Web Services belongs to the US group Amazon. Access from the USA can therefore not be ruled out. Amazon.com, Inc. is certified together with Amazon Web Services, Inc. under the Swiss-U.S. and the EU-U.S. Data Privacy Framework. In addition, the European Commission's standard contractual clauses are part of the contract terms of Amazon Web Services. Further details are given in the section "Transfers to third countries".

Newsletter - Measuring Success

The newsletters contain a so-called ‘web beacon’, i.e. a file the size of a single pixel, which is retrieved from our server – or, if we use a mailing service provider, from their server – when the newsletter is opened. As part of this retrieval, technical information – such as details about your browser and system – as well as your IP address and the time of retrieval are initially collected. This information is used to improve our services technically on the basis of the technical data, or to analyse target groups and their reading behaviour based on their location (which can be determined using the IP address) or the times at which the newsletter is accessed. The statistical analysis also includes determining whether newsletters are opened, when they are opened and which links are clicked. Although this information can, for technical reasons, be attributed to individual newsletter recipients, However, it is neither our intention, nor – where applicable – that of the mailing service provider, to monitor individual users. Rather, the analyses serve to help us identify our users’ reading habits and adapt our content accordingly, or to send different content based on our users’ interests. Unfortunately, it is not possible to opt out of performance tracking separately; in this case, the entire newsletter subscription must be cancelled.

Product information by e-mail

If you have bought from us, we send you information about our own similar products and services by e-mail. Examples are a welcome message after your first order, a reminder to reorder or news from our online shop. For this we use the e-mail address from your order. As with the newsletter, we record whether the e-mail was opened and which link was clicked.

The legal basis for these e-mails is our legitimate interest in maintaining our customer relationships (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR). Because you bought from us, we may send you these e-mails without separate consent as long as you do not object (Art. 3 para. 1 let. o UCA).

You can refuse these e-mails at any time and free of charge via the unsubscribe link in each e-mail or by a message to [email protected]. We will then send you no further e-mails of this kind.

Review requests

After an order has been delivered, we ask you for a review by e-mail at most twice. We do not do this for every order, but once per customer and, for companies, once per company. No earlier than one week after delivery we ask you to review Sana Swiss on Google. No earlier than two weeks after delivery we ask you to review products you bought in our shop. Both e-mails go to the e-mail address given with the order. We do not send reminders. As with the newsletter, we record whether the e-mail was opened and which link was clicked.

The e-mail about Google contains a link to our business profile on Google. Google only receives data when you open this link. From then on, Google's privacy policy applies, available at https://policies.google.com/privacy.

The e-mail about the products links to products you bought in our shop. Only customers who are logged in and bought the product from us can review it. For business customers, a purchase by the company counts. Your review appears on the product page with stars, text, date and your name, for business customers also with the company name. We also pass published reviews on to the Google Merchant Center. This way they can appear with the products in Google Search and Google Shopping. On request we delete your review.

The legal basis for the e-mails is our legitimate interest in feedback from our customers (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR). Because you bought from us, we may write to you about your order and the products you bought as long as you do not object (Art. 3 para. 1 let. o UCA). Publishing and passing on your review is based on your consent. You give it by submitting the review (Art. 6 (1) (a) GDPR). You can refuse review requests at any time and free of charge via the unsubscribe link in each of these e-mails or by a message to [email protected]. We will then send you no further requests.

Web hosting and email services

Our online shop and our business system run on servers of Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany, in a data centre in the EU.

Upstream of these servers is the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"). It protects our website against attacks and misuse and delivers it faster. In doing so, Cloudflare processes your IP address and technical information about your browser. Cloudflare is certified under the Swiss-U.S. and the EU-U.S. Data Privacy Framework (see "Transfers to third countries").

We send e-mails from our online shop, for example order confirmations, invoices and newsletters, via Amazon Simple Email Service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg, with servers in Frankfurt am Main.

