TEMPLATE — requires review by a Swiss-qualified lawyer before publication. This document is a working draft prepared for MINON NAN. It is not legal advice. Values in [square brackets] are placeholders that must be completed and verified before the document is published or relied upon. The list of processors and transfer mechanisms must be checked against the contracts actually concluded.
1. Who we are
The controller responsible for the processing of personal data described in this policy is:
[MINON NAN legal entity name, legal form]
[Street and number], [postcode] Zug, Switzerland
Email: [privacy@minonnan.com]
EU representative (art. 27 GDPR): [name and address of the EU representative, or a statement why none is required — to be determined by counsel].
Data protection advisor (optional under the nFADP): [name / contact, if appointed].
This policy covers minonnan.com and its sub-domains (iapresales.minonnan.com, partners.minonnan.com, admin.minonnan.com, api.minonnan.com), the alias domain raminona.com, the MINON NAN mobile app, and our emails.
2. Legal framework
We process personal data in accordance with the Swiss Federal Act on Data Protection of 25 September 2020 ("nFADP") and its ordinance, and — where applicable because we offer goods to people in the EU/EEA or monitor their behaviour — the EU General Data Protection Regulation ("GDPR"). Where this policy refers to a "legal basis", this is required under the GDPR; under the nFADP processing is lawful provided it complies with the processing principles.
3. What data we process, why, and on which legal basis
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Customer account | Name, email, password hash, language, addresses | Contract (art. 6(1)(b)) | Until account deletion, then [30] days |
| Orders and pre-orders | Order contents, prices, addresses, phone, payment status, communication | Contract (art. 6(1)(b)); legal obligation (art. 6(1)(c)) | 10 years (Swiss accounting law, art. 958f CO) |
| Payments | Payment reference, method, status; card data are processed only by the payment provider | Contract (art. 6(1)(b)) | 10 years |
| Delivery | Name, address, phone, email, parcel data shared with carriers and dropship partners | Contract (art. 6(1)(b)) | As for orders |
| Transactional emails | Email address, order data, language, delivery log | Contract (art. 6(1)(b)) | Delivery log [24] months |
| Newsletter (optional) | Email, language, consent proof, opens/clicks [if enabled] | Consent (art. 6(1)(a)) | Until withdrawal |
| Customer service and CRM | Contact data, enquiries, interaction history, lead source | Contract; legitimate interest (art. 6(1)(f)) in managing customer relations | [36] months after last contact |
| AI concierge | Chat messages, product context, technical session id | Legitimate interest in providing advice (art. 6(1)(f)); contract where it relates to an order | Conversation logs [90] days |
| Affiliate programmes | Partner identity, contact, tax data, IBAN (encrypted), clicks, attributed orders, commissions | Contract (art. 6(1)(b)); legal obligation | 10 years for payout records |
| Referral attribution | Pseudonymous click id, programme, timestamp, order reference | Legitimate interest in paying commissions correctly (art. 6(1)(f)) | Click data [30–90] days; order attribution as for orders |
| Security and fraud prevention | IP address (hashed where possible), device and log data, login events | Legitimate interest (art. 6(1)(f)) | [90] days |
| Analytics (cookieless) | Aggregated, pseudonymised usage data without cookies | Legitimate interest (art. 6(1)(f)) | [13] months |
| Analytics, A/B tests and marketing (optional) | Cookies / identifiers, page views, events, experiment variants | Consent (art. 6(1)(a)) | See Cookie Policy |
| Demand forecasting | Aggregated sales and pre-order quantities (no personal profiles) | Legitimate interest (art. 6(1)(f)) | — |
We do not make decisions based exclusively on automated processing that produce legal effects for you or similarly significantly affect you. Product recommendations and AI concierge answers are suggestions only.
4. Sources of data
We collect data directly from you (account, orders, forms, chat, partner applications), from your device (technical and — with consent — analytics data), from payment providers (payment status), from carriers (delivery status), and from affiliates (the fact that you followed a referral link).
