Privacy Policy
We, LuNiKy AG, located at Stampfenbachplatz 4, 8006, Zürich, operate the website luniky.ch and the associated online shop, providing products and services through this platform. Additionally, we operate a shop at Stampfenbachplatz 4, 8006, Zürich. Hereafter, we are referred to as the Controller for the collection, use, and processing of your data.
Below, we outline if and how we process your data:
Data Processing, Storage, and Deletion
We process only personal data that we collect directly through our website, related applications, external platforms, so-called "landing pages," or within the scope of business relationships with our customers and other business partners. Processing is conducted only if there is explicit consent or a legal basis, such as for contract execution, compliance with legal obligations, or our legitimate interests.
With your consent, we process your data only within the scope of this consent unless one of the following legal bases applies. Please note that you can withdraw your consent at any time; however, any processing carried out lawfully prior to withdrawal will not be affected.
The following legal bases apply:
- Consent of the data subject;
- Fulfillment of a contract with the data subject as a contracting party or necessary pre-contractual measures at the request of the data subject;
- Compliance with legal obligations of our company;
- Fulfillment of a task in the public interest;
- Legitimate interests of our company, provided the interests or fundamental rights of the data subject do not override.
We delete personal data as soon as the purpose of its collection is fulfilled and no further storage is necessary. However, certain cases may require us to store data longer due to legal obligations, particularly under Swiss or European regulations in areas such as contract and tax law, as well as commercial recordkeeping. For instance, business records, contracts, and accounting documents must be retained for 10 years. Personal data stored solely for legal reasons and no longer needed for service provision will be blocked and used only for accounting and tax purposes.
Transfer to Third Parties
In fulfilling contracts, the use of third-party services may be required, and data may need to be shared with external service providers for contractual performance. The legal basis for such data transfer is lawful processing as explained in the previous section. We ensure through contractual agreements that third parties involved in data processing comply with data protection regulations. In certain cases, we may be legally or judicially required to disclose data to governmental authorities or third parties.
Provision of Our Services and Creation of Log Files
When you access our website, our system automatically collects and stores information in log files. This information includes:
Browser type and version
Operating system
IP address
Internet service provider
Date and time
The above data cannot be directly attributed to a specific person and is not combined with other personal data. It remains within our system. The collection and storage of this data in log files are based on the legitimate interests of our company, particularly to ensure the functionality and security of our services and their optimization. Log files are automatically deleted at the end of each session.
Collection and storage of your data in log files are essential for the operation of our website; therefore, there is no option to object to this process.
Cookies, Tracking, Infrastructure and other Technologies
We use cookies and similar technologies on our website. Cookies are small text files stored by your browser that enable unique identification of your browser upon subsequent visits to our website. They save and transmit display settings and login information to make our website user-friendly and secure. The use of cookies is based on the legitimate interests of our company to optimize our website.
You have control over the use of cookies: by adjusting your browser settings, you can disable or restrict the transfer of cookies and delete cookies already stored at any time. However, please note that disabling cookies may limit the functionality of our services.
When you visit our website, you will be informed via a cookie banner, allowing you to consent to the use of cookies. This consent forms the legal basis for the deployment of cookies necessary for the full use of our services.
Tools, Applications and Other Technologies Used
We use Facebook plug-ins on our website, operated by Facebook Inc., USA. These plug-ins are identifiable by Facebook logos, the "Like" button, or the "Share" button. For an overview of Facebook plug-ins, please see: https://developers.facebook.com/docs/plugins.
When you visit our website, each plug-in establishes a direct connection between your browser and Facebook servers, allowing Facebook to receive information about your page visit along with your IP address, even if you are not logged into Facebook or do not have a Facebook account. This data is stored in the USA. If you are logged into Facebook during your visit to our website, Facebook can link your visit to your Facebook profile.
Facebook may use this data for purposes such as advertising, market research, or tailoring advertising. As the website operator, we have no influence over this data processing. To prevent this linkage, please log out of Facebook before visiting our site.
For further information on Facebook's privacy policy, please visit:
https://www.facebook.com/about/privacy.
Google Ads
We use Google Ads from Google for marketing purposes. In Europe, Google Ireland Limited, located at 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland, is responsible for Google Ads. Google Ads allows us to advertise our services on other websites.
Google Ads uses cookies stored on your computer, enabling an analysis of your use of our website. The data collected by the cookie (such as browser type, operating system, IP address, and referrer URL) is generally transmitted to and stored on a Google server, potentially in the USA.
The legal basis for data processing and transfer to the USA is the Standard Contractual Clauses, under which Google commits to adhering to applicable European laws and data protection standards, even when data is processed in third countries like the USA.
Please note that our use of Google Ads requires your consent, which is the legal basis. You can provide this consent via the cookie banner. Additionally, our company has a legitimate interest in using Google Ads.
