Welcome to Dunum and our website and store at www.dunum.ch. This Privacy Policy describes our practices for collecting, using, protecting and disclosing the personal information we collect from you when you visit our website and use our services.
General Information
Which law applies?
Our use of your personal data is subject to both the Swiss Federal Data Protection Act ("nDSG") and the EU General Data Protection Regulation ("GDPR"), and of course we process your personal data accordingly.
Considering that the nDSG was modeled on the GDPR, no conflict should arise if a consistent approach is taken. However, should any ambiguity arise, the strictest provision will be chosen to ensure the most comprehensive approach to protecting your personal data. The association SwissPrivacy.Law has published a comparison table between the nDSG and the GDPR, which you can find here which you can access here.
What is personal data?
Personal data is all information about personal or factual circumstances relating to an identified or identifiable natural person. This includes, for example, your name, your date of birth, your e-mail address, your postal address or your telephone number as well as online identifiers such as your IP address.
What is processing?
Processing is any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data.
Who is responsible for data processing?
The controller within the meaning of the nDSG and the GDPR is Dunum GmbH, Grabenstrasse 10, 4805 Brittnau, Switzerland ("Dunum", "we", "us" or "our").
If you have any questions about this Policy or our privacy practices, please contact us at shop@dunum.ch, call us at +41 62 751 73 92 or write to us at the above address.
What are the legal bases for processing?
In accordance with the nDSG and the GDPR, we must have at least one of the following legal bases to process your personal data:
Data that we collect automatically
Log data
Even if you do not log in or register on our website, but simply surf our website, data is collected and stored and processed by us. Specifically, this is i) the IP address of your computer, ii) the date and time of access, iii) the name and URL of the file accessed, iv) the browser used, v) the number of bytes transferred, vi) the status of the page request, vii) session ID, viii) referrer URL.
Hosting
To provide our website, we use the services of Shopify of the service provider Shopify International Limited, which processes all data to be processed in connection with the operation of our website on our behalf. The legal basis for data processing is our legitimate interest in providing our website.
Provision of the store
We use the Shopify store system. All data collected in our store is processed on Shopify's global servers. The legal basis for data processing is our legitimate interest in providing our store.
Content delivery network
We also use Shopify's Content Delivery Network (CDN) to distribute our online content. A CDN is a network of regionally distributed servers of our technical service providers that are connected via the Internet. When you visit our website, your device's browser transmits information to these service providers, which is collected in corresponding server log files. The server log files are usually anonymized and then transmitted without personal reference. The server log files include in particular i) information on the browser and operating system used, ii) the previously visited pages (so-called referral URL), iii) the IP address of the device used, iv) the name of the Internet provider and v) the date and time of all page views, including the amount of data transferred.
Cookies
We use so-called cookies on our website. Cookies are pieces of information that are transmitted from our web server or third-party web servers to your web browser and stored there for later retrieval. Cookies can be small files or other types of information storage. There are different types of cookies: i) Essential cookies. Essential cookies are cookies that provide a correct and user-friendly website; and ii) Non-essential cookies. Non-essential cookies are all cookies that do not fall under the definition of essential cookies, such as cookies that are used to analyze your behavior on a website ("analytical" cookies) or cookies that are used to show you advertisements ("advertising cookies").
As set out in the Swiss Unfair Competition Act (as amended) ("UCA"), the Telecommunications Act (as amended) ("TA") and the EU Directive on Privacy and Electronic Communications ("PECD"), we are required to obtain consent for the use of non-essential cookies. For more information about the cookies we use, please see our Cookie Policy. The legal basis for the processing is our legitimate interest and your consent.
Cookie consent
Our website uses a so-called cookie consent tool to obtain your consent to the storage of cookies and to document this consent. When you visit our website, the following personal data is processed by us: i) your consent(s) or the withdrawal of your consent(s); ii) your IP address; iii) information about your browser; iv) information about your device; v) time of your visit to the website. The basis for the processing is our legitimate interest and your consent.
