Effective July 2026
1 Data Controller
The entity responsible for the processing of personal data in connection with this website and the online store is:
Viocap AG
Bahnhofstrasse 21 B
CH-4106 Therwil
Switzerland
Email: [email protected]
EU Representative pursuant to Art. 27 of the GDPR: Viocap UG, Weinbergweg 70, 66119 Saarbrücken, [email protected]
2 Scope and Legal Basis
This Privacy Policy explains what personal data we process when you visit our website, place orders, create customer accounts, submit contact requests, subscribe to newsletters, and engage in other interactions; the purposes for which this is done; and the rights of data subjects.
We process data in accordance with the Swiss Federal Act on Data Protection. To the extent that the European Union’s General Data Protection Regulation or UK data protection law applies, we base our processing—depending on the specific process—in particular on the performance of a contract or pre-contractual measures, compliance with legal obligations, legitimate interests, or consent. The applicable legal basis is described for each individual process.
3 Categories of Personal Data
Depending on your use of our services, we may process the following data in particular:
Master data such as name, billing and shipping addresses, company, and customer number
Contact information such as email address and phone number
Contract and order data such as products, prices, discounts, order status, returns, and communication
Payment information and transaction references; we generally do not receive full card details ourselves when an external payment service is used
Shipping and customs data, including tracking number, delivery status, and required import information
Account data such as login, password hash, wish lists, and settings
Communication data from emails, forms, phone calls, reviews, or complaints
Technical data such as IP address, device and browser information, timestamps, log data, and cookie identifiers
Usage and preference data, to the extent that analytics or personalized advertising is enabled and permitted
Evidence of consent and privacy preferences
We ask that you do not submit any health data, diagnoses, photos of skin conditions, or other particularly sensitive data via general contact forms. If such data is required for a specific consultation service offered, a separate, legally reviewed process with its own information notice and appropriate safeguards must be used.
4 Website Provision and Hosting
When you visit the website, our hosting provider processes technically necessary data, specifically your IP address, date and time, pages visited, referrer URL, browser, operating system, and status information. This is done to ensure secure and stable website operation, to analyze errors, and to prevent misuse.
Hosting provider: [Name, full address, country, link to privacy policy]. Server locations: [Countries].
Legal basis for the EU, EEA, and UK: legitimate interest in secure and functional operation, unless consent is required. Retention period for server logs: [specific duration], unless longer retention is necessary to investigate a security incident or due to legal obligations.
5 Online Store and Order Processing
We process master data, contact information, order details, payment information, and communication data to accept orders, process payments, deliver goods, handle returns and warranty claims, and provide customer service.
Shop system: WooCommerce, operated within our WordPress installation. Key shop extensions used that have access to personal data: [list plugins and providers].
Legal basis for the EU, EEA, and UK: Performance of a contract and pre-contractual measures. Further processing is carried out to fulfill legal obligations regarding accounting, taxes, customs, product safety, and record-keeping. A purchase contract cannot be executed without the necessary order data.
6 Customer Account
If a voluntary customer account is offered, we process the provided account and order data to manage the account and to facilitate the processing of future orders at . The legal basis is the performance of a contract or the provision of the desired account functionality. An order can also be placed without a permanent customer account.
Customers may request the deletion of their account at [email protected]. Order documents subject to statutory retention requirements remain locked or stored separately until the respective retention period expires.
7 Payment Service Providers
To process payments, we transmit the necessary data to the payment service provider selected by the customer. This provider may process data under its own responsibility. The provider’s privacy policy applies in addition to this policy.
Include only providers that are actually offered and fill in the information completely:
[Credit Card Acquirer or PSP: Name, Address, Country, Purpose, Privacy Policy Link]
[PayPal: specific company, address, country, privacy policy link]
[Legal basis for the EU, EEA, and UK: performance of a contract; for separate fraud or credit checks, depending on the specific arrangement, legal obligation, legitimate interest, or consent. Automated decisions with legal or similarly significant effects must be explained separately under Section 17, if they occur.
8 Shipping, Logistics, Customs, and Fulfillment
For delivery, shipment tracking, returns, export, and, if applicable, customs clearance, we share the necessary data with shipping, logistics, fulfillment, and customs partners. This may include, in particular, name, shipping address, contact information, order details, value of goods, country of origin, and tracking number.
Recipients: Swiss Post / DHL
9 Contact and Customer Service
When you contact us via email, phone, form, or chat, we process your information to handle your inquiry, associate it with an order, and document the communication. Depending on the context, the legal basis is either pre-contractual measures, performance of a contract, a legitimate interest in providing efficient customer service, or your consent.
10 Newsletters and Marketing Emails
If you subscribe to our newsletter, we process your email address and, if applicable, your name, language, interests, subscription date, proof of consent, and technical delivery or interaction data.
Shipping provider: [Name, Address, Country, Privacy Policy link]. Tracking of opens and clicks: [yes / no]. If yes, purpose, legal basis, and option to opt out: [fill in].
You may revoke your consent at any time with future effect by using the unsubscribe link or by sending a message to [email]. The lawfulness of the processing up until the time of revocation remains unaffected. A minimal record of the revocation may be retained to ensure that no further messages are sent.
Advertising to existing customers without separate consent is permitted only to the extent that the applicable regulations allow it and a simple opt-out option is available. [Review legal requirements for each target market.]