Google Analytics
We use Google Analytics on our website, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses cookies stored on your computer, enabling an analysis of your use of our website. The data collected by the cookie (e.g., browser type, operating system, IP address, referrer URL) is generally transmitted to and stored on a Google server in the USA.
Google, on our behalf, uses the stored information to evaluate your use of our website, generate reports on website activity, and provide other services related to website and internet usage.
By changing your browser settings, you can disable or restrict the transfer of cookies. You can also delete stored cookies at any time via your browser settings, which can be done automatically. Please note that disabling cookies may prevent full use of all website features.
Please note that our use of Google Analytics requires your consent, which serves as the legal basis. You can provide this consent through the cookie banner. Our company also has a legitimate interest in using Google Analytics.
You can also prevent the collection of information generated by the cookie and related to your use of our website, as well as its processing by Google. Google offers a browser add-on to disable Google Analytics, which can be downloaded and installed here:
http://tools.google.com/dlpage/gaoptout?hl=en.
For more information about Google Analytics, please see the Google Analytics Terms of Service (https://marketingplatform.google.com/about/analytics/terms/en/), Google Analytics Help (https://support.google.com/analytics/answer/6004245?hl=en), and Google's Privacy Policy (https://policies.google.com).
Google Fonts
We use Google Fonts on our website. In Europe, Google Ireland Limited, 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland, is responsible for Google Fonts. Google Fonts enables us to use fonts without uploading them to our servers, improving the quality of our website (a so-called legitimate interest).
When you visit our website, the fonts are loaded from Google servers, and Google receives your IP address. Your data may be stored in the USA. The legal basis for data processing and transfer to the USA is the Standard Contractual Clauses, under which Google commits to adhere to applicable European data protection standards, even when data is processed in third countries like the USA.
For more information on Google Fonts, please refer to the Google Ads Data Processing Terms (applicable to Google Fonts): https://business.safety.google/adsprocessorterms/.
For more information, please refer to Google's Privacy Policy:
https://policies.google.com/privacy.
Google Tag Manager
We use Google Tag Manager, a marketing product from Google, on our website. In Europe, Google Ireland Limited, located at 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland, is responsible for Google Tag Manager. Google Tag Manager allows us to integrate, manage, and use code segments from tracking tools. The use of Google Tag Manager requires your consent, which is provided by consenting to individual tracking tools through the cookie banner.
Google Tag Manager does not use cookies. However, your data is captured by the individual tracking tools we manage through Google Tag Manager, and Google may process your data in the USA.
The legal basis for data processing and transfer to the USA is the Standard Contractual Clauses. Through these clauses, Google commits to comply with applicable European data protection laws, even when data is processed in third countries like the USA.
For more information on Google Tag Manager, please refer to the associated privacy policy (https://policies.google.com) and general information on Google Tag Manager: https://support.google.com/tagmanager.
Google Workspace
We use Google Workspace for our services, among other tools. In Europe, the responsible entity for Google Workspace is Google Ireland Limited, 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland.
The basis for data processing and data transfer to the USA is the so-called standard contractual clauses. These clauses oblige Google to comply with applicable European law and data protection standards. This also applies when data is processed in a third country, such as the USA.
For more information regarding Google Tag Manager, please refer to the corresponding privacy policy: https://policies.google.com.
Infomaniak Newsletter
We use the newsletter tool provided by Infomaniak Network AG, Rue Eugène Marziano 25, 1227 Les Acacias, Switzerland. Infomaniak assures that your data is stored exclusively in Switzerland and not transferred outside its own data centers.
Without your consent and the transmission of the information you provide to Infomaniak, we are generally unable to send you a newsletter. When you sign up for our newsletter, the data you provide (email address, optional: first name, last name, phone number) is received by Infomaniak. Infomaniak, therefore, acts as the recipient of your personal data and is our data processor.
The legal basis for processing your personal data is your consent. You may withdraw this consent at any time. Each newsletter contains a link for this purpose. Alternatively, you can inform us at any time through the contact methods mentioned at the beginning of this policy. Please note that the processing of your personal data up to the point of withdrawal is unaffected. Your data will be processed as long as your consent is in place and will be deleted if we terminate our contractual relationship with Infomaniak, provided no legal retention obligations apply.
For information on the purpose and scope of data collection, further processing, use by Infomaniak, and your rights and settings options, please refer to Infomaniak's privacy policy:
https://www.infomaniak.com/en/legal/confidentiality-policy.
We use social plug-ins from Instagram, provided by Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA, on our website. The plug-ins are identified by the Instagram logo or the "camera" icon on our site. When you visit our website, each plug-in creates a connection from your browser to the Instagram server. Regardless of whether you are logged into Instagram or have an account, Instagram receives information that you have visited our website with your IP address. This information is stored on the Instagram server in the USA. If you are logged into Instagram while visiting our site, Instagram can link your visit to your profile.
