Privacy policy

Note: This English translation of the privacy policy is provided for convenience only. In the event of discrepancies or inconsistencies, the German version of the privacy policy shall prevail.

1) Introduction and Contact Details of the Data Controller

1.1 We are pleased that you visit our website and thank you for your interest. Below, we explain how we process your personal data when you use our website. Personal data is any information that can be used to identify you personally.

1.2 The data controller for this website under Swiss data protection law (DSG) is:

Zekiroska Supplies
Fabrikstrasse 14
E-Mail: info@kirose.ch

The data controller determines, alone or jointly with others, the purposes and means of processing your personal data.

 

2) Data Collection When Visiting Our Website

2.1 When you visit our website without registering or actively providing information, certain data is automatically transmitted by your browser to our server. These “server log files” are technically necessary to ensure the website displays correctly and operates securely and reliably.

The data collected includes:

  • The page visited on our website
  • Date and time of access
  • Amount of data transferred
  • The referring source from which you accessed our site
  • Browser and operating system used
  • IP address (anonymized or truncated wherever possible)

This data is used solely for technical and security purposes, such as maintaining stability, troubleshooting, and optimizing our website. It is not shared with third parties, except in cases where server logs are examined to investigate suspected misuse or illegal activity.

2.2 To protect your data and securely transmit confidential information, our website uses SSL/TLS encryption. You can identify a secure connection by “https://” in the browser’s address bar and the lock icon.

 

3) Hosting & Content Delivery Network

3.1 Shopify
Our website is hosted on the Shopify platform provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides the technical infrastructure for operating and managing our online content.

While using our website, the data collected is processed on Shopify servers. Data may also be transferred to affiliated Shopify companies, including:

  • Shopify Inc., 150 Elgin Street, Ottawa, ON K2P 1L4, Canada

Shopify processes data in accordance with applicable data protection regulations. We have a data processing agreement with Shopify to ensure that your personal data is processed strictly according to our instructions and in compliance with Swiss data protection law (revDSG).

For data transfers to Canada, there is a decision by the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB) confirming that an adequate level of data protection exists in Canada.

 

4) Cookies

To enhance your experience and provide certain functions, we use cookies—small text files stored on your device.

  • Session cookies are deleted after you close your browser.
  • Persistent cookies remain on your device and help us remember your preferences on subsequent visits.

Cookies support the technical stability of our website and improve usability. If cookies process personal data, this is done in compliance with Swiss data protection law (revDSG), for purposes such as:

  • Ensuring technical functionality
  • Enhancing user experience
  • Marketing or analytics, based on your consent

You can manage cookies through your browser settings. Disabling certain cookies may affect the website’s functionality.

 

5) Contact and Customer Information

5.1 Email Communication
If you contact us via email, our online form, during checkout, or when subscribing to our newsletter, we process the information you provide.

  • General inquiries: info@kirose.ch
  • Newsletter subscriptions: processed to deliver requested information
  • Checkout emails: used to process and complete your order

5.2 Physical Addresses
Delivery and billing addresses are collected to ensure accurate order fulfillment.

5.3 Payment Information
Payment data is collected during checkout and processed exclusively to complete the transaction. Sharing occurs only with payment providers as necessary.

5.4 Phone Numbers / SMS
Phone numbers are not used for marketing purposes but may be optionally provided for order inquiries.

5.5 Data collected through Shopify and installed apps

  • Shopify Email: Email marketing campaigns
  • Shop App: Customer activity and order tracking
  • Point of Sale (POS): In-store sales data
  • Swiss Post Labels: Shipping information
  • Other apps (Flow, Search & Discovery, Translate & Adapt): Behavioral data, product interactions, optimization of shopping experience

  • We use the Meta Pixel and the Conversions API provided by Meta Platforms Ireland Limited to measure and optimize our advertising campaigns, deliver personalized ads on Facebook and Instagram, and analyze user behavior.