These providers process the data on our behalf. The legal basis is our legitimate interest in secure and reliable operation (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR).

Collection of access data and log files

Each time our website is accessed, our server and the upstream network of Cloudflare store access data. This includes the page or file requested, the date and time, the amount of data transferred, the message on whether the request was successful, browser and operating system, the previously visited page and the IP address. We need this data for secure operation and to investigate faults and misuse. We delete the access logs of our server after 14 days and the error reports of our system after 30 days. Data that we need to investigate an incident is kept until the incident has been closed. The legal basis is our legitimate interest (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR).

Visitor statistics in our shop system

Our shop system keeps its own visitor statistics. For this, it forms an identifier from the IP address, browser and session and does not store the IP address itself. For this identifier it records the country derived from the IP address, language and time zone, time and number of visits as well as the pages and products viewed. If you are logged in, we assign the visit to your customer account. We use the data for the statistics of our online shop, for the "Recently Viewed" list and in the live chat. The data stays on our server and is not passed on to third parties. We delete entries without a customer account 60 days after the last visit. Entries linked to a customer account remain as long as the customer account exists. The legal basis is our legitimate interest in an easy-to-use online shop (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR).

Google Tag Manager

We use Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to integrate and manage the services of the "Statistics" and "Marketing" categories (Google Analytics, LinkedIn Insight Tag, Google advertising features). We only load the Tag Manager after you have given your consent in the cookie settings. The integrated services only run for the categories you have accepted. For technical reasons Google then receives your IP address, information about your browser and device and the page you view. The Tag Manager itself sets no cookies and does not analyse any usage data. Together with the Tag Manager we transmit your cookie choice to Google ("consent mode") so that Google's services act accordingly. The legal basis is your consent (Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR). Use policy: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/

Google Analytics

With your consent to the "Statistics" category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics sets the cookies "_ga" and "_ga_[ID]" (lifetime two years each) and records how you use our online service: pages viewed, products viewed and added to the basket, completed orders (order number, products, amount), time spent, origin (e.g. search engine or campaign), technical information about your browser and device and your approximate location. For users in Switzerland, the EU and the United Kingdom, Google only uses your IP address to determine the approximate location and then discards it without storing it. Google processes the data on our behalf and prepares reports for us on the use of our online service. This creates pseudonymous usage profiles, which we do not combine with your name or your customer account. The data may be transferred to Google LLC in the USA, which is certified under the Swiss-U.S. and the EU-U.S. Data Privacy Framework. Data at the level of individual users and events is deleted after 14 months. The legal basis is your consent (Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR), which you can withdraw at any time via "Cookie settings". Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/12017362

Creating target audiences with Google Analytics

Only if you have also consented to the "Marketing" category may data from Google Analytics be used by Google for advertising purposes. We can then create audiences to show ads in the Google advertising network to users who have shown an interest in our online service ("remarketing"), and Google may link the data to your Google account if you are signed in there and have allowed personalised advertising. Without this consent, we send Google the signal that no advertising use is permitted. The legal basis is your consent (Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR).

Google AdWords and Conversion Tracking

With your consent to the "Marketing" category, we use Google Ads (formerly "AdWords") of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to place ads in the Google advertising network (e.g. in search results, in videos or on websites) and to measure how many users complete an order with us after clicking on an ad ("conversion measurement"). For this purpose Google sets cookies such as "_gcl_au" and "_gcl_aw" (lifetime 90 days), which record the ad through which you came to us. We only receive aggregated evaluations, no information that would allow us to identify you personally. Google processes the data pseudonymously and may transfer it to Google LLC in the USA, which is certified under the Swiss-U.S. and the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR). Further information: https://policies.google.com/technologies/ads, settings for personalised advertising: https://adssettings.google.com/

