Privacy Policy

The controller responsible for processing personal data in connection with the website www.n-stack.me and the N-Stack online store is:

Purple Ventures GmbH
Dottingen 12
9607 Mosnang
Switzerland

UID: CHE-337.669.133

Email: [PRIVACY / SUPPORT EMAIL]
Telephone: [PHONE]

N-Stack is a product and brand operated by Purple Ventures GmbH.

We process personal data in accordance with applicable Swiss data-protection law and, where applicable, the EU General Data Protection Regulation ("GDPR"). Swiss law requires transparency about the collection and processing of personal data, and individuals have rights to information concerning data processed about them.

We process personal data where necessary to:

• operate and secure our website and online shop;
• process and fulfil orders;
• receive and process payments;
• ship purchased products;
• communicate with customers;
• process returns, withdrawals, complaints and warranty requests;
• comply with accounting, tax and other legal obligations;
• analyse and improve our website where you have provided the required consent; and
• protect our legitimate business and security interests.

Where the GDPR applies, processing may in particular be based on performance of a contract, compliance with legal obligations, legitimate interests or your consent, depending on the relevant processing activity. The GDPR also requires businesses to inform users about purposes, legal bases, recipients, transfers and retention of personal data.

Our online store at www.n-stack.me is operated using the e-commerce platform Shopify.

Shopify provides the technical infrastructure required to display products, operate our online shop, manage customer information and orders, and provide checkout functionality.

When you browse our store or place an order, Shopify may process information including:

• your name;
• email address;
• telephone number;
• billing address;
• delivery address;
• order and transaction information;
• products viewed, added to your cart or purchased;
• browser and device information;
• IP address;
• cookie or device identifiers; and
• information about your interaction with our store.

Shopify confirms that it processes information such as contact information, billing and shipping information, transaction information, IP addresses, device identifiers and customer interactions when consumers interact with Shopify merchants. When Shopify acts on behalf of a merchant, the merchant remains responsible for explaining how that customer information is used.

We use this information primarily to operate the shop, process orders, provide customer service, prevent fraud and maintain the security of the store.

Shopify and international processing

Shopify operates internationally. For users in Switzerland and the EEA, Shopify states that personal information is received by its Irish affiliate and may subsequently be processed in other locations, including Canada and the United States.

Shopify states that transfers between Shopify entities from Switzerland or the EEA are protected, where applicable, through its approved Binding Corporate Rules and other legally recognised transfer mechanisms.

Further information about Shopify's processing practices is available in Shopify's own Consumer Privacy Policy.

When you place an order through N-Stack, we process the information required to enter into and fulfil the purchase contract.

This may include:

• first and last name;
• email address;
• telephone number;
• billing address;
• shipping address;
• products ordered;
• order value;
• payment method;
• transaction status;
• order history; and
• correspondence concerning the order.

We use this information for:

• order confirmation;
• payment processing;
• dispatch and delivery;
• customer support;
• returns and withdrawals;
• warranty and defect claims;
• fraud prevention; and
• statutory accounting and record-keeping.

Where GDPR applies, this processing is generally necessary for performance of the purchase contract or for taking steps requested by you before entering into a contract.

Some information must also be retained where required by accounting, tax or commercial law.

We offer PayPal as a payment method.

If you select PayPal during checkout, information required to process the payment is transmitted to PayPal. Depending on the transaction, this may include:

• your name;
• billing details;
• email address;
• transaction amount;
• currency;
• order or transaction identifier; and
• information necessary for fraud prevention and payment processing.

PayPal independently processes certain information for purposes including payment execution, fraud prevention, legal compliance and management of the customer relationship. PayPal's current privacy documentation expressly identifies payment administration and fraud prevention among its processing activities.

The specific PayPal entity responsible for PayPal's independent processing may depend on the customer's country or jurisdiction.

We do not receive your PayPal password.

The legal basis for transmitting information to PayPal is primarily the processing required to execute the payment method selected by you.

PayPal's own privacy terms also apply to PayPal's processing of your information.

We disclose personal data necessary for delivery to the shipping or logistics company responsible for your order.

This generally includes:

• recipient name;
• delivery address;
• telephone number where required for delivery;
• email address where used for delivery notifications; and
• shipment information.

The exact carrier should be added here once confirmed:

Shipping provider(s): [SWISS POST / DHL / UPS / DPD / OTHER]

Information is transmitted only to the extent necessary to process and deliver your order.

We use Google Analytics 4 ("Google Analytics"), a website analytics service provided by Google, to understand how visitors use www.n-stack.me and to improve our website and online store.

Depending on the configuration and your consent choices, Google Analytics may process information relating to:

• pages visited;
• session activity;
• approximate geographic information;
• browser type;
• device type;
• operating system;
• referring website;
• interactions with the website;
• purchases and other e-commerce events; and
• technical identifiers.