5. AI concierge
Our concierge chat uses a large language model provided by Anthropic (see section 6). Your messages and relevant catalogue data are sent to Anthropic to generate an answer. Please do not enter sensitive personal data (for example health information) in the chat. According to our contract, Anthropic acts as our processor and does not use the data submitted through its commercial API to train its models [to be verified against the current commercial terms]. Answers are generated automatically and may be inaccurate; binding information is that shown at checkout.
6. Recipients and processors
We share personal data only to the extent necessary with the following categories of recipients:
| Recipient | Purpose | Location / transfer mechanism |
|---|---|---|
| DigitalOcean, LLC | Hosting, databases, object storage (Spaces), backups | [Data centre region, e.g. Frankfurt (EU)]; US company: Data Processing Agreement and EU SCCs / Swiss-US Data Privacy Framework [verify] |
| Mollie B.V. | Payment processing (cards, TWINT, Apple Pay, PayPal, Alipay, etc.) | Netherlands (EU) — adequate country; Mollie also acts as an independent controller for regulatory obligations |
| Stripe Payments Europe Ltd. | Alternative payment processing, fraud prevention (incl. Link) | Ireland (EU); transfers to Stripe, Inc. (US) under SCCs / DPF |
| [SMTP provider, e.g. Postmark (ActiveCampaign) or SendGrid (Twilio)] | Sending transactional emails from mail.minonnan.com | [USA — SCCs / DPF] |
| Matomo (self-hosted on our DigitalOcean infrastructure) | Web analytics | Same as hosting; no data shared with the Matomo vendor |
| VWO (Wingify Software Pvt. Ltd.) | A/B testing, only after consent | [India / EU data centre — SCCs; verify] |
| Anthropic PBC [/ Anthropic Ireland, Limited] | AI concierge and recommendations | USA — SCCs / DPF [verify] |
| [HubSpot, Inc.] (only if enabled) | CRM synchronisation | [USA / EU data centre — SCCs / DPF] |
| [Wise Payments Ltd.] (only if enabled) | Payouts to affiliates | [UK / EU — adequacy] |
| Our bank [name] | SEPA payouts to affiliates, refunds | Switzerland |
| Carriers [Swiss Post, DHL, …] and suppliers / dropship partners (jny-dropship.com and our manufacturers) | Delivery of goods | [Switzerland, EU, China] — for China: SCCs or necessity for contract performance (art. 17(1)(b) nFADP / art. 49(1)(b) GDPR) |
| Authorities, courts, advisers | Legal obligations, defence of claims | Switzerland / as required |
Some recipients are located outside Switzerland and the EU/EEA. Where the destination country does not offer an adequate level of protection as recognised by the Swiss Federal Council or the European Commission, we use standard contractual clauses (with the Swiss addendum) or another statutory safeguard or exception. You can request a copy of these safeguards from us.
7. Cookies and similar technologies
We use strictly necessary cookies without consent, and analytics, personalisation and marketing technologies (including VWO and full Matomo tracking) only after your consent. Details and how to change your choice: Cookie Policy.
8. Data security
We use technical and organisational measures appropriate to the risk, including TLS encryption in transit, hashing of passwords (argon2), encryption of bank details (IBAN) at rest (AES-256-GCM), role-based access control for staff, audit logs, and regular backups.
9. Your rights
Subject to the applicable law, you have the right to:
- obtain information about and a copy of your personal data (access);
- have inaccurate data corrected;
- have data deleted or its processing restricted;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time with effect for the future;
- receive data you provided in a structured, machine-readable format (data portability);
- not be subject to solely automated decisions with legal or similarly significant effect, and to state your point of view where such decisions are made.
To exercise your rights, write to [privacy@minonnan.com] or use Account → Privacy (data export and account deletion). We may need to verify your identity.
You also have the right to lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch); in the EU, the authority of your place of residence or work.
10. Children
The Shop is not directed at children under 16. Data about infants (for example sizes for baby items) is processed only as part of an order placed by an adult.
11. Changes
We may update this policy. The current version is published on this page; material changes are announced on the website and, where consent is needed, you are asked again.
Version 2026-10-01 — template, not yet in force.