Google DoubleClick

With your consent to the "Marketing" category, we may also use the advertising services of Google Marketing Platform (formerly "DoubleClick") of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). They show ads in real time based on presumed interests and can show relevant ads on other websites to users who have visited our online service ("remarketing"). For this, cookies (e.g. "IDE", lifetime 13 to 24 months) or similar technologies are used, which record pseudonymously the pages visited, the ads clicked and technical information about the browser and device. Google may combine this information with other data. The data may be transferred to Google LLC in the USA, which is certified under the Swiss-U.S. and the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR). Further information: https://policies.google.com/technologies/ads, settings for personalised advertising: https://adssettings.google.com/

Meta pixel and Conversions API

With your consent to the "Marketing" category, we use the Meta pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It measures whether visitors come to us after seeing an ad on Facebook or Instagram and view an item, add it to the cart or place an order, and helps Meta show our ads to people who might be interested in them. Meta receives your IP address, information about your browser and device, the page address and the type of event with item number, quantity, value of goods and currency. We do not pass on your name, e-mail address, phone number or postal address. For this, Meta sets the cookies "_fbp" and "_fbc", which remain stored for 90 days. With the Conversions API we also send the same events from our server to Meta, again only with your consent and without any further information about you. Meta may link the data to your Facebook or Instagram account and may also process it in the USA. Meta Platforms, Inc. is certified under the Swiss-U.S. Data Privacy Framework. You can withdraw your consent at any time via the cookie icon at the bottom left. Meta privacy policy: https://www.facebook.com/privacy/policy/

TikTok pixel and Events API

With your consent to the "Marketing" category, we use the TikTok pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. The representative in Switzerland is TikTok Switzerland GmbH, Talacker 41, 8001 Zurich. The pixel measures whether visitors come to us after seeing an ad on TikTok and view an item, add it to the cart or place an order. TikTok receives your IP address, information about your browser and device, the page address and the type of event with item number, quantity, value of goods and currency. We do not pass on your name, e-mail address or phone number. For this, TikTok sets cookies such as "_ttp", "ttcsid" and "ttclid", which remain stored for up to 90 days. With the Events API we also send the same events from our server to TikTok, again only with your consent and without any further information about you. TikTok stores data on servers in the USA, Malaysia and Singapore. You can withdraw your consent at any time via the cookie icon at the bottom left. TikTok privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en

Product search and recommendations (Algolia)

For the search in our online shop, the search suggestions and the product recommendations ("Similar products", "Frequently bought together") we use the Algolia service provided by Algolia SAS, 55 rue d'Amsterdam, 75008 Paris, France. The data is processed on Algolia servers in the European Union. For log management and network security, Algolia uses sub-processors based in the USA. Search terms and IP addresses may therefore be transferred to the USA, on the basis of the European Commission's standard contractual clauses with the Swiss addendum.

If you have consented to the "Interaction history" category in the cookie settings and you use the search, click on a product or add it to the cart, your browser sends Algolia the search term, the selected filters, the products displayed and clicked, the time, technical information about browser and device, your IP address and a randomly generated pseudonymous user identifier. If you are logged in, your user ID takes its place as the pseudonymous identifier. This is the internal number of your customer account with us. With this information Algolia adjusts the order of search results for you. The key factors are characteristics such as the brand and category of the products you have clicked on, added to the cart or ordered, and the filters you have selected. Without your consent, your browser only sends the search query itself, without a user identifier. In that case it does not report what you click on or add to the cart, and your searches are not included in the analysis. Algolia does not receive your name or your e-mail address. When you place an order we also transmit the ordered products and the order value to Algolia. This way recommendations reflect actual purchasing behaviour. If you consented when shopping, the order is linked to your identifier. Without a customer account, a further pseudonymous identifier is added, from which your customer number cannot be derived. Without consent, and for orders we enter for you, for example by phone or e-mail, we report the order with an identifier that applies only to that one order. Only we know which identifier belongs to which customer. Algolia cannot identify you. You can change your choice at any time via the cookie icon at the bottom left.

The identifier is stored in a cookie ("_ALGOLIA", lifetime six months) only if you have consented to the "Interaction history" category in the cookie settings. Without consent no identifier is created, not even for the current browser session. Automated access (search engines, bots) is not analysed.