    In this context, event data (e.g. page views, purchases), technical data (e.g. IP address, device information), and — where actively transmitted via the Conversions API — hashed personal data may be processed. Data may be transferred to the United States; Meta is certified under the EU-US Data Privacy Framework.

    More information: https://www.facebook.com/privacy/explanation

5.6 Tracking & Cookies
During your visit, we may collect data on page views, product interactions, cart activity, and checkout behavior. This data is used only for order processing, customer communication, service improvement, and legally permitted marketing.

 

6) Comment Function

If you leave a comment on our website, the following data is collected and displayed publicly:

  • Your comment
  • Publication date and time
  • Your chosen name

To protect users and third parties, your IP address is logged. Your email address is used only to contact you in case of legal claims or content disputes.

 

7) Customer Account Creation

When you create an account, we collect and process the information necessary for account setup and management. You may request deletion of your account at any time via info@kirose.ch, provided:

  • All contracts linked to the account are fulfilled
  • No legal retention obligations exist
  • No legitimate interest requires further storage

8) Use of Customer Data for Direct Marketing

8.1 Newsletter Registration
You can subscribe to our newsletter by providing your email address. Additional information is optional for personalization. We use double opt-in, requiring confirmation via email. IP address, date, and time are recorded for proof of consent. You can unsubscribe anytime via the link in the newsletter or by emailing info@kirose.ch.

8.2–8.8 Email Marketing / Automated Emails / Tracking

  • Emails sent only with consent
  • Automated messages (cart abandonment, checkout, welcome, product recommendations) sent only with consent
  • Data processed via Shopify Email; sub-processors include Twilio and Mailgun
  • Tracking pixels used only with separate consent, data used solely to improve campaigns
  • Users can revoke consent at any time
  • Legal basis: consent (Art. 6(1)(a) GDPR / Art. 7 DSG)

 

9) Email Communication and Contact

9.1 Email Hosting via Hostpoint
We use Hostpoint AG, Rapperswil-Jona, Switzerland, for business email communication. Emails are processed and stored on Hostpoint servers, including:

  • Sender/recipient email addresses
  • Email content
  • Metadata (date, time, IP address)
  • Attachments

Purpose: responding to inquiries, sending confirmations and notifications, business communication, legal and tax retention.

Legal basis:

  • Contract performance (Art. 6(1)(b) GDPR)
  • Legitimate interest (Art. 6(1)(f) GDPR)
  • Legal obligations (Art. 6(1)(c) GDPR)

Hostpoint complies with Swiss DSG; data is stored in Switzerland.

9.2 Contact via Email or Form
Data is stored for inquiry handling and follow-ups and is not shared without consent.

 

10) Order Processing

10.1 Purpose of Data Processing
We collect and process personal data (name, delivery/billing address, email, payment information) to fulfill orders. Data is deleted once orders are completed unless legal obligations or legitimate interests require further storage.

10.2 Sharing with Shipping Providers
We use Swiss Post for delivery. Address and name shared for delivery; email/phone only if you consent for delivery coordination. Consent can be withdrawn anytime.

10.3 Payment Processing

  • Shopify Payments / credit card: encrypted transmission of payment data
  • TWINT: transmitted directly to TWINT AG
    All data used solely for payment processing and deleted after legal retention periods.

11) Web Analytics Services

11.1 Shopify Analytics
Your online shop kirose.ch uses the integrated analytics services of Shopify to improve functionality and optimize the shopping experience. The following data is collected:

  • Number of visitors and sessions
  • Page views and product views
  • Shopping cart activities
  • Purchase behavior and conversion data
  • Device information (desktop/mobile)

The processing is carried out exclusively for the purpose of optimizing our website and analyzing purchasing behavior.

 

11.2 Cookies and Tracking Technologies
We use cookies and similar technologies for the following purposes:

  • Necessary functions: for example shopping cart and checkout
  • Analysis and performance measurement: to improve the website
  • Marketing and personalization: for example personalized product recommendations

Visitors from Switzerland can manage cookie storage via the cookie settings on our website and withdraw their consent at any time.