YouTube videos
We have integrated components from YouTube (Google) integrated. The integration requires YouTube to be able to recognize the user's IP address. The IP address is required to send the video content to the user's browser. If you click on a YouTube component (video) on our website, your internet browser is prompted by the component to download a corresponding representation of the component. In this way, YouTube knows which specific subpages you have visited. The legal basis for data processing is our legitimate interest and your consent
Google reCAPTCHA
We also use reCAPTCHA from Google LLCto check whether the data entry was made by a human or an automated program. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as you enter our website. The legal basis for the use of reCAPTCHA is our legitimate interest.
Data that we collect directly
Making contact with us
In addition to your name, email address, IP address or telephone number, if provided, we usually collect the context of your message, which may also contain certain personal data. The personal data collected when you contact us is used to process your request and the legal basis is both your consent and a contract.
User account
To use our services, you can register and log in. Here too, we store data in order to create a user account for you: Name, e-mail address, chosen password. We store this data for as long as you are registered with us. If you delete your account, we will delete your data unless there is a legal retention period on our part. In this case, we must store your data for longer. The legal bases for processing are your consent, the provision of our contractual services and our legitimate interest.
Order processing
We process your first name, your surname, your e-mail address, your shipping and billing address, if different, as well as the data relating to your contract with us in order to process the contractual relationship between you and us. The legal basis for data processing is the contract.
Registration for events and workshops
When you register for our events and workshops, we process your first name, surname, email address and address. Our registration form is used on the basis of our legitimate interest in the planning and implementation of our events and workshops, taking into account your registration data and your consent. The data you enter in the form will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for storing the data no longer applies.
Payment data
When you make a purchase, your payment is processed via our payment service provider shoppay (Shopify) and the associated payment methods. The payment data is processed exclusively via the payment provider you have chosen and we have no access to the payment data transmitted by you. The legal basis for the provision of a payment system is the conclusion and execution of the contract.
Product reviews
We use the rating functions of Judge.meto constantly improve our products. We offer our customers the opportunity to rate us via an independent portal without us being able to influence this in any way. For this purpose, some data is transmitted to Judge.me. The integration is based on our legitimate interest and we have no influence or control over the data collected and processed by Judge.me.
Newsletter
If you have agreed to receive our newsletter, we will use your name and e-mail address to send you information about our products, promotions and news. You can revoke your consent to receive the newsletter at any time with effect for the future. You will find the link to unsubscribe at the end of each newsletter. The revocation leads to the deletion of the collected user data. The legal basis is your consent and our legitimate interest. Our email newsletters are sent via the technical service provider Omnisend sent out.
Marketing
If you have given us your separate consent to process your data for marketing and advertising purposes, we are entitled to contact you for these purposes via the communication channels for which you have given your consent.
You can give us your consent in a number of ways, for example by ticking a box on a form where we ask for your permission to send you marketing information, or sometimes your consent is implied from your interactions or contractual relationship with us. Where your consent is implied, this is because you have a reasonable expectation of receiving a marketing communication based on your interactions or contractual relationship with us.
Direct marketing is usually by email, but may also include other less traditional or new channels. These forms of contact are managed by us or by our contracted service providers. Any directly addressed marketing sent or carried out by us or on our behalf will include an option for you to unsubscribe or opt out.
Economic analysis and market research
For business reasons, we analyze the data we have on business transactions, contracts, inquiries, surfing behavior, etc., whereby the group of persons concerned may include contractual partners, interested parties and users of our services.
The analyses are carried out for the purpose of business evaluation and market research. The analyses serve us alone and are not passed on externally and are processed by means of anonymous analyses with summarized and/or anonymized values. In addition, we respect the privacy of users and process the data for analysis purposes as pseudonymously as possible and, if possible, anonymized (e.g. as aggregated data).
Social media
General information
We are present in social media on the basis of our legitimate interest (currently Facebook and YouTube).
Contact and interaction
If you contact us or interact with us via social media platforms, we and the respective social media platform are jointly responsible for the processing of your data and conclude a so-called joint controller agreement. The legal basis is our legitimate interest, your consent or, in some cases, the initiation of a contractual service, if any.
