Privacy Policy

matcha7, j. mathis (sole proprietorship)

Owner:
Julian Mathis
Gellertpark 12
4052 Basel, Switzerland

UID: CHE-205.691.659
E-Mail: info@matcha7.ch

We are responsible for the processing of your personal data in connection with our online shop matcha7.ch and our social media presences.

We process your data in accordance with the Swiss Federal Act on Data Protection (FADP). Where you order from or use our website in the EU/EEA, the EU General Data Protection Regulation (GDPR) additionally applies. In short: we only collect data we need to run the shop, fulfil your order and — with your consent — for analytics and advertising. We do not sell your data.

Depending on the situation, we process your data based on: the performance of a contract or pre-contractual measures (e.g. orders, delivery, subscription management; Art. 6(1)(b) GDPR), your consent (e.g. newsletter, marketing cookies; Art. 6(1)(a) GDPR), our legitimate interests (e.g. security, fraud prevention, basic statistics; Art. 6(1)(f) GDPR), and legal obligations (e.g. accounting retention duties; Art. 6(1)(c) GDPR). You may withdraw any consent at any time with effect for the future.

Order and customer data: name, address, email, phone number, ordered products, payment and delivery information, order history, and customer account data where applicable.

Communication data: the content of your enquiries by email or contact form.

Technical data: IP address, device and browser information, pages visited, date and time of access, referrer URL. This data is generated automatically when you visit the website (server logs) and serves security and stability.

Tracking and marketing data: only with your consent via the cookie banner (see sections 11 and 12).

Our website is hosted with Webflow (Webflow Inc., USA). The shop runs on Shopify (Shopify International Ltd., Ireland, and Shopify Inc., Canada); the Smootify service connects the website and the shop. These providers process personal data on our behalf as processors, including for the cart, customer accounts, checkout and the storage of order data. Data may be transferred to the USA and Canada in the process (see section 14).

We use the following payment providers: Shopify Payments (credit cards, Apple Pay and others; operated with Stripe as payment processor), TWINT (TWINT AG, Switzerland) and bank transfer (prepayment). Your payment details (e.g. card number) are collected and processed directly by the respective payment provider — we ourselves have no access to complete card data. The privacy notices of the respective provider also apply.

For recurring orders (subscriptions) we use Shopify Subscriptions. Your order and payment data is stored for the duration of the subscription to process the recurring deliveries and charges. You can cancel your subscription at any time via your customer account or by emailing us.

To deliver your order, we share the necessary data (name, delivery address, and email/phone for tracking where applicable) with our shipping partners (e.g. Swiss Post and international carriers for deliveries to the EU).

If you sign up for our newsletter, we process your email address (and name, if provided) to send you regular information about products and promotions. The legal basis is your consent; you can unsubscribe at any time via the link in every email. We use Mailchimp (Intuit Inc., USA) for sending. Mailchimp analyses whether and how newsletters are opened and clicked in order to improve delivery. Data may be transferred to the USA (see section 14).

For customer reviews with photos we use Loox (Loox App Ltd., Israel). After a purchase you may receive an email asking for a review. If you submit a review, your name (or chosen abbreviation), the review text and uploaded photos are published on our website. Participation is voluntary; you can request deletion of your review from us at any time. Switzerland and the EU have adequacy decisions in place for Israel.

We use cookies and similar technologies. Strictly necessary cookies (e.g. cart, login, cookie preferences) are required to operate the shop and do not need consent. All other cookies — for personalisation, analytics and marketing — are only used if you allow them via our cookie banner.

You can change or withdraw your choices at any time via the "Cookies Settings" link in the footer of our website. Without your consent, the services described in section 12 remain disabled.

We only use the following services with your consent. They help us understand how our website is used and run our advertising efficiently.

We use the Meta Pixel and the Meta Conversions API of Meta Platforms Ireland Ltd. (Ireland) and Meta Platforms Inc. (USA). They allow us to measure whether our advertising on Facebook and Instagram leads to visits and purchases (conversion measurement), to show relevant ads to visitors of our website (retargeting) and to build similar audiences. The data processed includes device and browser data, pages visited, triggered events (e.g. "add to cart", "purchase") and — in hashed, pseudonymised form — contact data such as email address. Via the Conversions API, certain events are additionally transmitted to Meta directly from our shop system. For data collection via the pixel we are jointly responsible with Meta; Meta is responsible for the further processing. See Meta's Data Policy for details. Data may be transferred to the USA (see section 14).

We use Google Analytics 4 of Google Ireland Ltd. (Ireland) and Google LLC (USA) to statistically analyse the use of our website (e.g. visitor numbers, origin, on-site behaviour). IP addresses are not stored, or are processed in truncated form. We use Google Tag Manager to manage our tracking services; it does not itself store cookies with personal references, but controls the loading of the other services in accordance with your consent.

We use the TikTok Pixel of TikTok Technology Ltd. (Ireland) and TikTok Inc. (USA) to measure our advertising campaigns on TikTok and for retargeting. Similar data is processed as with the Meta Pixel (device information, page views, events, and hashed contact data where applicable).

We use the Pinterest Tag of Pinterest Europe Ltd. (Ireland) to measure the success of our Pinterest advertising and for retargeting. Device information, page views and events such as purchases are processed.

To analyse how visitors use our website (e.g. click paths, use of individual features) we use PostHog (PostHog Inc., USA). The data is analysed in pseudonymised form and helps us improve the shop.

We operate profiles on Instagram, Facebook and TikTok. If you interact with us there (e.g. comments, direct messages), we process the resulting data to communicate with you. The respective platform providers are (also) responsible for data processing on the platforms themselves; for page statistics ("Insights") we are jointly responsible with Meta. The privacy notices of the respective platform apply.

We only share personal data where necessary for the purposes described: with processors (hosting, shop system, payment, shipping, newsletter and analytics providers), with authorities where legally required, or with your consent.

Some of our providers are based in the USA, Canada or Israel. Adequacy decisions exist for Canada and Israel. For transfers to the USA we rely on the Swiss–U.S. Data Privacy Framework and the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Commission's Standard Contractual Clauses (recognised by the Swiss FDPIC), supplemented by additional safeguards where necessary.

We keep personal data only as long as required for the respective purpose or by law. We retain order and invoice data for 10 years in accordance with commercial law. Newsletter data is stored until you unsubscribe. Tracking data is deleted or anonymised in accordance with the settings of the respective services, after 14 months at the latest.

Our website is fully TLS/SSL encrypted. We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Access is limited to persons and providers who need it for their tasks.

You have the right to: access the data stored about you, rectification of inaccurate data, erasure (where no retention obligation applies), restriction of processing, data portability in a common format, withdrawal of consent you have given, and objection to processing, in particular to direct marketing.

Simply contact us at info@matcha7.ch. We may request proof of identity to process your request. You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the data protection authority of your country of residence.

We may amend this privacy policy if our data processing or the legal situation changes. The version published on this page applies.