 

11.3 Shopify-specific Services

  • Shopify Pixels are used to analyze visitor behavior on the website and measure the effectiveness of marketing activities.
  • Shop App integration collects customer activities for functionality and improvement of the app.

Further information about the use of cookies and tracking by Shopify can be found in the Shopify Cookie Policy.

 

11.4 Data Processing by Shopify

  • Your shop is hosted by Shopify. Shopify processes personal data of your customers exclusively on our behalf.
  • Data may be transferred to other countries. Shopify ensures that an adequate level of data protection is maintained.
  • Further information can be found in the Shopify Privacy Policy.

 

11.5 Customer Rights

  • Visitors can manage their cookie consent and withdraw it at any time.
  • Opt-out options for sharing data for analysis and marketing purposes are available.
  • Requests regarding your data or data protection rights can be submitted directly via the Shopify Privacy Policy.

 

12) Online Marketing

12.1 Email Marketing (Shopify Email)
We use Shopify Email to send newsletters and promotional emails.

  • Your email address is collected only after explicit consent.
  • Usage is exclusively for sending newsletters and marketing communications.
  • Customers can opt-in for marketing emails during checkout.
  • Unsubscription is possible at any time via the link in each email.
  • Customer-specific data is not stored outside the subscriber list.

 

12.2 Marketing Consents

  • Customers must actively agree to receive marketing messages.
  • The double opt-in procedure may optionally be used to confirm consent.
  • Consents are recorded at checkout and can be changed or revoked at any time.

 

12.3 Personalized Advertising (Enhanced Services)

  • If Shopify Network Intelligence is enabled, customer data is used to display personalized advertising.
  • Information about customer activities may be shared with Shopify and, if applicable, third-party providers.
  • Data may be transferred to other countries, with Shopify ensuring an adequate level of data protection.
  • Customers can object to the transfer of data for advertising purposes at any time.

 

12.4 Tracking for Marketing Purposes

  • We track customer behavior to optimize marketing campaigns.
  • Analysis includes campaign performance, retargeting, and remarketing.
  • Tracking is carried out in a data protection-compliant manner and only as far as necessary.

 

12.5 Customer Rights in Marketing

  • You have the right to object to the use of your data for direct marketing.
  • You can object to personalized advertising measures at any time.
  • Requests regarding data sharing or opting out can be submitted via the Shopify Privacy Policy.
  • Marketing emails can be unsubscribed from at any time using the links in the emails.

 

12.6 Compliance with Anti-Spam Laws

  • We send marketing communications only to persons who have explicitly given their consent.
  • All sending measures comply with Swiss anti-spam regulations.

 

13) Retargeting, Remarketing, and Conversion Tracking

13.1 Retargeting / Remarketing

  • Purpose: We use retargeting and remarketing technologies to display personalized advertising to you on other websites and platforms based on your visit and behavior in our shop kirose.ch.
  • Technologies:
    • Shopify Pixels to track customer activities
    • Cookies and similar tracking technologies
    • Shopify Network Intelligence for personalized advertising
  • Collected data:
    • Visited pages and viewed products
    • Shopping cart activities
    • Purchase behavior
    • Device information (desktop or mobile)
  • Consent:
    • In Switzerland, these technologies are activated only with your consent via the cookie banner.
    • You can object to the transfer of data for advertising purposes at any time.

 

13.2 Conversion Tracking

  • Purpose: Conversion tracking is used to measure the effectiveness of our marketing campaigns, analyze which marketing measures lead to purchases, and optimize marketing expenditures.
  • Recorded events:
    • Page views
    • Product views
    • Shopping cart actions
    • Start of checkout
    • Entry of payment information
    • Completed purchases
  • Data processing:
    • The collected data is shared with Shopify and, if applicable, marketing partners.
    • Data may be transferred to other countries; Shopify ensures an adequate level of data protection.
    • Data is used exclusively for analysis and reporting.