Google states that Google Analytics does not log or store IP addresses for users located in the EU, Switzerland or the United Kingdom.

Consent

For visitors in regions where consent is required, Google Analytics is controlled through our cookie-consent mechanism.

Google provides Consent Mode specifically so Google tags can modify their behaviour according to a user's consent choices.

Where consent is required, analytics processing is based on your consent. You can withdraw or change that consent at any time through our cookie settings.

Withdrawal of consent does not affect the legality of processing performed before the withdrawal.

Important Shopify configuration

For the most privacy-conservative implementation, I would configure Basic Consent Mode for Germany/EU traffic.

With Google's Basic Consent Mode, Google tags are prevented from loading until the visitor interacts with the consent banner. With Advanced Consent Mode, Google tags can load before consent and send limited consent-related or cookieless signals even where consent has not been granted.

That is an implementation setting rather than something the Privacy Policy itself can fix.

Our website uses cookies and similar technologies.

Some cookies are technically necessary for the operation of the Shopify store, including functionality associated with:

• checkout;
• shopping carts;
• security;
• authentication;
• customer preferences; and
• technical operation of the website.

We may also use optional cookies or similar technologies for analytics.

Where legally required, optional analytics or other non-essential technologies are used only according to your consent choices.

We use a cookie-consent mechanism integrated with our Shopify store to record and manage those choices.

You can:

• accept optional cookies;
• reject optional cookies; and
• change your cookie preferences later.

Shopify provides merchants with regional cookie-banner and customer-privacy controls and allows analytics, marketing and personalisation choices to be managed through those settings.

If your banner is a third-party app rather than Shopify's native banner, add the name of the app/provider here.

When you access our website, technical information may be processed automatically to provide and secure the website.

This may include:

• IP address;
• date and time of access;
• requested URL;
• browser type;
• operating system;
• device information;
• referring page; and
• security-related information.

This processing is necessary for the technical operation, availability and security of the website and Shopify store.

If you contact us by email, through the website or concerning an order, we process the information contained in your enquiry.

This may include:

• your name;
• email address;
• telephone number;
• order number;
• message content; and
• related correspondence.

We use this information to answer your request and manage our customer relationship with you.

If customer accounts are enabled on the N-Stack Shopify store, Shopify processes the information necessary to create and operate the account.

This may include:

• name;
• email address;
• delivery addresses;
• order history; and
• account authentication information.

Customers can use their account to access the functions made available through our Shopify store.

Depending on your interaction with N-Stack, personal data may be disclosed to categories of recipients including:

• Shopify and its subprocessors;
• PayPal;
• shipping and logistics companies;
• Google in connection with Google Analytics where applicable;
• hosting and IT-security providers;
• accounting or tax-service providers;
• professional advisers; and
• public authorities where disclosure is legally required.

We provide service providers only with information necessary for the relevant service.

Because we use international technology and payment providers, personal data may be processed outside Switzerland or the EEA.

This is particularly relevant to Shopify and potentially Google, PayPal and their service providers.

Where required by applicable law, transfers are based on recognised safeguards such as:

• an adequacy decision;
• approved Binding Corporate Rules;
• Standard Contractual Clauses; or
• another legally permitted transfer mechanism.

Shopify specifically states that information originating in Switzerland or the EEA may be processed internationally and describes Binding Corporate Rules and contractual mechanisms for applicable transfers.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected.

Order and transaction information may be retained for longer periods where necessary to comply with:

• accounting requirements;
• tax requirements;
• commercial record-keeping obligations;
• warranty or product-liability matters;
• legal claims; and
• dispute resolution.

Customer correspondence is retained for as long as reasonably necessary to process the request and address related legal or contractual matters.

Analytics information is retained according to the retention settings configured in our Google Analytics account.

Depending on the applicable data-protection law, you may have rights including the right to:

• request information about personal data processed concerning you;
• obtain a copy of your personal data;
• correct inaccurate information;
• request deletion of personal data;
• restrict certain processing;
• object to certain processing;
• request data portability where applicable; and
• withdraw consent at any time where processing is based on consent.

Swiss data-protection law provides individuals with a right to request information from a controller about whether personal data concerning them is being processed and, if so, details of that processing.

Where the GDPR applies, additional statutory rights may apply.

Requests can be sent to:

[PRIVACY EMAIL]

We may request reasonable information necessary to verify your identity before processing a data-protection request.

If you believe that your personal data has been processed unlawfully, you may contact us using the details above.

Where Swiss data-protection law applies, the competent federal supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

Where GDPR applies, you may also have the right to submit a complaint to the competent data-protection supervisory authority in the relevant EEA country.

We take appropriate technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

However, no internet-based transmission or storage system can provide absolute security.

We may update this Privacy Policy when our services, technologies, legal requirements or data-processing activities change.

The current version will be published at:

www.n-stack.me

The date shown at the beginning of this Privacy Policy indicates when it was last updated.