Privacy Policy

General information

The controller for the data processing on this website is:

Collection and processing of personal data

Personal data are collected when you visit our website, contact us, create a customer account, sign in with Google or place an order.

The data processed include in particular:

• Surname and first name
• Address
• E-mail address
• Identification number of your Google account, if you sign in with Google (see “Sign-in with Google”)
• Telephone number
• Payment and order data
• IP address and technical access data

Purpose of the data processing

The processing of your personal data takes place for the following purposes:

• Handling of orders
• Dispatch of goods
• Customer service and communication
• Fulfilment of statutory obligations
• Improvement of our online offering

Cookies

Our website uses cookies and comparable technologies such as local storage in the browser. Cookies are small text files that are stored on your device.

We use technically necessary cookies and storage so that the website and the ordering process work: the identifier of your shopping cart, stored locally in your browser, a cookie for your chosen language and your choice regarding statistics cookies. When you sign in to your customer account, the following cookies are added:

• Session cookie (“__Host-vs_konto”): keeps you signed in. It contains a signed session identifier, cannot be read by programs on the page and is valid for no longer than the session (usually 24 hours, renewed when you use your account); it is deleted when you sign out.
• Sign-in time (“__Host-vs_anmeldung”): records that you have just signed in. This ensures that only you – and not someone at a device left unattended – can link a Google account to your customer account. Storage period 10 minutes; it is deleted when you sign out.
• Google sign-in process (“__Host-vs_oauth_google”): is only set if you choose “Continue with Google”. It connects the return from Google to your browser and thus protects against forged sign-ins. Storage period 10 minutes; it is deleted once the sign-in is complete.

These cookies are technically necessary, are only set on our own domain and are not passed on to third parties.

We only use statistics cookies (Google Analytics 4) if you expressly consent to them in the cookie notice. If you decline, Google Analytics is not loaded. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of every page; the withdrawal applies to the future. We do not use marketing cookies.

The Trusted Shops Trustbadge is loaded by Trusted Shops and may store its own data in your browser (see “Trusted Shops Trustbadge”).

Web analytics (Google Analytics 4)

With your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics shows us how our website is used – for example which pages are visited and which products are viewed, added to the cart or bought – so that we can improve our offering.

Without your consent, Google Analytics is not loaded and no data is transmitted to Google. With your consent, Google Analytics sets cookies and receives information about your device and browser, the pages visited, the time of the visit and your approximate location. After a paid order, we additionally report the purchase (order number, amount and products) directly from our server to Google Analytics – again only if you have given your consent.

A transfer of data to the United States cannot be ruled out.

The legal basis is your consent. You can withdraw it at any time via the “Cookie settings” link in the footer.

Further information can be found in Google’s privacy policy at https://policies.google.com/privacy.

Trusted Shops Trustbadge

Our website includes the Trustbadge of Trusted Shops SE, Subbelrather Strasse 15c, 50823 Cologne, Germany. The Trustbadge displays our Trusted Shops trust mark and, where available, the reviews of our shop submitted to Trusted Shops.

So that the Trustbadge can be displayed, your browser loads a program (script) and images from the server widgets.trustedshops.com when you visit the pages of our shop. For technical reasons, your browser transmits your IP address to Trusted Shops, along with information such as the time of access, the page visited (referrer), the browser type, the operating system and the language setting. Trusted Shops may also store information in cookies or in your browser’s local storage.

The Trustbadge is only loaded once the page has been fully built, and regardless of your choice in the cookie notice.

Our shop does not transmit any order data to Trusted Shops. If, after an order, you submit a review to Trusted Shops or use services of Trusted Shops such as buyer protection, you provide your data directly to Trusted Shops; Trusted Shops’ privacy policy then applies.

The legal basis is our legitimate interest in making our trust mark and our reviews visible. Where the GDPR applies, we rely on Art. 6(1)(f) GDPR.

Further information, for example on cookies, on how long the access data are stored and on any transfer to other countries, can be found in Trusted Shops’ privacy policy at https://www.trustedshops.de/impressum-datenschutz/.

Contact form

When you write to us via the contact form, you send us your name, your email address and your message. These details are not stored in a database but sent as an email to our mailbox.

Your address is placed in the reply-to field so that we can answer you. The message then sits in our mailbox at Microsoft 365 (see “Hosting”) like any other email.

We keep enquiries for as long as is necessary to deal with them and delete them afterwards, unless a statutory retention obligation applies. The legal basis is our legitimate interest in answering your enquiry, or the initiation of a contract.

Sign-in with Google

Instead of using your email address and password, you can also sign in to our shop with your Google account (“Continue with Google”). For users in Switzerland and the European Economic Area, the provider of this sign-in service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Its use is voluntary; you can create and use a customer account without Google at any time, and no customer account is needed to place an order.

If you choose “Continue with Google”, you are redirected to a Google sign-in page. There you sign in to Google and confirm which information is transmitted to us. We never learn your Google password. We only request the basic information of your profile from Google (permissions “openid”, “email” and “profile”) and receive:

• your email address and Google’s confirmation that this address is verified (signing in is not possible without a verified address),
• your name (first name and surname, as stored in your Google account),
• a unique identification number of your Google account assigned by Google, which we use to recognise you the next time you sign in.

We do not request your profile picture, your contacts or any other content of your Google account. We do not obtain permanent access to your Google account.