 

13.3 Data Protection Controls and Customer Rights

  • You can manage your cookie consent at any time via the cookie banner.
  • Opt-out options for personalized advertising or data sharing are available.
  • Customer inquiries regarding data protection can be submitted via the Shopify Privacy Policy.
  • Security: Pixels run in a secure sandbox environment, and access to personal data is restricted.
  • All measures are carried out in compliance with Swiss data protection laws (revDSG).

 

14) Site Functionality / Technically Necessary Cookies

14.1 Purpose
We use technically necessary cookies and technologies to ensure the basic functions of our online shop kirose.ch. These cookies are essential for the operation of the website and do not require consent.

 

14.2 Essential Functions

Shopping cart and checkout:

  • Storing items in the shopping cart during your visit
  • Managing the checkout process
  • Processing payments
  • Storing shipping information

Session management:

  • Maintaining your session during your visit
  • Storing your language preferences
  • Managing your login information (if a customer account exists)

Security:

  • Protection against fraudulent activities
  • Secure data transmission
  • Authentication and access control

Shop functions:

  • Product search and filtering
  • Displaying product availability and stock
  • Order management and tracking
  • Features for customer accounts

 

14.3 Shopify-specific Cookies

  • Session cookies for shopping cart and checkout
  • Security cookies for fraud protection
  • Preference cookies for language settings
  • Technical cookies to ensure shop functionality

 

14.4 No Consent Required

  • These technically necessary cookies are indispensable for the operation of the website.
  • They cannot be deactivated.
  • They do not require consent under the revised Swiss Data Protection Act.
  • They are not tracked via the cookie banner.

 

14.5 Data Storage

  • Stored information: shopping cart contents, session IDs, language preferences, login status (for customer accounts)
  • Storage duration:
    • Session cookies: until the end of the browser session
    • Persistent cookies: according to technical necessity (e.g., shopping cart up to fourteen days)

 

14.6 Hosting and Processing

  • Your shop is hosted by Shopify.
  • Data processing occurs on the servers of Shopify.
  • Further information can be found in the Shopify Privacy Policy.

Note: These technically necessary cookies are distinct from marketing, analysis, and personalization cookies, which require user consent.

 

15) Tools and Miscellaneous

15.1 Shopify as Hosting Platform

  • Your online shop kirose.ch is hosted on the Shopify platform.
  • Shopify processes customer data on our behalf as a data processor.
  • Further information can be found in the Shopify Data Processing Addendum.

 

15.2 Installed Apps in Your Shop
The following apps are currently active in your shop and access certain customer data necessary for their functionality:

  • Swiss Post Labels: shipping labels and shipping processing
  • Shopify Email: email marketing
  • Shop App: customer order tracking and shopping experience
  • Point of Sale: in-store sales
  • Flow: shop process automation
  • Search & Discovery: product search and recommendations
  • Translate & Adapt: multilingual functionality

 

15.3 Shopify Subprocessors (Subcontractors)

Shopify-owned subprocessors:

  • Shopify Inc., Canada
  • Shopify International Limited, Ireland
  • Shopify Commerce Singapore Pte. Ltd., Singapore
  • Additional Shopify entities worldwide

Third-party subprocessors:

  • Amazon Web Services (AWS), United States of America – cloud hosting
  • Google Cloud, Canada – cloud hosting and data processing
  • Cloudflare, United States of America – load balancing and DDoS protection
  • Twilio, United States of America – email and SMS transmission
  • Mailgun, United States of America – email and SMS transmission
  • OpenAI, Anthropic, Microsoft, United States of America – AI services for Shopify Sidekick
  • Google LLC, United States of America – map functionality

 

15.4 International Data Transfer

  • Customer data may be transferred to various countries.
  • Data from Switzerland is initially processed by Shopify International Limited (Ireland).
  • Transfers to third countries (for example the United States or Canada) are carried out with adequate data protection guarantees, for example through standard contractual clauses and other safeguards.

 

15.5 Payment Processing

  • Depending on the chosen payment method, data is transferred to the corresponding payment service providers:
    • Credit card providers
    • Shopify Payments
    • Other supported payment gateways

 

15.6 Shipping Service Providers

  • Shipping information is transferred to Swiss Post and, if applicable, additional shipping partners.
  • This is necessary for the delivery of your orders and shipment tracking.