Links to social media
We use links to refer to our social media presences. Unlike social media plugins, links do not result in the social media platform finding out about your visit when you access our site. However, like any link, they result in your data being processed by the social media platform at the latest when you click on the link. As a rule, the social media platform stores cookies on your device or even your usage behavior in your account, especially if you are logged in yourself. The social media platform may use your data to analyze your usage behavior and use it for (interest-based) advertising. This may result in advertising being displayed to you inside and outside the social media platform.
Principles of the processing of personal data
Storage and retention
Where necessary, we process and store your personal data for the duration of our business relationship, which also includes, for example, the initiation and execution of a contract.
In addition, we are subject to various retention and documentation obligations, including those arising from the statutory minimum retention periods and the Federal Department of Finance (FDF). The retention and documentation periods specified there are two to ten years.
Security
Our website uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content such as orders, login data or contact requests that you send to us. In addition, we have taken numerous security measures ("technical and organizational measures"), such as encryption or "need to know" access, to ensure the most comprehensive protection possible for personal data processed via this website.
Nevertheless, internet-based data transmissions can always have security gaps, meaning that absolute protection cannot be guaranteed. And databases or records containing personal data may be breached accidentally or by unlawful intrusion. Once we become aware of a data breach, we will notify all affected individuals whose personal data may have been compromised as soon as possible after the breach is discovered.
Special category data
We do not process any special category data unless this is explicitly required when using our services and explicit consent has been obtained for this service.
Accuracy
Personal data is kept as accurate, complete and up-to-date as necessary for the purposes for which it is used. However, it is important that the information we hold about you is accurate and up to date. Please therefore inform us of any changes to your personal data.
Automated decision making
Automated decision making is the process of making a decision by automated means without human involvement. Automated decision-making, including profiling, does not take place.
Data sale
We do not sell your personal data.
Sharing and disclosure
We do not disclose your personal data to third parties unless this is i) necessary for the provision of our services, including our carriers and suppliers, ii) you have consented to the disclosure, iii) or we are legally obliged to do so, e.g. by a court order or if this is necessary to support criminal or legal investigations or other legal investigations or proceedings at home or abroad or to fulfill our legitimate interests.
International transfer
We may transfer your personal data to other companies if this is necessary for the purposes described in this Privacy Policy. To ensure adequate protection of your personal data when it is transferred, we have entered into contractual arrangements for such transfers. We take all reasonable technical and organizational measures to protect the personal data we transfer.
Your rights and privileges
Rights to the protection of privacy
In accordance with the nDSG and the GDPR, you can exercise the following rights:
If you have any questions about the type of personal data we store about you, or if you wish to exercise any of your rights, please contact us.
Updating your data
If you believe that the data we hold about you is inaccurate or that we are no longer authorized to use it and you wish to request the rectification or erasure of this data or object to the processing, please contact us.
Withdrawal of your consent
You can withdraw your consent at any time by contacting us. The legality of the data processing carried out up to the revocation remains unaffected by the revocation.
Request for information
If you wish to make a request for access to your data, you can inform us of this in writing. We will respond to your requests for access and rectification as quickly as possible. If we are unable to respond to your request within thirty (30) days, we will let you know why and when we will be able to respond to your request. If we are unable to provide you with personal data or make a correction you have requested, we will let you know why.
Complaint to a supervisory authority
You have the right to complain to a supervisory authority responsible for data protection about our processing of personal data. For us, the Federal Data Protection and Information Commissioner, Feldeggweg 1, CH-3003 Bern, Switzerland, www.edoeb.admin.ch is the competent authority. However, we would appreciate the opportunity to address your concerns before you contact the Federal Data Protection and Information Commissioner.
Validity and questions
This Privacy Policy was last updated on Saturday, August 19, 2023 and is the current and valid version. However, we would like to point out that a revision of this policy may be necessary from time to time due to actual or legal changes.
If you have any questions about this Policy or our privacy practices, please contact us at shop@dunum.ch, call us at +41 62 751 73 92 or write to us at the above address.