If you do not want Instagram to associate the data collected on our website with your account, please log out of Instagram before visiting our website. Loading Instagram plug-ins can also be completely prevented by using a browser add-on.
For information on the purpose and scope of data collection, further processing, use by Instagram, and your rights and settings options, please refer to Instagram's privacy policy:
https://help.instagram.com/155833707900388.
kMeet
We use kMeet by Infomaniak Network AG, Rue Eugène Marziano 25, 1227 Les Acacias, for video conferencing on our website. kMeet (Infomaniak Network AG) assures that your data is stored exclusively in Switzerland and not transferred outside its own data centers. kMeet is a video conferencing tool we use to communicate with you.
The legal basis for using kMeet is your consent as the data subject. kMeet receives the data you provide us (name, email address, and/or phone number). Additionally, kMeet may collect other data from you, such as your IP address.
For more information on kMeet, please refer to Infomaniak's privacy policy:
https://www.infomaniak.com/en/legal/confidentiality-policy.
Kontaktformular
Our website has contact forms allowing you to get in touch with us. The information you provide, such as your first and last name, phone number, email address, subject, and message, will be transmitted to and stored by us.
The information you send is used solely to respond to your inquiry or message. By submitting your inquiry or message, you consent to the described data processing (legal basis: consent). You may withdraw your consent at any time; however, prior processing is unaffected by the withdrawal.
Links (Third Parties)
If we provide links to websites of other organizations, their respective privacy policies apply.
Microsoft Azure
We use Microsoft Azure for our services, provided by Microsoft Corp., Microsoft Way 1, 98052-6399 Redmond, WA. Among other things, we use it for web hosting services. Microsoft Azure may also process data in the USA.
The basis for data processing and data transfer to the USA is the so-called standard contractual clauses. These clauses oblige Microsoft Azure to comply with applicable European law and data protection standards.
For more information about the standard contractual clauses and/or the data processed by Microsoft Azure, please visit:
https://learn.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses;
https://www.microsoft.com/de-de/privacy/privacystatement.
TikTok
We use so-called social plug-ins from TikTok on our website, provided by the Chinese company TikTok with its European headquarters at TikTok Technology Limited, 2 Cardiff Lane, Grand Canal Dock, Dublin 2, D02 E395, Ireland. You can recognize these plug-ins by the TikTok logo.
As soon as you visit our website, the respective plug-in establishes a connection between your browser and TikTok's server. Regardless of whether you are logged in or even have an account, TikTok receives the information that you visited our website with your IP address. This information may be stored on servers outside of Europe (e.g., in the USA or China). If you are logged into TikTok while visiting our website, TikTok can associate your visit with your profile.
For more information about the standard contractual clauses and/or the data processed by TikTok, please visit:
https://ads.tiktok.com/i18n/official/policy/controller-to-controller
https://www.tiktok.com/legal/page/eea/privacy-policy/en.
We use the instant messaging service WhatsApp, provided by WhatsApp Inc. In Europe, WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, D02 KH28, Ireland, is responsible for WhatsApp. WhatsApp Inc. is a U.S. company and a subsidiary of Meta Platforms Inc.
Please note that WhatsApp may process your data in the USA. The legal basis for using WhatsApp is the consent of the data subject.
The basis for data processing and data transfer to the USA is the Standard Contractual Clauses, under which WhatsApp commits to comply with applicable European data protection standards, even when data is processed in third countries.
For further information on data transfer (under the Standard Contractual Clauses), please refer to: https://www.whatsapp.com/legal/business-data-transfer-addendum-20210927. Further information is also available at: https://www.whatsapp.com/privacy.
Applications
We process the dossiers and personal data you send us as part of the application process. We use this information to assess suitability for potential employment. We may involve third parties in the job posting and/or application process. We process in particular (but not limited to) your CV, any references you provide, publicly available profiles on social media, and other documents provided by you. If you are hired, your documents will be stored for the duration of employment; if your application is unsuccessful, your personal data will be deleted after six months.
Payments
In our online shop, on our website, and in our store, you may make cashless payments. For this purpose, we use various providers. The terms and conditions and privacy policies of the respective providers apply. Below is a list of our service providers along with links to their privacy policies:
Worldline: We use Worldline for processing online payments. More information is available at: https://worldline.com/en/compliancy/privacy.
SumUp: We use SumUp for processing card payments in our store. More information is available at: https://www.sumup.com/en-us/privacy.
TWINT: We use TWINT for processing both online and in-store payments. More information is available at: https://www.twint.ch/en/data-privacy.
Video Surveillance
Please note that specific areas of our premises are equipped with a video surveillance system. Monitored areas are marked with clearly visible signs. Audio recordings are not made.