We use this information to sign you in, to create a customer account with your email address and name the first time, and to link your Google account to this customer account. We store this information together with your customer account on our server in Switzerland (see “Hosting”); your name and email address from Google are updated each time you sign in with Google.

If a customer account already exists under your email address, we do not link Google to it automatically – not even if Google has verified the address. In this case, sign in as usual and then link Google yourself in your customer account under “Sign-in methods”. For this, we require that you have signed in shortly beforehand.

Under “Sign-in methods” in your customer account, you can unlink Google at any time, provided that a password is set for your customer account so that you can continue to sign in. When you unlink, we delete the stored Google identification number and the profile information transmitted by Google; your customer account with your orders remains. You can ask us to delete your entire customer account (see “Your rights”). You can also remove the connection to our shop in your Google account settings (section “Third-party apps and services”).

During sign-in, we set technically necessary cookies that serve only the sign-in process and the security of your account (see “Cookies”).

Legal basis: we process the information in order to provide the access to your customer account that you have requested (contract or pre-contractual measure). Where the General Data Protection Regulation (GDPR) applies, we rely on Art. 6(1)(b) GDPR and, for securing the sign-in process, on our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Google itself is responsible for the processing of your data by Google, for example when you sign in to Google. A transfer to the United States cannot be ruled out in this context. Further information can be found in Google’s privacy policy at https://policies.google.com/privacy.

We do not offer sign-in via Apple or other providers.

Newsletter

If you sign up for our newsletter, we use your email address to send you information about our products and offers.

We use the MailerLite service for sending. The provider for customers in Switzerland is MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland. Your email address is stored and processed there. Alongside the address, technical details about the dispatch are recorded, such as the time of sign-up.

Your sign-up is first stored at MailerLite as unconfirmed. Only once you confirm it is the address enabled for newsletter delivery; without confirmation it receives no newsletter.

That does not rule out someone entering another person’s address into the form. Such an entry stays unconfirmed, and the request to confirm goes to the holder of the address – not to whoever filled in the form. Anyone receiving such a message without having asked for it can ignore it; without confirmation nothing further happens.

You can unsubscribe from the newsletter at any time. The unsubscribe link at the end of every message is enough, or a short note to us. After unsubscribing you will receive no further messages; your address does, however, remain stored at MailerLite as unsubscribed, because that is the only way the unsubscription can be honoured permanently. You can ask us for complete deletion.

Signing up for the newsletter is voluntary and is not required in order to place an order.

Payment

To pay by TWINT, card or PostFinance, you are redirected from the ordering process to the secure payment page of PostFinance Checkout. The provider is PostFinance Ltd, Mingerstrasse 20, 3030 Bern, Switzerland. You enter your card or account details there; we do not receive or store them. PostFinance tells us whether and with which payment method the order was paid.

If you choose payment in advance, you transfer the amount to our bank account; we then receive the details your bank transmits with the payment, such as your name and account number.

Disclosure of data to third parties

Your personal data are only disclosed where this is necessary for the performance of the contract or where a statutory obligation exists.

Third parties may in particular be:

• PostFinance Ltd, Switzerland (payment processing, see “Payment”)
• Swiss Post, Switzerland (delivery of your order; for the shipping label we transmit your name and delivery address)
• DHL (delivery of orders to Germany or the EU; your name and delivery address appear on the shipping form)
• Infomaniak Network SA, Switzerland (server and image storage, see “Hosting”)
• MailerLite Limited, Ireland (newsletter, see “Newsletter”)
• Google Ireland Limited, Ireland (web analytics, only with your consent, see “Web analytics”; sign-in with Google, only if you use it, see “Sign-in with Google”)
• Trusted Shops SE, Germany (trust mark and reviews; when you visit our pages, your IP address and technical access data, see “Trusted Shops Trustbadge”)
• Microsoft Ireland Operations Limited, Ireland (sending of emails and mailbox via Microsoft 365, see “Hosting”)

Hosting

We operate the website and the shop ourselves. The shop runs on the shop software Medusa; we manage the website content such as pages, blog and legal texts with the software Payload. Both programs run on our own virtual server (VPS) of Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland. Product data, shopping carts, customer accounts and orders are therefore stored on servers in Switzerland.

The website’s images are stored in the Infomaniak Swiss Object Storage service, also in Switzerland.

Emails from the shop, such as the order confirmation, are sent via our mailbox at Microsoft 365 (Microsoft Ireland Operations Limited, Ireland). The emails you send us are also stored there. A transfer to the United States cannot be ruled out.

Your rights

Within the scope of the applicable data protection law you have in particular the right to:

• Information as to whether and which personal data we process about you
• Rectification of incorrect or incomplete data
• Erasure of your data, insofar as no statutory retention obligations conflict with this
• Restriction of the processing as well as objection to the processing
• Release or transfer of your data in a common electronic format
• Withdrawal of a consent you have given, with effect for the future

In order to assert your rights, please contact us by e-mail at info@vaporspirit.ch or in writing at the address stated above.

You also have the right to lodge a complaint with the competent data protection supervisory authority – in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC).

Data security

We use technical and organisational security measures in order to protect your data against unauthorised access, loss or manipulation.

Changes

We reserve the right to change this privacy policy at any time in order to adapt it to current legal requirements.