The purpose of the processing is a working and relevant product search and the improvement of search and recommendations based on actual use, with your consent also an order of search results tailored to you. The legal basis is our legitimate interest (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR) and, for the cookie, the analysis of your searches and clicks and the order of results tailored to you, your consent (Art. 6 (1) (a) GDPR). Algolia processes the data as a processor under a contract pursuant to Art. 9 FADP and Art. 28 GDPR and deletes analytics data after 90 days. Further information: https://www.algolia.com/policies/privacy/

Online presence on social media

We maintain an online presence on social networks and platforms in order to communicate with customers, prospective customers and users active on these platforms and to inform them about our services. Please note that this may involve the processing of users’ data outside the European Union. This may entail risks for users, as it could, for example, make it more difficult to enforce their rights. US providers certified under the Data Privacy Framework offer an adequate level of data protection (see "Transfers to third countries"). Furthermore, users’ data is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behaviour and the resulting interests. These user profiles may in turn be used, for example, to display adverts both within and outside the platforms that are presumed to correspond to users’ interests. For these purposes, cookies are usually stored on users’ computers, in which their usage behaviour and interests are recorded. Furthermore, data may also be stored in the user profiles regardless of the devices used by users (in particular where users are members of the respective platforms and are logged in to them). The processing of users’ personal data is carried out on the basis of our legitimate interests in effectively informing users and communicating with them in accordance with Article 6(1)(f) of the GDPR. If users are asked by the respective platform providers to consent to the data processing described above, the legal basis for the processing is Article 6(1)(a) and Article 7 of the GDPR. For a detailed description of the respective processing activities and the options for objecting (opt-out), please refer to the information provided by the platform providers via the links below. We would also like to point out that, in the case of requests for information and the exercise of users’ rights, these can most effectively be exercised with the platform providers. Only the platform providers have access to users’ data and can take appropriate measures and provide information directly. Should you nevertheless require assistance, please do not hesitate to contact us.

• LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). Privacy policy: https://www.linkedin.com/legal/privacy-policy, opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
• YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Privacy policy: https://policies.google.com/privacy, opt-out: https://adssettings.google.com/authenticated
• Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland), on the basis of an agreement on the joint processing of personal data. Privacy policy: https://www.facebook.com/privacy/policy/, specifically for Pages: https://www.facebook.com/legal/terms/information_about_page_insights_data
• Instagram (Meta Platforms Ireland Limited, same address as Facebook). Privacy policy: https://privacycenter.instagram.com/policy
• TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland). Privacy policy: https://www.tiktok.com/legal/privacy-policy-eea

Integration of third-party services and content

We only load YouTube and TikTok videos, Instagram posts, the Google Maps map and online appointment booking with Microsoft Bookings once you have consented to the "Marketing" category or request the content in the notice shown in its place. A click in the notice applies to this visit and only to that provider. Before that, the provider receives no data from you. The legal basis is your consent (Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR).

Within our online offering, we rely on our legitimate interests (i.e. our interest in the analysis, optimisation and commercial operation of our online offering within the meaning of Article 6(1)(f) of the GDPR) to incorporate content or services from third-party providers in order to integrate their content and services (hereinafter collectively referred to as ‘content’). This always requires the third-party providers of this content to collect users’ IP addresses, as they would be unable to send the content to users’ browsers without the IP address. The IP address is therefore necessary for the display of this content. We endeavour to use only such content where the respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as ‘web beacons’) for statistical or marketing purposes. These ‘pixel tags’ enable information, such as visitor traffic on the pages of this website, to be analysed. This pseudonymous information may also be stored in cookies on the user’s device and may include, amongst other things, technical information about the browser and operating system, referring websites, time of visit and further details regarding the use of our online service, as well as being linked to such information from other sources.

