THE MASK

Privacy policy

Last updated: 1 October 2026

This privacy policy explains which personal data we process when you visit themask.ch or place an order. It is based on the Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023) and the Data Protection Ordinance (DPO). Cookies are also governed by Art. 45c of the Telecommunications Act (TCA).

01 — Controller

themask.ch, Rue du Pilate 5, 2502 Biel/Bienne, email: support.themask@gmail.com.
Please send any data protection questions to this address.

02 — What data we process and why

Orders and customer service

Name, delivery and billing address, email address, phone number, products ordered, amounts, payment status, shipping data and your messages to us. Purposes: concluding and performing the contract, delivery, answering your questions, handling returns and warranty claims, accounting.

Payment

Payment is handled by the payment provider you choose. We only receive information such as the payment method, amount, status and, where applicable, the last digits of your card. Shopify and the payment providers check orders automatically for fraud risk; the decision to accept an order is ours.

Customer account

If you use an account: email address, saved addresses and order history.

Newsletter

Only with your consent: email address, time of sign-up, and whether emails are opened or links clicked. You can unsubscribe at any time via the link in every email.

Visiting the website

When you visit themask.ch, technically necessary data is recorded: IP address, browser, device, date and time, pages viewed and cart contents. Purposes: operating and securing the shop, preventing abuse.

Analytics and marketing

Only if you agree in the cookie banner: statistics on how the shop is used (Shopify Analytics). Without your consent, these services stay switched off.

03 — Cookies

Necessary cookies make the cart, checkout and language setting work. All other cookies (analytics, marketing) are only set after you consent in the cookie banner. "Decline" is as easy as "Accept". You can change your choice at any time via the "Cookie settings" link in the footer, and you can delete or block cookies in your browser.

04 — Recipients

We only share personal data where necessary for the purposes above:

  • Shopify International Limited (Ireland) and its group companies: running the shop, checkout, hosting
  • Payment providers: Shopify Payments (cards and TWINT)
  • Our production and shipping partner in China: only your name, delivery address, phone number and the products ordered, so that your parcel arrives
  • Carriers: international parcel services and Swiss Post
  • Email delivery: Shopify
  • Our fiduciary and accountants, and authorities where we are legally required to disclose data

We do not sell personal data.

05 — Disclosure abroad

  • EU/EEA (including Ireland) and Canada: the Federal Council recognises an adequate level of data protection (Annex 1 DPO).
  • USA: to companies certified under the Swiss-U.S. Data Privacy Framework, or on the basis of standard contractual clauses (Art. 16 para. 2 FADP).
  • China: China does not offer an adequate level of data protection. We only transfer the data needed for delivery, based on Art. 17 para. 1 let. b FADP (directly connected with the performance of our contract with you).

06 — Retention

We keep order and accounting data for ten years (Art. 958f of the Code of Obligations), newsletter data until you unsubscribe, and customer service messages for as long as needed, at most two years after the case is closed. Cookie lifetimes are shown in the cookie banner.

07 — Security

The shop is fully encrypted (HTTPS). Only people who need order data for their work have access to it.

08 — Your rights

You can ask at any time for access to your data (Art. 25 FADP), for your data in a common electronic format (Art. 28 FADP), for its correction or deletion, and you can object to its processing (Art. 30 and 32 FADP), unless a statutory retention obligation applies. You can withdraw your consent at any time.

Write to us at support.themask@gmail.com; we reply within 30 days. You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch.

09 — Automated decisions

We do not make automated individual decisions within the meaning of Art. 21 FADP.

10 — Children

The shop is not aimed at children under 16. We do not knowingly process children's data.

11 — Changes

We update this policy when our processing changes. The version published here applies.