 

15.7 Security Measures
Shopify implements:

  • Encryption of data transmission
  • Firewalls and regular security audits
  • PCI-DSS compliance for payment data
  • Regular security checks

Further information: Shopify Security.

 

15.8 Updates of Subprocessors

  • You can sign up for notifications about new subprocessors: Subprocessor Notifications.
  • The complete and current list of all subprocessors can be found here: Shopify Subprocessors.

 

15.9 Legal Bases

  • Shopify Terms of Service
  • Shopify Data Processing Addendum
  • Shopify Privacy Policy

Note: In this privacy policy, we make it transparent that customer data is shared with these third parties to ensure shop functionality, payment processing, shipping, and other services.

16) Rights of the Data Subject

16.1 Information and Access Rights
According to Articles nineteen and following of the revised Swiss Data Protection Act, you have the right vis-à-vis kirose.ch to:

  • Obtain information about the personal data we process about you, the purposes of the processing, and the recipients;
  • Rectify incorrect or incomplete data;
  • Delete your data, provided this is legally permissible and no retention obligations exist;
  • Restrict the processing to the extent that the accuracy of the data is contested or the processing is unlawful;
  • Object to the processing of personal data based on legitimate interests;
  • Withdraw a given consent at any time with effect for the future;
  • Lodge a complaint with the competent supervisory authority (in Switzerland: the Federal Data Protection and Information Commissioner, FDPIC).

 

16.2 Right to Object

  • If we process your personal data on the basis of our legitimate interests, you can object to the processing at any time for reasons arising from your particular situation.
  • Upon receipt of your objection, we will stop processing your data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or if the processing serves the assertion, exercise, or defense of legal claims.
  • If your personal data is used for direct marketing, you can object at any time without providing reasons. Upon receipt of the objection, we will cease processing your data for marketing purposes.
  • The objection can be made in writing, by email to info@kirose.ch, or through the contact options provided on the shop.

 

17) Duration of Storage of Personal Data

The storage of personal data depends on the specific purpose of processing, the statutory retention obligations (for example commercial and tax law requirements), and our legitimate interest in processing.

  • Consent: Data processed on the basis of your explicit consent will be stored until you withdraw your consent.
  • Contract Fulfillment / Legal Transactions: Data that is necessary for the fulfillment of contracts or the initiation of contracts will be stored for as long as required to fulfill the contract. After the expiry of statutory retention periods (for example accounting documents, tax documentation), data will be routinely deleted unless there is a legitimate interest in further storage.
  • Legitimate Interest: Data processed based on our legitimate interest will be stored until you object to the processing, unless there are compelling, protected reasons for further processing or the data is needed to assert, exercise, or defend legal claims.
  • Direct Marketing: Data used for direct marketing purposes will be stored until you object to the use for marketing purposes.

Unless otherwise specified in this privacy policy, personal data is deleted as soon as it is no longer required for the purposes for which it was collected.

 

18) Third-party apps

Use of the App “Order Printer Pro”

We use the app Order Printer Pro by Shopcircle for the automatic creation and delivery of invoices, packing slips, and other order-related documents.

Processed Data:

  • Name and contact details (email address, phone number)

  • Billing and shipping address

  • Order information (ordered products, prices, order number)

  • Payment information (payment method; no sensitive payment data such as credit card details is stored)

Purpose of Processing:
The data is processed solely for the creation and delivery of invoices and other order-related documents that are necessary for the fulfillment of your order.

Legal Basis:
Processing is carried out to fulfill the contract in accordance with Art. 6(1)(b) GDPR.

Retention Period:
Data is only retained as long as necessary to fulfill contractual obligations or statutory retention requirements.

Data Sharing:
Data is shared with Shopcircle, the provider of Order Printer Pro. For more information on Shopcircle’s privacy practices, please see: https://shopcircle.co/pages/privacy-policy.