The video surveillance system is used based on our legitimate interests, particularly to protect buildings, individuals, and assets, to prevent criminal acts, to gather evidence in case of criminal acts, and to exercise our property rights. The recordings are not used for marketing purposes or to monitor employee performance (exception: in cases of unlawful or fraudulent behavior). When necessary, we take measures to minimize the processing of personal data and potential risks to the data subjects.
Processing of recordings is exclusively conducted by our security personnel and/or law enforcement authorities should one of the aforementioned cases arise. Recordings are not shared with third parties or processed further. The recordings are stored only temporarily and deleted after a storage period of 30 days. Storage occurs exclusively in Switzerland.
We may engage external service providers to operate the surveillance system. These providers are carefully selected, instructed, and contractually obligated to comply with data protection regulations.
In any case, you have the same rights regarding video surveillance, recordings, and related processing as with other personal data processing (see the remaining provisions of this privacy policy).
Right of Access
As a data subject, you have the right to request confirmation from us regarding whether we are processing personal data concerning you. If this is the case, you have the right to access the following information:
The purposes for which the personal data is processed;
The categories of personal data that are processed;
The recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly in the case of recipients in third countries or international organizations;
The planned duration of the storage of your personal data or, if this is not possible, the criteria used to determine this duration;
The existence of a right to correction or deletion of your personal data or to restrict processing by us or to object to such processing;
The existence of a right to lodge a complaint with a supervisory authority;
All available information regarding the origin of personal data not collected from you;
The existence of automated decision-making, including profiling, and meaningful information about the logic involved as well as the scope and intended effects of such processing for you.
Furthermore, you have the right to know whether your personal data has been transferred to a third country or an international organization; in such cases, you have the right to be informed about the appropriate safeguards in connection with the transfer.
Right to Rectification and Deletion
You have the right to request the immediate rectification and/or completion of inaccurate and/or incomplete personal data concerning you.
You also have the right to request the immediate deletion of your personal data if one of the following reasons applies:
The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
You withdraw your consent, and there is no other legal basis for processing;
You object to the processing for reasons arising from your particular situation, and there are no overriding legitimate reasons for processing, or you object to processing for the purpose of direct marketing;
Your personal data was unlawfully processed;
Deletion of your personal data is necessary to fulfill a legal obligation;
Your personal data was collected in connection with the services offered by the information society in accordance with Article 8(1) GDPR.
Right to Restriction of Processing
As a data subject, you have the right to request the restriction of processing if one of the following conditions is met:
The accuracy of the personal data is contested. The restriction may be requested for the duration required to verify the accuracy of the personal data;
The processing is unlawful, and you request restriction instead of deletion;
We no longer need the personal data for processing, but you need it for the assertion, exercise, or defense of legal claims;
You object to the processing.
If the processing of your personal data is restricted, we may only process the data – aside from storage – with your consent or for the assertion, exercise, or defense of legal claims or to protect the rights of another natural or legal person or for reasons of public interest.
If you have obtained a restriction of processing according to the above conditions, we will inform you before lifting this restriction.
Notification Obligation to Third Parties
If we have made your personal data public and are legally required to delete it, we will take appropriate measures – including technical ones – to inform other data controllers and processors who process this data that you have requested the deletion of all links to this personal data or copies or replications of this data, taking into account available technology and implementation costs.
We inform all recipients to whom your personal data has been disclosed about any rectification or deletion of this data or any restriction on processing, except where this proves impossible or would involve a disproportionate effort. In such cases, we will strive to communicate the reasons for non-disclosure clearly and ensure that your rights are nonetheless protected.
Exceptions to the Right of Deletion
The right to deletion does not apply where processing is necessary to exercise the right to freedom of expression and information and/or to establish, exercise, and/or defend legal claims.
Right to Data Portability
As a data subject, you have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another data controller without hindrance from us, provided that processing is based on consent or a contract and that processing is carried out by automated means.
You also have the right to have your personal data transmitted directly from us to another data controller, where technically feasible. The rights and freedoms of others must not be adversely affected by this.
Widerspruchsrecht
As a data subject, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is based on Article 6(1)(e) or (f) GDPR. We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms. An additional exception exists where processing is necessary for the establishment, exercise, or defense of legal claims.
If we process your personal data for direct marketing purposes, you have the right to object to the processing at any time. If you object to processing for this purpose, we will no longer use your personal data for this purpose.
You have the right to withdraw your consent at any time. The lawfulness of processing prior to withdrawal remains unaffected by the withdrawal.
Right to Lodge a Complaint with a Supervisory Authority
You have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, particularly in your place of residence (EU/CH), place of work, or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR or the Federal Act on Data Protection (FADP).
The authority responsible for Switzerland is: Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern.
The supervisory authority with which the complaint was lodged will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy.
LuNiKy AG, November 2024