11 Cookies and Similar Technologies
Our website uses cookies and similar technologies such as local storage, pixels, or tags. Technically necessary technologies are used in particular for the shopping cart, login, security, language selection, and saving privacy preferences. Optional analytics, convenience, and marketing technologies are activated in the relevant markets only in accordance with the applicable consent rules.
Consent Management Platform: Usercentrics, Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany
The current cookie list, including provider, purpose, category, duration, and recipient, can be accessed by clicking the Cookiebot icon. There, you can change or revoke your selection at any time. Opting out must be just as easy as giving consent, to the extent required by law.
This privacy policy template does not replace a technically correct consent configuration. Scripts, tags, and external media requiring consent must not be loaded before consent is given.
12 Web Analytics
12.1 Google Analytics 4 Optional Module
We use Google Analytics 4. Depending on the configuration, the service processes, in particular, online identifiers, IP and device information, usage events, approximate location data, and information about visits and conversions. The purpose is to measure reach and improve our offering.
Google Analytics is activated in the relevant markets only after consent is given. Legal basis for the EU, EEA, and UK: consent. Consent may be revoked at any time via cookie settings. Retention period for event and user data: 12 months. Google Signals, User ID, advertising features, and data sharing: 12 months.
13 Online Advertising and Social Networks
With consent, marketing tags may be used to measure campaigns, create target audiences, or personalize advertising. In doing so, providers may link data from the store to existing user accounts.
Meta Pixel or Conversions API: [Meta company, address, data types, joint responsibility where applicable, purpose, retention period, privacy policy link]
Google Ads and Conversion Tracking: [Google company, data types, purpose, retention period, privacy policy link]
Pinterest, TikTok, LinkedIn, or others: [complete as needed]
Legal basis for the EU, EEA, and UK: Consent. Withdrawal via [Cookie Settings Link]. Whether and to what extent joint controllership applies must be assessed for each service and each specific feature and made transparent.
14 Embedded Content, Fonts, and Maps
External videos, maps, social media content, review widgets, chats, or fonts may transmit data to third parties when loaded. In the relevant markets, such content is [loaded only after consent is given / provided locally].
Services used: [YouTube / Google Maps / Instagram / Trustpilot / Chat / CDN / Web Fonts / ????
15 Recipients and Processors
We only disclose personal data if this is necessary for the purposes described, required by law, permitted to safeguard legitimate interests, or covered by consent. Recipients may include, in particular, hosting and IT service providers, payment providers, logistics partners, consultants, government agencies, and platform providers.
To the extent that service providers process data on our behalf, we enter into the necessary agreements and select them based on appropriate data protection and security criteria. Some recipients process data for their own purposes and provide information about this in their own privacy policies.
16 Transfers Abroad
Data may be processed in Switzerland, the EEA, the United Kingdom, or other countries. When transferring data to countries without a recognized adequate level of data protection, we use appropriate safeguards—such as recognized standard contractual clauses—where necessary and evaluate additional protective measures. In exceptional cases provided for by law, a transfer may take place, for example, to fulfill a contract, based on explicit consent, or to assert legal claims.
17 Profiling and Automated Decisions
In connection with the online store, we do not make any decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you.
18 Retention Period
We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention, documentation, or statute of limitations periods. Afterward, data is deleted or anonymized, unless further processing is permitted.
Specify specific time limits prior to publication:
Order, accounting, and tax records: [Retention period under Swiss law and, where applicable, local law]
Customer account: until deletion
Customer service and complaints: [retention period]
Server logs: until deletion
Proof of consent: until deletion
Newsletter data: until revoked, plus proof of deactivation
Analytics and marketing data: until deletion
Abandoned shopping carts: until deletion
19 Data Security
We take appropriate technical and organizational measures to protect personal data from unauthorized access, loss, alteration, or disclosure. Depending on the risk, these measures include, in particular, encrypted transmission, role- and permission-based access controls, system updates, data backups, logging, service provider audits, and procedures for security incidents. Absolute protection cannot be guaranteed.
20 Rights of Data Subjects
In accordance with applicable law, you may, in particular, request access to, rectification of, erasure of, restriction or blocking of, disclosure of, or transfer of certain data, as well as object to certain processing activities. Consent that has been given may be withdrawn at any time with future effect.
In cases of processing based on legitimate interests, individuals within the scope of the GDPR or the UK GDPR may object on grounds relating to their particular situation. You may object to direct marketing at any time.
Please direct inquiries to [email protected]. We may request information to verify your identity. Rights may be subject to legal restrictions, such as retention obligations or the overriding rights of third parties.
21 Right to File a Complaint
You may contact a competent data protection supervisory authority. In Switzerland, this is generally the Federal Data Protection and Information Commissioner, to the extent that it has jurisdiction. For individuals in the EU or the EEA, the supervisory authority of their place of residence or work may be competent. In the United Kingdom, this is generally the Information Commissioner’s Office.
22 children
Our general online store is not specifically targeted at children. We do not knowingly collect personal data from children for services requiring consent without the consent required under applicable law.
23 Changes to This Privacy Policy
We may update this Privacy Policy if there are changes to data processing practices, service providers, or legal requirements. The current version published on the website applies. Significant changes will be communicated in an appropriate manner, as necessary.
