隐私政策
Privacy policy
This page explains which personal data M’OUD Switzerland GmbH processes when you visit shop.moud.swiss, order from us, write to us or open a Flakon Pass or tree certificate. It is based on the Swiss Federal Act on Data Protection (FADP). For people in the EU and EEA, the General Data Protection Regulation (GDPR) also applies where it is applicable.
1. Controller
M’OUD Switzerland GmbH
Bramenring 19, 8302 Kloten, Switzerland
(Relocation of the registered office from Kollbrunn ZH to Kloten ZH filed with the Commercial Register)
UID CHE-215.784.601
Email info@moud.swiss (subject “Privacy”), phone +41 79 904 44 25
Please use this address for all privacy questions and to exercise your rights.
2. Which data we process and why
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Order, payment, shipping, invoice | Name, delivery and billing address, email, phone, order contents, payment status (no full card data is stored by us) | Contract (Art. 6(1)(b)), legal obligation (c) | 10 years for accounting records (Art. 958f Swiss CO) |
| Customer account | Name, email, addresses, order history | Contract (b) | Until you ask us to delete the account; records as above |
| Enquiries by email, contact form, WhatsApp, Instagram | Name, contact details, message content | Contract or enquiry (b), legitimate interest (f) | 2 years after the enquiry is closed |
| Automated concierge (reply drafts) | Message content, language, channel | Legitimate interest in quick replies (f) | 2 years; every reply to customers is approved by a person |
| Reviews | First name, review text, stars; email only to verify the purchase | Consent (a) | Until withdrawn; only the first name is published |
| Tree certificate (One Tree Planted) | Certificate number, first name and initial of the surname, verification code | Contract (b), consent for the public check page (a) | As long as the certificate exists |
| Flakon Pass (QR code on the box) | Truncated and hashed IP address, country, device class, time of access; on registration first name and email | Legitimate interest in authenticity checks (f), consent for registration (a) | 24 months; registration until withdrawn |
| Newsletter | Email, language, time of sign-up | Consent (a) | Until you unsubscribe |
| Analytics and marketing cookies | Usage data, device and browser data, truncated IP address | Consent via the cookie banner (a) | Up to 14 months |
| Operation and security | Server logs, IP address, time, page requested | Legitimate interest in a secure shop (f) | As short as needed for operation, as set by Shopify |
3. Recipients and processors
We share data only where needed for the purpose concerned:
- Shopify (Shopify International Ltd., Ireland; Shopify Inc., Canada): shop, customer account, orders, payments via Shopify Payments.
- Payment providers: Shopify Payments, Apple Pay, Google Pay, TWINT, Tamara (instalments in the Gulf states). Card data goes directly to the provider.
- Shipping: Swiss Post, DHL Express, Aramex. They receive name, address, phone and email for delivery.
- Base44: operation of the Flakon Pass, the certificate check page and internal tools.
- Email: Resend (transactional emails), Hostpoint AG, Switzerland (mailbox info@moud.swiss).
- AI services: Anthropic and other language models connected via Base44, for reply drafts and translations.
- Meta (WhatsApp, Instagram): when you write to us there.
- Google: fonts and search; analytics only with consent.
- One Tree Planted: receives only the number of trees planted, no personal data.
- Authorities, where the law requires it.
4. Transfers abroad
Some recipients are located outside Switzerland, mainly in the EU, Canada and the USA. Transfers to the EU, the EEA and Canada rely on the adequacy decisions of Switzerland and the EU. Transfers to the USA go only to companies certified under the Swiss-U.S. or EU-U.S. Data Privacy Framework, or are based on the European Commission’s standard contractual clauses with the Swiss addendum. For orders to the Gulf states, the data needed for payment and delivery goes to Tamara and Aramex; the basis is the performance of your contract (Art. 17(1)(c) FADP, Art. 49(1)(b) GDPR).
5. Cookies
We set technically necessary cookies (cart, language, security) without consent. Analytics and marketing cookies only run once you agree in the cookie banner. To change your choice, delete the cookies for shop.moud.swiss in your browser; the banner will appear again on your next visit.
6. Your rights
You can request access to your data, have incorrect data corrected and have data deleted where no retention obligation applies. You can withdraw consent at any time with effect for the future, object to processing based on legitimate interest and receive your data in a common format. Please write to info@moud.swiss. We usually reply within 30 days and may ask for proof of identity for security.
You may lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. People in the EU may contact the authority in their country of residence.
7. No automated individual decisions
We do not make decisions based solely on automated processing that have legal effects for you. Concierge reply drafts are checked by a person before they are sent.
8. Security
The connection to the shop is encrypted (TLS). Only people who need customer data for their work have access to it. For the Flakon Pass we store IP addresses only in truncated and hashed form.
9. Children
Our offer is aimed at adults. We ask people under 16 not to send us data without their parents’ consent.
10. Changes
We update this policy when our processes or the law change. The version published here applies.
Last updated: 3 November 2026