YouTube

We embed videos from the “YouTube” platform provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://www.google.com/policies/privacy/ , Opt-out: https://adssettings.google.com/authenticated .

TikTok

On the "Mobility" page we show videos from our TikTok account. For users in Switzerland the provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, together with TikTok Information Technologies UK Limited. The representative in Switzerland is TikTok Switzerland GmbH, Talacker 41, 8001 Zurich. When the content loads, TikTok receives your IP address and information about your browser and device and sets cookies, for example "ttwid" for one year and "msToken" for ten days. TikTok stores data on servers in the USA, Malaysia and Singapore. TikTok privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en

Fonts

We deliver the fonts of our website from our own server. Your browser therefore does not load any fonts from Google or other providers.

Protection against misuse (Cloudflare Turnstile)

We protect our contact form, the newsletter sign-up, the registration and the password reset with Cloudflare Turnstile of Cloudflare, Inc. (details under "Web hosting and email services"). Turnstile is only loaded when you fill in such a form. It uses technical information about the browser and device to check whether a human is sending the form, and is not used for advertising. The legal basis is our legitimate interest in protection against misuse and spam (Art. 31 para. 1 FADP and Art. 6 (1) (f) GDPR). Privacy policy: https://www.cloudflare.com/privacypolicy/

Google Maps

We incorporate maps from the “Google Maps” service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The data processed may include, in particular, users’ IP addresses and location data; however, this data is not collected without their consent (which is usually given via the settings on their mobile devices). The data may be processed in the USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://adssettings.google.com/authenticated.

The map on the contact page only loads once you have consented to the "Marketing" category or request it in the notice. You can also open directions without the map using the "Google Maps" and "Apple Maps" buttons.

Browser notifications

For push notifications in the browser, our website integrates Firebase Cloud Messaging from Google. Firebase only loads once you have consented to the "Marketing" category. Google then receives your IP address and information about your browser and device. We do not send push notifications today. You would only receive them if you expressly allow them in your browser. The legal basis is your consent (Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR). The data may be transferred to Google LLC in the USA, which is certified under the Data Privacy Framework. Google privacy policy: https://policies.google.com/privacy

Instagram

On the "Mobility" page we show posts from our Instagram account. For users in Switzerland the provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When the content loads, Meta receives your IP address and information about your browser and device. If you are logged in to Instagram, Meta may link the visit to your account. Instagram privacy policy: https://privacycenter.instagram.com/policy

LinkedIn

With your consent to the "Marketing" category, we also use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"). During your visit it transmits to LinkedIn the page you view, the referring page, your IP address, information about your browser and device and the time. From this, LinkedIn prepares reports for us on the performance of our ads and on the characteristics of our visitor groups, without us being able to identify individuals, and may show relevant ads to LinkedIn members (retargeting). For this purpose LinkedIn sets cookies, for example "li_sugr" (90 days), "bcookie" (one year), "lidc" (24 hours), "UserMatchHistory" and "AnalyticsSyncHistory" (30 days each) and "li_fat_id" (30 days). According to LinkedIn, direct identifiers are removed within seven days and the remaining pseudonymised data is deleted within 180 days. We are jointly responsible with LinkedIn for the collection via our website. LinkedIn alone is responsible for any further processing. The legal basis is your consent (Art. 31 para. 1 FADP and Art. 6 (1) (a) GDPR), which you can withdraw at any time via "Cookie settings". Further information: https://www.linkedin.com/legal/privacy-policy and https://www.linkedin.com/legal/l/cookie-table

LinkedIn Corporation in the USA is certified under the Swiss-U.S. and the EU-U.S. Data Privacy Framework (see "Transfers to third countries").

Created using Datenschutz-Generator.de by Dr Thomas Schwenke, solicitor

Language versions

This privacy policy is available in several languages. In the event of any contradictions, questions of interpretation or ambiguities between the different language versions, the German version shall prevail.

The foreign-language versions are provided solely to aid understanding and have no legal effect in their own right.